views:

86

answers:

3

I'm reading Windows via c/c++. And I just wonder a large file can be mapped to memory.

When we execute an application, a PE file is mapped their process address(user partition).

In 32bit Windows, a Large file(larger than 2GB) can be loaded to user partition? or it will be failed?
If it is possible, Does Paging file help the loading?

+1  A: 

No, you can't - you will exhaust your VA space, regardless of the paging file setting.

Paul Betts
+1  A: 

I don't think the entire file is mapped, only up to the size of the executable image (as listed in the PE header). So a self-extracting archive > 2GB should be possible. The code would have to use the standard file I/Os to extract its data from the latter part of the file, following the end of the PE image.

Ben Voigt
+1  A: 

You will not be able to do this on 32 bit Windows. Any program running that wants to do this will have at minimum 3 modules loaded:

  • ntdll.dll
  • kernel32.dll
  • yourApplication.exe

yourApplication.exe will by default load at 0x00400000.exe, although you can change that address. ntdll.dll and kernel32.dll will load at their usual load addresses in the high 0x7Dxx0000 range.

On Vista and later operating systems the above paragraph isn't true as the load addresses are randomised, but the dlls will still be present at their own address in the first 2GB of memory.

Thus you will not have enough contiguous space anywhere to load your exceptionally large PE file, even if you start Windows with the /3GB switch.

If you want a good idea of where the various DLLs will load, use VMValidator (free) to visualize the address space of your app. The Virtual Memory View shows you a graphical representation (1 pixel per 4Kb page) of memory. The Pages and Paragraph views show you the actual Virtual Memory status of each memory page and memory paragraph.

For 64 bit Windows, you may be able to load a 2GB 64 bit PE file - there certainly should be enopugh contiguous space to allow it to load in memory. As for whether it would then work I cannot say, you will have to test it.

Stephen Kellett