x64遍历VAD

最新推荐文章于 2023-05-12 13:41:59 发布

My classmates

最新推荐文章于 2023-05-12 13:41:59 发布

阅读量1.8k

点赞数 1

CC 4.0 BY-SA版权

分类专栏： win64

本文链接：https://blog.youkuaiyun.com/weixin_42052102/article/details/85082190

本文详细探讨了在x64体系结构中遍历虚拟地址描述符(VAD)的过程，涵盖了VAD的数据结构、遍历策略以及在内存管理中的关键作用。通过理解这一过程，读者将能更好地掌握操作系统如何管理和保护内存资源。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

#include <ntifs.h>
typedef struct _MMADDRESS_NODE
{
   
   
	ULONG64 u1;
	struct _MMADDRESS_NODE* LeftChild;
	struct _MMADDRESS_NODE* RightChild;
	ULONG64 StartingVpn;
	ULONG64 EndingVpn;
}MMADDRESS_NODE, *PMMADDRESS_NODE;
typedef struct _EX_FAST_REF
{
   
   
	union
	{
   
   
		PVOID Object;
		ULONG_PTR RefCnt : 3;
		ULONG_PTR Value;
	};
} EX_FAST_REF, *PEX_FAST_REF;
struct _SEGMENT
{
   
   
	struct _CONTROL_AREA* ControlArea; 
	ULONG TotalNumberOfPtes;
	ULONG SegmentFlags;
	ULONG64 NumberOfCommittedPages;
	ULONG64 SizeOfSegment; 
	union
	{
   
   
		struct _MMEXTEND_INFO* ExtendInfo;  
		void* BasedAddress; 
	};
	ULONG64 SegmentLock; 
	ULONG64 u1; 
	ULONG64 u2; 
	struct _MMPTE* PrototypePte; 
	ULONGLONG ThePtes[0x1]; 
};
//控制区
struct _CONTROL_AREA
{
   
   
	struct _SEGMENT* Segment;
	struct _LIST_ENTRY DereferenceList;
	unsigned __int64 NumberOfSectionReferences;
	unsigned __int64 NumberOfPfnReferences;
	unsigned __int64 NumberOfMappedViews;
	unsigned __int64 NumberOfUserReferences;
	ULONG  u; 
	ULONG FlushInProgressCount; 
	struct _EX_FAST_REF FilePointer; 
	
	/*ULONG ControlAreaLock;
	ULONG ModifiedWriteCount;
	ULONG Starti