win10以后，很多全局变量都没了，例如MmNonPagedPoolStart 之类的，如何能够快速定位到某个地址在某个范围之内。长话短说，直接上函数 int64 MiGetSystemRegionType(ULONGLONG virtualaddress) { if ( virtualaddress < 0xFFFF800000000000 ) return 0i64; else return (unsigned __int8)byte_140C4F748[((virtualaddress >> 0x27) & 0x1FF) - 0x100]; } if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } windbg 查看 fffff800`0e620a0a 483bc8 cmp rcx,rax fffff800`0e620a0d 721d jb nt!MiGetSystemRegionType+0x2c (fffff800`0e620a2c) fffff800`0e620a0f 48c1e927 shr rcx,27h fffff800`0e620a13 81e1ff010000 and ecx,1FFh fffff800`0e620a19 8d8100ffffff lea eax,[rcx-100h] fffff800`0e620a1f 488d0d62eea200 lea rcx,[nt!MiState+0x3108 (fffff800`0f04f888)] fffff800`0e620a26 0fb60408 movzx eax,byte ptr [rax+rcx] fffff800`0e620a2a c3 ret if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } byte_140C4F748 是 nt!MiState+0x3108 不得不提一嘴， win10以后内存相关的巨多变量都与 nt!MiState相关， nt!MiState 这个类型是 _MI_SYSTEM_INFORMATION ,直接展开， vs结构成员大概长这样 [+0x000] SessionWsList [Type: _LIST_ENTRY] [+0x010] SessionIdBitmap : 0x0 [Type: _RTL_BITMAP *] [+0x018] PagedPoolInfo [Type: _MM_PAGED_POOL_INFO] [+0x030] MaximumNonPagedPoolInPages : 0x0 [Type: unsigned __int64] [+0x038] SizeOfPagedPoolInPages : 0x0 [Type: unsigned __int64] [+0x040] SystemPteInfo [Type: _MI_SYSTEM_PTE_TYPE] [+0x0a0] NonPagedPoolCommit : 0xfffff8000f04ee28 [Type: unsigned __int64] [+0x0a8] SmallNonPagedPtesCommit : 0x0 [Type: unsigned __int64] [+0x0b0] BootCommit : 0x0 [Type: unsigned __int64] [+0x0b8] MdlPagesAllocated : 0x44a600 [Type: unsigned __int64] [+0x0c0] SystemPageTableCommit : 0x8dac4 [Type: unsigned __int64] [+0x0c8] ProcessCommit : 0x71600 [Type: unsigned __int64] [+0x0d0] DriverCommit : 90312 [Type: long] [+0x0d4] PagingLevels : 0x80 [Type: unsigned char] [+0x0d8] PfnDatabaseCommit : 0x1dbb2 [Type: unsigned __int64] [+0x100] SystemWs [Type: _MMSUPPORT_FULL [6]] [+0x880] SystemCacheShared [Type: _MMSUPPORT_SHARED] [+0x900] AggregateSystemWs [Type: _MMSUPPORT_AGGREGATION [1]] [+0x920] MapCacheFailures : 0x0 [Type: unsigned long] [+0x928] PagefileHashPages : 0x0 [Type: unsigned __int64] [+0x930] PteHeader [Type: _SYSPTES_HEADER] [+0xa48] SystemVaTypeCount [Type: unsigned __int64 [16]] [+0xac8] SystemVaType [Type: unsigned char [256]] [+0xbc8] SystemVaRegions [Type: _MI_SYSTEM_VA_ASSIGNMENT [13]] if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } byte_140C4F748 确切的位置是在 MI_SYSTEM_INFORMATION.Vs.SystemVaType+0x40的位置，其实是符号的问题，就是 MI_SYSTEM_INFORMATION.Vs.SystemVaType _MI_SYSTEM_INFORMATION.Vs.SystemVaType 起始位置， 1: kd> db 0xfffff8000f04f848 fffff800`0f04f848 bf 03 00 00 00 00 00 00-58 23 00 00 00 00 00 00 ........X#...... fffff800`0f04f858 00 00 00 00 00 00 00 00-07 00 00 00 00 00 00 00 ................ fffff800`0f04f868 ec 09 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ fffff800`0f04f878 25 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 %............... fffff800`0f04f888 00 00 00 04 00 00 00 00-00 0e 0e 04 04 04 04 04 ................ fffff800`0f04f898 04 04 00 00 00 01 00 00-00 00 00 00 00 00 00 00 ................ fffff800`0f04f8a8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ fffff800`0f04f8b8 00 0f 06 06 06 06 06 06-06 06 06 06 06 06 06 06 ................ if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } byte_140C4F748 变量的值 1: kd> db 0xfffff8000f04f888 fffff800`0f04f888 00 00 00 04 00 00 00 00-00 0e 0e 04 04 04 04 04 ................ fffff800`0f04f898 04 04 00 00 00 01 00 00-00 00 00 00 00 00 00 00 ................ fffff800`0f04f8a8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ fffff800`0f04f8b8 00 0f 06 06 06 06 06 06-06 06 06 06 06 06 06 06 ................ fffff800`0f04f8c8 06 06 06 06 06 06 06 06-06 06 06 06 06 06 06 06 ................ fffff800`0f04f8d8 06 06 00 00 00 00 00 02-02 00 00 00 00 00 00 00 ................ fffff800`0f04f8e8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ fffff800`0f04f8f8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } SystemVaType 类型是_MI_SYSTEM_VA_TYPE 1: kd> dt _MI_SYSTEM_VA_TYPE nt!_MI_SYSTEM_VA_TYPE MiVaUnused = 0n0 MiVaSessionSpace = 0n1 MiVaProcessSpace = 0n2 MiVaBootLoaded = 0n3 MiVaPfnDatabase = 0n4 MiVaNonPagedPool = 0n5 MiVaPagedPool = 0n6 MiVaSpecialPoolPaged = 0n7 MiVaSystemCache = 0n8 MiVaSystemPtes = 0n9 MiVaHal = 0n10 MiVaSessionGlobalSpace = 0n11 MiVaDriverImages = 0n12 MiVaSystemPtesLarge = 0n13 MiVaKernelStacks = 0n14 MiVaSecureNonPagedPool = 0n15 MiVaMaximumType = 0n16 if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } 另外提一嘴，微软的成员名是怎么命名的， NonPagedPool 的大小定义在nt！MiState中为什么是这个GlobalPushLock 成员名。难道是我逆向错了？

这地方好像还真没注意过之前有看到openark可以给内存池都扫出来但是没注意他代码具体怎么写的这个结构里面好像没看到mmpfnbase有点可惜

MOVRAX214D MiVaPfnDatabase就是PfnDataBase，其次就是KdDebuggerData里也有PfnDataBase

kanren 那这个不错不用去ntos里面搜特征了

MOVRAX214D 他这个函数并不能全能枚举出来最起码 bootloaded 这个是有问题的

wsj 本来也没法完全枚举出来，这玩意只是提供一个pml4 index，有没有内存是另一码事

kanren 那现在有没有通用的办法去搞出全部的数据来。

wsj 目前看来没有啥稳定方案

win10 后版本如何快速获取内核地址所在的区域

正在加载…

加载论坛时出错，请强制刷新页面重试。