so in windows xp we have 4GB of memory per process, right? the first 2GB (00000000-7fffffff) is for the process to use, and the other 2GB (80000000-ffffffff) is part of system/os memory.

so i see that in the Memory Map window, you get to see/search whatever memory has been used/allocated by your process. in that window, you can usually see addresses up to about 7fffffff. is there a way to search the next 2GB of memory, from 80000000 to ffffffff?

thanks!

That area is restricted to kernel mode, you can only scan there using a driver or other ring-0 trick

I think it's not necessary to scan the upper 2G, in most situation, isn't it?

I remember there was a trick involving ReadProcessMemory or some other api... but I cant remember which flag was used