Windows NT 4.0 source code leak
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

212 lines
6.6 KiB

#include "precomp.h"
#pragma hdrstop
#include "..\pte.c"
//
// one page is reserved for the pde
//
//#define PDE_TOP 0xC01FFFFF
#define PTI_MASK 0x00FFE000
//
// MiGetPdeAddress returns the address of the PTE which maps the
// given virtual address.
//
#define PMMPTEx ULONG
//
// MiGetVirtualAddressMappedByPte returns the virtual address
// which is mapped by a given PTE address.
//
#define MiGetVirtualAddressMappedByPte(va) \
((PVOID)((ULONG)(va) << (PAGE_SHIFT-2)))
#define MM_PTE_VALID_MASK (0x1)
#define MM_PTE_PROTOTYPE_MASK (0x2)
#define MM_PTE_DIRTY_MASK (0x4)
#define MM_PTE_TRANSITION_MASK (0x4)
#define MM_PTE_GLOBAL_MASK (0x10)
#define MM_PTE_WRITE_MASK (0x80)
#define MM_PTE_COPY_ON_WRITE_MASK (0x100)
#define MM_PTE_OWNER_MASK (0x2)
#define MM_PTE_PROTECTION_MASK 0xf8
#define MM_PTE_PAGEFILE_MASK 0xf00
ULONG LocalNonPagedPoolStart;
extern ULONG MmSubsectionBase;
#define MmProtopte_Base ((ULONG)0xE1000000)
DECLARE_API( pte )
/*++
Routine Description:
Displays the corresponding PDE and PTE.
Arguments:
args - Address Flags
Return Value:
None
--*/
{
ULONG Address;
ULONG result;
ULONG flags = 0;
PMMPTEx Pte;
PMMPTEx Pde;
ULONG PdeContents;
ULONG PteContents;
if (LocalNonPagedPoolStart == 0) {
LocalNonPagedPoolStart = GetUlongValue ("MmNonPagedPoolStart");
}
if (MmSubsectionBase == 0) {
MmSubsectionBase = GetUlongValue ("MmSubsectionBase");
}
sscanf(args,"%lx %lx",&Address, &flags);
if (!flags && (Address >= PTE_BASE) && (Address < PDE_TOP)) {
//
// The address is the address of a PTE, rather than
// a virtual address. Don't get the corresponding
// PTE contents, use this address as the PTE.
//
Address = (ULONG)MiGetVirtualAddressMappedByPte (Address);
}
if (!flags) {
Pde = (PMMPTEx)MiGetPdeAddress (Address);
Pte = (PMMPTEx)MiGetPteAddress (Address);
} else {
Pde = (PMMPTEx)Address;
Pte = (PMMPTEx)Address;
}
dprintf("%08lX - PDE at %08lX PTE at %08lX\n ",Address, Pde, Pte);
if ( !ReadMemory( (DWORD)Pde,
&PdeContents,
sizeof(ULONG),
&result) ) {
dprintf("Unable to get PDE\n");
return;
}
if (PdeContents & 0x1) {
if ( !ReadMemory( (DWORD)Pte,
&PteContents,
sizeof(ULONG),
&result) ) {
dprintf("Unable to get PTE\n");
return;
}
dprintf(" contains %08lX contains %08lX\n",
PdeContents, PteContents);
dprintf(" pfn %06lX V%c%c%c%c%c",
PdeContents >> 9,
PdeContents & 0x2 ? 'U' : 'K',
PdeContents & 0x4 ? 'D' : '-',
PdeContents & 0x10 ? 'G' : '-',
PdeContents & 0x14 ? 'W' : 'R',
PdeContents & 0x18 ? 'C' : '-');
if (PteContents & 0x1) {
dprintf(" pfn %06lX V%c%c%c%c%c\n",
PteContents >> 9,
PteContents & 0x2 ? 'U' : 'K',
PteContents & 0x4 ? 'D' : '-',
PteContents & 0x10 ? 'G' : '-',
PteContents & 0x14 ? 'W' : 'R',
PteContents & 0x18 ? 'C' : '-');
} else {
dprintf(" not valid\n");
if (PteContents & MM_PTE_PROTOTYPE_MASK) {
if ((PteContents >> 12) == 0xfffff) {
dprintf(" Proto: VAD\n");
dprintf(" Protect: %2lx\n",
(PteContents & MM_PTE_PROTECTION_MASK) >> 3);
} else {
dprintf(" Proto: %8lx\n",
MiPteToProto((PMMPTE)&PteContents));
}
} else if (PteContents & MM_PTE_TRANSITION_MASK) {
dprintf(" Transition: %5lx\n",
PteContents >> 9);
dprintf(" Protect: %2lx\n",
(PteContents & MM_PTE_PROTECTION_MASK) >> 3);
} else if (PteContents != 0) {
if (PteContents >> 12 == 0) {
dprintf(" DemandZero\n");
} else {
dprintf(" PageFile %2lx\n",
(PteContents & MM_PTE_PAGEFILE_MASK) >> 1);
dprintf(" Offset %lx\n",
PteContents >> 12);
}
dprintf(" Protect: %2lx\n",
(PteContents & MM_PTE_PROTECTION_MASK) >> 3);
} else {
;
}
}
} else {
dprintf(" contains %08lX unavailable\n",
PdeContents);
if (PdeContents & MM_PTE_PROTOTYPE_MASK) {
if ((PdeContents >> 12) == 0xfffff) {
dprintf(" Proto: VAD\n");
dprintf(" protect: %2lx\n",
(PdeContents & MM_PTE_PROTECTION_MASK) >> 3);
} else {
if (flags) {
dprintf(" Subsection: %8lx\n",
MiGetSubsectionAddress((PMMPTE)&PdeContents));
dprintf(" Protect: %2lx\n",
(PdeContents & MM_PTE_PROTECTION_MASK) >> 3);
}
dprintf(" Proto: %8lx\n",
MiPteToProto((PMMPTE)&PdeContents));
}
} else if (PdeContents & MM_PTE_TRANSITION_MASK) {
dprintf(" Transition: %5lx\n",
PdeContents >> 9);
dprintf(" Protect: %2lx\n",
(PdeContents & MM_PTE_PROTECTION_MASK) >> 3);
} else if (PdeContents != 0) {
if (PdeContents >> 12 == 0) {
dprintf(" DemandZero\n");
} else {
dprintf(" PageFile %2lx\n",
(PdeContents & MM_PTE_PAGEFILE_MASK) >> 8);
dprintf(" Offset %lx\n",
PdeContents >> 12);
}
dprintf(" Protect: %2lx\n",
(PdeContents & MM_PTE_PROTECTION_MASK) >> 3);
} else {
;
}
}
return;
}