3 ms·
How can code be running in kernel mode if it doesn’t have unrestricted memory access?
by l33t233372 4y ago
How can code be running in kernel mode if it doesn’t have unrestricted memory access?
- johntb86 4y agoThe page tables can be set up so kernel-mode code doesn't have access to all of memory. You could get around this by modifying the cr3 register to point to a different page directory, but that could cause problems whenever a context switch happens and cr3 is reverted. Microsoft also has PatchGuard, which could probably detect changes like that. In theory you could work around all these protections, but it would be difficult and fragile.