Superfetch Is the Index: A User-Mode Physical Memory Read on Windows

How Superfetch page metadata and an Object Manager redirect turn an NLS section lookup into a privileged, read-only physical-memory view, and where the technique stops.