[fsdhook]

Hi, everyone.
I want to map an address on specified 4GB space. Example:
Base of NTOSKRNL.EXE is 0xFFFFF800AABBCCDD, I want to allocate memory on virtual address 0xFFFFF800********, how to realize that?

[tangptr]

That example is inappropriate. According to the Windows AMD64 Memory Management, virtual addresses from fffff800`00000000 to fffff8ff`ffffffff are the mappings initialized by os loader.
Virtual addresses from fffffa80`00000000 to fffffaa0`00000000 are paged pool memory range, where ntoskrnl is located there.
Concordantly, ExAllocatePool with parameter 1 specified as PagedPool would return a virtual address within that range.
It is a 128GB range. Therefore, it is impossible to map an address on specified 4GB space with documented system functions.

[fsdhook]

That example is inappropriate. According to the Windows AMD64 Memory Management, virtual addresses from fffff800`00000000 to fffff8ff`ffffffff are the mappings initialized by os loader.
Virtual addresses from fffffa80`00000000 to fffffaa0`00000000 are paged pool memory range, where ntoskrnl is located there.
Concordantly, ExAllocatePool with parameter 1 specified as PagedPool would return a virtual address within that range.
It is a 128GB range. Therefore, it is impossible to map an address on specified 4GB space with documented system functions.

What a pity!