KeStackAttachProcess(Process, &ApcState); attach = TRUE; if (!MmIsAddressValid(TargetAddr)) return STATUS_ABANDONED; PMDL mdl = IoAllocateMdl((PVOID)TargetAddr, (ULONG)uSize, FALSE, FALSE, NULL); if (mdl == NULL) { KeUnstackDetachProcess(&ApcState); return STATUS_NOT_MAPPED_DATA; } havemdl = TRUE; __try { MmBuildMdlForNonPagedPool(mdl); MmProbeAndLockPages(mdl, KernelMode, IoReadAccess); lockpage = TRUE; MappedAddress = MmMapLockedPagesSpecifyCache(mdl, KernelMode, MmCached, NULL, FALSE, NormalPagePriority); if(MappedAddress) { KeUnstackDetachProcess(&ApcState); attach = FALSE; maplockpage = TRUE; if(MmIsAddressValid(Buffer)) { memcpy(Buffer, MappedAddress, uSize); } } } __except (1) { ; } if (maplockpage) MmUnmapLockedPages(MappedAddress, mdl); if (lockpage) MmUnlockPages(mdl); if (havemdl) IoFreeMdl(mdl); if (attach) KeUnstackDetachProcess(&ApcState);
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
lononan MmIsaddressValid无法验证R0地址,请使用: __try { ProbeForRead(Address, Length, sizeof(CHAR)); }__except ...
hzqst 不考虑分页内存可以用手工解析页表的方式读取考虑分页内存,目前无解 千言万语汇成一句话:牢饭真香