I've stumbled accross some code which reads a dword at memory location 0x7ffe000, which causes the program to crash and the wine debugger to start.
After some investigation, it seems that reading the memory location 0x7ffe0000 should return KeTickCount.LowPart to the user process. Has anyone ever heard about that ? I was wondering if it was a native windows NT behaviour, or if it was done by a special kernel-space exception handler installed by the program.
It's a native NT thing; a page of memory at that address is shared between user and kernel space. The definition in the w2k ddk.
I found it, thank you very much.
Could anyone tell me where I should look to implement that shared page in wine ? In the page fault exception handler ? Any information will be welcome.
BTW does anyone know where I can find information about KeTickCount ? I'd like to understand the meaning and purpose of the 3 fields (LowPart, High1Time, High2Time). There's nothing about it in the MSDN.
It looks like KeTickCount.LowPart is a 10ms counter. Anyone can confirm ?
Laurent Pinchart