|
|
@ -43,7 +43,11 @@ namespace physmeme
|
|
|
|
{
|
|
|
|
{
|
|
|
|
// scan every page of the physical memory range
|
|
|
|
// scan every page of the physical memory range
|
|
|
|
for (auto page = page_va; page < page_va + end; page += 0x1000)
|
|
|
|
for (auto page = page_va; page < page_va + end; page += 0x1000)
|
|
|
|
|
|
|
|
{
|
|
|
|
if (!is_page_found.load()) // keep scanning until its found
|
|
|
|
if (!is_page_found.load()) // keep scanning until its found
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
__try
|
|
|
|
|
|
|
|
{
|
|
|
|
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
|
|
|
|
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
|
|
|
|
{
|
|
|
|
{
|
|
|
|
//
|
|
|
|
//
|
|
|
@ -59,6 +63,10 @@ namespace physmeme
|
|
|
|
is_page_found.store(true);
|
|
|
|
is_page_found.store(true);
|
|
|
|
return;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
physmeme::unmap_phys(page_va, end);
|
|
|
|
physmeme::unmap_phys(page_va, end);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
@ -76,6 +84,8 @@ namespace physmeme
|
|
|
|
for (auto page = page_va; page < page_va + 0x1000 * 512; page += 0x1000)
|
|
|
|
for (auto page = page_va; page < page_va + 0x1000 * 512; page += 0x1000)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
if (!is_page_found.load())
|
|
|
|
if (!is_page_found.load())
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
__try
|
|
|
|
{
|
|
|
|
{
|
|
|
|
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
|
|
|
|
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
|
|
|
|
{
|
|
|
|
{
|
|
|
@ -93,6 +103,8 @@ namespace physmeme
|
|
|
|
return;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {}
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
physmeme::unmap_phys(page_va, 0x1000 * 512);
|
|
|
|
physmeme::unmap_phys(page_va, 0x1000 * 512);
|
|
|
|
}
|
|
|
|
}
|
|
|
@ -105,6 +117,8 @@ namespace physmeme
|
|
|
|
for (auto page = page_va; page < page_va + remainder; page += 0x1000)
|
|
|
|
for (auto page = page_va; page < page_va + remainder; page += 0x1000)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
if (!is_page_found.load())
|
|
|
|
if (!is_page_found.load())
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
__try
|
|
|
|
{
|
|
|
|
{
|
|
|
|
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
|
|
|
|
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
|
|
|
|
{
|
|
|
|
{
|
|
|
@ -122,6 +136,8 @@ namespace physmeme
|
|
|
|
return;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
__except (EXCEPTION_EXECUTE_HANDLER) {}
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
physmeme::unmap_phys(page_va, remainder);
|
|
|
|
physmeme::unmap_phys(page_va, remainder);
|
|
|
|
}
|
|
|
|
}
|
|
|
|