AddressCheck.h File Reference

Header files for address checks. More...

Go to the source code of this file.

Functions
BOOLEAN	CheckAddressCanonicality (UINT64 VAddr, PBOOLEAN IsKernelAddress)
	Checks if the address is canonical based on x86 processor's virtual address width or not.

Detailed Description

Header files for address checks.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-04-27

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CheckAddressCanonicality()

BOOLEAN CheckAddressCanonicality	(	UINT64	VAddr,
		PBOOLEAN	IsKernelAddress )

Checks if the address is canonical based on x86 processor's virtual address width or not.

Parameters

VAddr	virtual address to check
IsKernelAddress	Filled to show whether the address is a kernel address or user-address

IsKernelAddress wouldn't check for page attributes, it just checks the address convention in Windows

Returns

BOOLEAN

{
    UINT64 Addr = (UINT64)VAddr;
    UINT64 MaxVirtualAddrLowHalf, MinVirtualAddressHighHalf;
 
    //
    // Get processor's address width for VA
    //
    UINT32 AddrWidth = g_CompatibilityCheck.VirtualAddressWidth;
 
    //
    // get max address in lower-half canonical addr space
    // e.g. if width is 48, then 0x00007FFF_FFFFFFFF
    //
    MaxVirtualAddrLowHalf = ((UINT64)1ull << (AddrWidth - 1)) - 1;
 
    //
    // get min address in higher-half canonical addr space
    // e.g., if width is 48, then 0xFFFF8000_00000000
    //
    MinVirtualAddressHighHalf = ~MaxVirtualAddrLowHalf;
 
    //
    // Check to see if the address in a canonical address
    //
    if ((Addr > MaxVirtualAddrLowHalf) && (Addr < MinVirtualAddressHighHalf))
    {
        *IsKernelAddress = FALSE;
        return FALSE;
    }
 
    //
    // Set whether it's a kernel address or not
    //
    if (MinVirtualAddressHighHalf < Addr)
    {
        *IsKernelAddress = TRUE;
    }
    else
    {
        *IsKernelAddress = FALSE;
    }
 
    return TRUE;
}