MemoryManager.c File Reference

Reading/Writing memory and all memory affairs. More...

#include "pch.h"

Functions
BOOLEAN	ReadPhysicalMemoryUsingMapIoSpace (PVOID PhysicalAddress, PVOID Buffer, SIZE_T BufferSize)
	Read physical memory from the physical address (used in VMI mode).
BOOLEAN	WritePhysicalMemoryUsingMapIoSpace (PVOID PhysicalAddress, PVOID Buffer, SIZE_T BufferSize)
	Write physical memory to the physical address (used in VMI mode).
BOOLEAN	MemoryManagerReadProcessMemoryNormal (HANDLE PID, PVOID Address, DEBUGGER_READ_MEMORY_TYPE MemType, PVOID UserBuffer, SIZE_T Size, PSIZE_T ReturnSize)
	Read process memory.
BOOLEAN	MemoryManagerWritePhysicalMemoryNormal (PVOID TargetAddress, PVOID UserBuffer, SIZE_T Size)
	Write process memory.

Detailed Description

Reading/Writing memory and all memory affairs.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-24

Copyright

This project is released under the GNU Public License v3.

Function Documentation

MemoryManagerReadProcessMemoryNormal()

BOOLEAN MemoryManagerReadProcessMemoryNormal	(	HANDLE	PID,
		PVOID	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemType,
		PVOID	UserBuffer,
		SIZE_T	Size,
		PSIZE_T	ReturnSize )

Read process memory.

This function should not be called from vmx-root mode

Parameters

PID	Target Process Id
Address	Target Address
MemType	Type of memory
UserBuffer	Buffer to save to the user. This buffer must be in nonpageable memory.
Size	Size of read
ReturnSize	Return Size

Returns

BOOLEAN

{
    PEPROCESS        SourceProcess;
    MM_COPY_ADDRESS  CopyAddress         = {0};
    KAPC_STATE       State               = {0};
    PHYSICAL_ADDRESS TempPhysicalAddress = {0};
 
    //
    // Check if we want another process memory, this way we attach to that process
    // the find the physical address of the memory and read it from here using physical
    // address
 
    //
    // The second thing that we consider here is reading a physical address doesn't
    // need to attach to another process
    //
    if (PsGetCurrentProcessId() != PID && MemType == DEBUGGER_READ_VIRTUAL_ADDRESS)
    {
        //
        // User needs another process memory
        //
 
        if (PsLookupProcessByProcessId(PID, &SourceProcess) != STATUS_SUCCESS)
        {
            //
            // if the process not found
            //
            return FALSE;
        }
        __try
        {
            KeStackAttachProcess(SourceProcess, &State);
 
            //
            // We're in context of another process let's read the memory
            //
            TempPhysicalAddress = MmGetPhysicalAddress(Address);
 
            KeUnstackDetachProcess(&State);
 
            //
            // Now we have to read the physical address
            //
            CopyAddress.PhysicalAddress.QuadPart = TempPhysicalAddress.QuadPart;
            MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_PHYSICAL, ReturnSize);
 
            ObDereferenceObject(SourceProcess);
 
            return TRUE;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            KeUnstackDetachProcess(&State);
 
            ObDereferenceObject(SourceProcess);
 
            return FALSE;
        }
    }
    else
    {
        //
        // Process needs itself memory
        //
        __try
        {
            if (MemType == DEBUGGER_READ_VIRTUAL_ADDRESS)
            {
                CopyAddress.VirtualAddress = Address;
                MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_VIRTUAL, ReturnSize);
            }
            else if (MemType == DEBUGGER_READ_PHYSICAL_ADDRESS)
            {
                //
                // Check whether the physical memory is valid or not
                //
                if (!CheckAddressPhysical((UINT64)Address))
                {
                    return FALSE;
                }
 
                CopyAddress.PhysicalAddress.QuadPart = (LONGLONG)Address;
 
                if (MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_PHYSICAL, ReturnSize) != STATUS_SUCCESS && *ReturnSize == 0)
                {
                    //
                    // If the memory is not readable, it might be an MMIO address
                    // Try again with another method
                    //
 
                    // LogInfo("reading using MMIO Map IO Space using VMCALL");
 
                    if (AsmVmxVmcall(VMCALL_READ_PHYSICAL_MEMORY, (UINT64)Address, (UINT64)UserBuffer, (UINT64)Size) == STATUS_SUCCESS)
                    {
                        *ReturnSize = Size;
                        return TRUE;
                    }
                    else
                    {
                        //
                        // unknown error
                        //
                        *ReturnSize = 0;
                        return FALSE;
                    }
                }
            }
            else
            {
                //
                // Type is not recognized
                //
                return FALSE;
            }
 
            //
            // MmCopyVirtualMemory(SourceProcess, Address, TargetProcess, UserBuffer, Size, KernelMode, ReturnSize);
            // memcpy(UserBuffer, Address, Size);
            //
 
            return TRUE;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            return FALSE;
        }
    }
}

MemoryManagerWritePhysicalMemoryNormal()

BOOLEAN MemoryManagerWritePhysicalMemoryNormal	(	PVOID	TargetAddress,
		PVOID	UserBuffer,
		SIZE_T	Size )

Write process memory.

This function should not be called from vmx-root mode

Parameters

TargetAddress	Target Address
UserBuffer	Buffer to write to the memory
Size	Size of the buffer

Returns

BOOLEAN

{
    if (AsmVmxVmcall(VMCALL_WRITE_PHYSICAL_MEMORY, (UINT64)TargetAddress, (UINT64)UserBuffer, (UINT64)Size) == STATUS_SUCCESS)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

ReadPhysicalMemoryUsingMapIoSpace()

BOOLEAN ReadPhysicalMemoryUsingMapIoSpace	(	PVOID	PhysicalAddress,
		PVOID	Buffer,
		SIZE_T	BufferSize )

Read physical memory from the physical address (used in VMI mode).

Parameters

PhysicalAddress	Physical Address
Buffer	Buffer to save the memory
BufferSize	Size of the buffer

Returns

BOOLEAN

{
    PHYSICAL_ADDRESS PhysicalAddressTemp = {0};
    PhysicalAddressTemp.QuadPart         = (LONGLONG)PhysicalAddress;
 
    PVOID VirtualAddress = MmMapIoSpaceEx(PhysicalAddressTemp, BufferSize, PAGE_READWRITE | PAGE_NOCACHE);
 
    if (VirtualAddress == NULL)
    {
        return FALSE;
    }
 
    RtlCopyMemory(Buffer, VirtualAddress, BufferSize);
 
    MmUnmapIoSpace(VirtualAddress, BufferSize);
 
    return TRUE;
}

WritePhysicalMemoryUsingMapIoSpace()

BOOLEAN WritePhysicalMemoryUsingMapIoSpace	(	PVOID	PhysicalAddress,
		PVOID	Buffer,
		SIZE_T	BufferSize )

Write physical memory to the physical address (used in VMI mode).

Parameters

PhysicalAddress	Physical Address
Buffer	Buffer to write to the memory
BufferSize	Size of the buffer

Returns

BOOLEAN

{
    PHYSICAL_ADDRESS PhysicalAddressTemp = {0};
    PhysicalAddressTemp.QuadPart         = (LONGLONG)PhysicalAddress;
 
    PVOID VirtualAddress = MmMapIoSpaceEx(PhysicalAddressTemp, BufferSize, PAGE_READWRITE | PAGE_NOCACHE);
    if (VirtualAddress == NULL)
    {
        return FALSE;
    }
 
    RtlCopyMemory(VirtualAddress, Buffer, BufferSize);
 
    MmUnmapIoSpace(VirtualAddress, BufferSize);
 
    return TRUE;
}