PEEKs and POKEs in Windows x64?
dennis - Mon, 05/24/2010 - 18:46
This kernel/driver-level Windows NT code:
void huh()
{
LARGE_INTEGER a;
KeQueryTickCount(&a);
DbgPrint ("%d", a.QuadPart);
};
... is now translated in Windows 2003 DDK x64 environment into:
mov rdx, 0FFFFF78000000320h
lea rcx, Format ; "%d"
mov rdx, [rdx]
call DbgPrint_0
Wow, some variable's address (KeTickCount) is now hardcoded just into driver's code during compilation.
Is not it just return to the PEEKs and POKEs?
http://en.wikipedia.org/wiki/PEEK_and_POKE
Is Microsoft promise to fix this variable to this address forever?

Recent comments
7 weeks 2 days ago
20 weeks 6 days ago
20 weeks 6 days ago
30 weeks 2 days ago
31 weeks 6 days ago
31 weeks 6 days ago
32 weeks 2 days ago
33 weeks 10 hours ago
33 weeks 2 days ago
33 weeks 2 days ago