Virtual Memory Layout on x86 is:
+------------------------------------+ 00000000 | | | | | | | User Mode Addresses | | | | All pages within this range | | are potentially accessible while | | the CPU is in USER mode. | | | | | +------------------------------------+ 7ffff000 | 64k No Access Area | +------------------------------------+ 80000000 | | | NTLDR loads the kernel, HAL and | | boot drivers here. The kernel | | then relocates the drivers to the | | system PTE area. | | | | Kernel mode access only. | | | | When possible, the PFN database & | | initial non paged pool is built | | here using large page mappings. | | | +------------------------------------+ | | | Additional system PTEs, system | | cache or special pooling | | | +------------------------------------+ | | | System mapped views. | | | +------------------------------------+ | | | Session space. | | | +------------------------------------+ C0000000 | Page Table Pages mapped through | | this 4mb region | | Kernel mode access only. | | | +------------------------------------+ C0400000 | HyperSpace - working set lists | | and per process memory management | | structures mapped in this 8mb | | region. | | Kernel mode access only. | +------------------------------------+ C0C00000 | System Cache Structures | | reside in this 4mb region | | Kernel mode access only. | +------------------------------------+ C1000000 | System cache resides here. | | Kernel mode access only. | | | | | +------------------------------------+ E1000000 | Start of paged system area | | Kernel mode access only. | | | | | +------------------------------------+ | | | System PTE area - for mapping | | kernel thread stacks and MDLs | | that require system VAs. | | Kernel mode access only. | | | +------------------------------------+ | | | NonPaged System area | | Kernel mode access only. | | | +------------------------------------+ FFBE0000 | Crash Dump Driver area | | Kernel mode access only. | +------------------------------------+ FFC00000 | Last 4mb reserved for HAL usage | +------------------------------------+
