[Xearinox]

Hello.

How to access KUSER_SHARED_DATA structure directly from usermode?

Thanks.

[rinn]

Hello.

Cast it as a structure pointer with absolute address.

Best Regards
-rin

[Xearinox]

Hello rinn, thanks for response, do you mean something like this:

Code: Select all

KUSER_SHARED_DATA* kusd = (KUSER_SHARED_DATA*)0x7FFE0000;

???

[EP_X0FF]

It is R/O memory region of a PAGE_SIZE mapped at fixed address in user mode. Just use it address as a pointer like rinn already said. This doesn't working for you?

[Xearinox]

Yes I know that address is in the fixed address in all Windows NT+ versions.

But working with memory is my weakness.

I ask because, if it is read only memory mapped in every process, is this struct members 100% accurate, for example can we will assume, that no USERMODE process can not change this?

[TheExecuter]

usermode processes can;

vprotect(....,0x40,&oldprotect)
writeprocessmemory(...)
vprotect(....,oldprotect,&temp)

so yes.

[Xearinox]

Thank you all.

LOCK.