CODEWITHSUNDEEP
c++cwindowsmemoryinternals
JohnnyCat
JohnnyCat

Reputation: 203

Windows virtual memory and kernel mode

I know that in 32-bit architecture the kernel mode virtual memory is mapped between 0x80000000 and 0xFFFFFFFF.

It contains some structures as EPROCESS , ETHREAD ... etc and also the page directories and tables for the current process.

While trying to fetch the virtual address of a certain function is ntoskrnl let's say "nt!NtReadFile" I find that's it's mapped in the kernel virtual address 0x89421130 for example.

I tried to patch some nops after the RET with a random instruction and when switching to another process context I found that the instruction I put is still there.

Does that mean that virtual memory where Ntoskrnl is loaded stays unchanged in every process virtual address space ?

Thanks.

Upvotes: 2

Views: 1148

Answers (1)

nobody
nobody

Reputation: 20174

Does that mean that virtual memory where Ntoskrnl is loaded stays unchanged in every process virtual address space?

Yes. There is one copy of the kernel in memory on a running Windows system, and the exact same kernel address space (i.e. 0x80000000-0xFFFFFFFF on 32-bit) is mapped into every process.

Upvotes: 3

Related Questions