Question about Windows memory architecture

[M4RCKUS]

I'm very confused about one thing in Windows memory architecture. Thought someone here could help me out.

The Virtual Address space (numbering) is unique to every process, right? I.E. application "A" can have some data structure at address 0x12345678, while another completely different application "B" can have completely different data structure at same address 0x12345678. Correct me if this is wrong. Now, assuming this, why is that virtual address space is split into partitions like from 0x00010000 to 0x7FFEFFFF for user mode applications and from 0x80000000 to 0xFFFFFFFF for kernel-mode apps. Why can't user-mode app take the "higher" part of address space if the space numbering is unique to it? For example, user-mode app "X" could use address 0xBBCCDDEE for it's data and kernel-mode app could use same address (0xBBCCDDEE) for it's own different kernel data. I believe one process can not simultaneously have user-mode and kernel-mode code, right? I have absolutely no knowledge about kernel-mode stuff so this might be very n00b question and please enlighten me.

Thanks in advance!

Edited November 13, 2009 by M4RCKUS

[kao]

Short answer, quoting a quite nice blog post:

"User Mode Memory is the address space where all nonsystem (kernel) processes and applications run. Each process has its own virtual memory address space up to the maximum allowable on the OS Architecture. If you have 10 user mode process running on a 32bit windows system each will have its own 2GB address space

Kernel Memory, unlike the User Mode Address space, shares the same address space (2GB by default on a 32bit system), and all kernel allocations share the same memory space."

(emphasis mine)

If you want to get a longer answer, read the complete series of posts here: http://www.ravenreport.com/blog/post/Windows-Memory-Architecture-Part-1.aspx

Cheers,

kao.

[atom0s]

Heres some other info about the memory management in Windows:

Virtual-Memory Manager (Windows NT):
/>http://msdn.microsoft.com/en-us/library/ms810616.aspx

Memory Management (What ever driver writer needs to know.):
/>http://www.microsoft.com/whdc/driver/kernel/mem-mgmt.mspx - .doc download on the right.