Re: [Vol-users] Windows kernel memory.

Carl, On MS Windows all processes share the same kernel address space with two salient exceptions. The first is session space (GDI related stuff, clipboard, win32k, etc.) which is shared on a per session basis. The second is that it is possible to manipulate the page tables for malicious purposes to give a process a unique view of a portion of the kernel address space. There is no such thing as "the address spaces of all processes." Each process has its own address space, though some page tables (e.g. for the kernel address space) may be shared among more than one process. The "idle process" isn't a real process; the address space (and other process resources) belong to the system process (absent malice). Regards, gmg.