{
	"id": "ec8b6d4e-c0aa-4894-a733-5e8e312d3881",
	"created_at": "2026-04-06T01:31:41.601408Z",
	"updated_at": "2026-04-10T13:12:25.587603Z",
	"deleted_at": null,
	"sha1_hash": "e3fe9d1a4def039dc45c703abdb37b305c7f970b",
	"title": "User Mode and Kernel Mode - Windows drivers",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 54510,
	"plain_text": "User Mode and Kernel Mode - Windows drivers\r\nBy EliotSeattle\r\nArchived: 2026-04-06 00:29:30 UTC\r\nIn this article\r\n1. User mode\r\n2. Kernel mode\r\n3. Related content\r\nA processor in a computer that runs Windows operates in two different modes: user mode and kernel mode. The\r\nprocessor switches between these modes depending on the type of code it's executing. Applications operate in user\r\nmode. Core operating system components function in kernel mode. Although many drivers operate in kernel\r\nmode, some can function in user mode.\r\nWhen you launch an application in user mode, Windows creates a process for it. This process provides the\r\napplication with a private virtual address space and a private handle table. Since each application's virtual address\r\nspace is private, one application can't modify another application's data. Each application runs in isolation. This\r\napproach ensures that if an application crashes, it doesn't affect other applications or the operating system.\r\nThe virtual address space of a user-mode application is also limited. A process running in user mode can't access\r\nvirtual addresses that are reserved for the operating system. Limiting the virtual address space of a user-mode\r\napplication prevents the application from modifying or damaging critical operating system data.\r\nAll code that runs in kernel mode shares a single virtual address space. As a result, a kernel-mode driver isn't\r\nisolated from other drivers or the operating system. If a kernel-mode driver mistakenly writes to the wrong virtual\r\naddress, it could compromise data that belongs to the operating system or another driver. If a kernel-mode driver\r\ncrashes, it causes the entire operating system to crash.\r\nThe following diagram illustrates the communication between user-mode and kernel-mode components.\r\nhttps://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode\r\nPage 1 of 2\n\nVirtual address spaces\r\nFeedback\r\nWas this page helpful?\r\nAdditional resources\r\nTraining\r\nLast updated on 10/29/2025\r\nSource: https://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode\r\nhttps://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode"
	],
	"report_names": [
		"user-mode-and-kernel-mode"
	],
	"threat_actors": [],
	"ts_created_at": 1775439101,
	"ts_updated_at": 1775826745,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e3fe9d1a4def039dc45c703abdb37b305c7f970b.pdf",
		"text": "https://archive.orkl.eu/e3fe9d1a4def039dc45c703abdb37b305c7f970b.txt",
		"img": "https://archive.orkl.eu/e3fe9d1a4def039dc45c703abdb37b305c7f970b.jpg"
	}
}