(实验) 给地址0挂上物理页，实现可读可写

原理图

直接上代码

#include "stdafx.h"
#include <windows.h>

DWORD* pPDE1=NULL;
DWORD* pPTE1=NULL;
DWORD* pPDE2=NULL;
DWORD* pPTE2=NULL;
DWORD vPDI;
DWORD vPTI;

void __declspec(naked) function()
{
	__asm
	{
		pushad
		pushfd
		mov eax,[esp + 0x24 + 0x8 + 0x0]//arg1
		mov dword ptr vPDI,eax
		mov eax,[esp + 0x24 + 0x8 + 0x4]//arg2
		mov dword ptr vPTI,eax
	}
	pPDE1=(DWORD*)(0xC0300000 + 0x4 * vPDI); //
	pPDE2=(DWORD*)(0xC0300000 + 0x4 * 0); // 0x00000000
	if ((*pPDE2 & 0x1) == 0)
	{
		//PDE
		*pPDE2 = *pPDE1;
		pPTE1=(DWORD*)(0xC0000000 + 0x1000 * vPDI + 0x4 * vPTI); //
		pPTE2=(DWORD*)(0xC0000000 + 0x1000 * 0 + 0x4 * 0); // 0x00000000
		//PTE
		*pPTE2 = *pPTE1;
	}
	else
	{
		pPTE1=(DWORD*)(0xC0000000 + 0x1000 * vPDI + 0x4 * vPTI); //
		pPTE2=(DWORD*)(0xC0000000 + 0x1000 * 0 + 0x4 * 0); // 0x00000000
		//PTE
		*pPTE2 = *pPTE1;
	}
	__asm
	{
		popfd
		popad
		retf 0x8
	}
}

int main(int argc, char* argv[])
{
	int x = 0x12345678;
	int param1 = ((int)&x >> 22); //PDI
	int param2 = ((int)&x << 10) >> 22;//PTI 
	printf("x address is : %08x\n",&x);
	printf("x address PDI is : %08x\n",param1);
	printf("x address PTI is : %08x\n",param2);
	char buffer[6] = {0,0,0,0,0xb0,0};
	__asm
	{
		push param2 //arg2
	    push param1 //arg1
		call fword ptr [buffer]
	}
	printf("%08x\n",vPDI);
	printf("%08x\n",vPTI);
	int* ptr = (int*)0; 
	printf("0 adderss value is : %08x\n",*ptr);//read
	*ptr = 0x12345678;//write
	printf("0 adderss value is : %08x\n",*ptr);
	return 0;
}

结果