2

As far as I know, global and static variables are stored in heap memory, while local variables are on stack memory. I think this is the case when we speak about a binary file (like PE) that is located in memory. If this is correct, I am wondering: Are local and global variables stored plainly in a disk image (binary in Disk), can we see them directly by inspecting the disk image?

  • Yes, you can usually find these variables in the .data section – user2073973 Dec 1 '17 at 14:09
  • @user2073973 Even local variables? – Aan Dec 1 '17 at 14:34
  • @Aan if by local values you mean something like, std::string = "bla"; then yes. The "bla"const char array will be stored on the .data (depending on your compiler settings) section. – user2073973 Dec 4 '17 at 8:58
3

First, local variables needn't be stored on the stack. Modern compilers will first try to use CPU registers to store local variables.

Next, heap and stack are terms that relate to virtual memory. Virtual memory starts to exist when the operating system creates the process. It does not exist when the file is on disk only. Therefore, you can never see a variable on disk.

Now, @user2073973 left a comment that the variables are stored in the .data section. This is typically true, but

  • a compiler does not need to generate a .data section, if he can avoid it by other means.
  • without symbols, the .data section is just data. You don't know which portion will make up a variable. AB12CD34EF could be 5 bytes or 1 int + 1 byte.
| improve this answer | |
1

Data storage on modern OSes and their appropriate file formats is far more complex than that.

There are multiple locations to store variables, of those the more predominant are:

  1. The stack. This is where small-scoped variables are usually stored, often defined in the function or code block level. Those variables are relatively "cheap" to allocate but their scope is limited isn't flexible. Stack is somewhat limited in size, and allocating too many big variables may cause stack overflow crashes.
  2. The heap. The heap allows more control and flexibility of the scope a variable leaves in, at the cost of bugs potential (memory leaks, heap corruption) and security vulnerabilities. It is also slightly more "expensive" to allocate performance-wise. The heap is only limited buy the address space size and available RAM, when RAM limitations are mitigated by using the page file (called swap in Linux/Mac).
  3. Virtual memory (directly). Quite similar to the heap, but instead of using the OS's flexible-size heap chunks allocation, allocating entire pages and managing their partition manually. This is quite similar and rarely used in common-day programs.
  4. pre-allocated regions. Some global-scoped variables (global and static variables are stored here, not on the heap) are often allocated inside PE regions designated for variables. These regions are often divided to an uninitialized section and an initialized section.

The last one, the pre-allocated regions, is the only type of variable storage encoded in the PE file directly and the only one there's a chance to access from the hard drive, but only initial values are readable. You cannot use that to read current variable values (because those will only be stored in memory).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.