内存区域划分布局已有资料表述
PoolBigPageTable 是 Windows 操作系统内核中一个非常重要的数据结构,它用来管理和跟踪大页内存(Big Pages)的分配和使用情况。
以下均以WIN10 21H2为例

如上图所示
在IDA中 "ExFreeHeapPool"函数有关于PoolBigPageTable"表中"对于指定地址如何查找其在表中的位置.
代码中myself_expoolTag为实验假设开辟的内存,PoolBigPageTableSize_val为系统全局变量大小
通过如上代码运算可以得到指定index 之后根据上述微软的计算过程
以及对应每一块"内存包"的结构体:
上述代码左侧的式子得到之后,便与自己开辟的地址进行比较如果不一样则index+1亦或者左侧代码+0x18到下一个正常2次循环便可以得到指定地址
如果不按照2次及以下查找也可以像上述代码一样暴力.在此利用不再赘述
最后你便可以选择抹去此表中的信息块
注意:算法在不同的微软系统版本不同,请自行查阅.
index
=
(((
0x9E5F
*
(unsigned __int64)(unsigned
int
)((ULONG64)myself_expoolTag >>
0xC
)) >>
0x20
) ^
(
0x9E5F
*
(unsigned __int64)(unsigned
int
)((ULONG64)myself_expoolTag >>
0xC
))) & (unsigned
int
)(
*
(ULONG64
*
)PoolBigPageTableSize_val
-
1
);
index
=
(((
0x9E5F
*
(unsigned __int64)(unsigned
int
)((ULONG64)myself_expoolTag >>
0xC
)) >>
0x20
) ^
(
0x9E5F
*
(unsigned __int64)(unsigned
int
)((ULONG64)myself_expoolTag >>
0xC
))) & (unsigned
int
)(
*
(ULONG64
*
)PoolBigPageTableSize_val
-
1
);
/
/
定义 Pool_Info 结构体
typedef struct _Pool_Info {
volatile ULONGLONG Va;
/
/
0x0
ULONG Key;
/
/
0x8
ULONG Pattern :
8
;
/
/
0xc
ULONG PoolType :
12
;
/
/
0xc
ULONG SlushSize :
12
;
/
/
0xc
ULONGLONG NumberOfBytes;
} Pool_Info,
*
pPool_Info;
/
/
定义 Pool_Info 结构体
typedef struct _Pool_Info {
volatile ULONGLONG Va;
/
/
0x0
ULONG Key;
/
/
0x8
ULONG Pattern :
8
;
/
/
0xc
ULONG PoolType :
12
;
/
/
0xc
ULONG SlushSize :
12
;
/
/
0xc
ULONGLONG NumberOfBytes;
} Pool_Info,
*
pPool_Info;
*
(_QWORD
*
)(PoolBigPageTable_buffer
+
24i64
*
(unsigned
int
)index) !
=
memory_viraddress
*
(_QWORD
*
)(PoolBigPageTable_buffer
+
24i64
*
(unsigned
int
)index) !
=
memory_viraddress
ULONG64 End_PoolBigPageTable
=
*
(ULONG64
*
)PoolBigPageTable_val
+
*
(ULONG64
*
)PoolBigPageTableSize_val
*
0x18
;
fix_pool
=
*
(ULONG64
*
)PoolBigPageTable_val;
while
(fix_pool < End_PoolBigPageTable)
{
tempPoolInfo
=
(pPool_Info)fix_pool;
if
(tempPoolInfo
-
>Va
=
=
0
)
{
fix_pool
+
=
0x18
;
continue
;
}
if
(tempPoolInfo
-
>Va
=
=
(ULONG64)myself_expoolTag)
{
DbgPrint(
"找到匹配的修复信息地址,地址为: %llx\r\n"
, fix_pool);
isFound
=
true;
break
;
}
fix_pool
+
=
0x18
;
}
ULONG64 End_PoolBigPageTable
=
*
(ULONG64
*
)PoolBigPageTable_val
+
*
(ULONG64
*
)PoolBigPageTableSize_val
*
0x18
;
fix_pool
=
*
(ULONG64
*
)PoolBigPageTable_val;
while
(fix_pool < End_PoolBigPageTable)
[注意]看雪招聘,专注安全领域的专业人才平台!