Incorrect image base address of win32k.sys on Win RRS feed

  • Question

    Title: Incorrect image base address of win32k.sys on Win 8.1/Win 10


    like you already know, the image base address of module win32k.sys (at least here in my test enviroment on Win 8.1 and Win 10 both x32) is:

    0x00010000 (output on console, user mode app)
    0x10000 (format to set directly on source code of you driver)

    I have a example (user mode code in C++) that show exactly this value, but why on my kernel mode code below i'm find a diferent value of 0x00010000?

    even i mapping win32k.sys (kernel mode code) comes same result.

    someone can help me please?

    Tuesday, October 31, 2017 6:44 AM

All replies