Default Windows CE Memory Management

Hi,
I spent some time reading the Windows CE 3.0 source code but still cannot figure where the page descriptors are located. According to the source code they should start at virtual address 0xFFFFD000. I am trying to write a hack to enable the write back cache of the XScale PXA255 CPUs. Any ideas?