Changeset 5259 for trunk/src


Ignore:
Timestamp:
Feb 24, 2001, 5:37:15 AM (25 years ago)
Author:
bird
Message:

Updated method.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/win32k/mmf/mmf.cpp

    r4546 r5259  
    1 /* $Id: mmf.cpp,v 1.1 2000-10-31 17:35:00 bird Exp $
     1/* $Id: mmf.cpp,v 1.2 2001-02-24 04:37:15 bird Exp $
    22 *
    33 * Memory Mapped Files.
     
    3535@subsection     Loader Exploits (Overloads)
    3636
    37 The Ring-0 part will overload the handling of the Ring-3 DLL, that's the
    38 reason why I will insist on having a separate MMF DLL. When the first call to
    39 the MMF is issued we'll find the MMF DLL and "hook" it's handle. This
    40 "hooking" will enable us to make speciall processing in LDRGetPage,
    41 LDRFreeTask and maybe ldrAllocateObjects. All of these LDR functions will have
    42 to be overloaded with my own functions - LDRGetPage will be written in
    43 assembly to minimize latency.<p>
     37The Ring-0 part will create pseudo MTEs for each file handle given in the
     38openmapping call. These MTEs will not be linked into the mte list, but will
     39be linked into a private MMF list. By doing it this way we'll be able to use
     40the LDRGetPage function without overloading it. We just have to feed the
     41loader with valid pagelists.<p>
    4442
     43We'll have to do cleanups of this internal MTEs by overloading LDRFreeTask.<p>
    4544
    46 @subsubsection  LDRGetPage
    47 
    48 As you will see somewhere else (when this text is completed) we'll allocate
    49 objects my self and give the hMTE of the MMF DLL. The block number will be
    50 relative to the start of each mapping if there is a filebacking of the
    51 object.<p>
    52 
    53 So, what we'll actually do is 1st to check that the call isn't for the real
    54 LX objects of the MMF DLL. Since we're overloading the processing of the
    55 MMF DLL we will have to distiguish between calls related to the processing
    56 of the DLL and the processing of our memorymapped objects. Then, if this
    57 is a request for a page in the one of the objects of the MMF DLL we'll simply
    58 call(/jump) to the original LDRGetPage.<p>
    59 
    60 If this is a request for a page in one of the memory mapped objects, we'll
    61 have to get that page. Starts out by finding the mapping this is for. If it's
    62 a mapping without filebacking we'll simply return a zero'ed page. Else, we'll
    63 have to read it from the disk. And that's about all we'll have to do.
     45Objects are allocated by us self using ldrAllocObjects and ldrSetVMFlags will
     46be overloaded to set the correct flags.
    6447
    6548
     
    8467<ul>
    8568    <li>MMFCreating  - Create a mapping handle.
    86     <li>MMFDuplicate - Duplicates an mapping handle.
     69    <li>MMFDuplicate - Duplicates a mapping handle.
    8770    <li>MMFOpen      - Open an existing mapping.
    8871    <li>MMFViewMap   - Creates a view for a part of the file.
     
    10588
    10689 */
     90
     91
Note: See TracChangeset for help on using the changeset viewer.