EDIT: while browsing on StackOverflow, I discovered ZwAllocateVirtualMemory and that was not yielded by any google searches or documentation trawling, as it’s under “Previous Versions” of the documentation - does that mean access to this function is deprecated? Why isn’t it in updated documentation, and are there any downsides to using this over VirtualAlloc?
Anyway, this makes my question fairly obsolete, but I still want to understand what MmMapLockedPages really does when AccessMode = UserMode.
OP: I have read in this question that a kernel driver can map space it’s allocated in system memory into user memory, with MmMapLockedPages. From what I can find in the documentation, there aren’t any other (documented) NT API kernel-mode functions one can use to “put” memory to user space virtual memory. I want to know whether that mapping allows the user to have some kind of viewing to the memory but that memory is still in system space, or if there is a “mapped” chunk of memory of the same size in user space that’s completely accessible by the caller, as if that memory had been malloc’d.
My understanding of the memory systems is far from good, so excuse any misuse of terminology!
