kd> u MmIsAddressValid
80511990 8bff mov edi,edi
80511992 55 push ebp
80511993 8bec mov ebp,esp
80511995 51 push ecx
80511996 51 push ecx
80511997 8b4d08 mov ecx,dword ptr [ebp+8]//传进来的参数,就是一个地址,假定为address
8051199a 56 push esi
8051199b 8bc1 mov eax,ecx//第几个参数?
8051199d c1e812 shr eax,12h
805119a0 bef83f0000 mov esi,3FF8h
805119a5 23c6 and eax,esi
805119a7 2d0000a03f sub eax,3FA00000h
// PDE==address'=address>>12h+3ff8h-3FA00000h
805119ac 8b10 mov edx,dword ptr [eax]//取得计算后的address地址,address'应该是到达一个结构,去第一项给edx
805119ae 8b4004 mov eax,dword ptr [eax+4]//去第二项给eax
//一系列的换算
805119b1 8945fc mov dword ptr [ebp-4],eax//将第二项送入一个局部变量,假定为param1=[address'+4];
805119b4 8bc2 mov eax,edx
805119b6 57 push edi
805119b7 83e001 and eax,1//eax=[address]+1;,标志Present位
805119ba 33ff xor edi,edi
805119bc 0bc7 or eax,edi//[address']+1为0的话就是无效的地址,;如果页面存在标志Present位 = 0,表示该页没有加载到对应的
805119be 7461 je nt!MmIsAddressValid+0x91 (80511a21)//相等的话就跳到结尾处,置al为0,无效的地址
805119c0 bf80000000 mov edi,80h
805119c5 23d7 and edx,edi//edx=[address]+80h,取Page size位,Page size位 = 1,表示LargePage
805119c7 6a00 push 0
805119c9 8955f8 mov dword ptr [ebp-8],edx//假定为param2=[address']+80h;
805119cc 58 pop eax //eax=0;
805119cd 7404 je nt!MmIsAddressValid+0x43 (805119d3)//跳805119d3,最高位 = 0 ,非LargePage
805119cf 85c0 test eax,eax
805119d1 7452 je nt!MmIsAddressValid+0x95 (80511a25)//地址有效的最高位 = 1 ,LargePage
805119d3 c1e909 shr ecx,9 //ecx为我们传进来的参数address,。即地址中的高20位代表pte偏移,低12位表示属性
805119d6 81e1f8ff7f00 and ecx,7FFFF8h
805119dc 8b81040000c0 mov eax,dword ptr [ecx-3FFFFFFCh]//
805119e2 81e900000040 sub ecx,40000000h //PTE=address''=address>>9+7ffff8h-40000000h,减40000000h就是加0xC0000000
805119e8 8b11 mov edx,dword ptr [ecx] //将address''的地址传给edx edx=[address''] ,PTE context
805119ea 8945fc mov dword ptr [ebp-4],eax //param1=[address>>9-3FFFFFFCh]
805119ed 53 push ebx
805119ee 8bc2 mov eax,edx
805119f0 33db xor ebx,ebx
805119f2 83e001 and eax,1 eax=[address'']+1;, pte 页面存在标志 Present位
805119f5 0bc3 or eax,ebx
805119f7 5b pop ebx // [address'']+1为0的话就无效 标志 Present位不存在无效
805119f8 7427 je nt!MmIsAddressValid+0x91 (80511a21)//无效
805119fa 23d7 and edx,edi edx=[address'']+80h
805119fc 6a00 push 0
805119fe 8955f8 mov dword ptr [ebp-8],edx // param2=[address'']+80h
80511a01 58 pop eax // eax与edx相比较
80511a02 7421 je nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a04 85c0 test eax,eax //还是跳、、
80511a06 751d jne nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a08 23ce and ecx,esi
805119fc 6a00 push 0
805119fe 8955f8 mov dword ptr [ebp-8],edx
80511a01 58 pop eax
80511a02 7421 je nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a04 85c0 test eax,eax
80511a06 751d jne nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a08 23ce and ecx,esi
80511a0a 8b89000060c0 mov ecx,dword ptr [ecx-3FA00000h]
80511a10 b881000000 mov eax,81h
80511a15 23c8 and ecx,eax
80511a17 33d2 xor edx,edx
80511a19 3bc8 cmp ecx,eax
80511a1b 7508 jne nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a1d 85d2 test edx,edx
80511a1f 7504 jne nt!MmIsAddressValid+0x95 (80511a25)//有效
80511a21 32c0 xor al,al
80511a23 eb02 jmp nt!MmIsAddressValid+0x97 (80511a27)
80511a25 b001 mov al,1
80511a27 5f pop edi
80511a28 5e pop esi
80511a29 c9 leave
80511a2a c20400 ret 4
80511a2d cc int 3
80511a2e cc int 3
80511a2f cc int 3
80511a30 cc int 3
80511a31 cc int 3
PAE模式
int PDE = ((lVirtualAddress>>21)<<3) & 0x3FF8 + 0xC0600000;
int PTE = ((lVirtualAddress>>12)<<3) & 0x7FFFF8 + 0xC0000000;
//从网上找的一个C代码
BOOLEAN MmIsAddressValid ( PVOID VirtualAddress )
{
BYTE PresentSign = 0x1;
BYTE PageSizeSign = 0x80;
BYTE PresentAndPageSizeSign = 0x81;
PVOID lVirtualAddress;
ULONG PDE,PDEContext;
ULONG PTE,PTEContext;
lVirtualAddress = VirtualAddress;
PDE = (((ULONG)lVirtualAddress>>21)<<3) & 0x3FF8 + 0xC0600000;
PDEContext = (ULONG)*(PVOID)PDE;
if(!(PDEContext & PresentSign))
return FALSE;
if(PDEContext & PageSizeSign)
return TRUE;
PTE = (((ULONG)lVirtualAddress>>12)<<3) & 0x7FFFF8 + 0xC0000000;
PTEContext = (ULONG)*(PVOID)PTE;
if(!(PTEContext & PresentSign ))
return FALSE;
if(!(PTEContext & PageSizeSign))
return TRUE;
else
{
PDE = (ULONG)PTE & 0x3ff8 + 0xc0600000;
PDEContext = (ULONG)*(PVOID)PDE;
if(PDEContext & PresentAndPageSizeSign)
return TRUE;
}
return FALSE;
}
kd> !pte
VA 00000000
PDE at 00000000C0600000 PTE at 00000000C0000000
contains 0000000002C80067 contains 0000000000000000
pfn 2c80 ---DA--UWEV