I don't know the user mode address of KI_USER_SHARED_DATA on X64.
Please tell me.
Please tell me.
A forum for reverse engineering, OS internals and malware analysis
0xFFFFF78000000000
Ring0 - the source of inspiration
EP_X0FF wrote:0xFFFFF78000000000yes,i know i can use this address to access KI_USER_SHARED_DATA in KERNEL MODE.
but how can i access KI_USER_SHARED_DATA in USER MODE?
It is mapped on same page as in x86, 0x07FFE0000. There is no difference.
Ring0 - the source of inspiration
EP_X0FF wrote:It is mapped on same page as in x86, 0x07FFE0000. There is no difference.Thanks.
