[悬赏]如何在64位系统下检验内核地址有效性？【已解决】
MmIsAddressValid有时不管用，是人人皆知的事情。不少高手都说：基本没有绝对有效的方法。
那么，大家有没有比较有效的办法呢？
需求：
一个校验地址有效性的函数，能像WINDBG一样，访问任何地址都不会蓝屏。
奖励：
终身核心会员 + 10000水晶币。 已经自己解决了：BOOLEAN IsAddressSafe(UINT_PTR StartAddress)
{
#ifdef AMD64
//cannonical check. Bits 48 to 63 must match bit 47
UINT_PTR toppart=(StartAddress >> 47);
if (toppart & 1)
{
//toppart must be 0x1ffff
if (toppart != 0x1ffff)
return FALSE;
}
else
{
//toppart must be 0
if (toppart != 0)
return FALSE;
}
#endif
{
#ifdef AMD64
UINT_PTR kernelbase=0x7fffffffffffffffULL;
if (StartAddress<kernelbase)
return TRUE;
else
{
PHYSICAL_ADDRESS physical;
physical.QuadPart=0;
physical=MmGetPhysicalAddress((PVOID)StartAddress);
return (physical.QuadPart!=0);
}
return TRUE; //for now untill I ave figure out the win 4 paging scheme
#else
/* MDL x;
MmProbeAndLockPages(&x,KernelMode,IoModifyAccess);
MmUnlockPages(&x);
*/
ULONG kernelbase=0x7ffe0000;
if ((!HiddenDriver) && (StartAddress<kernelbase))
return TRUE;
{
UINT_PTR PTE,PDE;
struct PTEStruct *x;
/*
PHYSICAL_ADDRESS physical;
physical=MmGetPhysicalAddress((PVOID)StartAddress);
return (physical.QuadPart!=0);*/
PTE=(UINT_PTR)StartAddress;
PTE=PTE/0x1000*PTESize+0xc0000000;
//now check if the address in PTE is valid by checking the page table directory at 0xc0300000 (same location as CR3 btw)
PDE=PTE/0x1000*PTESize+0xc0000000; //same formula
x=(PVOID)PDE;
if ((x->P==0) && (x->A2==0))
{
//Not present or paged, and since paging in this area isn't such a smart thing to do just skip it
//perhaps this is only for the 4 mb pages, but those should never be paged out, so it should be 1
//bah, I've got no idea what this is used for
return FALSE;
}
if (x->PS==1)
{
//This is a 4 MB page (no pte list)
//so, (startaddress/0x400000*0x400000) till ((startaddress/0x400000*0x400000)+(0x400000-1) ) ) is specified by this page
}
else //if it's not a 4 MB page then check the PTE
{
//still here so the page table directory agreed that it is a usable page table entry
x=(PVOID)PTE;
if ((x->P==0) && (x->A2==0))
return FALSE; //see for explenation the part of the PDE
}
return TRUE;
}
#endif
}
}代码来自CheatEngine。利用此函数和MmIsAddressValid进行两次判断，在正常模式下暂时未发现误判断。最后，感谢ithurricane大牛提供线索。 win64下这么麻烦？ 可惜了来晚了，不然就可以是终身会员了。。。 支持!! 好东西
页:
[1]