首页
社区
课程
招聘
内存保护的疑惑
发表于: 2010-5-3 00:17 4279

内存保护的疑惑

2010-5-3 00:17
4279
还是用堕落天才的代码如下
__asm{//去掉内存保护
      cli
      mov  eax,cr0
      and  eax,not 10000h
      mov  cr0,eax
      }

      *((ULONG*)Address) = (ULONG)MyNtOpenProcess;//HOOK SSDT

      __asm{//恢复内存保护  
      mov  eax,cr0
      or   eax,10000h
      mov  cr0,eax
      sti
      }
刚开始我理解为禁用分页机制,实际是间接去掉保护了,因为在分页机制里,PTE里包含有该页读或写的标志位,但是又有个问题,编译器编译出来的代码里*((ULONG*)Address应该是个虚拟地址,在关闭分页机制后,CPU如何能把该地址直接作为线性地址来用呢???
于是用windbg调试了下,惊奇的发现asm代码并不是禁用分页,比如我的虚拟机里
cr0=8001003b
cr0寄存器内容如下
PG 0000(中间都是0) ET TS EM MP PE
and  eax,not 10000h,not 10000h得到的是FFFEFFFF,执行后的EAX=8000003B,它的PG为仍然为1,难道这原本就是个错误???
后来我将去掉内存保护和恢复内存保护的代码注释掉,编译的驱动加载后尝试没有一点问题,在虚拟机里和本机里都试过,请问这是怎么回事???

[峰会]看雪.第八届安全开发者峰会10月23日上海龙之梦大酒店举办!

收藏
免费 0
支持
分享
最新回复 (5)
雪    币: 2523
活跃值: (520)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
2
这段代码修改的是CR0的WP位,不是PG位

WP        Write Protect (bit 16 of CR0) — Inhibits supervisor-level procedures from writing
into user-level read-only pages when set; allows supervisor-level procedures to write
into user-level read-only pages when clear. This flag facilitates implementation of the
copy-on-write method of creating a new process (forking) used by operating systems
such as UNIX*.
2010-5-3 00:59
0
雪    币: 95
活跃值: (419)
能力值: ( LV9,RANK:310 )
在线值:
发帖
回帖
粉丝
3
呵呵,谢谢ls的解答,还有个问题,ssdt在系统区,所在内存页应该是只读的吧,为什么我把那个ASM代码去掉,仍然可以写进去呢
2010-5-3 01:18
0
雪    币: 95
活跃值: (419)
能力值: ( LV9,RANK:310 )
在线值:
发帖
回帖
粉丝
4
虚拟机里*((ULONG*)Address)为80502404
kd> !pte 80502404
               VA 80502404
PDE at 00000000C0602010    PTE at 00000000C0402810
contains 00000000004001E3  contains 0000000000000000
pfn 400        -GLDA--KWEV    LARGE PAGE pfn 502
奇怪的是PTE的内容为全0,而不是502XXX
这里有张PTE标志位图,http://bbs.pediy.com/showthread.php?t=93424
2010-5-3 01:35
0
雪    币: 65
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
学习中....

.
2010-5-3 07:51
0
雪    币: 95
活跃值: (419)
能力值: ( LV9,RANK:310 )
在线值:
发帖
回帖
粉丝
6
网上对cr0的标志描述不全,在wiki上找的资料如下:与大家共享
Control registers in x86 series
CR0
The CR0 register is 32 bits long on the 386 and higher processors. On x86-64 processors in long mode, it (and the other control registers) are 64 bits long. CR0 has various control flags that modify the basic operation of the processor.

Bit Name Full Name Description
31 PG Paging If 1, enable paging and use the CR3 register, else disable paging
30 CD Cache disable Globally enables/disable the memory cache
29 NW Not-write through Globally enables/disable write-back caching
18 AM Alignment mask Alignment check enabled if AM set, AC flag set (in EFLAGS register, and privilege level is 3)
16 WP Write protect Determines whether the CPU can write to pages marked read-only
5 NE Numeric error Enable internal x87 floating point error reporting when set, else enables PC style x87 error detection
4 ET Extension type On the 386, it allowed to specify whether the external math coprocessor was an 80287 or 80387
3 TS Task switched Allows saving x87 task context only after x87 instruction used after task switch
2 EM Emulation If set, no x87 floating point unit present, if clear, x87 FPU present
1 MP Monitor co-processor Controls interaction of WAIT/FWAIT instructions with TS flag in CR0
0 PE Protected Mode Enable If 1, system is in protected mode, else system is in real mode

CR1
Reserved

CR2
Contains a value called Page Fault Linear Address (PFLA). When a page fault occurs, the address the program attempted to access is stored in the CR2 register.

CR3

Typical use of CR3 in address translation with 4 KiB pages.Used when virtual addressing is enabled, hence when the PG bit is set in CR0. CR3 enables the processor to translate virtual addresses into physical addresses by locating the page directory and page tables for the current task. Typically, the upper 20 bits of CR3 become the page directory base register (PDBR).

CR4
Used in protected mode to control operations such as virtual-8086 support, enabling I/O breakpoints, page size extension and machine check exceptions.

Bit Name Full Name Description
14 SMXE SMX Enable  
13 VMXE VMX Enable  
10 OSXMMEXCPT Operating System Support for Unmasked SIMD Floating-Point Exceptions enable unmasked SSE exceptions
9 OSFXSR Operating system support for FXSAVE and FXSTOR instructions Must be set to use SSE instructions, enable fast FPU save and restore
8 PCE Performance-Monitoring Counter enable If set, RDPMC can be executed at any privilege level, else it can only be used in kernel mode (ring 0)
7 PGE Page Global Enabled  
6 MCE Machine Check Exception Enables machine check interrupts to occur if set
5 PAE Physical Address Extension Changes page table layout to translate 32-bit virtual address into extended 36-bit physical address
4 PSE Page Size Extensions If unset page size is 4 KiB, else it is increased to 4 MiB, or with PAE, 2 MiB
3 DE Debugging Extensions  
2 TSD Time Stamp Disable If set, RDTSC instruction can only be executed when in ring 0, otherwise RDTSC can be used at any privilege level
1 PVI Protected-mode Virtual Interrupts Enables hardware support of virtual interrupt flag (VIF) in protected mode.This feature can enable some program running at privilege level 0 to run at privilege level 3(applications level;least privileged)
0 VME Virtual 8086 Mode Extensions If set,enables support for virtual interrupt flag in virtual-8086 mode.This feature may improve performance in this mode

其实最好的资料还是intel手册,http://www.intel.com/products/processor/manuals/
关于cr0的内容在
Intel® 64 and IA-32 Architectures Software Developer's Manual
Volume 3A: System Programming Guide
http://www.intel.com/Assets/PDF/manual/253668.pdf
2010-5-3 10:18
0
游客
登录 | 注册 方可回帖
返回
//