【随手写】Windows内核学习-内存篇-打印VAD树

#include <ntddk.h>

NTSTATUS PsLookupProcessByProcessId(
	IN HANDLE    ProcessId,
	OUT PEPROCESS* Process
);

typedef struct {
	ULONG CommitCharge : 19;
	ULONG PhysicalMapping : 1;
	ULONG ImageMap : 1;
	ULONG UserPhysicalPages : 1;
	ULONG NoChange : 1;
	ULONG WriteWatch : 1;
	ULONG Protection : 5;
	ULONG LargePages : 1;
	ULONG MemCommit : 1;
	ULONG PrivateMemory : 1;
}MMVAD_FLAGS,*PMMVAD_FLAGS;

typedef struct {
	PUINT32 StartingVpn;
	PUINT32 EndingVpn;
	PUINT32 Parent;
	PUINT32 LeftChild;
	PUINT32 RightChild;
	MMVAD_FLAGS VadFlags;
	PUINT32 ControlArea;
	PUINT32 FirstPrototypePte;
	PUINT32 LastContiguousPte;
	PUINT32 u2;
}MMVAD,*PMMVAD;

VOID printTab(INT count) {
	for (size_t i = 0; i < count; i++)
	{
		DbgPrint("\t");
	}
}

VOID PrintVadRoot(PMMVAD vad,INT depth) {
	if (!vad) {
		return;
	}

	printTab(depth);
	DbgPrint("VAD: 『%#X』\n", vad);

	printTab(depth);
	DbgPrint("—StartingVpn：『%#X』\n", vad->StartingVpn);

	printTab(depth);
	DbgPrint("—EndingVpn：『%#X』\n", vad->EndingVpn);

	printTab(depth);
	DbgPrint("—MemCommit：『%d』\n", (&vad->VadFlags)->CommitCharge);

	printTab(depth);
	DbgPrint("—Protection：『%d』\n", (&vad->VadFlags)->Protection);

	printTab(depth);
	DbgPrint("—Parent：『%#X』\n", vad->Parent);

	printTab(depth);
	DbgPrint("—LeftChild：『%#X』\n", vad->LeftChild);
	PrintVadRoot(vad->LeftChild, depth + 1);

	printTab(depth);
	DbgPrint("—RightChild：『%#X』\n", vad->RightChild);
	PrintVadRoot(vad->RightChild, depth + 1);
	
}



NTSTATUS UnloadDriver(PDRIVER_OBJECT DriverObject)
{
	DbgPrint("驱动卸载成功\n");
	return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
	DriverObject->DriverUnload = UnloadDriver;
	DbgPrint("驱动已成功加载\n");


	UINT32 pid = 244;
	PCHAR eProcess = 0;
	PsLookupProcessByProcessId(pid, &eProcess);
	if (!eProcess) {
		DbgPrint("GG");
		return STATUS_SUCCESS;
	}
	PMMVAD VadRoot = *(PUINT32)(eProcess + 0x11c);
	if (!VadRoot) {
		DbgPrint("GGV");
		return STATUS_SUCCESS;
	}
	DbgPrint("EProcess -> %#X\n", eProcess);
	DbgPrint("VadRoot -> %#X\n", VadRoot);
	INT depth = 0;
	PMMVAD parent = VadRoot;
	while (parent->Parent != 0) {
		depth++;
		parent = parent->Parent;
	}
	PrintVadRoot(VadRoot,depth);

	return STATUS_SUCCESS;
}