IDontCode
/
physmeme
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

sometimes the gdrv returns an invalid virtual address that is 1 page

Browse Source 
ahead of the actual mapping... added a try/catch around memcmp
master
xerox 4 years ago
parent 61fb1b0638
commit 48e3357155
2 changed files with 110 additions and 78 deletions
Show Stats Download Patch File Download Diff File

94
physmeme-lib/kernel_ctx/kernel_ctx.cpp
Unescape View File

@ -43,22 +43,30 @@ namespace physmeme
{ {
// scan every page of the physical memory range // scan every page of the physical memory range
for (auto page = page_va; page < page_va + end; page += 0x1000) for (auto page = page_va; page < page_va + end; page += 0x1000)
{
if (!is_page_found.load()) // keep scanning until its found if (!is_page_found.load()) // keep scanning until its found
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32)) {
__try
{ {
// if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
// this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking! {
// //
psyscall_func.store((void*)page); // this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking!
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandleA(NULL)); //
auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId())); psyscall_func.store((void*)page);
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandleA(NULL));
if (my_proc_base != my_proc_base_from_syscall) auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId()));
continue;
if (my_proc_base != my_proc_base_from_syscall)
is_page_found.store(true); continue;
return;
is_page_found.store(true);
return;
}
} }
__except (EXCEPTION_EXECUTE_HANDLER) {}
}
}
physmeme::unmap_phys(page_va, end); physmeme::unmap_phys(page_va, end);
} }
} }
@ -77,21 +85,25 @@ namespace physmeme
{ {
if (!is_page_found.load()) if (!is_page_found.load())
{ {
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32)) __try
{ {
// if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
// this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking! {
// //
psyscall_func.store((void*)page); // this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking!
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandle(NULL)); //
auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId())); psyscall_func.store((void*)page);
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandle(NULL));
if (my_proc_base != my_proc_base_from_syscall) auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId()));
continue;
if (my_proc_base != my_proc_base_from_syscall)
is_page_found.store(true); continue;
return;
is_page_found.store(true);
return;
}
} }
__except (EXCEPTION_EXECUTE_HANDLER) {}
} }
} }
physmeme::unmap_phys(page_va, 0x1000 * 512); physmeme::unmap_phys(page_va, 0x1000 * 512);
@ -106,21 +118,25 @@ namespace physmeme
{ {
if (!is_page_found.load()) if (!is_page_found.load())
{ {
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32)) __try
{ {
// if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
// this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking! {
// //
psyscall_func.store((void*)page); // this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking!
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandle(NULL)); //
auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId())); psyscall_func.store((void*)page);
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandle(NULL));
if (my_proc_base != my_proc_base_from_syscall) auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId()));
continue;
if (my_proc_base != my_proc_base_from_syscall)
is_page_found.store(true); continue;
return;
is_page_found.store(true);
return;
}
} }
__except (EXCEPTION_EXECUTE_HANDLER) {}
} }
} }
physmeme::unmap_phys(page_va, remainder); physmeme::unmap_phys(page_va, remainder);

94
physmeme/kernel_ctx/kernel_ctx.cpp
Unescape View File

@ -43,22 +43,30 @@ namespace physmeme
{ {
// scan every page of the physical memory range // scan every page of the physical memory range
for (auto page = page_va; page < page_va + end; page += 0x1000) for (auto page = page_va; page < page_va + end; page += 0x1000)
{
if (!is_page_found.load()) // keep scanning until its found if (!is_page_found.load()) // keep scanning until its found
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32)) {
__try
{ {
// if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
// this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking! {
// //
psyscall_func.store((void*)page); // this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking!
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandleA(NULL)); //
auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId())); psyscall_func.store((void*)page);
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandleA(NULL));
if (my_proc_base != my_proc_base_from_syscall) auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId()));
continue;
if (my_proc_base != my_proc_base_from_syscall)
is_page_found.store(true); continue;
return;
is_page_found.store(true);
return;
}
} }
__except (EXCEPTION_EXECUTE_HANDLER) {}
}
}
physmeme::unmap_phys(page_va, end); physmeme::unmap_phys(page_va, end);
} }
} }
@ -77,21 +85,25 @@ namespace physmeme
{ {
if (!is_page_found.load()) if (!is_page_found.load())
{ {
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32)) __try
{ {
// if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
// this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking! {
// //
psyscall_func.store((void*)page); // this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking!
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandle(NULL)); //
auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId())); psyscall_func.store((void*)page);
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandle(NULL));
if (my_proc_base != my_proc_base_from_syscall) auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId()));
continue;
if (my_proc_base != my_proc_base_from_syscall)
is_page_found.store(true); continue;
return;
is_page_found.store(true);
return;
}
} }
__except (EXCEPTION_EXECUTE_HANDLER) {}
} }
} }
physmeme::unmap_phys(page_va, 0x1000 * 512); physmeme::unmap_phys(page_va, 0x1000 * 512);
@ -106,21 +118,25 @@ namespace physmeme
{ {
if (!is_page_found.load()) if (!is_page_found.load())
{ {
if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32)) __try
{ {
// if (!memcmp(reinterpret_cast<void*>(page), ntoskrnl_buffer + nt_rva, 32))
// this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking! {
// //
psyscall_func.store((void*)page); // this checks to ensure that the syscall does indeed work. if it doesnt, we keep looking!
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandle(NULL)); //
auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId())); psyscall_func.store((void*)page);
auto my_proc_base = reinterpret_cast<std::uintptr_t>(GetModuleHandle(NULL));
if (my_proc_base != my_proc_base_from_syscall) auto my_proc_base_from_syscall = reinterpret_cast<std::uintptr_t>(get_proc_base(GetCurrentProcessId()));
continue;
if (my_proc_base != my_proc_base_from_syscall)
is_page_found.store(true); continue;
return;
is_page_found.store(true);
return;
}
} }
__except (EXCEPTION_EXECUTE_HANDLER) {}
} }
} }
physmeme::unmap_phys(page_va, remainder); physmeme::unmap_phys(page_va, remainder);

Write Preview
Loading…
Cancel
Save