Under Process Monitor, if we pick up specific process then choose its property, under event properties, the process tab shows address for each individual library file and what do these addresses refer to? Also the addresses under Stack point to virtual or physical memory location?


All of the addresses shown are virtual. They are the starting addresses of the DLLs or other mapped files in the process's virtual address space. The addresses shown in the Stack tab are also virtual.

You can see a similar breakdown in Process Explorer - enable the "DLLs view" in the lower pane. And also in VMmap, but with more detail. VMmap includes the addresses of "sections" within each executable file. There will be one section for code, one for read-only data, one for "resources", etc., plus some control information.

It's actually extremely difficult for a virtual memory OS on x86/x64 to directly use, i.e. reference, a physical address. Once the system "goes virtual", ie sets the "Paging enable" bit in CR0 - which happens very early in the boot - all addresses asserted by the running code (whether kernel or user mode) are interpreted by the CPU as virtual addresses, and must be translated (using info from the page tables) to physical before they are presented to the memory controller.

Kernel code in the OS does of course ''manage'' physical memory (for example, assigning it to processes that need it) and manipulates page table entries and physical page numbers, but it can't directly ''reference'' memory via the memory's physical addresses.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.