PMDL NTAPI IoCreateWriteMdlForAddress2(PVOID InAddress, PVOID *OutAddress, size_t Size){ if ((InAddress == NULL) | (Size == 0)) return NULL; PMDL pMdl = IoAllocateMdl(InAddress, Size, FALSE, FALSE, NULL); if (pMdl == NULL) return NULL; MmProbeAndLockPages(pMdl, KernelMode, IoReadAccess); pMdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA; *OutAddress = MmMapLockedPagesSpecifyCache(pMdl, KernelMode, MmCached,NULL,FALSE, NormalPagePriority); return pMdl;} VOID NTAPI IoFreeMdlForAddress(PVOID OutAddress, PMDL pMdl){ MmUnmapLockedPages(OutAddress, pMdl); //MmUnlockPages(pMdl); IoFreeMdl(pMdl);}
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
MaMy COW失效了....如楼上所说只读的话 官方方法是 ZwProtectVirtualMemory,需要自己从SSDT找地址
