Im analysing a PE exectuable, i want to know why the physical size is less than the virtual size for the second section?
00000FEC and 00000E00
Exactly what is the Physical size and how is it calculated? Sometimes its more than the virtual size, sometimes its less than the virtual size
# Name VirtSize RVA PhysSize Offset
1 .text 000C44C1 00001000 000C4600 00000800
2 .data 00000FEC 000C6000 00000E00 000C4E00
3 .rsrc 00000520 000C7000 00000600 000C5C00
4 .reloc 0000B098 000C8000 0000B200 000C6200
The virtual size represents the "actual" size of the section, once it has been mapped to memory, whereas the physical size is the number of bytes allocated in the PE file for the section data. Note that the physical size is always a multiple of the file block size (512 bytes), so it might contain some padding bytes after the bytes that correspond to actual section data.
If the physical size is larger than the virtual size, it is precisely because the section data is padded out to a multiple of the file block size (you can see that the difference in size will be less than 512 bytes).
If the virtual size is larger than the physical size, it is because the section ends with zero/null-bytes, and the zeros are not represented explicitly in the PE file to save space.
Related
virtual adress size: 32 bits
page size = 4K =2^12 bytes
what is the number of pages?
i know the answer is (2^32)/(2^12) = 2^20 but why?
i think it should be (2^32)/(2^15) because of the byte bit conversion (2^12)*(8)=2^15
Every byte in memory has a numeric address starting from 0. The CPU has one or more registers which hold the address of that one byte which is being worked upon. A register is a physical device and has limits to how large a number it can store.
virtual address size: 32 bits
This means the address register can store one address (number) which could be anything between 0 and 2^32 -1.
As the largest address that the address register can store is 2^32 -1 there is no point in having more memory bytes. Because the CPU will never be able to work with them. So in general we assume the total memory to be 2^32 bytes.
page size = 4K =2^12 bytes
The total memory of millions of bytes is actually organized in chunks called pages. Here total memory of 2^32 bytes is chunked into pages of 2^12 bytes.
what is the number of pages?
the answer is (2^32)/(2^12) = 2^20. Good job!
but why? i think it should be (2^32)/(2^15) because of the byte bit conversion (2^12)*(8)=2^15
Here 2^32 is the total number of bytes in memory. 2^12 is total number of bytes in a page. Both numerator and denominator should be in same units - bytes. So you need not convert the denominator to bits.
Note:
I have used over simplification of terms like memory, address, register etc. Many of the statements made above are not valid for a real laptop - but useful for initial learning.
This question is mostly just to clarify my understanding.
Say I have a 32-bit Computer, with virtual memory space of 2^32 bytes.
Memory paging is used, each page is 2^8 bytes.
So the memory address sizes are 24 bits. Since (2^32/2^8 = 2^24 bytes).
And the offset would be 8 bits? This I do not quite understand. Since I know that the total address is 32, and 24 is already taken by the pages, so the remainder is the offset of 8.
Lastly for the page size. If each physical memory address is stored in 32 bits (4 bytes), the table size would be 2^26 (2^24 * 2^2). Is this correct?
Page Table size = number of entries*size of entry
In your case, each page is 2^8 bytes, that is - you need 8 bits offset. You got that one right.
This leaves us with 24 bits for Page. 2^24 different pages.
Size of page-table for process X is: 2^24*Entry-Size. which is not provided by you here.
Lets assume it needs 32 bits per entry. Then, 2^24*32 = 2^24*2^5 = 2^29 bits.
I use NtQueryInformationFile with FILE_STANDARD_INFORMATION struct to retrieve the allocation size of file. But for small files it returns incorrect1 result. For example text file with size 1 byte returns 8 bytes allocation size, instead 4096 bytes. Where is problem?
1 I'm assuming that this value is incorrect, because Explorer (on Windows XP Checked Build in my case) the size on disk reports higher figures (4096 bytes for a file with size 1).
file size in EndOfFile member. AllocationSize - this is how many disk space allocated for file -
Usually, this value is a multiple of the sector or cluster size of the
underlying physical device.
Question is here:
Consider a logical-address space of 32 pages with page size 512 words,
mapped onto a physical memory of 128 frames.
I want to know if my attempting calculation below is correct:
so far I have come the:
**
32 pages = 2^5 bits
512 words = 2^9 bits
128 frames = 2^7 bits
**
How to calculate the logical address and physical address if i do not know the word size?
Word size depends on the computer architecture. Generally for a 32 bit CPU the word size is 32 bits(4 bytes) and for 64 bit CPU, it is 64 bits(8 bytes).
* Logical address will be generated by the CPU for a particular proceess, you don't need to calculate anything. As the CPU generates the logical address it will be mapped to physical address by Page Map Table or a fast Cache in Memory management unit(MMU).
* With respect to the details given above, your CPU generates the logical address of 14 bits, so it can address (2^14 words in memory). Assuming your processor is 32 bit, then it can access 2^16 bytes.
* Given the logical address of 14 bits, it looks in the page map table by using the first 9 bits for page. Then it finds the address where the page is actually located in the physical memory and it adds the offset to the physical address to find memory location in the Main memory.
I'm reading the "Modern Operating System" book. And I'm confused about the "Page Size".
In the book, the author says,
The incoming 16-bit virtual address is
split into a 4-bit page number and
12-bit offset. With 4 bits for the
page number, we can have 16 pages, and
with 12 bits for the offset, we can
address all 4096 bytes within a
page.
Why 4096 bytes? With 12 bits, we can address 4096 entries within a page, correct. But, one entry is an address (in this case, address size = 16 bits). So I think we can address 4096(entry) * 16(bit) = 4096(entry) * 2(byte) = 8KB, but why the book says that we can address 4096 (bytes) ?
Thanks in advance! :)
This is assuming byte-addressed memory (which almost every machine made in the past 30 years uses), so each address refers to a byte, not an entry or address or any other larger value. To hold a 16-bit value, you'll need two consecutive addresses (two bytes).
More than 30 years ago, there used to be machines which were word addressed, which worked like you surmise. But such machines had a tough time dealing with byte-oriented data (such as ASCII characters), and so have fallen out of favor. Nowadays, things like byte addressability, 8-bit bytes and twos-complement integers are pretty much just assumed.
The 12 bits are an offset within a page. The offset is in bytes, not addresses. 2^12 is 4096.
Because with 12 bit, we can address 2^12=4096 slots. Each slot represents an address which size is 1 byte in byte-addressable memory. Hence the total size is 4096*1=4096 bytes = 4KB.
What you are calculating is the page size, i.e. the size of a page in the page table in the memory. As we use 12 bits for the offset, each frame in the physical memory is 2^12=4096K. However, each page in the page table occupies 2^12 entries x 2 bytes = 8K in the memory.
okay so you have 16 bit virtual address let see what does it mean .It means you have 2**16 =65536 bytes.
4 bit page number that means there are 16 pages as 2^4=16
Now You Name The Pages As page1,page2...page16.
Now We are left with 12bits let us see how many address can 12 bits represent 2**12=4096 bytes
65536 bytes could also be achieved by dividing it into 16 pages containing 4096 bytes each as 4096*16=65536