-
-
[求助]WIN10 1803 补丁之后MmMapIoSpace失效
-
发表于: 2018-8-2 14:19
-
|
|
|---|---|
|
|
|
|
|
NTSTATUS Mapped_Memory_Addr(ULONG LowAddr, ULONG HigAddr, PULONG Addr_Arry, int Mapped_len) { NTSTATUS Status = STATUS_UNSUCCESSFUL; PHYSICAL_ADDRESS Physical_address; //PULONG Page_dri_base; RtlZeroMemory(&Physical_address, sizeof(PHYSICAL_ADDRESS)); if (LowAddr == 0) { return Status; } Physical_address.u.LowPart = ProcessCr3Low; Physical_address.u.HighPart = ProcessCr3Hig; //DbgBreakPoint(); PULONG Page_dri_base = (PULONG)MmMapIoSpace(Physical_address, Mapped_len, TRUE); if (ARGUMENT_PRESENT(Page_dri_base) && MmIsAddressValid(Page_dri_base)) { for (ULONG i = 0; i < PAGE_DIR_MAX; i++) { Addr_Arry[i] = Page_dri_base[i]; if (i % 8== 0) { DbgPrint("\n"); } DbgPrint("%08X ", Addr_Arry[i]); } DbgPrint("\n"); Status = STATUS_SUCCESS; MmUnmapIoSpace(Page_dri_base, Mapped_len); return Status; } return Status; } NTSTATUS OpenProcess(HANDLE ProcessPid) { PEPROCESS ProcessInfo = NULL; PKPROCESS ProccessMemoryInfo = NULL; NTSTATUS Status = STATUS_UNSUCCESSFUL; ProcessCr3Low = 0; ProcessCr3Hig = 0; if (ProcessPid < 0) return Status; Status = PsLookupProcessByProcessId(ProcessPid, &ProcessInfo); if (!NT_SUCCESS(Status)) { DbgPrint("GetPidCr3Error:%X", Status); return Status; } if (ARGUMENT_PRESENT(ProcessInfo) && MmIsAddressValid(ProcessInfo)) { ProccessMemoryInfo = ProcessInfo + 0X0; Status = STATUS_SUCCESS; ProcessCr3Low = ProccessMemoryInfo->DirectoryTableBase[0]; ProcessCr3Hig = ProccessMemoryInfo->DirectoryTableBase[1]; DbgPrint("CR3 =%X%X\n", ProcessCr3Hig, ProcessCr3Low); return Status; } return Status; } LONGLONG Get_Last_digit(ULONG Addr) { LONGLONG Tmp = Addr; Tmp &= 0x000000000F; Tmp *= 0x100000000; return Tmp; } ULONGLONG translate_Linear_address(int Linearaddress) { NTSTATUS Status = STATUS_UNSUCCESSFUL; VIRTUAL_ADDRESS virtualAddress = { 0 }; ULONG tmp_arry[PAGE_DIR_MAX] = { 0 }; ULONG32 Tmp = 0; virtualAddress.ulVirtualAddress = Linearaddress; if (ProcessCr3Low == 0 ) { DbgPrint("OpenProcessFail\n"); return Status; } DbgPrint("CR3 =%X%X,offset = %X,pt = %X,pdt = %X,pdpt = %X,plm4 = %X\n", ProcessCr3Hig, ProcessCr3Low, virtualAddress.stVirtualAddress.offset, virtualAddress.stVirtualAddress.PT, virtualAddress.stVirtualAddress.PDT, virtualAddress.stVirtualAddress.PDPT, virtualAddress.stVirtualAddress.PLM4); Status = Mapped_Memory_Addr(ProcessCr3Low, ProcessCr3Hig,tmp_arry, MAPING_MAX_LEN); if (!NT_SUCCESS(Status)) { DbgPrint("PLM4_Addr Mapped Fail\n"); return Status; } /* ULONG PLM4_Addr = tmp_arry[virtualAddress.stVirtualAddress.PLM4]; Tmp = tmp_arry[virtualAddress.stVirtualAddress.PLM4 + 1]; Tmp &= 0x000000000F; PLM4_Addr &= 0x000000FFFFFFF000; DbgPrint("PLM4_Addr = %X\n", PLM4_Addr); ULONG PDPT_Addr = PLM4_Addr + virtualAddress.stVirtualAddress.PDPT * 0x8; Status = Mapped_Memory_Addr(PDPT_Addr, Tmp,tmp_arry, MAPING_MAX_LEN); if (!NT_SUCCESS(Status)) { DbgPrint("PDPT_Addr Mapped Fail\n"); return Status; } PDPT_Addr = tmp_arry[0]; Tmp = tmp_arry[1]; Tmp &= 0x000000000F; PDPT_Addr &= 0x000000FFFFFFF000; DbgPrint("PDPT_Addr = %X\n", PDPT_Addr); ULONG PDT_Addr = PDPT_Addr + virtualAddress.stVirtualAddress.PDT * 0x8; Status = Mapped_Memory_Addr(PDT_Addr, Tmp,tmp_arry, MAPING_MAX_LEN); if (!NT_SUCCESS(Status)) { DbgPrint("PDT_Addr Mapped Fail\n"); return Status; } PDT_Addr = tmp_arry[0]; Tmp = tmp_arry[1]; Tmp &= 0x000000000F; PDT_Addr &= 0x000000FFFFFFF000; DbgPrint("PDT_Addr = %X\n", PDT_Addr); ULONG PT_Addr = PDT_Addr + virtualAddress.stVirtualAddress.PT * 0x8; Status = Mapped_Memory_Addr(PT_Addr, Tmp,tmp_arry, MAPING_MAX_LEN); if (!NT_SUCCESS(Status)) { DbgPrint("PT_Addr Mapped Fail\n"); return Status; } PT_Addr = tmp_arry[0]; Tmp = tmp_arry[1]; Tmp &= 0x000000000F; PT_Addr &= 0x000000FFFFFFF000; DbgPrint("PT_Addr = %X\n", PT_Addr); ULONGLONG Physucal_Addr = PT_Addr + virtualAddress.stVirtualAddress.offset; Physucal_Addr = Physucal_Addr | Get_Last_digit(tmp_arry[1]); return Physucal_Addr; /*PHYSICAL_ADDRESS Physical_address; DbgPrint("Physucal_Addr: %p\n", Physucal_Addr); RtlZeroMemory(&Physical_address, sizeof(PHYSICAL_ADDRESS)); Physical_address.u.LowPart = Physucal_Addr; Physical_address.u.HighPart = Tmp; char *Buffer = (char *)MmMapIoSpace(Physical_address, sizeof(PHYSICAL_ADDRESS), TRUE); DbgPrint("Data:%s\n", Buffer);*/ return 0L; } 我的CR3是获取的进程的。
最后于 2018-8-2 15:09
被BDBig编辑
，原因：
|
|
|
|
|
|
|
|
|
我不是写外挂的。。。 typedef struct _KPROCESS { DISPATCHER_HEADER Header; LIST_ENTRY ProfileListHead; ULONG DirectoryTableBase[2]; ULONG Unused0; KGDTENTRY LdtDescriptor; KIDTENTRY Int21Descriptor; WORD IopmOffset; UCHAR Iopl; UCHAR Unused; ULONG ActiveProcessors; ULONG KernelTime; ULONG UserTime; LIST_ENTRY ReadyListHead; SINGLE_LIST_ENTRY SwapListEntry; PVOID VdmTrapcHandler; LIST_ENTRY ThreadListHead; ULONG ProcessLock; ULONG Affinity; union { ULONG AutoAlignment : 1; ULONG DisableBoost : 1; ULONG DisableQuantum : 1; ULONG ReservedFlags : 29; LONG ProcessFlags; }; CHAR BasePriority; CHAR QuantumReset; UCHAR State; UCHAR ThreadSeed; UCHAR PowerState; UCHAR IdealNode; UCHAR Visited; union { KEXECUTE_OPTIONS Flags; UCHAR ExecuteOptions; }; ULONG StackCount; LIST_ENTRY ProcessListEntry; UINT64 CycleTime; } KPROCESS, *PKPROCESS; 就是想研究线性地址转物理地址。可是在1803 直接就报废了 好像就是哪个判断的问题太吧 |
|
|
你这是32位的结构体啊，64位的DirectoryTableBase结构是ULONG_PTR DirectoryTableBase，而且不是数组 |
|
|
不是把。64位也可以用的。高位 低位。WINDBG测试过了。在其他版本的64位正常。1803就不行的。我看你发的那个帖子里 有人也反应了这个问题。多了这个判断。你可以参考下PHYSICAL_ADDRESS.LowPart PHYSICAL_ADDRESS.higPart 就知道了。64位也可以是数组 分别代表CR3高位 低位
最后于 2018-8-2 17:32
被BDBig编辑
，原因：
|
|
|
可能DirectoryTableBase里某一位多了新的东西，不能直接拿来当PML4T，你试过把12~35位以外的位清零吗？ |
|
|
。 好了问题解决了。1803之后再映射物理地址用MmMapIoSpace确实不行了。如果是baseaddr 是某个进程的CR3 直接给你 pass掉了。我用mdl 映射物理地址正常了
最后于 2018-8-3 21:16
被BDBig编辑
，原因：
|
|
|
我擦 这问题我也复现了 微软是真滴牛批 |
|
|
我也发现了，真是智障改动。我以前测试环境一直是1607. |
|
|
自己动手丰衣足食 [滑稽]
最后于 2018-8-6 14:38
被BDBig编辑
，原因：
|
|
|
inter的CPU出BUG了 微软只是一个小补丁 暂时的。我知道原因了 |
|
|
真的和页表隔离补丁有关系么？页表隔离补丁win7也有啊 |
|
|
应该是没关系的。我在UC发文 有人和我说是针对CPU BUG打出的补丁 https://www.unknowncheats.me/forum/c-and-c-/291751-converting-physical-addresses-linear-addresses.html |
|
|
所以搞了半天还是没法映射页表么 和hyper-v应该关系不大，虚拟化没开 |
|
|
自己实现映射的函数。现在都是这样做的 在1803 |
|
|
行吧 看来只能这样了 |
|
|
映射的函数能贴出来看看么 
|
|
|
|
hzqst
黑洛
