nt!MmMapViewInSystemCache函數分析PointerPte的填充

第一部分：

1: kd> kc
?#
00 nt!MmMapViewInSystemCache
01 nt!CcGetVacbMiss
02 nt!CcGetVirtualAddress
03 nt!CcMapData
04 Ntfs!NtfsMapStream
05 Ntfs!NtfsReadBootSector
06 Ntfs!NtfsMountVolume
07 Ntfs!NtfsCommonFileSystemControl
08 Ntfs!NtfsFspDispatch
09 nt!ExpWorkerThread
0a nt!PspSystemThreadStartup
0b nt!KiThreadStartup

1: kd> p
nt!MmMapViewInSystemCache+0x32b:
80aaf01d 8b0e??????????? mov???? ecx,dword ptr [esi]
1: kd> dv
??? SectionToMap = 0xe127a740
??? CapturedBase = 0x89988000
?? SectionOffset = 0xf78d6900 {-9175257283469246464}
CapturedViewSize = 0x00000040
?????? PteOffset = 0
?????? LastProto = 0x00000000
???? PteContents = struct _MMPTE
???????? OldIrql = 0x00 ''
???????? LastPte = 0x89988000
?? LastPteOffset = 0x40
????????? Waited = 1
??????? ProtoPte = 0xf78d6900
?? NumberOfPages = 0x40

??? if (PointerPte->u.List.NextEntry == MM_EMPTY_PTE_LIST) {

??? if ((PointerPte + 1)->u.List.NextEntry == (KeReadTbFlushTimeStamp() & MM_FLUSH_COUNTER_MASK)) {
??????? KeFlushEntireTb (TRUE, TRUE);
??? }

第二部分：

1: kd> p
nt!MmMapViewInSystemCache+0x355:
80aaf047 8b4e04????????? mov???? ecx,dword ptr [esi+4]
1: kd> r
eax=00001314 ebx=898ff908 ecx=c10c0000 edx=00000000 esi=c0304200

1: kd> dd c0304200
c0304200? c10c0000 00000000 00000000 00000000

??? //
??? // Zero this explicitly now since the number of pages may be only 1.
??? //

??? (PointerPte + 1)->u.List.NextEntry = 0;

1: kd> p
nt!MmMapViewInSystemCache+0x36d:
80aaf05f 816604ff0f0000? and???? dword ptr [esi+4],0FFFh

1: kd> r
eax=00001314 ebx=898ff908 ecx=00000000 edx=00000000 esi=c0304200 edi=00000000

第三部分：

??? *CapturedBase = MiGetVirtualAddressMappedByPte (PointerPte);?? ??? ?c1080000

#define MiGetVirtualAddressMappedByPte(PTE) ((PVOID)((ULONG)(PTE) << 10))

c0304200

1100 0000 0011 0000 0100 0010 0000 0000
11 0000 0100 0010 0000 0000 00 0000 0000 ?

11 00?? ?00 01?? ?00 00?? ?10 00?? ?00 00?? ?00 00 0000 0000
c1080000

1: kd> !pte c1080000
???????????????? VA c1080000
PDE at C0300C10???????? PTE at C0304200
contains 0A03F963?????? contains C10C0000
pfn a03f? -G-DA--KWEV?? not valid
???????????????????????? Page has been freed

第四部分：

回顧PointerPte的由來：

??? PointerPte = MmFirstFreeSystemCache;

??? //
??? // Update next free entry.
??? //

??? ASSERT (PointerPte->u.Hard.Valid == 0);

??? MmFirstFreeSystemCache = MmSystemCachePteBase + PointerPte->u.List.NextEntry;
??? ASSERT (MmFirstFreeSystemCache <= MiGetPteAddress (MmSystemCacheEnd));

1: kd> p
nt!MmMapViewInSystemCache+0x377:
80aaf069 8bc6??????????? mov???? eax,esi
1: kd> p
nt!MmMapViewInSystemCache+0x379:
80aaf06b c1e00a????????? shl???? eax,0Ah
1: kd> r
eax=c0304200

1: kd> dv
??? SectionToMap = 0xe127a740
??? CapturedBase = 0x89988000

1: kd> dx -r1 ((ntkrnlmp!void * *)0x89988000)
((ntkrnlmp!void * *)0x89988000)???????????????? : 0x89988000 [Type: void * *]
??? 0xc1080000

1: kd> !pte 0xc1080000
???????????????? VA c1080000
PDE at C0300C10???????? PTE at C0304200
contains 0A03F963?????? contains C10C0000
pfn a03f? -G-DA--KWEV?? not valid
???????????????????????? Page has been freed

1: kd> x nt!MmFirstFreeSystemCache
80b23594????????? nt!MmFirstFreeSystemCache = 0xc0304300

1: kd> dd 0xc0304200?? ??? ?//0xc0304200下一個是0xc0304300
c0304200? c10c0000

304300
0011 0000 0100 0011 0000 0000
0011 0000 0100 0011 0000 00
00?? ?11 00?? ?00 01?? ?00 00?? ?11 00?? ?00 00
c10c0?? ??? ?//正確

1: kd> dd 0xc0304200
c0304200? c10c0000 00000000 00000000 00000000
c0304210? 00000000 00000000 00000000 00000000

第五部分：

1: kd> dt subsection 0x898ff8d8+30
nt!SUBSECTION
?? +0x000 ControlArea????? : 0x898ff8d8 _CONTROL_AREA
?? +0x004 u??????????????? : __unnamed
?? +0x008 StartingSector?? : 0
?? +0x00c NumberOfFullSectors : 0x100
?? +0x010 SubsectionBase?? : 0xe1009c00 _MMPTE
?? +0x014 UnusedPtes?????? : 0
?? +0x018 PtesInSubsection : 0x100
?? +0x01c NextSubsection?? : (null)

?????? PteOffset = 0

??? ProtoPte = &Subsection->SubsectionBase[PteOffset];?? ??? ?=0xe1009c00

1: kd> p
nt!MmMapViewInSystemCache+0x384:
80aaf076 8d0c88????????? lea???? ecx,[eax+ecx*4]
1: kd> r
eax=e1009c00 ebx=898ff908 ecx=00000000 edx=00000000 esi=c0304200 edi=00000000
eip=80aaf076 esp=f78d6910 ebp=f78d6930 iopl=0???????? nv up ei ng nz na pe nc
cs=0008? ss=0010? ds=0023? es=0023? fs=0030? gs=0000???????????? efl=00000286
nt!MmMapViewInSystemCache+0x384:
80aaf076 8d0c88????????? lea???? ecx,[eax+ecx*4]
1: kd> p
nt!MmMapViewInSystemCache+0x387:
80aaf079 894d10????????? mov???? dword ptr [ebp+10h],ecx
1: kd> r
eax=e1009c00 ebx=898ff908 ecx=e1009c00 edx=00000000 esi=c0304200 edi=00000000

1: kd> dv
??? SectionToMap = 0xe127a740
?
??????? ProtoPte = 0xe1009c00?? ??? ?//正確

第六部分：

??? LastProto = &Subsection->SubsectionBase[Subsection->PtesInSubsection];

?? +0x018 PtesInSubsection : 0x100

0xe1009c00+0x100*4=

1: kd> ?0xe1009c00+0x100*4
Evaluate expression: -520052736 = e100a000

1: kd> dv
??? SectionToMap = 0xe127a740

?????? LastProto = 0xe100a000

??? LastPte = PointerPte + NumberOfPages;?? ?eax=c0304300

0xc0304200+0x40*4=
1: kd> ?0xc0304200+0x40*4
Evaluate expression: -1070578944 = c0304300

1: kd> p
nt!MmMapViewInSystemCache+0x396:
80aaf088 8d0486????????? lea???? eax,[esi+eax*4]
1: kd> r
eax=00000040 ebx=898ff908 ecx=00000100 edx=00000000 esi=c0304200 edi=00000000
eip=80aaf088 esp=f78d6910 ebp=f78d6930 iopl=0???????? nv up ei ng nz na pe nc
cs=0008? ss=0010? ds=0023? es=0023? fs=0030? gs=0000???????????? efl=00000286
nt!MmMapViewInSystemCache+0x396:
80aaf088 8d0486????????? lea???? eax,[esi+eax*4]
1: kd> p
nt!MmMapViewInSystemCache+0x399:
80aaf08b 8d7e08????????? lea???? edi,[esi+8]
1: kd> r
eax=c0304300

第七部分：

??? while (PointerPte < LastPte) {

??????? if (ProtoPte >= LastProto) {

??????????? //
??????????? // Handle extended subsections.
??????????? //

??????????? Subsection = Subsection->NextSubsection;
??????????? ProtoPte = Subsection->SubsectionBase;
??????????? LastProto = &Subsection->SubsectionBase[
??????????????????????????????????????? Subsection->PtesInSubsection];
??????? }
??????? PteContents.u.Long = MiProtoAddressForKernelPte (ProtoPte);
??????? MI_WRITE_INVALID_PTE (PointerPte, PteContents);

??????? ASSERT (((ULONG_PTR)PointerPte & (MM_COLOR_MASK << PTE_SHIFT)) ==
???????????????? (((ULONG_PTR)ProtoPte & (MM_COLOR_MASK << PTE_SHIFT))));

??????? PointerPte += 1;
??????? ProtoPte += 1;
??? }

??? ProtoPte = &Subsection->SubsectionBase[PteOffset];?? ??? ?=0xe1009c00

#define MiProtoAddressForKernelPte(proto_va)? MiProtoAddressForPte(proto_va)

#define MiProtoAddressForPte(proto_va)? \
?? ((((((ULONG)proto_va - MmProtopte_Base) >> 1) & (ULONG)0x000000FE)?? | \
??? (((((ULONG)proto_va - MmProtopte_Base) << 2) & (ULONG)0xfffff800))) | \
??? MM_PTE_PROTOTYPE_MASK)

#define MM_PTE_PROTOTYPE_MASK???? 0x400

#define MmProtopte_Base ((ULONG)MmPagedPoolStart)
1: kd> x nt!MmPagedPoolStart
80b15028????????? nt!MmPagedPoolStart = 0xe1000000

1: kd> !pte 0xe1009c00
???????????????? VA e1009c00
PDE at C0300E10???????? PTE at C0384024
contains 0A1C0963?????? contains 0A1CD963
pfn a1c0? -G-DA--KWEV?? pfn a1cd? -G-DA--KWEV

9c00

1001 1100 0000 0000
1001 1100 0000 000

1001 110?? ?0 000?? ?0 000
?? ?1 111?????? 1 110

1001 1100 0000 0000 00

10?? ?01 11?? ?00 00?? ?00 00?? ?00 00
27000

27400

第八部分：

??????? PteContents.u.Long = MiProtoAddressForKernelPte (ProtoPte);?? ?//關鍵地方1：

1: kd> p
nt!MmMapViewInSystemCache+0x3ee:
80aaf0e0 8b4510????????? mov???? eax,dword ptr [ebp+10h]
1: kd> p
nt!MmMapViewInSystemCache+0x3f1:
80aaf0e3 2b052850b180??? sub???? eax,dword ptr [nt!MmPagedPoolStart (80b15028)]
1: kd> r
eax=e1009c00

1: kd> p
nt!MmMapViewInSystemCache+0x411:
80aaf103 894d08????????? mov???? dword ptr [ebp+8],ecx
1: kd> r
eax=00027000 ebx=898ff908 ecx=00027400

第九部分：

??????? MI_WRITE_INVALID_PTE (PointerPte, PteContents);?? ?//關鍵地方2：

1: kd> p
nt!MmMapViewInSystemCache+0x506:
80aaf1f8 8906??????????? mov???? dword ptr [esi],eax
1: kd> r
eax=00027400 ebx=898ff908 ecx=f78d6920 edx=e7f77906 esi=c0304200 edi=80b79030

1: kd> dd 0xc0304200
c0304200? 00027400 00000000 00000000 00000000
c0304210? 00000000 00000000 00000000 00000000
c0304220? 00000000 00000000 00000000 00000000
c0304230? 00000000 00000000 00000000 00000000
c0304240? 00000000 00000000 00000000 00000000
c0304250? 00000000 00000000 00000000 00000000
c0304260? 00000000 00000000 00000000 00000000
c0304270? 00000000 00000000 00000000 00000000

1: kd> !pte 0xc0304200
???????????????? VA c1080000
PDE at C0300C10???????? PTE at C0304200
contains 0A03F963?????? contains 00027400
pfn a03f? -G-DA--KWEV?? not valid
???????????????????????? Proto: E1009C00

第十部分：

1: kd> dd 0xc0304200
c0304200? 00027400 00027402

1: kd> !pte 0xc0304204
???????????????? VA c1081000
PDE at C0300C10???????? PTE at C0304204
contains 0A03F963?????? contains 00027402
pfn a03f? -G-DA--KWEV?? not valid
???????????????????????? Proto: E1009C04

??????? ProtoPte = 0xe1009c08

第十一部分：

1: kd> dd 0xc0304200
c0304200? 00027400 00027402 00027404 00000000

1: kd> dd 0xc0304200
c0304200? 00027400 00027402 00027404 00027406
c0304210? 00027408 0002740a 0002740c 0002740e
c0304220? 00027410 00027412 00027414 00027416
c0304230? 00027418 0002741a 0002741c 0002741e
c0304240? 00027420 00027422 00027424 00027426
c0304250? 00027428 0002742a 0002742c 0002742e
c0304260? 00027430 00027432 00027434 00027436
c0304270? 00027438 0002743a 0002743c 0002743e

dv
??????? ProtoPte = 0xe1009c80

1: kd> dd 0xc0304200+80
c0304280? 00027440 00027442 00027444 00027446
c0304290? 00027448 0002744a 0002744c 0002744e
c03042a0? 00027450 00027452 00027454 00027456
c03042b0? 00027458 0002745a 0002745c 0002745e
c03042c0? 00027460 00027462 00027464 00027466
c03042d0? 00027468 0002746a 0002746c 0002746e
c03042e0? 00027470 00027472 00027474 00027476
c03042f0? 00027478 0002747a 0002747c 0002747e

??????? ProtoPte = 0xe1009cfc

1: kd> dd 0xe1009c00
e1009c00? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009c10? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009c20? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009c30? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009c40? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009c50? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009c60? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009c70? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
1: kd> dd 0xe1009c00+80
e1009c80? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009c90? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009ca0? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009cb0? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009cc0? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009cd0? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009ce0? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2
e1009cf0? fcfe94c2 fcfe94c2 fcfe94c2 fcfe94c2

1: kd> p
nt!MmMapViewInSystemCache+0x50f:
80aaf201 3b750c????????? cmp???? esi,dword ptr [ebp+0Ch]
1: kd> r
eax=0002747e ebx=898ff908 ecx=f78d6920 edx=e7f77906 esi=c0304300 edi=80b88f00
eip=80aaf201 esp=f78d6910 ebp=f78d6930 iopl=0???????? nv up ei ng nz ac pe nc
cs=0008? ss=0010? ds=0023? es=0023? fs=0030? gs=0000???????????? efl=00000296
nt!MmMapViewInSystemCache+0x50f:
80aaf201 3b750c????????? cmp???? esi,dword ptr [ebp+0Ch] ss:0010:f78d693c=c0304300
1: kd> dd f78d6930+c
f78d693c? c0304300