Conversion.c File Reference

Functions for address checks. More...

#include "pch.h"

Functions
_Use_decl_annotations_ UINT64	PhysicalAddressToVirtualAddress (UINT64 PhysicalAddress)
	Converts Physical Address to Virtual Address.
_Use_decl_annotations_ UINT64	PhysicalAddressToVirtualAddressByProcessId (PVOID PhysicalAddress, UINT32 ProcessId)
	Converts Physical Address to Virtual Address based on a specific process id.
_Use_decl_annotations_ UINT64	PhysicalAddressToVirtualAddressByCr3 (PVOID PhysicalAddress, CR3_TYPE TargetCr3)
	Converts Physical Address to Virtual Address based on a specific process's kernel cr3.
_Use_decl_annotations_ UINT64	PhysicalAddressToVirtualAddressOnTargetProcess (PVOID PhysicalAddress)
	Converts Physical Address to Virtual Address based on current process's kernel cr3.
_Use_decl_annotations_ UINT64	VirtualAddressToPhysicalAddress (_In_ PVOID VirtualAddress)
	Converts Virtual Address to Physical Address.
_Use_decl_annotations_ UINT64	VirtualAddressToPhysicalAddressByProcessId (PVOID VirtualAddress, UINT32 ProcessId)
	Converts Virtual Address to Physical Address based on a specific process id's kernel cr3.
_Use_decl_annotations_ UINT64	VirtualAddressToPhysicalAddressByProcessCr3 (PVOID VirtualAddress, CR3_TYPE TargetCr3)
	Converts Virtual Address to Physical Address based on a specific process's kernel cr3.
_Use_decl_annotations_ UINT64	VirtualAddressToPhysicalAddressOnTargetProcess (PVOID VirtualAddress)
	Converts Virtual Address to Physical Address based on the current process's kernel cr3.

Detailed Description

Functions for address checks.

Functions for memory conversions.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-04-27

Copyright

This project is released under the GNU Public License v3.

Function Documentation

PhysicalAddressToVirtualAddress()

_Use_decl_annotations_ UINT64 PhysicalAddressToVirtualAddress

(

UINT64

PhysicalAddress

)

Converts Physical Address to Virtual Address.

Parameters

PhysicalAddress

The target physical address

Returns

UINT64 Returns the virtual address

{
    PHYSICAL_ADDRESS PhysicalAddr;
    PhysicalAddr.QuadPart = PhysicalAddress;
 
    return (UINT64)MmGetVirtualForPhysical(PhysicalAddr);
}

PhysicalAddressToVirtualAddressByCr3()

_Use_decl_annotations_ UINT64 PhysicalAddressToVirtualAddressByCr3	(	PVOID	PhysicalAddress,
		CR3_TYPE	TargetCr3 )

Converts Physical Address to Virtual Address based on a specific process's kernel cr3.

this function should NOT be called from vmx-root mode

Parameters

PhysicalAddress	The target physical address
TargetCr3	The target's process cr3

Returns

UINT64 Returns the virtual address

{
    CR3_TYPE         CurrentProcessCr3;
    UINT64           VirtualAddress;
    PHYSICAL_ADDRESS PhysicalAddr;
 
    //
    // Switch to new process's memory layout
    //
    CurrentProcessCr3 = SwitchToProcessMemoryLayoutByCr3(TargetCr3);
 
    //
    // Validate if process id is valid
    //
    if (CurrentProcessCr3.Flags == NULL64_ZERO)
    {
        //
        // Pid is invalid
        //
        return NULL64_ZERO;
    }
 
    //
    // Read the virtual address based on new cr3
    //
    PhysicalAddr.QuadPart = (LONGLONG)PhysicalAddress;
    VirtualAddress        = (UINT64)MmGetVirtualForPhysical(PhysicalAddr);
 
    //
    // Restore the original process
    //
    SwitchToPreviousProcess(CurrentProcessCr3);
 
    return VirtualAddress;
}

PhysicalAddressToVirtualAddressByProcessId()

_Use_decl_annotations_ UINT64 PhysicalAddressToVirtualAddressByProcessId	(	PVOID	PhysicalAddress,
		UINT32	ProcessId )

Converts Physical Address to Virtual Address based on a specific process id.

this function should NOT be called from vmx-root mode

Parameters

PhysicalAddress	The target physical address
ProcessId	The target's process id

Returns

UINT64 Returns the virtual address

{
    CR3_TYPE         CurrentProcessCr3;
    UINT64           VirtualAddress;
    PHYSICAL_ADDRESS PhysicalAddr;
 
    //
    // Switch to new process's memory layout
    //
    CurrentProcessCr3 = SwitchToProcessMemoryLayout(ProcessId);
 
    //
    // Validate if process id is valid
    //
    if (CurrentProcessCr3.Flags == NULL64_ZERO)
    {
        //
        // Pid is invalid
        //
        return NULL64_ZERO;
    }
 
    //
    // Read the virtual address based on new cr3
    //
    PhysicalAddr.QuadPart = (LONGLONG)PhysicalAddress;
    VirtualAddress        = (UINT64)MmGetVirtualForPhysical(PhysicalAddr);
 
    //
    // Restore the original process
    //
    SwitchToPreviousProcess(CurrentProcessCr3);
 
    return VirtualAddress;
}

PhysicalAddressToVirtualAddressOnTargetProcess()

_Use_decl_annotations_ UINT64 PhysicalAddressToVirtualAddressOnTargetProcess

(

PVOID

PhysicalAddress

)

Converts Physical Address to Virtual Address based on current process's kernel cr3.

this function should NOT be called from vmx-root mode

Parameters

PhysicalAddress

The target physical address

Returns

UINT64 Returns the virtual address

{
    CR3_TYPE GuestCr3;
 
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    return PhysicalAddressToVirtualAddressByCr3(PhysicalAddress, GuestCr3);
}

VirtualAddressToPhysicalAddress()

_Use_decl_annotations_ UINT64 VirtualAddressToPhysicalAddress

(

_In_ PVOID

VirtualAddress

)

Converts Virtual Address to Physical Address.

Parameters

VirtualAddress

The target virtual address

Returns

UINT64 Returns the physical address

{
    return MmGetPhysicalAddress(VirtualAddress).QuadPart;
}

VirtualAddressToPhysicalAddressByProcessCr3()

_Use_decl_annotations_ UINT64 VirtualAddressToPhysicalAddressByProcessCr3	(	PVOID	VirtualAddress,
		CR3_TYPE	TargetCr3 )

Converts Virtual Address to Physical Address based on a specific process's kernel cr3.

Parameters

VirtualAddress	The target virtual address
TargetCr3	The target's process cr3

Returns

UINT64 Returns the physical address

{
    CR3_TYPE CurrentProcessCr3;
    UINT64   PhysicalAddress;
 
    //
    // Switch to new process's memory layout
    //
    CurrentProcessCr3 = SwitchToProcessMemoryLayoutByCr3(TargetCr3);
 
    //
    // Validate if process id is valid
    //
    if (CurrentProcessCr3.Flags == NULL64_ZERO)
    {
        //
        // Pid is invalid
        //
        return NULL64_ZERO;
    }
 
    //
    // Read the physical address based on new cr3
    //
    PhysicalAddress = MmGetPhysicalAddress(VirtualAddress).QuadPart;
 
    //
    // Restore the original process
    //
    SwitchToPreviousProcess(CurrentProcessCr3);
 
    return PhysicalAddress;
}

VirtualAddressToPhysicalAddressByProcessId()

_Use_decl_annotations_ UINT64 VirtualAddressToPhysicalAddressByProcessId	(	PVOID	VirtualAddress,
		UINT32	ProcessId )

Converts Virtual Address to Physical Address based on a specific process id's kernel cr3.

this function should NOT be called from vmx-root mode

Parameters

VirtualAddress	The target virtual address
ProcessId	The target's process id

Returns

UINT64 Returns the physical address

{
    CR3_TYPE CurrentProcessCr3;
    UINT64   PhysicalAddress;
 
    //
    // Switch to new process's memory layout
    //
    CurrentProcessCr3 = SwitchToProcessMemoryLayout(ProcessId);
 
    //
    // Validate if process id is valid
    //
    if (CurrentProcessCr3.Flags == NULL64_ZERO)
    {
        //
        // Pid is invalid
        //
        return NULL64_ZERO;
    }
 
    //
    // Read the physical address based on new cr3
    //
    PhysicalAddress = MmGetPhysicalAddress(VirtualAddress).QuadPart;
 
    //
    // Restore the original process
    //
    SwitchToPreviousProcess(CurrentProcessCr3);
 
    return PhysicalAddress;
}

VirtualAddressToPhysicalAddressOnTargetProcess()

_Use_decl_annotations_ UINT64 VirtualAddressToPhysicalAddressOnTargetProcess

(

PVOID

VirtualAddress

)

Converts Virtual Address to Physical Address based on the current process's kernel cr3.

Parameters

VirtualAddress

The target virtual address

Returns

UINT64 Returns the physical address

{
    CR3_TYPE CurrentCr3;
    CR3_TYPE GuestCr3;
    UINT64   PhysicalAddress;
 
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Switch to new process's memory layout
    //
    CurrentCr3 = SwitchToProcessMemoryLayoutByCr3(GuestCr3);
 
    //
    // Validate if process id is valid
    //
    if (CurrentCr3.Flags == NULL64_ZERO)
    {
        //
        // Pid is invalid
        //
        return NULL64_ZERO;
    }
 
    //
    // Read the physical address based on new cr3
    //
    PhysicalAddress = MmGetPhysicalAddress(VirtualAddress).QuadPart;
 
    //
    // Restore the original process
    //
    SwitchToPreviousProcess(CurrentCr3);
 
    return PhysicalAddress;
}