透過MmIsAddressValid看Windows分頁機(jī)制

1、這兩天在逆向分析MmIsAddressValid這個(gè)函數(shù)，學(xué)習(xí)了下PAE分頁機(jī)制,并且也發(fā)現(xiàn)了一個(gè)問題。就是本機(jī)ntoskrnl中導(dǎo)出的MmIsAddressValid函數(shù)是采用非PAE方式的，而本機(jī)XP SP2系統(tǒng)采用的卻是PAE方式的分頁機(jī)制。這個(gè)可以通過windbg中看到。 在這里寫出來與大家分享。關(guān)于PAE (Physical Address Extension 物理地址擴(kuò)展)是 Intel x86 Pentium Pro處理器引入的一種內(nèi)存映射模式。在此模式下CPU可以訪問多達(dá)64GB的物理內(nèi)存。在PAE模式下PDE和PTE為64位，而不是原來的32位。其結(jié)構(gòu)如下：lkd> d

2、t _hardware_ptent!_HARDWARE_PTE +0x000 Valid : Pos 0, 1 Bit +0x000 Write : Pos 1, 1 Bit +0x000 Owner : Pos 2, 1 Bit +0x000 WriteThrough : Pos 3, 1 Bit +0x000 CacheDisable : Pos 4, 1 Bit +0x000 Accessed : Pos 5, 1 Bit +0x000 Dirty : Pos 6, 1 Bit +0x000 LargePage : Pos 7, 1 Bit +0x000 Global : Pos 8,

3、1 Bit +0x000 CopyOnWrite : Pos 9, 1 Bit +0x000 Prototype : Pos 10, 1 Bit +0x000 reserved0 : Pos 11, 1 Bit +0x000 PageFrameNumber : Pos 12, 26 Bits +0x000 reserved1 : Pos 38, 26 Bits +0x000 LowPart : Uint4B +0x004 HighPart : Uint4B以上具體理論部分可以看下intel的v3.System Programming Guide。上面有這兩種分頁方式的介紹。非PAE分頁，理論部

4、分，看圖，分4K 和 4M兩種頁。下面是ida 看到的ntoskrnl.exe中導(dǎo)出的MmIsAddressValid。.text:0040C661 ; BOOLEAN _stdcall MmIsAddressValid(PVOID VirtualAddress).text:0040C661 public MmIsAddressValid.text:0040C661 MmIsAddressValid proc near ; CODE XREF: sub_40D65E+Cp.text:0040C661 ; sub_415459:loc_415470p .text:0040C661.text:00

5、40C661 VirtualAddress = dword ptr 8.text:0040C661.text:0040C661 ; FUNCTION CHUNK AT .text:0041B84E SIZE 00000007 BYTES.text:0040C661 ; FUNCTION CHUNK AT .text:0044A4F2 SIZE 00000019 BYTES.text:0040C661.text:0040C661 mov edi, edi.text:0040C663 push ebp.text:0040C664 mov ebp, esp.text:0040C666 mov ecx

6、, ebp+VirtualAddress.text:0040C669 mov eax, ecx.text:0040C66B shr eax, 14h ; 右移20位.text:0040C66E mov edx, 0FFCh ; 取高10位.text:0040C673 and eax, edx.text:0040C675 sub eax, 3FD00000h ; 加上0xc0300000.text:0040C675 ; PDE = (VA >> 22) << 2 )& 0xffc + 0xc0300000.text:0040C67A mov eax, eax.te

7、xt:0040C67C test al, 1 ; present位.text:0040C67E jz loc_41B84E.text:0040C684 test al, al.text:0040C686 js short loc_40C6AC ; 判斷page size位.text:0040C688 shr ecx, 0Ah ; 右移10位.text:0040C68B and ecx, 3FFFFCh.text:0040C691 sub ecx, 40000000h.text:0040C697 mov eax, ecx ; PTE = (VA >> 12) << 2 )

8、 & 0x3FFFC + 0xc0000000.text:0040C699 mov ecx, eax ; ecx = PTE Context.text:0040C69B test cl, 1 ; 判斷present位.text:0040C69E jz loc_41B84E.text:0040C6A4 test cl, cl.text:0040C6A6 js loc_44A4F2 ; 判斷page size位.text:0040C6AC.text:0040C6AC loc_40C6AC: ; CODE XREF: MmIsAddressValid+25j.text:0040C6AC ;

9、MmIsAddressValid+3DE9Fj.text:0040C6AC mov al, 1.text:0040C6AE.text:0040C6AE loc_40C6AE: ; CODE XREF: MmIsAddressValid+F1EFj.text:0040C6AE pop ebp.text:0040C6AF retn 4.text:0040C6AF MmIsAddressValid endp.text:0040C6AF還原為c代碼為：BOOLEAN MmIsAddressValid ( PVOID VirtualAddress ) BYTE PresentSign = 0x1; BY

10、TE PageSizeSign = 0x80; BYTE PresentAndPageSizeSign = 0x81; PVOID lVirtualAddress; ULONG PDE,PDEContext; ULONG PTE,PTEContext; lVirtualAddress = VirtualAddress; PDE = (ULONG)lVirtualAddress>>22)<<2) & 0xffc + 0xC0300000; PDEContext = (ULONG)*(PVOID)PDE; if(!(PDEContext & PresentS

11、ign) return FALSE; if(PDEContext & PageSizeSign) return TRUE; PTE = (ULONG)lVirtualAddress>>12)<<2) & 0x3FFFc + 0xC0000000; PTEContext = (ULONG)*(PVOID)PTE; if(!(PTEContext & PresentSign ) return FALSE; if(!(PTEContext & PageSizeSign) return TRUE; else PDE = (ULONG)PTE &a

12、mp; 0xffc + 0xc0300000; PDEContext = (ULONG)*(PVOID)PDE; if(PDEContext & PresentAndPageSizeSign) return TRUE; return FALSE;它是非PAE分頁模式.從代碼中得出PDE,PTE的計(jì)算公式為：PDE = (VA >> 22) << 2 ) & 0xffc + 0xc0300000；PTE = (VA >> 12) << 2 ) & 0x3FFFFC + 0xc0000000；PAE分頁，理論部分，看圖，分4K

13、 和 2M兩種頁。接下來看看Windbg中反編譯得到的。lkd> u MmIsAddressValid l 50nt!MmIsAddressValid:80510fa0 8bff mov edi,edi80510fa2 55 push ebp80510fa3 8bec mov ebp,esp80510fa5 51 push ecx ;申請空間 EBP - 480510fa6 51 push ecx ;申請空間 EBP - 880510fa7 8b4d08 mov ecx,dword ptr ebp+8 ; 取參數(shù)，虛擬地址80510faa 56 push esi80510fab 8bc1

14、 mov eax,ecx80510fad c1e812 shr eax,12h ; 右移12H(18位,相當(dāng)于>>21<<3),即線性地址高11位（32- 21）代表頁目錄索引，而頁目錄中每 ; 個(gè)索引占8個(gè)字節(jié)，故該索引在頁目錄中的相對偏移位置是頁目錄索引*8，也就是<<3。找到其 ; PDE 80510fb0 bef83f0000 mov esi,3FF8h ;3FF8H = 11 1111 1111 1 000 ,標(biāo)示取高11位80510fb5 23c6 and eax,esi80510fb7 2d0000a03f sub eax,3FA00000h

15、; 頁目錄對應(yīng)的虛擬地址 0 - 3FA00000 = c0600000h,頁目錄地址 + 原有的eax的偏移 = ; PDE,每個(gè)PDE中有8字節(jié)，代表64位的頁表80510fbc 8b10 mov edx,dword ptr eax ;取PDE低4字節(jié)80510fbe 8b4004 mov eax,dword ptr eax+4 ;取PDE高4字節(jié)80510fc1 8945fc mov dword ptr ebp-4,eax ;暫存80510fc4 8bc2 mov eax,edx80510fc6 57 push edi80510fc7 83e001 and eax,1 ;頁面存在標(biāo)志 P

16、resent位80510fca 33ff xor edi,edi80510fcc 0bc7 or eax,edi80510fce 7461 je nt!MmIsAddressValid+0x91 (80511031) ;如果頁面存在標(biāo)志Present位 = 0，表示該頁沒有加載到對應(yīng)的 ;物理頁面，不是有效地址。80510fd0 bf80000000 mov edi,80h ; 80H = 1000 000080510fd5 23d7 and edx,edi ;取Page size位，Page size位 = 1，表示LargePage 80510fd7 6a00 push 080510fd9

17、 8955f8 mov dword ptr ebp-8,edx 80510fdc 58 pop eax ;EAX = 080510fdd 7404 je nt!MmIsAddressValid+0x43 (80510fe3) ; 最高位 = 0 ，非LargePage80510fdf 85c0 test eax,eax 80510fe1 7452 je nt!MmIsAddressValid+0x95 (80511035) ;最高位 = 1，LargePage的情況，跳轉(zhuǎn)80510fe3 c1e909 shr ecx,9 ;ecx=線性地址,右移9位,相當(dāng)于>>12 <<

18、;3 。即地址中的高20位代表pte偏移，低12位表示屬性80510fe6 81e1f8ff7f00 and ecx,7FFFF8h ;7FFFF8h = 0111 1111 1111 1111 1111 1 000,20位,第31到第12位,即前面20位 80510fec 8b81040000c0 mov eax,dword ptr ecx-3FFFFFFCh; 80510ff2 81e900000040 sub ecx,40000000h ;pte=(VA>>12)<<3) &0x7FFFF8 +0xc0000000; (-0x40000000 means

19、+0xc0000000) 80510ff8 8b11 mov edx,dword ptr ecx ;PTE context80510ffa 8945fc mov dword ptr ebp-4,eax80510ffd 53 push ebx80510ffe 8bc2 mov eax,edx80511000 33db xor ebx,ebx80511002 83e001 and eax,1 ; pte 頁面存在標(biāo)志 Present位80511005 0bc3 or eax,ebx80511007 5b pop ebx80511008 7427 je nt!MmIsAddressValid+0x9

20、1 (80511031);無效位跳轉(zhuǎn)8051100a 23d7 and edx,edi ;edx=pte,edi=80h,取Page size位，Page size位 = 1，表示LargePage8051100c 6a00 push 08051100e 8955f8 mov dword ptr ebp-8,edx ;暫存80511011 58 pop eax80511012 7421 je nt!MmIsAddressValid+0x95 (80511035) ;not LargePage,valid80511014 85c0 test eax,eax ; LargePage80511016

21、 751d jne nt!MmIsAddressValid+0x95 (80511035)80511018 23ce and ecx,esi ;ecx=pte,esi=3FF8h 3FF8H = 11 1111 1111 1 000 ,表示取高11位 2M分頁的情況8051101a 8b89000060c0 mov ecx,dword ptr ecx-3FA00000h ; 0 - 3FA00000 = c0600000h ;ecx = PDE Context80511020 b881000000 mov eax,81h ;判斷Page size位和Present位80511025 23c8

22、and ecx,eax80511027 33d2 xor edx,edx80511029 3bc8 cmp ecx,eax 8051102b 7508 jne nt!MmIsAddressValid+0x95 (80511035)8051102d 85d2 test edx,edx ;not valid8051102f 7504 jne nt!MmIsAddressValid+0x95 (80511035)80511031 32c0 xor al,al80511033 eb02 jmp nt!MmIsAddressValid+0x97 (80511037)80511035 b001 mov a

23、l,180511037 5f pop edi80511038 5e pop esi80511039 c9 leave8051103a c20400 ret 4還原為c的代碼為：BOOLEAN MmIsAddressValid ( PVOID VirtualAddress ) BYTE PresentSign = 0x1; BYTE PageSizeSign = 0x80; BYTE PresentAndPageSizeSign = 0x81; PVOID lVirtualAddress; ULONG PDE,PDEContext; ULONG PTE,PTEContext; lVirtualAddress = VirtualAddress; PDE = (ULONG)lVirtualAddress>>21)<<3) & 0x3FF8 + 0xC0600000; PDEContext = (ULONG)*(PVOID)PDE; if(!(PDEContext & Pre