upload some png

KernelLibrary/Common.h

@@ -246,6 +246,7 @@ enum class VadCountPos {
 	NumberGenericTableElements
 };
 
+
 struct BitField {
 	USHORT Position;
 	USHORT Size;
@@ -257,7 +258,25 @@ struct MmAvlTableOffsets {
 };
 
 struct MmVadFlagsOffsets {
-	ULONG Protection;
+	ULONG64 Protection;
+	BitField ProtectionBitField;
+	ULONG64 PrivateMemory;
+	BitField PrivateMemoryBitField;
+	ULONG64 NoChange;
+	BitField NoChangeBitField;
+	ULONG64 CommitCharge;
+	BitField CommitChargeBitField;
+};
+
+struct MmVadShortOffsets {
+	ULONG64 StartingVpn;
+	ULONG64 EndingVpn;
+	ULONG VpnSize;
+	ULONG64 Parent;
+	ULONG ParentSize;
+	ULONG64 LeftChild;
+	ULONG64 RightChild;
+	ULONG ChildSize;
 };
 
 struct VadData {
@@ -265,6 +284,8 @@ struct VadData {
 	EProcessOffsets EprocessOffsets;
 	MmAvlTableOffsets TableOffsets;
 	ULONG Pid;
+	MmVadFlagsOffsets VadFlagsOffsets;
+	MmVadShortOffsets VadShortOffsets;
 };
 
 struct VadInfo {

KernelLibrary/CpuInfo.cpp

@@ -0,0 +1,2 @@
+#include "pch.h"
+#include "CpuInfo.h"

KernelLibrary/CpuInfo.h

@@ -0,0 +1 @@
+#pragma once

KernelLibrary/KernelLibrary.vcxproj

@@ -232,6 +232,7 @@
     <ClInclude Include="BypassAntiKernelDbg.h" />
     <ClInclude Include="BypassObCallback.h" />
     <ClInclude Include="Common.h" />
+    <ClInclude Include="CpuInfo.h" />
     <ClInclude Include="CriticalRegion.h" />
     <ClInclude Include="CyclicBuffer.h" />
     <ClInclude Include="DbgDefender.h" />
@@ -280,6 +281,7 @@
     <ClCompile Include="AutoLock.cpp" />
     <ClCompile Include="BypassAntiKernelDbg.cpp" />
     <ClCompile Include="BypassObCallback.cpp" />
+    <ClCompile Include="CpuInfo.cpp" />
     <ClCompile Include="CriticalRegion.cpp" />
     <ClCompile Include="CyclicBuffer.cpp" />
     <ClCompile Include="DbgDefender.cpp" />

KernelLibrary/KernelLibrary.vcxproj.filters

@@ -13,10 +13,6 @@
       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
     </Filter>
-    <Filter Include="Driver Files">
-      <UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
-      <Extensions>inf;inv;inx;mof;mc;</Extensions>
-    </Filter>
     <Filter Include="Synchronization">
       <UniqueIdentifier>{08ba55e2-d7d7-4d8a-80c2-d1203de7ef76}</UniqueIdentifier>
     </Filter>
@@ -38,6 +34,10 @@
     <Filter Include="Timer">
       <UniqueIdentifier>{c59f543e-d208-4f78-899d-a0147ca066cb}</UniqueIdentifier>
     </Filter>
+    <Filter Include="Header Files\Driver Files">
+      <UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
+      <Extensions>inf;inv;inx;mof;mc;</Extensions>
+    </Filter>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="pch.h">
@@ -181,6 +181,9 @@
     <ClInclude Include="VadHelpers.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="CpuInfo.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="pch.cpp">
@@ -303,6 +306,9 @@
     <ClCompile Include="VadHelpers.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="CpuInfo.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <MASM Include="code64.asm">

KernelLibrary/VadHelpers.cpp

@@ -55,5 +55,113 @@ NTSTATUS VadHelpers::GetVadCount (VadData* pData, PULONG pCount) {
 		ObDereferenceObject(Process);
 	}
 
+	return status;
+}
+
+ULONG64 VadHelpers::ReadBitField(PUCHAR readAddr, BitField * pBitField) {
+	readAddr += (pBitField->Position / 8);
+	ULONG readSz = (pBitField->Position % 8 + pBitField->Size
+		+ 7) / 8;
+	ULONG64 readBits;
+	ULONG64 bitCopy;
+
+	RtlCopyMemory(&readBits, readAddr, readSz);
+
+	readBits = readBits >> (pBitField->Position % 8);
+	bitCopy = ((ULONG64)1 << pBitField->Size);
+	bitCopy -= (ULONG64)1;
+	readBits &= bitCopy;
+	return readBits;
+}
+
+ULONG64 VadHelpers::ReadFieldValue(PUCHAR readAddr, ULONG readSize) {
+	ULONG64 value;
+	RtlCopyMemory(&value, readAddr, readSize);
+	return value;
+}
+
+NTSTATUS VadHelpers::DumpsAllVadsForProcess(VadData* pData, VadInfo* pInfo) {
+	ULONG64 Next;
+	ULONG64 VadToDump;
+	ULONG64 ParentStored;
+	ULONG64 First;
+	ULONG64 Left;
+	ULONG64 Prev;
+	ULONG Flags;
+	ULONG Done;
+	ULONG Level = 0;
+	ULONG Count = 0;
+	ULONG AverageLevel = 0;
+	ULONG MaxLevel = 0;
+	ULONG VadFlagsPrivateMemory = 0, VadFlagsNoChange = 0;
+	ULONG PhysicalMapping = 0, ImageMap = 0, NoChange = 0, LargePages = 0, MemCommit = 0,
+		PrivateMemory = 0, Protection = 0;
+	ULONG64 StartingVpn = 0, EndingVpn = 0, Parent = 0, LeftChild = 0, RightChild = 0;
+	ULONG64 ControlArea = 0, FirstPrototypePte = 0, LastContiguousPte = 0, CommitCharge = 0;
+
+	VadToDump = 0;
+	Flags = 0;
+
+	PEPROCESS Process = nullptr;
+	NTSTATUS status = PsLookupProcessByProcessId(UlongToHandle(pData->Pid), &Process);
+	if (NT_SUCCESS(status)) {
+		do
+		{
+			VadToDump = (ULONG64)Process + pData->EprocessOffsets.VadRoot;
+			if (VadToDump == 0) {
+				status = STATUS_INVALID_PARAMETER;
+				break;
+			}
+
+			First = VadToDump;
+			if (First == 0) {
+				status = STATUS_INVALID_PARAMETER;
+				break;
+			}
+
+			PUCHAR readAddr = (PUCHAR)VadToDump + pData->VadFlagsOffsets.PrivateMemory;
+			VadFlagsPrivateMemory = ReadBitField(readAddr, &pData->VadFlagsOffsets.PrivateMemoryBitField);
+			
+			readAddr = (PUCHAR)VadToDump + pData->VadFlagsOffsets.NoChange;
+			VadFlagsNoChange = ReadBitField(readAddr, &pData->VadFlagsOffsets.NoChangeBitField);
+				
+			readAddr = (PUCHAR)VadToDump + pData->VadShortOffsets.StartingVpn;
+			ULONG readSz = pData->VadShortOffsets.VpnSize;
+			StartingVpn = ReadFieldValue(readAddr, readSz);
+			readAddr = (PUCHAR)VadToDump + pData->VadShortOffsets.EndingVpn;
+			EndingVpn = ReadFieldValue(readAddr, readSz);
+
+			readAddr = (PUCHAR)VadToDump + pData->VadShortOffsets.LeftChild;
+			readSz = pData->VadShortOffsets.ChildSize;
+			LeftChild = ReadFieldValue(readAddr, readSz);
+			readAddr = (PUCHAR)VadToDump + pData->VadShortOffsets.RightChild;
+			RightChild = ReadFieldValue(readAddr, readSz);
+			readAddr = (PUCHAR)VadToDump + pData->VadFlagsOffsets.CommitCharge;
+			CommitCharge = ReadBitField(readAddr, &pData->VadFlagsOffsets.CommitChargeBitField);
+
+			Prev = First;
+
+			while (LeftChild != 0) {
+				Prev = First;
+				First = LeftChild;
+				Level += 1;
+				if (Level > MaxLevel) {
+					MaxLevel = Level;
+				}
+
+				readAddr = (PUCHAR)First + pData->VadShortOffsets.LeftChild;
+				readSz = pData->VadShortOffsets.ChildSize;
+				LeftChild = ReadFieldValue(readAddr, readSz);
+			}
+
+			readAddr = (PUCHAR)First + pData->VadShortOffsets.StartingVpn;
+			readSz = pData->VadShortOffsets.VpnSize;
+			StartingVpn = ReadFieldValue(readAddr, readSz);
+
+		} while (false);
+		
+		ObDereferenceObject(Process);
+	}
+
 	return status;
 }

KernelLibrary/VadHelpers.h

@@ -2,4 +2,7 @@
 
 struct VadHelpers abstract final {
 	static NTSTATUS GetVadCount(VadData* pData,PULONG pCount);
+	static NTSTATUS DumpsAllVadsForProcess(VadData* pData, VadInfo* pInfo);
+	static ULONG64 ReadBitField(PUCHAR readAddr, BitField* pBitField);
+	static ULONG64 ReadFieldValue(PUCHAR readAddr, ULONG readSize);
 };