CreateFileMapping function with the SEC_IMAGE flag.

Вадим Подгорный 41 Reputation points
2022-09-28T02:26:23.69+00:00

Hello. I have a problem. I 'm trying to create an executable mapping .NET the file in memory using the CreateFileMapping function with the SEC_IMAGE flag. However, the projection is always one page with a size of 4096 bytes. When I try to read the memory from the next page, I get an exception. Why is this happening?

Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,441 questions
{count} votes

Accepted answer
  1. RLWA32 40,941 Reputation points
    2022-09-29T12:41:07.12+00:00

    Following shows how VMMap has analyzed the address space of a process that has mapped a .Net executable using SEC_IMAGE. Note that VMMap shows serveral blocks, some of which are reserved and not committed. The first block is 4K and is committed memory.

    I updated the demo application to show the virtual memory mapping of the .Net executable. You can see that it corresponds to the information reported by VMMap. The following images show the result of attempting to read from committed blocks vs. reserved blocks.

    VMMap and demo application

    246045-regions.png

    Committed block 0 -

    246075-commit1.png

    Reserved block 1 -

    246025-reservefail.png

    Committed block 2 -

    246087-commit2.png

    2 people found this answer helpful.

2 additional answers

Sort by: Most helpful
  1. Xiaopo Yang - MSFT 11,506 Reputation points Microsoft Vendor
    2022-09-28T07:37:56.71+00:00

    According to MapViewOfFile , For files that are larger than the address space, you can only map a small portion of the file data at one time. When the first view is complete, you can unmap it and map a new view.
    To obtain the size of a view, use the VirtualQuery function.


  2. RLWA32 40,941 Reputation points
    2022-09-29T00:51:03.527+00:00

    Use the Sysinternals VMMap utility to examine the address space of your process. It will show you that the 4K region associated with the address returned from MapViewOfFile for the executable is only one of several regions. Also note that the following region may be reserved but without any committed memory. I think you are misinterpreting the reason for the exception.

    For example,

    245814-vmmap.png

    0 comments No comments