Book note _ windows mixed HOOK _ part 4 _ use MDL to modify the memory Protection Mechanism

Source: Internet
Author: User

 

MDL (Memory Descriptor List) refers to the Memory Descriptor table, which contains the starting address, owner process, number of bytes, and flag of the Memory region. The MDL structure is defined in ntddk. h. The specific structure is as follows:

Typedef struct _ MDL {

Struct _ MDL * Next;

CSHORT Size;

CSHORT MdlFlags;

Struct _ EPROCESS * Process;

PVOID MappedSystemVa;

PVOID StartVa;

ULONG ByteCount;

ULONG ByteOffset;

} MDL, * PMDL;

To modify the memory flag, you need to declare a structure that is used to forcibly convert the type of the KeServiceDescriptorTable variable exported by the Windows Kernel. The structure is as follows:

Typedef struct ServiceDescriptorEntry {

Unsigned int * ServiceTableBase;

Unsigned int * ServiceCounterTableBase; // Used only in checked build

Unsigned int NumberOfServices;

Unsigned char * paramtablebase;

} Servicedescriptortableentry_t, * pservicedescriptortableentry_t;

 

 

The source code in Rootkits is as follows. Although it can be compiled and executed in windows XP, some of the functions are outdated and new functions are replaced. The descriptions are as follows:

G_pmdlsystemcall = mmcreatemdl (null, keservicedescriptortable. servicetablebase, keservicedescriptortable. numberofservices * 4 );

If (! G_pmdlsystemcall)

Return status_unsuccessful;

Mmbuildmdlfornonpagedpool (g_pmdlsystemcall );

// Change the flags of the MDL

G_pmdlsystemcall-> mdlflags = g_pmdlsystemcall-> mdlflags | mdl_mapped_to_system_va;

Mappedsystemcalltable = mmmaplockedpages (g_pmdlsystemcall, kernelmode );

 

 

The MmCreateMdl function is defined as follows:

PMDL
MmCreateMdl (
IN PMDL
 MemoryDescriptorListOPTIONAL,
IN PVOID
 Base,
IN SIZE_T
Length
);

The new function is

PMDL
IoAllocateMdl (
_ In_opt PVOID
VirtualAddress,
_ In ULONG
Length,
_ In BOOLEAN
SecondaryBuffer,
_ In BOOLEAN
ChargeQuota,
_ Inout_opt PIRP
IrpOPTIONAL
);

 

IoAllocateMdl is used to allocate an MDL structure, that is, to map a piece of memory space of the system to another place, modify the protection attribute of this part of memory, and modify its content, to modify the protected memory. The first parameter is the start address of the MDL memory, and the second parameter is the MDL length.

Because the MDL created by IoAllocateMdl is directed to the buffer of the non-Paging virtual memory, the MmBuildMdlForNonPagedPool function is required to update the MDL in the physical memory.

 

The MmMapLocakedPages function is defined as follows:

PVOID
MmMapLockedPages (
IN PMDL
 MemoryDescriptorList,
IN KPROCESSOR_MODE
AccessMode
);

The new function is MmMapLockedPagesSpecifyCache, which is defined

PVOID
MmMapLockedPagesSpecifyCache (
_ In PMDLX
MemoryDescriptorList,
_ In KPROCESSOR_MODE
AccessMode,
_ In MEMORY_CACHING_TYPE
CacheType,
_ In_opt PVOID
BaseAddress,
_ In ULONG
BugCheckOnFailure,
_ In MM_PAGE_PRIORITY
Priority
);

It is used to lock the MDL page in the memory and allow users to modify its attributes.

The Code modified after using the new function is as follows:

// G_pmdlsystemcall = mmcreatemdl (null, keservicedescriptortable. servicetablebase, // keservicedescriptortable. numberofservices * 4 );

G_pmdlsystemcall = ioallocatemdl (keservicedescriptortable. servicetablebase, keservicedescriptortable. numberofservices * 4, false, false, null );

If (! G_pmdlsystemcall)

Return status_unsuccessful;

Mmbuildmdlfornonpagedpool (g_pmdlsystemcall );

// Change the flags of the MDL

// Mappedsystemcalltable = mmmaplockedpages (g_pmdlsystemcall, kernelmode );

Mappedsystemcalltable = mmmaplockedpagesspecifycache (g_pmdlsystemcall, kernelmode, mmwritecombined, null, false, 0 );

MappedSystemCallTable = MmMapLockedPages (g_pmdlSystemCall, KernelMode );

 

 

 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.