LSA Shell

Local Security Access Shell

For the user login/domain control, Isass.exe

PAE

Physical Address Extensions

Windows kernel move to the memory address higher than 4G and give app more memory.

AWE

Address Windowing Extensions

The user can use the memory which address higher than 4G.

But there can not be code, sharing data and video data in the AWE address.

To check all the DLLs depended on.

1. depends.exe (static check)
2. Process explorer. (Can check the dynamic loading DLL.)
3. windbg

The size of stack is limited, (about 2M)

The default size of system heap is 1M.

Check the Mem usage:

1. Task Manager: the actual using of VM should check “VM size”.
2. Performance Monitor

Call stack is grown from high address to lower.

ESP: stack pointer. Indicate the top address of the stack. (TOP)

EBP: Base stack pointer. Indicate the base address of a stack.(BASE)