64 bit process addresses

April 12, 2009

native 64 bit processes get a huge address space of 8 TB (instead of the usual 2GB of 32 bit processes). However, to actually get this address space range, the executable image must be linked with the LARGEADDRESSAWARE flag. If it’s not, only the lower 2GB will be available. Why is that? Why doesn’t a native 64 bit process get automatically the larger address space? I’ll leave you to think about this a bit – I’ll answer in a few paragraphs.

Here’s a simple test program:

int _tmain(int argc, _TCHAR* argv[]) {

    void* p;

    __int64 total = 0;

    SIZE_T chunk = 1 << 28;    // 256MB

    do {

        p = ::VirtualAlloc(NULL, chunk, MEM_COMMIT,

                           PAGE_READWRITE);

 

        if(p)

            printf(“Allocated: %p (total=%15I64X)\n”,

                   p, total += chunk);

        else

            printf(“Failed… %d\n”, GetLastError());

    } while(p);

 

    return 0;

}

 

The LARGEADRESSAWARE flag can be enabled / disabled by using Project->Properties in Visual Studio and selecting Link->System:

 

image

 

Here are the results when the flag is off:

image

Notice how the addresses don’t go higher than 2GB. Now with the flag enabled:

image

I can allocate more memory, only limited by the page files size(s).

What’s is the default setting? In an x64 project, it’s enabled (usually a good thing). In an x86 project, it’s disabled (usually not a good thing, I’ll explain why).

So, why is that? Why doesn’t a process benefit automatically from the larger address space?

For 64 bit processes, the answer lies in porting. A 64 bit app is probably ported from its 32 bit equivalent (maybe even developed side by side). If a dangerous cast exists in the 32 bit application (e.g. casting a void* to an int), this cast will not cause trouble in the 64 bit port – the high DWORD of the pointer will always be zero, so can simply be cut off.

The more interesting question is why not get a 4GB address space that a 32-bit pointer can hold? And while we’re at it, on a 32 bit system, the LARGEADDRESSAWARE flag can give a process a 3GB address space (instead of 2GB) if the system has been configured to use it (the /3GB flag in boot.ini in pre-Vista systems, or the equivalent switch to bcdedit in Vista+ systems), but the 3GB space will not be granted unless the app is linked with that flag enabled. Why?

The answer is, that programmers can be too ingenious for their own good. if a programmer knows she can never get a pointer larger or equal to 2GB, she can use the most significant bit (MSB) for some app-specific purpose (a terrible idea, but nothing can stop her). So, if that app suddenly gets a pointer in the range of 2GB-3GB, the MSB will be ruined and so will the app.

To conclude, an app must explicitly state that it understands addresses above 2GB correctly, whether 64 bit or 32 bit.

By the way, a 32 bit app linked with this flag enabled gets a “full” 4GB address space when run on a 64 bit system (the so called “Wow64”). Definitely a bonus!

 

Add comment
facebook linkedin twitter email

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

*

11 comments

  1. DennisgJanuary 21, 2010 ב 02:44

    I have Windows 7 Ultimate installed in my HCL laptop. Last month i was encrypting my external hard disk with “bit locker drive encryption”. It started normally, but suddenly after 49%, it stuck, displaying an error: “An error occurred. This disk has one or more errors, run chkdsk/r, if the error persist this may be indicative of a hardware fault…” I then thought to decrypt my data back and to disable the protection. When I tried doing this, after some time my PC hanged and the operation got aborted. When I restarted my system, i found that the disk is not being detected. It is not shown in “computer”, although the disk lights were on. I tried running the hard disk in “Ubuntu OS”, it works there, but all my data is encrypted. My hard disk is absolutely fine and OK. There is no problem with hardware and no virus is there in my PC as well. What to do now? How can i get my data back and how can i decrypt my harddisk? Please help, since this data worths me a lot. The capacity of my hard disk is 250GB and its a Western Digital brand. Thanks, Niks. unlock iphone 3g

    Reply
  2. AAbbCCaacFebruary 16, 2010 ב 18:57

    There is a user who is signing up under the name “CELINE” and is posting phishing scams related to this site…

    If you see “CELINE”, DO NOT OPEN PROFILE… and DO NOT ENTER in password… EVEN THOUGH IT MAY LOOK REAL!

    ____________________
    http://www.f3w.org

    Reply
  3. KondziuFebruary 16, 2010 ב 23:32

    i have a problem with my internal HDD. When this all happened, i was playing a game online. I got a Virus Worm and i shut down my computer and reformatted my HDD and put windows back on. I had a secondary HDD in for back-up purposes. so got windows in and put everything back, but i then noticed that my computers performance went down drastically with my main HDD, I could not copy anything i had onto the back-up drive and once i did it was so slow to copy the file. Once i had all the files on the back-up drive, i decided to start from the back-up drive with windows. Same applied. It was really slow with the reading-and-writing. i decided to take the secondary back-up drive out and boot from the main HDD. Everything seemed to be running smoothly i checked the main HDD Temperature with HD tune. The drives temp was 37 degrees Celsius, and the drive went to normal temperature of 43-44 degrees Celsius. I then decided to plug in the secondary HDD and leave it on for a day. the temperature went from 43-44 degrees to 47-48 degrees Celsius. So my guess is that the HDD drives are getting way to hot, and i am getting what seems like bad sectors in the drive, but it has never done this before. I have always had my back-up drive in ever since i got my main HDD. I can’t place my finger on what is wrong with my drives. Once the main HDD is lower temperatures the drive seems to be performing better. but its normal temperature is 43-44 degrees Celsius and i still have some problems with reading and writing then. Can someone tell me what has happened please. I dont know if it was from the worm virus or if the temperatures are getting too hot (but has never done this before) can someone tell me what to do. I have changed the line leading into the motherboard as well, and that seems to have no effect. i even swapped the board lines between the CD drives and the HDD drives, no effect on that either. can someone tell me what is going on, i have ran out of options. forex robot

    Reply
  4. KondziuFebruary 16, 2010 ב 23:36

    I suddenly noticed that most files names turned blue in font color in every directory i enter. i can not seem to change it back to black and i do not understand what have caused it. i thought maybe it is a virus or spyware since it happened suddenly, i checked for viruses and spywares/malwares and i could not find anything. Has anybody had any experience with this sort of phenomenon ? (i have winXP). forex robot

    Reply
  5. KondziuFebruary 16, 2010 ב 23:49

    I have Verizon High Speed Internet. Wireless, DSL. I have a Modem. Both my laptop and computer are Windows Vista. HP. I know it as nothing to do with my computer becasue i’m usuing a new Laptob and My computer is not the problem, both are Very fast, and clean, No spyware or viruses. I am currently using IE7. Even my M Firefox is slow. I download Google chrome and its still slow. I double checked, my wires they are all secure there are no loose wires. I have a Linksy Router, and it is secured with WPA-PSK. I know no one hacked in, so thats not the case for slow ness. Also, You know how a Modem has green, blinking lights. Sometimes My Internet goes a way, the internet light gos away for minutes or an hour, then the Internet comes back. Its frustrating. My friend has the same Internet as me…she lives a couple doors away…and her Internet is like lightning very fast….AND NO she does not have fios…her internet is the same. as mines. It takes forever for utube and hulu video to load. I have flashplayer 10. something…. SO……………………… I’m asking u guys b4 i call the company…. forex robot

    Reply
  6. KondziuFebruary 17, 2010 ב 00:04

    Unless hackers and viruses have turned a new leaf what did I do that fixed my pc. It was glitching every so often the programs would say not responding and have a white film over them I couldn’t do nothing I did the following. Scanned for viruses with Nod 32 scanned with spy bot (found faults) scanned with pc utillities (found faults) I also booted and tryed fixing with the windows cd the final thing I tried was to boot in safe mode which was the last thing I did and it started working so was it the safe mode and the only thing I can see altering is the visual display. did this fix my pc. Just dont want to do it again thaTS ALL forex robot

    Reply
  7. KondziuFebruary 17, 2010 ב 00:10

    My laptop has been A LOT slower than usual, and a lot of the pages on the internet don’t respond. I’m thinking it’s a virus, and i would like to know what you think it could be, and what i could do to prevent further viruses, and “cure” this one? anything can help 🙂 thank you. Oh, and when it doesn’t respond, the screen goes like white, but you can still see through it, and it makes this low beep noise? forex robot

    Reply
  8. KondziuFebruary 17, 2010 ב 00:39

    Out of no where. I keep getting messages that pop up stating that my computer is infected, danger, attention, etc… then it tells you to download or continue unprotected. Uniblue does make a AntiSpyware for computers called Spy Eraser. However as this one appears to be legite, its comprimising my computer. After searching for the file I found it not as a program on the computer, but as a file in System32. Every two minutes those messages come up. I can not exit the program or disable it. It appears as if its a legitimate program, an icon on the bar next to the clock and one implanted on the desk top. However I ran all my spyware programs, anti-virus’ programs and id failed to detect it. So I instaled MalwareBytes and it found it, and removed it. I ran it twice and everything else twice. Three hours later while the computer was siting, the message popped up. The icon reappeared on the desktop. The message continues every two minutes. Each message is similar but a little different from the rest. However it never changes its motive. I ran MalwareBytes again, it detected the infected files. So I did some research and found that I should use a program called RegCure to eliminate the rest of the files that were not being removed under the registry. It found 1242 infected files, and fixed them. However, I still find myself in the same boat. However I was told that I may not need to re-install the Windows, XP. Any suggestions before I move ahead on the reinstallation. forex robot

    Reply
  9. KondziuFebruary 17, 2010 ב 00:52

    Last night my computer rebooted without warning or explanation. It came back up with everything normal seeming so I assumed it was one of those bastard windows updates. About an hour later I was using firefox and then it stopped responding to clocks. Outside of firefox, a mouseclick was recognized once per item, but no more. Using alt + ctrl + del results in the icon for the system monitor showing up in the tasktray, but nothing more. I could not interact. I rebooted it in safe mode and used system restore to take it to about 3 days back. (I haven’t had any other day work so far and I’ve tried at least 10 different days.) I thought it had fixed it, and I left the computer running all night with no programs open. In the morning, I went to firefox and after about 10 minutes, everything locked again. Rebooted and tried internet explorer with the same result. I just now removed firefox 3.0 and then installed 3.5, but that didn’t change anything. While downloading new nvidia drivers (I suspect that it’s a graphical problem) the system locked again and I just now rebooted. I am very frustrated. Neither AVG nor SpyRemover find any viruses or other malware. They’re both up to date. Part of what is bothering me is that there are no symptoms of viruses or malware outside of this. In some ways, that would almost be preferable. At the moment though, I am stuck, so please do what you can to help. forex robot

    Reply
  10. AAbbCCaacFebruary 17, 2010 ב 01:38

    There is a user who is signing up under the name “CELINE” and is posting phishing scams related to this site…

    If you see “CELINE”, DO NOT OPEN PROFILE… and DO NOT ENTER in password… EVEN THOUGH IT MAY LOOK REAL!

    ____________________
    http://www.f3w.org

    Reply
  11. AAbbCCaacFebruary 17, 2010 ב 05:06

    There is a user who is signing up under the name “CELINE” and is posting phishing scams related to this site…

    If you see “CELINE”, DO NOT OPEN PROFILE… and DO NOT ENTER in password… EVEN THOUGH IT MAY LOOK REAL!

    ____________________
    http://www.f3w.org

    Reply