> > >>Hi everybody, >> >>I've stumbled accross some code which reads a dword at memory location >>0x7ffe000, which causes the program to crash and the wine debugger to start. >> >>After some investigation, it seems that reading the memory location >>0x7ffe0000 should return KeTickCount.LowPart to the user process. Has anyone >>ever heard about that ? I was wondering if it was a native windows NT >>behaviour, or if it was done by a special kernel-space exception handler >>installed by the program. >> >It's a native NT thing; a page of memory at that address is shared >between user and kernel space. The definition in the w2k ddk. > I found it, thank you very much.
BTW does anyone know where I can find information about KeTickCount ? I'd like to understand the meaning and purpose of the 3 fields (LowPart, High1Time, High2Time). There's nothing about it in the MSDN. Laurent Pinchart