As the subject states I would like to know whether there is a single virtual address space for the Windows kernel and all kernel mode drivers ? So basically a kernel mode driver has access to all Windows kernel data structures ?
Asked
Active
Viewed 129 times
0
-
basically yes. almost all address space is common. – RbMm Dec 07 '21 at 15:03
-
@RbMm Thank you. If you can provide an answer same as the comment I will accept it. – JoeT Dec 07 '21 at 17:14
1 Answers
0
Basically yes, however the answer is complicated. There is a division of the virtual address space for any process into 'user mode' and 'kernel mode' address spaces.
When executing a thread in the kernel process, which is the default for kernel drivers and components, there is a single shared virtual address space. However kernel components can also execute threads in other processes, in which case that thread is using the virtual address space of that process for the user mode portion of the address space, while also having access to the shared kernel mode address space.
Mark Roddy
- 1
- 1