PMDL NTAPI IoCreateWriteMdlForAddress2(PVOID InAddress, PVOID *OutAddress, size_t Size){ if ((InAddress == NULL) | (Size == 0)) return NULL; PMDL pMdl = IoAllocateMdl(InAddress, Size, FALSE, FALSE, NULL); if (pMdl == NULL) return NULL; MmProbeAndLockPages(pMdl, KernelMode, IoReadAccess); pMdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA; *OutAddress = MmMapLockedPagesSpecifyCache(pMdl, KernelMode, MmCached,NULL,FALSE, NormalPagePriority); return pMdl;} VOID NTAPI IoFreeMdlForAddress(PVOID OutAddress, PMDL pMdl){ MmUnmapLockedPages(OutAddress, pMdl); //MmUnlockPages(pMdl); IoFreeMdl(pMdl);}
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
MaMy COW失效了....如楼上所说只读的话 官方方法是 ZwProtectVirtualMemory,需要自己从SSDT找地址
