Paging Table Manipulation From Usermode
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
xerox 577cbd52ed
when destroying mem_ctx, dont use vdm_ctx to do so, also yeild execution
4 years ago
nasa-tables when destroying mem_ctx, dont use vdm_ctx to do so, also yeild execution 4 years ago
LICENSE init commit 4 years ago
README.md Update README.md 4 years ago
nasa-tables.sln init commit 4 years ago

README.md

credit

  • buck - inspiration for most of this.
  • Ch40zz - helping me connect the dots.

nasa-tables

paging table manipulation from user-mode. operations such as getting and setting all paging table entries and values are offered. the code is aware of large pages and allows the programmer to allocate 2mb pages if needed (without going through all of the shenanigans of breaking a 2mb page down over a new PT handled by the user).

Please disable spectra/meltdown since this patch creates two sets of PML4's per process (which i dont support). Link to write up can be found here.

example

vdm::vdm_ctx vdm;
nasa::mem_ctx my_proc(vdm);

const auto ntoskrnl_base =
    reinterpret_cast<void*>(
	    util::get_kmodule_base("ntoskrnl.exe"));

const auto ntoskrnl_pde = my_proc.get_pde(ntoskrnl_base);
std::printf("[+] pde.present -> %d\n", ntoskrnl_pde.second.present);
std::printf("[+] pde.pfn -> 0x%x\n", ntoskrnl_pde.second.pfn);
std::printf("[+] pde.large_page -> %d\n", ntoskrnl_pde.second.large_page);
[+] pde.present -> 1
[+] pde.pfn -> 0x10400
[+] pde.large_page -> 1
[+] press any key to close...

table entry manipulation

  • get/set pml4e's
  • get/set pdpte's
  • get/set pde's
  • get/set pte's

table manipulation

  • copy table
  • make self referencing table.

virtual memory

  • convert virtual addresses to physical addresses
  • get table entries for a given address
  • change table entries for a given address