保护模式测试

工具:VC 6 WinDbg

第一题

//注意点:下面采用的都是PAE分页(2-9-9-12)
公式:
PDE = ((dwAddr>>21)<<3) & 0x3FF8 + 0xC0600000 ; //2 + 9
PTE = ((dwAddr>>12)<<3) & 0x7FFFF8 + 0xC0000000;// 2 + 9 + 9
第一题难点在于计算PDE PTE

#include "stdafx.h"
#include <Windows.h>
#include <malloc.h>
void Judge();
BOOL bRet;
DWORD dwPDI;
DWORD dwPTI;
BOOL ReadMemory(OUT PBYTE buffer,IN DWORD dwAddr,IN DWORD dwLength){
	//容器为下面的复制数据做准备
	DWORD tempAddr = dwAddr;
	DWORD tempLength = dwLength;
	do{
	//要考虑是否跨页
		dwPDI = ((dwAddr>>21)<<3) & 0x3FF8;
		dwPDI += 0xC0600000;
		dwPTI = ((dwAddr>>12)<<3) & 0x7FFFF8;
		dwPTI += 0xC0000000;
		printf("addr:%x PDE:%x PTE:%x",dwAddr,dwPDI,dwPTI);
		Judge();
		dwLength -= 0x1000;
		dwAddr += 0x1000;
	}while((dwAddr&0xFFF + dwLength) > 0x1000);
	if(bRet == NULL){
		return FALSE;
	}
	if(!memcpy(buffer,(PBYTE)tempAddr,tempLength)){
		printf("memcpy faild\n");
		return FALSE;
	}
	printf("ReadMemory Sucessed\n");
	return TRUE;
}

void Judge(){
	char buffer[6] = {0};	
	*(PDWORD)&buffer[0] = 0x12345678;
	*(PWORD)&buffer[4] = 0x48;
	//调用门提权 在WinDbg里输入eq 8003f048 0040EC00`00081090
	__asm{
		call fword ptr[buffer]
	}
	printf(" Ret:%x\n",bRet);
}
//test() 顾名思义 汇编指令里的test
void __declspec(naked) test(){
	__asm{
		pushad	
		pushfd
		
		xor eax,eax
		mov bRet,eax
		
		mov eax,dwPDI
		mov eax,[eax]
		test eax,1
		jz end
		
		mov eax,dwPTI
		mov eax,[eax]
		test eax,1
		jz end
		mov eax,1
		mov bRet,eax
end:
		popfd
		popad
		retf
	}
}

int main(int argc, char* argv[])
{
	DWORD b = 0x1000;
	PBYTE a = (PBYTE)malloc(0x1000);
	memset(a,0,1000);
	ReadMemory(a,(DWORD)&b,4);
	return 0;
}

第二题

如果第一题熟悉了那么第二题就是简简单单的挂页
0x00000000 - 0x0000FFFF(可能有错) 防止空指针 我们挂上物理页就可以访问了

#include "stdafx.h"
#include <Windows.h>
#include <malloc.h>
void Judge();
DWORD dwSelfPTE;
DWORD dwTargetPTE;
void CallGate(){
//调用门提权 在WinDbg里输入eq 8003f048 0040EC00`00081090
	char buffer[6] = {0};	
	*(PDWORD)&buffer[0] = 0x12345678;
	*(PWORD)&buffer[4] = 0x48;
	__asm{
		call fword ptr[buffer]
	}
}

void __declspec(naked) test(){
	__asm{
		pushad	
		pushfd
		
		mov eax,dwSelfPTE
		mov ecx,dwTargetPTE

		mov eax,[eax]
		mov [ecx],eax
		
		popfd
		popad
		retf
	}
}

int main(int argc, char* argv[])
{
	DWORD dwAddr = 0x1000;

	PDWORD pArr = (PDWORD)VirtualAlloc(0,400,MEM_COMMIT,PAGE_READWRITE);
	if(!pArr){
		printf("VirtualAlloc faild\n");
		return 0;
	}
	for(int i = 0;i < 100;i++){
		*pArr = (DWORD)pArr;
		pArr++;
	}

	dwSelfPTE = (((DWORD)pArr>>12)<<3) & 0x7FFFF8;
	dwSelfPTE += 0xC0000000;
	dwTargetPTE = ((dwAddr>>12)<<3) & 0x7FFFF8;
	dwTargetPTE += 0xC0000000;
	printf("pArr:%x dwAddr:%x\n",pArr,dwAddr);
	printf("dwSelfPTE:%x dwTargetPTE:%x\n",dwSelfPTE,dwTargetPTE);
	CallGate();
	
	for(int j=0;j<100;j++){
		printf("%x:%x\n",dwAddr,*((PDWORD)dwAddr));
		dwAddr += 4;
	}

	getchar();
	return 0;
}