- Timestamp:
- Feb 24, 2001, 5:37:15 AM (25 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/win32k/mmf/mmf.cpp
r4546 r5259 1 /* $Id: mmf.cpp,v 1. 1 2000-10-31 17:35:00bird Exp $1 /* $Id: mmf.cpp,v 1.2 2001-02-24 04:37:15 bird Exp $ 2 2 * 3 3 * Memory Mapped Files. … … 35 35 @subsection Loader Exploits (Overloads) 36 36 37 The Ring-0 part will overload the handling of the Ring-3 DLL, that's the 38 reason why I will insist on having a separate MMF DLL. When the first call to 39 the MMF is issued we'll find the MMF DLL and "hook" it's handle. This 40 "hooking" will enable us to make speciall processing in LDRGetPage, 41 LDRFreeTask and maybe ldrAllocateObjects. All of these LDR functions will have 42 to be overloaded with my own functions - LDRGetPage will be written in 43 assembly to minimize latency.<p> 37 The Ring-0 part will create pseudo MTEs for each file handle given in the 38 openmapping call. These MTEs will not be linked into the mte list, but will 39 be linked into a private MMF list. By doing it this way we'll be able to use 40 the LDRGetPage function without overloading it. We just have to feed the 41 loader with valid pagelists.<p> 44 42 43 We'll have to do cleanups of this internal MTEs by overloading LDRFreeTask.<p> 45 44 46 @subsubsection LDRGetPage 47 48 As you will see somewhere else (when this text is completed) we'll allocate 49 objects my self and give the hMTE of the MMF DLL. The block number will be 50 relative to the start of each mapping if there is a filebacking of the 51 object.<p> 52 53 So, what we'll actually do is 1st to check that the call isn't for the real 54 LX objects of the MMF DLL. Since we're overloading the processing of the 55 MMF DLL we will have to distiguish between calls related to the processing 56 of the DLL and the processing of our memorymapped objects. Then, if this 57 is a request for a page in the one of the objects of the MMF DLL we'll simply 58 call(/jump) to the original LDRGetPage.<p> 59 60 If this is a request for a page in one of the memory mapped objects, we'll 61 have to get that page. Starts out by finding the mapping this is for. If it's 62 a mapping without filebacking we'll simply return a zero'ed page. Else, we'll 63 have to read it from the disk. And that's about all we'll have to do. 45 Objects are allocated by us self using ldrAllocObjects and ldrSetVMFlags will 46 be overloaded to set the correct flags. 64 47 65 48 … … 84 67 <ul> 85 68 <li>MMFCreating - Create a mapping handle. 86 <li>MMFDuplicate - Duplicates a nmapping handle.69 <li>MMFDuplicate - Duplicates a mapping handle. 87 70 <li>MMFOpen - Open an existing mapping. 88 71 <li>MMFViewMap - Creates a view for a part of the file. … … 105 88 106 89 */ 90 91
Note:
See TracChangeset
for help on using the changeset viewer.