Microsoft® Windows® 2000 Security Handbook

Kernel Mode Memory

Although memory management is fairly simple in user mode (just say "heap!"), things get significantly more complicated in kernel mode. First, I need to talk for a brief moment about paging and how it relates to kernel memory.

Kernel Memory and Paging

If you'll recall from Chapter 1, "Architecture," interrupts are notifications that something (usually hardware) needs attention. Interrupts have various priority levels associated with them, and a procedure servicing an interrupt of a given priority (IRQ Level or IRQL ) won't be interrupted by an interrupt of a lower IRQL; rather, the request remains pending until the kernel is running code at a lower IRQL.

Here's the catch: Remember, again from Chapter 1, when we talked about ...