RE: Re: [ntdev] Windows kernel code page alignment

>This -

82a66ffb 0f848f010000 je nt!MmUnsecureVirtualMemory+0xe29 (82a67190)
82a67001 8b5d08 mov ebx,dword ptr [ebp+8]

The JE instruction does not have an alignment requirement. The offset it was put at in the page of your image was determined by the compiler and linker. Windows loader had nothing to do with it.

Instructions can cross page boundaries, cache line boundaries, and word boundaries.

Expect it.

Good Luck,

Dave Cattley