KeStackAttachProcess(Process, &ApcState); attach = TRUE; if (!MmIsAddressValid(TargetAddr)) return STATUS_ABANDONED; PMDL mdl = IoAllocateMdl((PVOID)TargetAddr, (ULONG)uSize, FALSE, FALSE, NULL); if (mdl == NULL) { KeUnstackDetachProcess(&ApcState); return STATUS_NOT_MAPPED_DATA; } havemdl = TRUE; __try { MmBuildMdlForNonPagedPool(mdl); MmProbeAndLockPages(mdl, KernelMode, IoReadAccess); lockpage = TRUE; MappedAddress = MmMapLockedPagesSpecifyCache(mdl, KernelMode, MmCached, NULL, FALSE, NormalPagePriority); if(MappedAddress) { KeUnstackDetachProcess(&ApcState); attach = FALSE; maplockpage = TRUE; if(MmIsAddressValid(Buffer)) { memcpy(Buffer, MappedAddress, uSize); } } } __except (1) { ; } if (maplockpage) MmUnmapLockedPages(MappedAddress, mdl); if (lockpage) MmUnlockPages(mdl); if (havemdl) IoFreeMdl(mdl); if (attach) KeUnstackDetachProcess(&ApcState);
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
lononan MmIsaddressValid无法验证R0地址,请使用: __try { ProbeForRead(Address, Length, sizeof(CHAR)); }__except ...
hzqst 不考虑分页内存可以用手工解析页表的方式读取考虑分页内存,目前无解 千言万语汇成一句话:牢饭真香