MMPTE数据结构

本文详细解析了MMPTE内存页表的结构及其在操作系统内存管理中的作用。介绍了MMPTE作为union类型,如何抽象PDE、PTE等数据结构,并详细解释了其内部各个字段的意义,如Valid、Write、Owner等位标识,以及PageFrameNumber等关键信息。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

MMPTE其实是个union,它抽象了PDE,PTE,原型PTE等数据结构

kd> dt _MMPTE -r2
nt!_MMPTE
   +0x000 u                : __unnamed
      +0x000 Long             : Uint4B
      +0x000 Flush            : _HARDWARE_PTE_X86
         +0x000 Valid            : Pos 0, 1 Bit
         +0x000 Write            : Pos 1, 1 Bit
         +0x000 Owner            : Pos 2, 1 Bit
         +0x000 WriteThrough     : Pos 3, 1 Bit
         +0x000 CacheDisable     : Pos 4, 1 Bit
         +0x000 Accessed         : Pos 5, 1 Bit
         +0x000 Dirty            : Pos 6, 1 Bit
         +0x000 LargePage        : Pos 7, 1 Bit
         +0x000 Global           : Pos 8, 1 Bit
         +0x000 CopyOnWrite      : Pos 9, 1 Bit
         +0x000 Prototype        : Pos 10, 1 Bit
         +0x000 reserved         : Pos 11, 1 Bit
         +0x000 PageFrameNumber  : Pos 12, 20 Bits
      +0x000 Hard             : _MMPTE_HARDWARE
         +0x000 Valid            : Pos 0, 1 Bit
         +0x000 Writable         : Pos 1, 1 Bit
         +0x000 Owner            : Pos 2, 1 Bit
         +0x000 WriteThrough     : Pos 3, 1 Bit
         +0x000 CacheDisable     : Pos 4, 1 Bit
         +0x000 Accessed         : Pos 5, 1 Bit
         +0x000 Dirty            : Pos 6, 1 Bit
         +0x000 LargePage        : Pos 7, 1 Bit
         +0x000 Global           : Pos 8, 1 Bit
         +0x000 CopyOnWrite      : Pos 9, 1 Bit
         +0x000 Prototype        : Pos 10, 1 Bit
         +0x000 Write            : Pos 11, 1 Bit
         +0x000 PageFrameNumber  : Pos 12, 20 Bits
      +0x000 Proto            : _MMPTE_PROTOTYPE
         +0x000 Valid            : Pos 0, 1 Bit
         +0x000 ProtoAddressLow  : Pos 1, 7 Bits
         +0x000 ReadOnly         : Pos 8, 1 Bit
         +0x000 WhichPool        : Pos 9, 1 Bit
         +0x000 Prototype        : Pos 10, 1 Bit
         +0x000 ProtoAddressHigh : Pos 11, 21 Bits
      +0x000 Soft             : _MMPTE_SOFTWARE
         +0x000 Valid            : Pos 0, 1 Bit
         +0x000 PageFileLow      : Pos 1, 4 Bits
         +0x000 Protection       : Pos 5, 5 Bits
         +0x000 Prototype        : Pos 10, 1 Bit
         +0x000 Transition       : Pos 11, 1 Bit
         +0x000 PageFileHigh     : Pos 12, 20 Bits
      +0x000 Trans            : _MMPTE_TRANSITION
         +0x000 Valid            : Pos 0, 1 Bit
         +0x000 Write            : Pos 1, 1 Bit
         +0x000 Owner            : Pos 2, 1 Bit
         +0x000 WriteThrough     : Pos 3, 1 Bit
         +0x000 CacheDisable     : Pos 4, 1 Bit
         +0x000 Protection       : Pos 5, 5 Bits
         +0x000 Prototype        : Pos 10, 1 Bit
         +0x000 Transition       : Pos 11, 1 Bit
         +0x000 PageFrameNumber  : Pos 12, 20 Bits
      +0x000 Subsect          : _MMPTE_SUBSECTION
         +0x000 Valid            : Pos 0, 1 Bit
         +0x000 SubsectionAddressLow : Pos 1, 4 Bits
         +0x000 Protection       : Pos 5, 5 Bits
         +0x000 Prototype        : Pos 10, 1 Bit
         +0x000 SubsectionAddressHigh : Pos 11, 20 Bits
         +0x000 WhichPool        : Pos 31, 1 Bit
      +0x000 List             : _MMPTE_LIST
         +0x000 Valid            : Pos 0, 1 Bit
         +0x000 OneEntry         : Pos 1, 1 Bit
         +0x000 filler0          : Pos 2, 8 Bits
         +0x000 Prototype        : Pos 10, 1 Bit
         +0x000 filler1          : Pos 11, 1 Bit
         +0x000 NextEntry        : Pos 12, 20 Bits

转载于:https://www.cnblogs.com/fanzi2009/archive/2011/12/22/2297570.html

kd> x nt!MmPfnDatabase fffff805`7b8fc500 nt!MmPfnDatabase = <no type information> kd> dt _mmpfn fffff805`7b8fc500+0x460f7*0x30 nt!_MMPFN +0x000 ListEntry : _LIST_ENTRY [ 0x470348fa`8b4ce3f7 - 0xc4034900`d7834908 ] +0x000 TreeNode : _RTL_BALANCED_NODE +0x000 u1 : <anonymous-tag> +0x008 PteAddress : 0xc4034900`d7834908 _MMPTE +0x008 PteLong : 0xc4034900`d7834908 +0x010 OriginalPte : _MMPTE +0x018 u2 : _MIPFNBLINK +0x020 u3 : <anonymous-tag> +0x024 NodeBlinkLow : 0x1047 +0x026 Unused : 0y1001 +0x026 Unused2 : 0y0100 +0x027 ViewCount : 0x83 '' +0x027 NodeFlinkLow : 0x83 '' +0x027 ModifiedListBucketIndex : 0y0011 +0x027 AnchorLargePageSize : 0y11 +0x028 u4 : <anonymous-tag> kd> dt _mmpfn fffff805`7b8fc500+0x4609*0x30 nt!_MMPFN +0x000 ListEntry : _LIST_ENTRY [ 0x006f006c`006c0041 - 0x00000064`00650077 ] +0x000 TreeNode : _RTL_BALANCED_NODE +0x000 u1 : <anonymous-tag> +0x008 PteAddress : 0x00000064`00650077 _MMPTE +0x008 PteLong : 0x00000064`00650077 +0x010 OriginalPte : _MMPTE +0x018 u2 : _MIPFNBLINK +0x020 u3 : <anonymous-tag> +0x024 NodeBlinkLow : 0x54 +0x026 Unused : 0y0101 +0x026 Unused2 : 0y0110 +0x027 ViewCount : 0 '' +0x027 NodeFlinkLow : 0 '' +0x027 ModifiedListBucketIndex : 0y0000 +0x027 AnchorLargePageSize : 0y00 +0x028 u4 : <anonymous-tag> kd> dx -id 0,0,ffffbd046545f1c0 -r1 (*((ntkrnlmp!_LIST_ENTRY *)0xfffff8057c61f350)) (*((ntkrnlmp!_LIST_ENTRY *)0xfffff8057c61f350)) [Type: _LIST_ENTRY] [+0x000] Flink : 0x470348fa8b4ce3f7 [Type: _LIST_ENTRY *] [+0x008] Blink : 0xc4034900d7834908 [Type: _LIST_ENTRY *]
07-21
分析下这个代码PVOID SearchSpecialCode1(PVOID pSearchBeginAddr, ULONG ulSearchLength, PUCHAR pSpecialCode, ULONG ulSpecialCodeLength) { PVOID pDestAddr = NULL; PUCHAR pBeginAddr = (PUCHAR)pSearchBeginAddr; PUCHAR pEndAddr = pBeginAddr + ulSearchLength; PUCHAR i = NULL; ULONG j = 0; KdPrint(("pEndAddr:%p %s\n", pEndAddr)); for (i = pBeginAddr; i <= pEndAddr; i++)//遍历地址 { if (MmIsAddressValid((PVOID)(i)))KdPrint(("dz:%p %p\n", i, *(PUCHAR)(i))); // 遍历特征码 for (j = 0; j < ulSpecialCodeLength; j++) { // 判断地址是否有效 if (!MmIsAddressValid((PVOID)(i + j))) { break; } // 匹配特征码 if (*(PUCHAR)(i + j) != pSpecialCode[j]) { break; } } // 匹配成功 if (j >= ulSpecialCodeLength) { pDestAddr = (PVOID)i; break; } } return pDestAddr; } struct _MMPTE//全名_MMPTE_PROTOTYPE { ULONGLONG Valid : 1; //0x0 ULONGLONG DemandFillProto : 1; //0x0 ULONGLONG HiberVerifyConverted : 1; //0x0 ULONGLONG ReadOnly : 1; //0x0 ULONGLONG SwizzleBit : 1; //0x0 ULONGLONG Protection : 5; //0x0 ULONGLONG Prototype : 1; //0x0 ULONGLONG Combined : 1; //0x0 ULONGLONG Unused1 : 4; //0x0 LONGLONG ProtoAddress : 48; //0x0 }; typedef struct _MMPFN { void* padding1; void* PteAddress;//0x8 struct _MMPTE OriginalPte; //0x10 char padding2[0x18];//_MMPFN 结构是0x30大小 这里0x18给他补上 }_MMPFN, * P_MMPFN; P_MMPFN* get_MmPfnDataBase() { UNICODE_STRING st = { 0 }; RtlInitUnicodeString(&st, L"MmGetVirtualForPhysical"); PVOID start = MmGetSystemRoutineAddress(&st); ULONG64 sub140608650start = SearchSpecialCode1(start, 0x20, "\x48\x03\xD2", 3); //DbgBreakPoint(); ULONG64 sub140608650start1 = sub140608650start + 0x5; P_MMPFN* fanh = *(LONG64*)sub140608650start1; return fanh; } UINT64 va_to_pa(void* va) { return MmGetPhysicalAddress(va).QuadPart; } BOOLEAN hide_mem(HANDLE pid, void* va, ULONG attribute) { PEPROCESS process = 0; KAPC_STATE apc; NTSTATUS status; //DbgBreakPoint(); status = PsLookupProcessByProcessId(pid, &process); if (!NT_SUCCESS(status)) { KdPrint(("PsLookupProcessByProcessId ...sb status:0x%x\n", status)); return FALSE; } KeStackAttachProcess((PVOID)process, &apc); void* align_va = PAGE_ALIGN(va); UINT64 pa = va_to_pa(align_va); if (pa == 0) { KdPrint(("va_err\n")); ObDereferenceObject(process); KeUnstackDetachProcess(&apc); return FALSE; } UINT32 pfn = pa >> 12; //P_MMPFN MmPfndataBase = get_MmPfnDataBase(); // 假设返回类型是PMMPFN ULONG64 mmpf = get_MmPfnDataBase(); P_MMPFN MmPfndataBase1 = mmpf - 0x8; P_MMPFN mmpfn = &MmPfndataBase1[pfn]; mmpfn->OriginalPte.Protection = attribute; ObDereferenceObject(process); KeUnstackDetachProcess(&apc); return TRUE; }
最新发布
08-10
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值