The WIN32 Memory Model grayscale （灰度的WIN32内存模型）.pdf

The WIN32 Memory Model: Tying it all together. Presented for DC619 Why Study Memory Mechanics • To understand process mechanics. • To learn the subtlety between physical, and virtual space. • To understand process space manipulation techniques. – Process Object Manipulation – Table Hooking – Driver Chaining – DKOM Rootkitting Techniques – General Purpose Runtime Alterations • Because you have to, and you cant be an evil hacker without it. Prerequsites Tenacity. Also probably, C. Tools and Dox Tools: WinDBG: Available in the Windows Debugging Tools package (free) WDK: Newly available driver development kit (free with ms live acct) Visual C++/Studio: Express Edition (free), Studio (cash). Dox: Windows Userland API: Google for “Windows API Reference” for dox. Windows Kernel API: Google for “Kernel-Mode driver reference”. Userland and Kernel Land Physical Memory • Is Literal and existent and can be referenced by hardware testing. • Called “linear” or “absolute” addressing. • Has no bearing to context, or scope, and has no real operational functionality in itself besides being referenced by the system processor. The word memory in reference to windows, is a carte blanche term which is used to refrence any and all utilization of physical memory. There is literally a \\device\physicalmemory device which can be accessed from kernel land to directly access the raw memory on your system. Note: In windows xp and below, a system process can access this device from userland!!! Virtual Memory • It is ethereal and contextual • It has philosophical premise in efficiency, and expansion. • It is quite literally, process space. Virtual memory is an idea thought up by processor manufactures quite a long time ag