Where are threads stored in memory relative to other process structures during execution on a windows x86 system

Question

So a process is:

------DOS header/PE header

------executable code and statically linked libraries

------slack space?

------some dynamically linked libraries

------start of heap

------slack space

------top of stack

------bottom of stack

I am unsure of where the kernel mode stack and user mode stacks are relative to eachother in the virtual memory allocated for the process stack - also, when a new thread is spawned by a multithreaded process, where is the virtual memory allocated for it?

Thanks!

Answer 1

On x86 Windows, the kernel-mode modules are located in the (virtual) memory space from 0x80000000 , which is not accessible from a user mode process, and all the user-mode modules are located in the memory space before 0x80000000 .

When a new (user-mode) thread gets spawned, a new memory page is allocated for its stack in both the user-mode memory space (accessible from both user-mode and kernel-mode) and kernel-mode memory space (accessible only from the kernel mode). Note that there are some system threads that do not have a user mode context (thus no stack allocated in any of the user-mode processes). These threads purely run in the kernel and do not run under user-mode.