I noticed some weird behavior on my Windows 7 virtual machine. I'm using Linux's KVM to track execution and modifications to page frames.
I have some code in Windows 7 thats uses MmProbeAndLockPages() to lock
a virtual memory range belonging to a DLL that is loaded in userspace.
Now, i noticed that one of the frames that is locked within that DLL, is also used in some other DLL! even though i see no connection between these DLLs, and i don't see the content being equal too.
Is there any possibility for this to happen? Does Windows 7 have a mechanism similar to Linux's KSM(Kernel same page merging)?
I noticed each DLL uses a different segment of that page frame.