title: Windows Virtual Address Space
body: <p>as I read <a href="https://docs.microsoft.com/en-us/windows/desktop/memory/virtual-address-space" rel="nofollow noreferrer">here</a> the virtual address space of a 32 bit Windows application has 2GB of storage (from 0x00000000-0x7FFFFFFF). The other 2GB are reserved for the system address space.</p>
  <p>However, I found a pointer in a 32bit program (using Cheat Engine) which is pointing to an address which isn't in range of the virutal address space. The addresses in my last exploration were 0x301DDC3C -&gt; 0x87F56190 like you can see in the picture:
  <a href="https://i.stack.imgur.com/vfFZZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vfFZZ.png" alt="enter image description here" /></a></p>
  <p>(The expansion in the first line means a dereference of the pointer 0x301DDC3C, in the next line you can see what's in the dereference location 0x87F56190 in RAM)</p>
  <p>After dereferencing the pointer there are pointers back into the process virtual address space.</p>
  <p><strong>How is it possible that a user mode application has a valid pointer into system address space?</strong></p>
  <p>Does this mean the pointer in location 0x301DDC3C is pointing to an location in the system address space? And so the process I'm examining is using kernel mode stuff?</p>