Read of memory location 0x7ffe0000 in windows NT

[Laurent Pinchart]

>
>
>>Hi everybody,
>>
>>I've stumbled accross some code which reads a dword at memory location 
>>0x7ffe000, which causes the program to crash and the wine debugger to start.
>>
>>After some investigation, it seems that reading the memory location 
>>0x7ffe0000 should return KeTickCount.LowPart to the user process. Has anyone 
>>ever heard about that ? I was wondering if it was a native windows NT 
>>behaviour, or if it was done by a special kernel-space exception handler 
>>installed by the program.
>>
>It's a native NT thing; a page of memory at that address is shared 
>between user and kernel space. The definition in the w2k ddk.
>
I found it, thank you very much.

BTW does anyone know where I can find information about KeTickCount ? 
I'd like to understand the meaning and purpose of the 3 fields (LowPart, 
High1Time, High2Time). There's nothing about it in the MSDN.

Laurent Pinchart