CreateFileMapping function with the SEC_IMAGE flag.

Hello. I have a problem. I 'm trying to create an executable mapping .NET the file in memory using the CreateFileMapping function with the SEC_IMAGE flag. However, the projection is always one page with a size of 4096 bytes. When I try to read the memory from the next page, I get an exception. Why is this happening?

Xiaopo Yang - MSFT 12,231 Reputation points Microsoft Vendor

2022-09-28T06:09:01.797+00:00

Could you please show a minimal, reproducible sample without private information? And Have you seen Creating Named Shared Memory?

Вадим Подгорный 41

HANDLE FileR = ::CreateFileW(m_file_R, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_RANDOM_ACCESS, NULL);  
HANDLE MappingR = ::CreateFileMappingW(FileR, 0, PAGE_READONLY | SEC_IMAGE, 0, 0, 0);  
LPVOID WinINIR = ::MapViewOfFile(MappingR, FILE_MAP_READ, 0, 0, 0);

Вадим Подгорный 41 Reputation points

2022-09-28T07:06:49.12+00:00

The problem is that when the executable is displayed in memory .NET file with the SEC_IMAGE flag, a projection is created not of the entire file, but only of one page with a size of 4096 bytes, check for yourself.

Accepted answer

RLWA32 43,381 Reputation points

2022-09-29T12:41:07.12+00:00

Following shows how VMMap has analyzed the address space of a process that has mapped a .Net executable using SEC_IMAGE. Note that VMMap shows serveral blocks, some of which are reserved and not committed. The first block is 4K and is committed memory.

I updated the demo application to show the virtual memory mapping of the .Net executable. You can see that it corresponds to the information reported by VMMap. The following images show the result of attempting to read from committed blocks vs. reserved blocks.

VMMap and demo application

Committed block 0 -

Reserved block 1 -

Committed block 2 -
Please sign in to rate this answer.

2 people found this answer helpful.
Вадим Подгорный 41 Reputation points

2022-09-29T22:05:50.373+00:00

Thanks for your reply. As far as I understand, the projection can be continuous, or it can consist of pieces?
I am trying to write an application that displays a projected file in the HEX editor, what should I do in this case? Scan memory with the VirtualQuery function for availability? How do I understand that this area belongs to my projection?

Вадим Подгорный 41 Reputation points

2022-09-29T22:31:43.257+00:00

When a projection is created without the SEC_IMAGE flag, I work with it without problems as a continuous section, even with very large files. But in this case, it turns out that for some reason the file is projected in chunks and scattered across memory. I checked a lot of files with the VirtualQuery function and made sure that most of the available memory areas follow continuously, but as I understood this is not the rule. The matter is further complicated by the fact that the file is projected with different sections of protection. Please advise me how best to proceed.

RLWA32 43,381 Reputation points

2022-09-29T22:46:46.317+00:00

See the QueryVirtualMemoryInformation function and WIN32_MEMORY_REGION_INFORMATION structure. It will return the total size of the virtual memory allocated by MapViewOfFile.

Вадим Подгорный 41 Reputation points

2022-09-30T02:01:11.65+00:00

I got it! Memory is allocated in one sequential section.
The QueryVirtualMemoryInformation function shows the size equal to SizeOfImage of the PE file, which is correct. However, some areas of memory are reserved. I can't understand why? Why reserve a plot, and not just fill it with zeros?

RLWA32 43,381 Reputation points

2022-09-30T06:53:41.627+00:00

I'm probably oversimplifying but reserving virtual memory addresses does not incur the performance costs of committing memory and writing data to the committed pages.

If your initial problem about receiving exceptions has been solved kindly accept my response as an "Answer".
Sign in to comment

2 additional answers

Xiaopo Yang - MSFT 12,231 Reputation points Microsoft Vendor

2022-09-28T07:37:56.71+00:00

According to MapViewOfFile , For files that are larger than the address space, you can only map a small portion of the file data at one time. When the first view is complete, you can unmap it and map a new view.
To obtain the size of a view, use the VirtualQuery function.
Please sign in to rate this answer.
Вадим Подгорный 41 Reputation points

2022-09-28T20:06:04.957+00:00

It turns out that ordinary files do not exceed the size of the address space, but .NET does? Have you noticed that the projection is done with the SEC_IMAGE flag?

Xiaopo Yang - MSFT 12,231 Reputation points Microsoft Vendor

2022-09-29T01:33:31.83+00:00

Why do you think MapViewOfFile must map the whole file into memory although you think that ordinary files do not exceed the size of the address space? Do you know if there has a continuous address space which is larger than the file?
Sign in to comment
RLWA32 43,381 Reputation points

2022-09-29T00:51:03.527+00:00

Use the Sysinternals VMMap utility to examine the address space of your process. It will show you that the 4K region associated with the address returned from MapViewOfFile for the executable is only one of several regions. Also note that the following region may be reserved but without any committed memory. I think you are misinterpreting the reason for the exception.

For example,
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

CreateFileMapping function with the SEC_IMAGE flag.

2 additional answers