8:55 p.m.
Hello,
I am doing some research on Windows kernel, using volatility.
I need to get the mapping from virtual addresses to physical ones for kernel memory.
As far as I know, every process maps kernel virtual addresses (addresses upper than
0x7fffffff in 32bit Windows versions with 3GB split disabled) to physical ones in the same
way.
In other words, the address spaces relative to every process are equals for kernel
virtual addresses.
Is this always true?
I noticed that some plugins (e.g. kdbgscan) use the address space of the process
"Idle", others use the address spaces of all processes (e.g. modscan).
Which is the right way to proccede to develop a plugin to get the full virtual to
physicall mapping for kernel addresses?
Thank you.
4:24 a.m.
Carl,
You can convert virtual to physical addresses using the
address_space.vtop() function. As you pointed out, processes all share
the top section with the kernel. If you are after the kernel memory
you will need to get the kernel address space (see
utils.load_as('virtual')).
Hope this helps.
Michael.
On 1 March 2012 02:55, carl galton <carlgalton(a)gmx.com> wrote:
Hello,
I am doing some research on Windows kernel, using volatility.
I need to get the mapping from virtual addresses to physical ones for kernel
memory.
As far as I know, every process maps kernel virtual addresses (addresses
upper than 0x7fffffff in 32bit Windows versions with 3GB split disabled) to
physical ones in the same way.
In other words, the address spaces relative to every process are equals for
kernel virtual addresses.
Is this always true?
I noticed that some plugins (e.g. kdbgscan) use the address space of the
process "Idle", others use the address spaces of all processes (e.g.
modscan).
Which is the right way to proccede to develop a plugin to get the full
virtual to physicall mapping for kernel addresses?
Thank you.
_______________________________________________
Vol-users mailing list
Vol-users(a)volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
10:03 a.m.
Carl,
On MS Windows all processes share the same kernel address space with two
salient exceptions. The first is session space (GDI related stuff,
clipboard, win32k, etc.) which is shared on a per session basis. The
second is that it is possible to manipulate the page tables for
malicious purposes to give a process a unique view of a portion of the
kernel address space.
I noticed that some plugins (e.g. kdbgscan) use the
address space of
the
process "Idle", others use the address spaces of all processes (e.g.
modscan).
There is no such thing as "the address spaces of all processes." Each
process has its own address space, though some page tables (e.g. for the
kernel address space) may be shared among more than one process. The
"idle process" isn't a real process; the address space (and other
process resources) belong to the system process (absent malice).
Regards,
gmg.
4756
days inactive
4756
days old
vol-users@lists.volatilityfoundation.org
2 comments
3 participants
participants (3)
-
carl galton -
George M. Garner Jr. -
Michael Cohen