Resources
- Technology
- By vimalshekar : https://vimalshekar.github.io/reverse-engg/Windows-Architecture-Basics
- VirtualMemory : https://nghiant3223.github.io/2025/05/29/fundamental_of_virtual_memory.html || https://de-engineer.github.io/Understanding-Virtual-Memory-Paging-and-other-memory-related-concepts/ || https://connormcgarr.github.io/paging/
- PE : https://0xrick.github.io/win-internals/pe1/ || https://til.arktronic.com/2025/09/04/windows-gui-cui.html
- TEB : https://securitymaven.medium.com/thread-environment-block-teb-in-windows-os-06fb138eb78b
- Questions
- CreatFileA & CreatFileW : https://x.com/vxunderground/status/1991476681853354195
- UTF : https://stackoverflow.com/questions/2241348/what-are-unicode-utf-8-and-utf-16
Tools
Commands
- Windows Process Subsystem
dumpbin /headers C:\Windows\System32\cmd.exe | findstr /i subsystem # use the Developer Powershell VS
Notes
Windows Virtual Memory
In systems programming and malware development, you must separate virtual addresses (pointers) from physical memory (actual RAM hardware).
1. Free (Unclaimed Land)
- What it is: These are virtual addresses that are completely empty and unallocated.
- Physical RAM used: None.
- The Analogy: It is wild, unclaimed wilderness. Anyone can walk up and claim a plot of land.
- What happens if you touch it: If your C/C++ pointer accidentally points to a “Free” address and tries to read or write data there, your program will instantly crash with an Access Violation.
2. Reserved (Fenced-off Land)
- What it is: You have told the OS, “I want to claim addresses
0x1000through0x5000.” The OS marks those addresses as belonging exclusively to your process. No other function or thread in your program can accidentally allocate memory in that space.- Physical RAM used: None. (This is the crucial part. Reserving costs you zero physical memory).
- The Analogy: You bought the plot of land and put a fence around it. No one else can build there, but you can’t sleep there yet because there is no house.
- What happens if you touch it: Even though you own it, if you try to write your shellcode into a Reserved address, your program will still crash with an Access Violation. There is no physical hardware behind the address to hold the data yet.
3. Committed (The Built House)
- What it is: You tell the OS, “Take that Reserved address space, and actually map it to the physical RAM hardware (or the hard drive’s page file) so I can store data in it.”
- Physical RAM used: Yes. The OS allocates actual physical bytes to back up those virtual addresses.
- The Analogy: You built the physical apartment building on your fenced-off land. You can now move furniture (data) into it.
- What happens if you touch it: Success. As long as the memory protections (like
PAGE_READWRITEorPAGE_EXECUTE_READ) allow it, you can safely write your payload here and execute it.flowchart TD API Allocation Flows Free -- "VirtualAlloc(MEM_RESERVE)" --> Res Res -- "VirtualAlloc(MEM_COMMIT)" --> Com Free -- "VirtualAlloc(MEM_COMMIT | MEM_RESERVE)" --> Com Styling for Obsidian Themes style Free fill:none,stroke:#7f8c8d,stroke-width:2px,stroke-dasharray: 5 5 style Res fill:none,stroke:#f39c12,stroke-width:2px style Com fill:none,stroke:#27ae60,stroke-width:3px style RAM fill:none,stroke:#2980b9,stroke-width:2px
Parameter Direction WinApi
These annotations define the direction of data flow between your code (the caller) and the Windows API function.
[in](Input): You must supply this value. The function only reads this data and will not modify it (e.g.,lpApplicationName).[out](Output): The function uses this parameter to return data to you. You provide a pointer to an empty structure, and the API fills it with new information (e.g.,lpProcessInformation).[in, out](Input/Output): You provide data that the function will read, and the function is also allowed to modify it during execution (e.g.,lpCommandLine).[optional]: You are not required to provide a value; you can passNULL(or0), and the function will fall back to its default behavior.