Re: Read of memory location 0x7ffe0000 in windows NT

[David Welch]

On Tue, Apr 02, 2002 at 12:11:09AM +0200, Laurent Pinchart wrote:
> Hi everybody,
>
> I've stumbled accross some code which reads a dword at memory location 
> 0x7ffe000, which causes the program to crash and the wine debugger to start.
>
> After some investigation, it seems that reading the memory location 
> 0x7ffe0000 should return KeTickCount.LowPart to the user process. Has anyone 
> ever heard about that ? I was wondering if it was a native windows NT 
> behaviour, or if it was done by a special kernel-space exception handler 
> installed by the program.

It's a native NT thing; a page of memory at that address is shared 
between user and kernel space. The definition in the w2k ddk.