|

楼主 |
发表于 2023-6-28 21:13:35
|
显示全部楼层
//函数原理是把参数Physicaladdress映射一个虚拟地址,再读取这个虚拟地址的内容复制给参数1,Size最多4KB
//思路:寻找个内核内存的空白4K页,用于赋值虚拟地址
NTSTATUS ReadPhysicalAddress(PVOID lpBuffer, ULONG64 Physicaladdress, SIZE_T Size)//效率很高
{
//PAadress:接收VaToPa 返回的VA地址的PTE虚拟地址,
//VAadress:接收VaToPa 返回的VA地址,
static PL4PTE PTEadress ;
static VA VAadress ;
if (!Physicaladdress )
return STATUS_UNSUCCESSFUL;
//system进程里找到个空白的4K页用于自写映射,VAadress是找到的空白4K页的虚拟地址,PTEadress是这个虚拟地址的PTE
if (VAadress.Value == 0)
{
VAadress.Value = VaToPa(&PTEadress);
}
//Physicaladdress 传进来的是是ppn+ppo
//adress是实际虚拟地址 后12位是ppo
ULONG64 reallyadress = VAadress.Value + (Physicaladdress & 0xfff);
//不加这个就读内存
//MySleep(1);
KIRQL irql = WPOFFx64();
PTEadress->Value = (Physicaladdress & 0xFFFFFFFFFF000);
PTEadress->Fields.U_S = 0;
PTEadress->Fields.PCD = 1;
PTEadress->Fields.G = 1;
PTEadress->Fields.R_W = 1;
PTEadress->Fields.P = 1;
RtlCopyMemory(lpBuffer, reallyadress, Size);
DbgPrint("%llx %llx %llx %llx\n", *(PLONG64)reallyadress, VAadress.Value, Physicaladdress, PTEadress);
RtlZeroMemory(PTEadress,8);
WPONx64(irql);
return STATUS_SUCCESS;
} |
评分
-
查看全部评分
|