Read of memory location 0x7ffe0000 in windows NT

Laurent Pinchart laurent.pinchart at skynet.be
Tue Apr 2 16:01:02 CST 2002


> >>I've stumbled accross some code which reads a dword at memory location
> >>0x7ffe000, which causes the program to crash and the wine debugger to
> >> start.
> >>
> >>After some investigation, it seems that reading the memory location
> >>0x7ffe0000 should return KeTickCount.LowPart to the user process. Has
> >> anyone ever heard about that ? I was wondering if it was a native
> >> windows NT behaviour, or if it was done by a special kernel-space
> >> exception handler installed by the program.
> >
> >It's a native NT thing; a page of memory at that address is shared
> >between user and kernel space. The definition in the w2k ddk.
>
> I found it, thank you very much.

Could anyone tell me where I should look to implement that shared page in 
wine ? In the page fault exception handler ? Any information will be welcome.

> BTW does anyone know where I can find information about KeTickCount ?
> I'd like to understand the meaning and purpose of the 3 fields (LowPart,
> High1Time, High2Time). There's nothing about it in the MSDN.

It looks like KeTickCount.LowPart is a 10ms counter. Anyone can confirm ?

Laurent Pinchart



More information about the wine-devel mailing list