[MS Windows segmentation]: User space segmentation howto

[denilsson31]

I'm currently developing a home-built debugging plug-in.
It consists in reading the code segment of a debugged program. Nevertheless, it doesn't work at all.
Obviously, I can't read the targeted segment code. Something is read (no Segmentation Fault) but I don't know what ...
I've observed that user processes use the same descriptor selector that is CS = 1B indicating this is the GDT, involved. So, no matter to load CS value in a Data Selector Register. Just EIP value should be loaded.

So, I wrote a test program given an address, reads and tries to disassemble.
But what a surprise, if I run two instances of this test program at the same time, EIP remains the same.

If I do the same with two releases of my tested program (compiled with different level of optimization: -g for the first and -O3 for the other). EIP values differ. Agree.
Reading its own code works for all of two. Agree.
But, reading code of the other gives unexpected result.

Can't understand that. I feel confused but it's crazy:

CS value remains the same referencing the gdt.
EIP remains the same.

Conclusion:
could GDT be switched between process ?
Answer is yes. GDTR value changes against process.

Unthinkable.
What is the benefit against using of several segments entry in gdt or use of LDT.

Does someone know how to access memory of an other process ?

Can someone explain the advantage of such memory management in Windows Vista ?

Thanks a lot

[Gigasoft]

Congratulations for not making it to section 3.3.2 of the Intel 64 and IA-32 Architectures Software Developer's Manual Volume 1.

In Windows, GDTR does not change. The same processor always uses the same GDT, while different processors use different GDTs. However, CR3, which contains the physical address of the page directory, changes when switching between threads belonging to different processes. That's why the same virtual address can refer to different memory cells in the context of different processes. In this case, the address in EIP actually corresponds to the same physical address, since it's the same program (unchanging sections of an executable are only loaded once and have only one copy in memory, no matter how many processes they have been loaded into). For information on paging on the Intel architecture, see Chapter 4 of the Intel 64 and IA-32 Architectures Software Developer’s Manual, Volume 3A.