-
-
[原创]透过MiIsAddressValid函数看x64下分页机制（4kB小页）
-
发表于: 2012-3-16 21:45
-
本来应该贴个图，介绍下windows x64下的分页情况的，由于权限问题作罢了。。。
这里做个简单介绍吧~ （只分析了4kb小页的情况）
sign extended--符号扩展位--- 在线性地址48~63bit
●PML4 entry--在线性地址39～47bit用于索引PML4 entry，指向PDP
●PDP entry--在线性地址的30～38bit用来索引PDP entry,指向PDE
●PDE entry--在线性地址的21～29bit用来索引PDEentry,指向PTE
●PTE entry--在线性地址的12～20bit用来索引PTE entry,指向page offset
●page offset--在线性地址的0～11bit提供在页中的offset
其中，由于sign extended的作用会将线性地址分成相同大小的两段，从0至00007FFF`FFFFFFFF，以及从 FFFF8000`00000000至FFFFFFFF`FFFFFFFF总计256TB的地址范围。
下面是IDA Pro解析nt中的MiIsAddressValid的代码：
.text:00000001400AAE20 MiIsAddressValid proc near ; CODE XREF: RtlpWalkFrameChain+13Ap
.text:00000001400AAE20 ; MmAccessFault-6DB6Dp ...
.text:00000001400AAE20 mov rax, rcx
.text:00000001400AAE23 sar rax, 30h ; VA = rcx
.text:00000001400AAE27 inc rax
.text:00000001400AAE2A cmp rax, 1
.text:00000001400AAE2E ja loc_1400AAEC3 ; 判断地址在从0至 00007FFF`FFFFFFFF，以及从 FFFF8000`00000000至FFFFFFFF`FFFFFFFF总计256TB的地址范围
.text:00000001400AAE34 mov rax, rcx
.text:00000001400AAE37 mov rdx, 0FFFFF6FB7DBED000h
.text:00000001400AAE41 shr rax, 27h ; VA >> 39
.text:00000001400AAE45 and eax, 1FFh ; 得到PLM4
.text:00000001400AAE4A test byte ptr [rdx+rax*8], 1 ; present位
.text:00000001400AAE4E jz short loc_1400AAEC3
.text:00000001400AAE50 mov rax, rcx
.text:00000001400AAE53 mov rdx, 0FFFFF6FB7DA00000h
.text:00000001400AAE5D shr rax, 1Bh ; (VA >> 30) << 3
.text:00000001400AAE61 and eax, 1FFFF8h ; 得到PDPE
.text:00000001400AAE66 test byte ptr [rax+rdx], 1
.text:00000001400AAE6A jz short loc_1400AAEC3
.text:00000001400AAE6C mov rdx, 904C0000000h
.text:00000001400AAE76 mov rax, rcx
.text:00000001400AAE79 shr rax, 12h ; (VA >> 21) << 3
.text:00000001400AAE7D and eax, 3FFFFFF8h
.text:00000001400AAE82 sub rax, rdx ; add FFFFF6FB40000000
.text:00000001400AAE85 mov rdx, [rax]
.text:00000001400AAE88 test dl, 1
.text:00000001400AAE8B jz short loc_1400AAEC3
.text:00000001400AAE8D test dl, dl ; page size
.text:00000001400AAE8F js short loc_1400AAEC6
.text:00000001400AAE91 shr rcx, 9
.text:00000001400AAE95 mov rax, 7FFFFFFFF8h
.text:00000001400AAE9F and rcx, rax
.text:00000001400AAEA2 mov rax, 98000000000h ; add FFFFF68000000000
.text:00000001400AAEAC sub rcx, rax
.text:00000001400AAEAF mov rax, [rcx]
.text:00000001400AAEB2 test al, 1
.text:00000001400AAEB4 jz short loc_1400AAEC3
.text:00000001400AAEB6 mov r8b, 80h
.text:00000001400AAEB9 and al, r8b
.text:00000001400AAEBC cmp al, r8b ; page size
.text:00000001400AAEBF setnz al
.text:00000001400AAEC2 retn
ext:00000001400AAEC3 ; ---------------------------------------------------------------------------
.text:00000001400AAEC3
.text:00000001400AAEC3 loc_1400AAEC3: ; CODE XREF: MiIsAddressValid+Ej
.text:00000001400AAEC3 ; MiIsAddressValid+2Ej ...
.text:00000001400AAEC3 xor al, al
.text:00000001400AAEC5 retn ; false
.text:00000001400AAEC6 ; ---------------------------------------------------------------------------
.text:00000001400AAEC6
.text:00000001400AAEC6 loc_1400AAEC6: ; CODE XREF: MiIsAddressValid+6Fj
.text:00000001400AAEC6 mov al, 1
.text:00000001400AAEC8 retn ; true
.text:00000001400AAEC8 MiIsAddressValid endp
从以上代码中得出页面大小为4KB情况，PLM4E,PDPE,PDE,PTE的计算方式如下：
PLM4E = (((VA >> 39) & 0x1ff) << 3) + 0x0FFFFF6FB7DBED000
PDPE = (((VA >> 30) << 3) & 0x1ffff8) + 0xFFFFF6FB7DA00000
PDE = (((VA >> 21) << 3) & 0x3ffffff8) + 0xFFFFF6FB40000000
PTE = (((VA >> 12) << 3) & 0x7FFFFFFFF8) + 0xFFFFF68000000000
这是本人发的第二个帖子，估计会有不少错误的地方，还请各位多多指点~~
这里做个简单介绍吧~ （只分析了4kb小页的情况）
sign extended--符号扩展位--- 在线性地址48~63bit
●PML4 entry--在线性地址39～47bit用于索引PML4 entry，指向PDP
●PDP entry--在线性地址的30～38bit用来索引PDP entry,指向PDE
●PDE entry--在线性地址的21～29bit用来索引PDEentry,指向PTE
●PTE entry--在线性地址的12～20bit用来索引PTE entry,指向page offset
●page offset--在线性地址的0～11bit提供在页中的offset
其中，由于sign extended的作用会将线性地址分成相同大小的两段，从0至00007FFF`FFFFFFFF，以及从 FFFF8000`00000000至FFFFFFFF`FFFFFFFF总计256TB的地址范围。
下面是IDA Pro解析nt中的MiIsAddressValid的代码：
.text:00000001400AAE20 MiIsAddressValid proc near ; CODE XREF: RtlpWalkFrameChain+13Ap
.text:00000001400AAE20 ; MmAccessFault-6DB6Dp ...
.text:00000001400AAE20 mov rax, rcx
.text:00000001400AAE23 sar rax, 30h ; VA = rcx
.text:00000001400AAE27 inc rax
.text:00000001400AAE2A cmp rax, 1
.text:00000001400AAE2E ja loc_1400AAEC3 ; 判断地址在从0至 00007FFF`FFFFFFFF，以及从 FFFF8000`00000000至FFFFFFFF`FFFFFFFF总计256TB的地址范围
.text:00000001400AAE34 mov rax, rcx
.text:00000001400AAE37 mov rdx, 0FFFFF6FB7DBED000h
.text:00000001400AAE41 shr rax, 27h ; VA >> 39
.text:00000001400AAE45 and eax, 1FFh ; 得到PLM4
.text:00000001400AAE4A test byte ptr [rdx+rax*8], 1 ; present位
.text:00000001400AAE4E jz short loc_1400AAEC3
.text:00000001400AAE50 mov rax, rcx
.text:00000001400AAE53 mov rdx, 0FFFFF6FB7DA00000h
.text:00000001400AAE5D shr rax, 1Bh ; (VA >> 30) << 3
.text:00000001400AAE61 and eax, 1FFFF8h ; 得到PDPE
.text:00000001400AAE66 test byte ptr [rax+rdx], 1
.text:00000001400AAE6A jz short loc_1400AAEC3
.text:00000001400AAE6C mov rdx, 904C0000000h
.text:00000001400AAE76 mov rax, rcx
.text:00000001400AAE79 shr rax, 12h ; (VA >> 21) << 3
.text:00000001400AAE7D and eax, 3FFFFFF8h
.text:00000001400AAE82 sub rax, rdx ; add FFFFF6FB40000000
.text:00000001400AAE85 mov rdx, [rax]
.text:00000001400AAE88 test dl, 1
.text:00000001400AAE8B jz short loc_1400AAEC3
.text:00000001400AAE8D test dl, dl ; page size
.text:00000001400AAE8F js short loc_1400AAEC6
.text:00000001400AAE91 shr rcx, 9
.text:00000001400AAE95 mov rax, 7FFFFFFFF8h
.text:00000001400AAE9F and rcx, rax
.text:00000001400AAEA2 mov rax, 98000000000h ; add FFFFF68000000000
.text:00000001400AAEAC sub rcx, rax
.text:00000001400AAEAF mov rax, [rcx]
.text:00000001400AAEB2 test al, 1
.text:00000001400AAEB4 jz short loc_1400AAEC3
.text:00000001400AAEB6 mov r8b, 80h
.text:00000001400AAEB9 and al, r8b
.text:00000001400AAEBC cmp al, r8b ; page size
.text:00000001400AAEBF setnz al
.text:00000001400AAEC2 retn
ext:00000001400AAEC3 ; ---------------------------------------------------------------------------
.text:00000001400AAEC3
.text:00000001400AAEC3 loc_1400AAEC3: ; CODE XREF: MiIsAddressValid+Ej
.text:00000001400AAEC3 ; MiIsAddressValid+2Ej ...
.text:00000001400AAEC3 xor al, al
.text:00000001400AAEC5 retn ; false
.text:00000001400AAEC6 ; ---------------------------------------------------------------------------
.text:00000001400AAEC6
.text:00000001400AAEC6 loc_1400AAEC6: ; CODE XREF: MiIsAddressValid+6Fj
.text:00000001400AAEC6 mov al, 1
.text:00000001400AAEC8 retn ; true
.text:00000001400AAEC8 MiIsAddressValid endp
从以上代码中得出页面大小为4KB情况，PLM4E,PDPE,PDE,PTE的计算方式如下：
PLM4E = (((VA >> 39) & 0x1ff) << 3) + 0x0FFFFF6FB7DBED000
PDPE = (((VA >> 30) << 3) & 0x1ffff8) + 0xFFFFF6FB7DA00000
PDE = (((VA >> 21) << 3) & 0x3ffffff8) + 0xFFFFF6FB40000000
PTE = (((VA >> 12) << 3) & 0x7FFFFFFFF8) + 0xFFFFF68000000000
这是本人发的第二个帖子，估计会有不少错误的地方，还请各位多多指点~~
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
