Wow64SharedInformation vs. Shellcode

//http://waleedassar.blogspot.com/
//http://www.twitter.com/waleedassar

//In 64-bit versions of Windows e.g. Win7, the SharedUserData page (_KUSER_SHARED_DATA)
//defines 16 new fields for an array called Wow64SharedInformation. The "Wow64SharedInformation"
//array is found at offset 0x340 from the start of the "SharedUserData" page.

---------------Side Note :) -----------------------------------------------------
//N.B. The "SharedUserData" page exists at address 0x7ffe0000 on all versions of
//windows (exception Win8) no matter how the system is configured.
// e.g. On 32-bit systems    , the page still exists at 0x7ffe0000.
// e.g. On /3GB configuration, the page still exists at 0x7ffe0000.
// e.g. On 64-bit systems    , the page still exists at 0x7ffe0000.
//------------------------------------------------------------------------------

//The array fields are as follows:
------Field-----------              ----Holds address of------
0:000:x86> dps 7ffe0340
7ffe0340  ------------------>        ntdll32!LdrInitializeThunk
7ffe0344  ------------------>        ntdll32!KiUserExceptionDispatcher
7ffe0348  ------------------>        ntdll32!KiUserApcDispatcher
7ffe034c  ------------------>        ntdll32!KiUserCallbackDispatcher
7ffe0350  ------------------>        ntdll32!LdrHotPatchRoutine
7ffe0354  ------------------>        ntdll32!ExpInterlockedPopEntrySListFault
7ffe0358  ------------------>        ntdll32!ExpInterlockedPopEntrySListResume
7ffe035c  ------------------>        ntdll32!ExpInterlockedPopEntrySListEnd
7ffe0360  ------------------>        ntdll32!RtlUserThreadStart
7ffe0364  ------------------>        ntdll32!RtlpQueryProcessDebugInformationRemote
7ffe0368  ------------------>        ntdll32!EtwpNotificationThread
7ffe036c  ------------------>        BaseAddress of 32-bit ntdll.dll



This should be useful for writing shellcode since you have several functions
entrypoints ready i.e. no need to go through GetProcAddress or LdrGetProcedureAddress.

In case this is useful for you, ping me @waleedassar, i am just curious to know.