In this brief technical article, Loh explains the differences in kernel mode behavior between Windows CE 5.0 and Windows CE 6.0. In CE 6.0, most system APIs are implemented by modules that are now loaded into the kernel process and so calling an API automatically switches a thread to kernel.
The "gotcha," as Loh describes it, is passing function pointers into kernel mode code such as device drivers. If the function pointer is called directly, it effectively exposes kernel space to user mode code, a potentially serious breach of security.
Read the full article here:
Understanding Windows CE 6.0's kernel mode
Related stories:
