MmIsAddressValid

最新推荐文章于 2024-05-13 14:08:24 发布

原创最新推荐文章于 2024-05-13 14:08:24 发布 · 1.7k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#c #byte

驱动/内核/HOOK/ROOKIT 专栏收录该内容

26 篇文章

订阅专栏

kd> u MmIsAddressValid

80511990 8bff            mov     edi,edi
80511992 55              push    ebp
80511993 8bec            mov     ebp,esp
80511995 51              push    ecx
80511996 51              push    ecx
80511997 8b4d08          mov     ecx,dword ptr [ebp+8]//传进来的参数，就是一个地址，假定为address
8051199a 56              push    esi
8051199b 8bc1            mov     eax,ecx//第几个参数？
8051199d c1e812          shr     eax,12h
805119a0 bef83f0000      mov     esi,3FF8h
805119a5 23c6            and     eax,esi
805119a7 2d0000a03f      sub     eax,3FA00000h
// PDE==address'=address>>12h+3ff8h-3FA00000h
805119ac 8b10            mov     edx,dword ptr [eax]//取得计算后的address地址，address'应该是到达一个结构，去第一项给edx
805119ae 8b4004          mov     eax,dword ptr [eax+4]//去第二项给eax
//一系列的换算
805119b1 8945fc          mov     dword ptr [ebp-4],eax//将第二项送入一个局部变量，假定为param1=[address'+4]；
805119b4 8bc2            mov     eax,edx
805119b6 57              push    edi
805119b7 83e001          and     eax,1//eax=[address]+1;,标志Present位
805119ba 33ff            xor     edi,edi
805119bc 0bc7            or      eax,edi//[address']+1为0的话就是无效的地址,;如果页面存在标志Present位 = 0，表示该页没有加载到对应的

805119be 7461 je nt!MmIsAddressValid+0x91 (80511a21)//相等的话就跳到结尾处，置al为0，无效的地址

805119c0 bf80000000      mov     edi,80h
805119c5 23d7            and     edx,edi//edx=[address]+80h,取Page size位，Page size位 = 1，表示LargePage
805119c7 6a00            push    0
805119c9 8955f8          mov     dword ptr [ebp-8],edx//假定为param2=[address']+80h;
805119cc 58              pop     eax //eax=0;
805119cd 7404            je      nt!MmIsAddressValid+0x43 (805119d3)//跳805119d3，最高位 = 0 ，非LargePage
805119cf 85c0            test    eax,eax
805119d1 7452            je      nt!MmIsAddressValid+0x95 (80511a25)//地址有效的最高位 = 1 ，LargePage

805119d3 c1e909          shr     ecx,9  //ecx为我们传进来的参数address,。即地址中的高20位代表pte偏移，低12位表示属性
805119d6 81e1f8ff7f00    and     ecx,7FFFF8h
805119dc 8b81040000c0    mov     eax,dword ptr [ecx-3FFFFFFCh]//
805119e2 81e900000040    sub     ecx,40000000h //PTE=address''=address>>9+7ffff8h-40000000h，减40000000h就是加0xC0000000
805119e8 8b11            mov     edx,dword ptr [ecx] //将address''的地址传给edx edx=[address''] ，PTE context
805119ea 8945fc          mov     dword ptr [ebp-4],eax //param1=[address>>9-3FFFFFFCh]
805119ed 53              push    ebx
805119ee 8bc2            mov     eax,edx
805119f0 33db            xor     ebx,ebx
805119f2 83e001          and     eax,1 eax=[address'']+1;， pte 页面存在标志 Present位

805119f5 0bc3            or      eax,ebx
805119f7 5b              pop     ebx // [address'']+1为0的话就无效标志 Present位不存在无效
805119f8 7427            je      nt!MmIsAddressValid+0x91 (80511a21)//无效
805119fa 23d7            and     edx,edi   edx=[address'']+80h
805119fc 6a00            push    0
805119fe 8955f8          mov     dword ptr [ebp-8],edx // param2=[address'']+80h
80511a01 58              pop     eax // eax与edx相比较
80511a02 7421            je      nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a04 85c0            test    eax,eax //还是跳、、
80511a06 751d            jne     nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a08 23ce            and     ecx,esi
805119fc 6a00            push    0
805119fe 8955f8          mov     dword ptr [ebp-8],edx
80511a01 58              pop     eax
80511a02 7421            je      nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a04 85c0            test    eax,eax
80511a06 751d            jne     nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a08 23ce            and     ecx,esi
80511a0a 8b89000060c0    mov     ecx,dword ptr [ecx-3FA00000h]
80511a10 b881000000      mov     eax,81h
80511a15 23c8            and     ecx,eax
80511a17 33d2            xor     edx,edx
80511a19 3bc8            cmp     ecx,eax
80511a1b 7508            jne     nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a1d 85d2            test    edx,edx
80511a1f 7504            jne     nt!MmIsAddressValid+0x95 (80511a25)//有效

80511a21 32c0 xor al,al
80511a23 eb02 jmp nt!MmIsAddressValid+0x97 (80511a27)

80511a25 b001            mov     al,1
80511a27 5f              pop     edi
80511a28 5e              pop     esi
80511a29 c9              leave
80511a2a c20400          ret     4
80511a2d cc              int     3
80511a2e cc              int     3
80511a2f cc              int     3
80511a30 cc              int     3
80511a31 cc              int     3
PAE模式
int PDE = ((lVirtualAddress>>21)<<3) & 0x3FF8 + 0xC0600000;
int PTE = ((lVirtualAddress>>12)<<3) & 0x7FFFF8 + 0xC0000000;

//从网上找的一个C代码
BOOLEAN MmIsAddressValid ( PVOID VirtualAddress )
{
BYTE PresentSign = 0x1;
BYTE PageSizeSign = 0x80;
BYTE PresentAndPageSizeSign = 0x81;
PVOID lVirtualAddress;
ULONG PDE,PDEContext;
ULONG PTE,PTEContext;
lVirtualAddress = VirtualAddress;
PDE = (((ULONG)lVirtualAddress>>21)<<3) & 0x3FF8 + 0xC0600000;
PDEContext = (ULONG)*(PVOID)PDE;
if(!(PDEContext & PresentSign))
return FALSE;

if(PDEContext & PageSizeSign)
return TRUE;

PTE = (((ULONG)lVirtualAddress>>12)<<3) & 0x7FFFF8 + 0xC0000000;
PTEContext = (ULONG)*(PVOID)PTE;
if(!(PTEContext & PresentSign ))
return FALSE;

if(!(PTEContext & PageSizeSign))
return TRUE;
else
{
PDE = (ULONG)PTE & 0x3ff8 + 0xc0600000;
PDEContext = (ULONG)*(PVOID)PDE;
if(PDEContext & PresentAndPageSizeSign)
return TRUE;

}

return FALSE;
}

kd> !pte
               VA 00000000
PDE at 00000000C0600000    PTE at 00000000C0000000
contains 0000000002C80067 contains 0000000000000000
pfn 2c80       ---DA--UWEV