MSDN Docs

Virtual Address Space

Overview

The virtual address space (VAS) is the range of memory addresses that a process can use. Windows maps the VAS to physical memory using a combination of paging, address translation, and protection mechanisms.

Address Space Layout

RegionTypical Range (x64)Description
Low Memory (DLLs, Stack)0x0000000000400000 – 0x00007FFFFFFFFFFFUser-mode code, data, and stack.
HeapVariableDynamic allocations via HeapAlloc.
Guard PagesVariableProtect against overflow.
Reserved / UnusedVariableAddress space reserved for future mapping.
High Memory (Kernel)0xFFFF800000000000 – 0xFFFFFFFFFFFFFFFFKernel-mode address space (not accessible from user mode).

Key API Functions

#include <windows.h>

// Allocate a region of virtual memory
LPVOID addr = VirtualAlloc(
    NULL,               // Let the system choose the address
    4096,               // Size of allocation (bytes)
    MEM_RESERVE | MEM_COMMIT,
    PAGE_READWRITE
);

// Query information about a region
MEMORY_BASIC_INFORMATION mbi;
SIZE_T result = VirtualQuery(addr, &mbi, sizeof(mbi));
if (result) {
    printf("BaseAddress: %p\n", mbi.BaseAddress);
    printf("RegionSize:  %zu\n", mbi.RegionSize);
    printf("State:       %u\n", mbi.State);
}

// Release the memory
VirtualFree(addr, 0, MEM_RELEASE);

Best Practices

FAQ

Why does VirtualAlloc sometimes return NULL even when there appears to be free memory?

Memory fragmentation, address space layout randomization (ASLR), and system reserves can limit the contiguous region available for allocation.

Can I allocate executable memory in a secure way?

Use VirtualAlloc with PAGE_EXECUTE_READWRITE only when necessary, then immediately change protection to PAGE_EXECUTE_READ after writing.