Are Windows memory files always loaded by default?

Question

I have empirically determined that on my system a memory mapped file created for a specific size is always completely reset to zero by default. For example, using a call

HANDLE hMM = 
    CreateFileMapping (h,
                        NULL,
                        PAGE_READWRITE,
                        0,
                        0x01400000,//20MB
                        NULL);

.. and writing to the mapped view of this file always leads to a 20MB file that is completely nullified, except when I wrote non-zero data.

I am wondering if uninitialized parts of a file can be considered zeros. Is this behavior guaranteed for Windows in general?

Answer 1

The CreateFileMapping documentation (Remarks section) explicitly indicates that

, ; .

, , ( ); , , , , - , ( ).

, , , (, FAT), , .

, , , :

, , 0 ().

, , , , , .

Answer 2

, , . , NtAllocateVirtualMemory/VirtualAlloc NtCreateSection/CreateFileMapping.

, , .

: - CreateFileMapping, SetEndOfFile , . .

2: , MSDN Win32 . ZwSetInformationFile :

FileInformationClass FileEndOfFileInformation EndOfFile FILE_END_OF_FILE_INFORMATION , ZwSetInformationFile .

, . .

Answer 3

Yes, as indicated by wj32. This is due to the c2 requirements that NT has met since its birth. However, depending on what you are trying to do, you should probably look for sparse files.