x64通过页表自映射计算PTE_BASE

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
//InitializePteBase(__readcr3());
VOID InitializePteBase(ULONG64 dirbase)
{
PHYSICAL_ADDRESS phAddr = { 0 };
ULONG64 slot = 0;
ULONG_PTR pfn = dirbase >> 12;

phAddr.QuadPart = pfn << PAGE_SHIFT;

HARDWARE_PTE* pml4 = (HARDWARE_PTE*)MmGetVirtualForPhysical(phAddr);

while (pml4[slot].PageFrameNumber != pfn) slot++;

PTE_BASE = (slot << 39) + 0xFFFF000000000000;
PDE_BASE = PTE_BASE + (slot << 30);
PPE_BASE = PDE_BASE + (slot << 21);
PXE_BASE = PPE_BASE + (slot << 12);

return;
}
ccee4c9a4ad0c4b6555dcb780386d80b.png

x64通过页表自映射计算PTE_BASE
https://rogxo.github.io/2022/08/06/2022-08-06-x64通过页表自映射计算PTE_BASE/
作者
Rogxo
发布于
2022年8月6日
许可协议
CC BY-NC-SA 4.0