Link to this heading64bit

  • Passes Parameters through Registers (rdi, rsi, rdx, rcx, then stack)

Link to this headingMemory Map

Kernel is shared between all processes
Userspace

Windows Memory Map:

_________________________________________
| Kernel Space |    0xffffffffffffffff  |
|     (256 TB) |  - 0xffff800000000000  |
|______________|________________________|
|              |    0x00007FFFFFFFFFFFF |
| User Mode    |                        |
| Space(256 TB)|                        |
|              |                        |
|              |  - 0x00000000000000000 |
|______________|________________________|

Link to this headingASLR