On Monday, March 10, 2025 9:54:18 PM Central Daylight Time robert lippmann wrote:
- MacOS won't allow you to map anything below 4 GB, so Wine can't place
the KSHARED_USER_DATA at 0x7ffe0000.
Actually, Windows doesn’t do that anymore on 64 bit systems:
https://msrc.microsoft.com/blog/2022/04/randomizing-the-kuser_shared_data-st ructure-on-windows/
That's not quite what you think. Microsoft can't actually move the KUSD without breaking things in both the user and the kernel; it's de facto API. Rather, what they did is make the *kernel* page read-only (the user page was already read-only), and map a writable copy at a different address (the kernel page needs to be writable so that the kernel can update dynamic fields like time). This doesn't help us because we still need to map the read-only page.