A forum for reverse engineering, OS internals and malware analysis 

Discussion on reverse-engineering and debugging.
 #23882  by Kamala
 Sun Sep 14, 2014 10:24 pm
Hi,

I was recently looking at the windows kernel address space layout and noticed that physical address 0xf0000 (bios page) is mapped several hundred times (roughly .7Mb) in windows kernel address space (pte type - syspte). I wasn't able to justify the need for such a large mapping to the same physical page and was wondering if there is an obvious reason to that which I am missing? Thought I would check before I start tracing the kernel allocation code to dig deeper. Please let me know if you have any thoughts on this. Thanks.

Kamala