I'm trying to get some information about how the x86 subsystem works within the 64-bit os and how it is addressed.
As example: If a (64-bit)driver inside the windows kernel tries to read a memory part of a 32-bit subsystem process, how do you get/calculate the 64-bit address where the 32-bit data is stored? In 32-bit usermode you simply take the base of the process module + offset and you're able to read the data with a ReadProcessMemory call.
But how do I find/access the 32-bit subsystem data from inside the 64-bit kernel?