Used the kernel base address from the loader structure instead MmSystemRangeStart. 
MmSystemRangeStart isn't the base address with the 3GB switch.

Modified: trunk/reactos/hal/halx86/generic/halinit.c
Modified: trunk/reactos/hal/halx86/include/halp.h
Modified: trunk/reactos/hal/halx86/mp/apic.c
Modified: trunk/reactos/hal/halx86/mp/halinit_mp.c
Modified: trunk/reactos/hal/halx86/up/halinit_up.c
Modified: trunk/reactos/hal/halx86/xbox/halinit_xbox.c

--- trunk/reactos/hal/halx86/generic/halinit.c	2005-07-16 12:35:34 UTC (rev 16596)
+++ trunk/reactos/hal/halx86/generic/halinit.c	2005-07-16 13:01:18 UTC (rev 16597)
@@ -38,7 +38,7 @@

   if (BootPhase == 0)
     {
       RtlZeroMemory(&HalpHooks, sizeof(HALP_HOOKS));

-      HalpInitPhase0();      

+      HalpInitPhase0(LoaderBlock);      

     }
   else if (BootPhase == 1)
     {

--- trunk/reactos/hal/halx86/include/halp.h	2005-07-16 12:35:34 UTC (rev 16596)
+++ trunk/reactos/hal/halx86/include/halp.h	2005-07-16 13:01:18 UTC (rev 16597)
@@ -38,7 +38,7 @@

 PVOID HalpMapPhysMemory(ULONG PhysAddr, ULONG Size);
 
 /* Non-generic initialization */

-VOID HalpInitPhase0 (VOID);

+VOID HalpInitPhase0 (PLOADER_PARAMETER_BLOCK LoaderBlock);

 
 /* DMA Page Register Structure  
  080     DMA        RESERVED

--- trunk/reactos/hal/halx86/mp/apic.c	2005-07-16 12:35:34 UTC (rev 16596)
+++ trunk/reactos/hal/halx86/mp/apic.c	2005-07-16 13:01:18 UTC (rev 16597)
@@ -83,6 +83,8 @@

    WRITE_PORT_UCHAR((PUCHAR)0x71, value); \
 })
 

+extern ULONG_PTR KernelBase;
+

 /* FUNCTIONS *********************************************************************/
 
 extern ULONG Read8254Timer(VOID);
@@ -1035,7 +1037,7 @@

    /* Write the page directory page */
    Ke386GetPageTableDirectory(Common->PageDirectory);
    /* Write the kernel entry point */

-   Common->NtProcessStartup = (ULONG_PTR)RtlImageNtHeader(MmSystemRangeStart)->OptionalHeader.AddressOfEntryPoint + (ULONG_PTR)MmSystemRangeStart;

+   Common->NtProcessStartup = (ULONG_PTR)RtlImageNtHeader((PVOID)KernelBase)->OptionalHeader.AddressOfEntryPoint + KernelBase;

    /* Write the state of the mae mode */
    Common->PaeModeEnabled = Ke386GetCr4() & X86_CR4_PAE ? 1 : 0;
 

--- trunk/reactos/hal/halx86/mp/halinit_mp.c	2005-07-16 12:35:34 UTC (rev 16596)
+++ trunk/reactos/hal/halx86/mp/halinit_mp.c	2005-07-16 13:01:18 UTC (rev 16597)
@@ -18,10 +18,11 @@

 /* FUNCTIONS ***************************************************************/
 
 extern BOOLEAN HaliFindSmpConfig(VOID);

+ULONG_PTR KernelBase;

 
 /***************************************************************************/
 VOID

-HalpInitPhase0(VOID)

+HalpInitPhase0(PLOADER_PARAMETER_BLOCK LoaderBlock)

 
 {
    static BOOLEAN MPSInitialized = FALSE;
@@ -29,7 +30,7 @@

 
    /* Only initialize MP system once. Once called the first time,
       each subsequent call is part of the initialization sequence

-			for an application processor. */

+      for an application processor. */

 
    DPRINT("HalpInitPhase0()\n");
 
@@ -45,6 +46,10 @@

    {
       KEBUGCHECK(0);
    }

+
+   /* store the kernel base for later use */
+   KernelBase = ((PLOADER_MODULE)LoaderBlock->ModsAddr)[0].ModStart;
+

 }
 
 /* EOF */

--- trunk/reactos/hal/halx86/up/halinit_up.c	2005-07-16 12:35:34 UTC (rev 16596)
+++ trunk/reactos/hal/halx86/up/halinit_up.c	2005-07-16 13:01:18 UTC (rev 16597)
@@ -18,7 +18,7 @@

 /* FUNCTIONS ***************************************************************/
 
 VOID

-HalpInitPhase0(VOID)

+HalpInitPhase0(PLOADER_PARAMETER_BLOCK LoaderBlock)

 {
   HalpInitPICs();
 

--- trunk/reactos/hal/halx86/xbox/halinit_xbox.c	2005-07-16 12:35:34 UTC (rev 16596)
+++ trunk/reactos/hal/halx86/xbox/halinit_xbox.c	2005-07-16 13:01:18 UTC (rev 16597)
@@ -22,7 +22,7 @@

 /* FUNCTIONS ***************************************************************/
 
 VOID

-HalpInitPhase0(VOID)

+HalpInitPhase0(PLOADER_PARAMETER_BLOCK LoaderBlock)

 {
   HalpHooks.InitPciBus = HalpXboxInitPciBus;