Re: Accessing Physical Memory & Other Process's Address Space
- From: Tim Roberts <spamtrap@xxxxxxxxxx>
- Date: Thu, 07 Feb 2008 06:20:52 GMT
"mybwpp@xxxxxxxxxxxxxx" <spamtrap@xxxxxxxxxx> wrote:
In 32 bit protected mode, each user process is allocated a 4GB address
space, whereby program data and code resides in lower 2GB and kernel
is mapped in the upper 2GB (in some cases it is 3GB for user and 1GB
for kernel). However the part of linear address space where kernel is
mapped, is not accessible to user process, due to the difference in
privilege levels. The question is that, do kernel mode processes also
get their address space mapped in the same manner.
In Windows and Linux, at least, there is no such thing as a "kernel mode
process". Processes simply exist. Sometimes they run in user mode,
sometimes they run in kernel mode. In user mode, part of the address space
is visible. In kernel mode, all of it is.
If yes, than it
implies that kernel is also mapped into a part of their address space.
If a kernel mode driver is malicious, it can easily make arbitrary
changes to kernel, as kernel is mapped to its address space and is
accessible also (as both are operating at the same privilege level).
Am I thinking on the correct lines or there is some misconception?
That is correct. In Windows and Linux, at least, kernel code is "trusted
code", and has full run of the system, including overwriting other kernel
code. That's why Microsoft is making it harder to run kernel code.
--
Tim Roberts, timr@xxxxxxxxx
Providenza & Boekelheide, Inc.
.
- Follow-Ups:
- Re: Accessing Physical Memory & Other Process's Address Space
- From: Gil Hamilton
- Re: Accessing Physical Memory & Other Process's Address Space
- References:
- Accessing Physical Memory & Other Process's Address Space
- From: mybwpp@xxxxxxxxxxxxxx
- Re: [Clax86list] Accessing Physical Memory & Other Process's Address Space
- From: Charles Crayne
- Re: Accessing Physical Memory & Other Process's Address Space
- From: mybwpp@xxxxxxxxxxxxxx
- Accessing Physical Memory & Other Process's Address Space
- Prev by Date: Re: Can WXP handle 4 GB of Physical Memory
- Next by Date: Re: Accessing Physical Memory & Other Process's Address Space
- Previous by thread: Re: Accessing Physical Memory & Other Process's Address Space
- Next by thread: Re: Accessing Physical Memory & Other Process's Address Space
- Index(es):
Relevant Pages
|
