Alex Ionescu wrote:
Here is
the Object Type Initializer for Sections:
+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x000 Length : 0x4c
+0x002 UseDefaultObject : 0x1 ''
+0x003 CaseInsensitive : 0 ''
+0x004 InvalidAttributes : 0x100
+0x008 GenericMapping : _GENERIC_MAPPING
+0x000 GenericRead : 0x20005
+0x004 GenericWrite : 0x20002
+0x008 GenericExecute : 0x20008
+0x00c GenericAll : 0xf001f
+0x018 ValidAccessMask : 0x1f001f
+0x01c SecurityRequired : 0 ''
+0x01d MaintainHandleCount : 0 ''
+0x01e MaintainTypeList : 0 ''
+0x020 PoolType : 1 ( PagedPool ) <=========
+0x024 DefaultPagedPoolCharge : 0x58 <=========
So the objects are in the Paged Pool.
I'm removing the ViewListHead and ViewListLock from section object. This
members are only used for finding the start address of an image. The
start address can be calculated from each segment of a section object.
- Hartmut