Windows 95 used a hybrid 16-bit and 32-bit virtual memory architecture. It mapped all running 16-bit Win16 applications into a shared 2GB–3GB linear address space arena, relying on the 32-bit Virtual Machine Manager and a global heap to handle segmented memory and compatibility.
Address Space and Arenas
- Compatibility Arena (0–4 MB): Reserved for low-level MS-DOS and Win32s/Windows 3.11 real-mode compatibility structures.
- Private Arena (4 MB–2 GB): Each modern Win32 process received its own private, isolated virtual address space.
- Shared Arena (2–3 GB): Housing for the 16-bit subsystem components, shared memory-mapped files, and the global heap where all 16-bit applications coexisted and could see one another.
- System Arena (3–4 GB): Reserved exclusively for core operating system kernel and ring-0 tasks.
16-Bit App Memory Handling
- Segmented Memory: 16-bit apps used 16:16 selector:offset addressing, restricted traditionally by 64KB segment limits unless using special expanded descriptor limits.
- Global Heap: GlobalAlloc and LocalAlloc APIs allocated memory blocks from the global heap, often flagged as movable (
GMEM_MOVEABLE) so the system could shuffle physical memory fragments around. - Cooperative vs. Preemptive Mix: While 32-bit Win32 processes ran preemptively, groups of 16-bit apps shared a single underlying virtual machine, meaning a hang or memory leak in one 16-bit app could destabilize the shared 2–3GB region or crash the entire subsystem.
- Compatibility Shims: Modern versions of Windows still preserve remnants of this behavior (such as
EmulateHeapin the Windows Application Compatibility framework) to redirect old heap APIs for legacy software
Might have to give it a try because alot of Win11 security measures can be bypassed using The Windows Assessment and Deployment Kit (Windows ADK).