#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * USER_SHARED_DATA pointer to the Windows KUSER_SHARED_DATA structure at its fixed
 * user-mode mapping address (0x7FFE0000).
 *
 * The Windows kernel exposes a read-only data structure, mapped into every user-mode
 * process at the fixed virtual address `0x7FFE0000`. This region contains frequently
 * accessed system information and avoids the overhead of system calls for data that
 * the kernel updates frequently. The mapping is always present and identical across
 * all user processes, it provides a fast and efficient way to retrieve system state.
 */
#define USER_SHARED_DATA ((KUSER_SHARED_DATA * const)0x7ffe0000)

#endif
#endif
View code on GitHub