[_MAX_]

Hello kernelmode,

As i have read in a paper :
"In windows each process has its own Page Directory and Page Tables" ,
How can i find Page Directory and All Page Tables for specific process/thread ?

Thank you for your helps

[R00tKit]

Typically, the upper 20 bits of CR3 become the page directory base register (PDBR), which stores the physical address of the first page directory entry.
you can read :

• Rootkit arsenal book
  Intel developer manual
  source code of shadow walker it manipulate PTE and TLB http://www.kernelmode.info/forum/downlo ... hp?id=1914

[_MAX_]

What about

Code: Select all

    union {
        HARDWARE_PTE                PageDirectoryPte; // +0x148
        UINT64                      Filler; // +0x148
    };

in _EPROCESS Block ?
because i want to find procX.exe Page Directory and Page Table it most accessible some how depend on process name! i want to locate specific process/thread s Page Directory/Page Table

[R00tKit]

find EPROCESS with name or PID so do this: (offset need fix)

Code: Select all

1: kd> !process
PROCESS ff981a58  SessionId: 0  Cid: 0d54    Peb: 7ffde000  ParentCid: 0550
    DirBase: 023406e0  ObjectTable: e1541510  HandleCount:  30.
 
1: kd>  dt nt!_EPROCESS ff981a58  Pcb.DirectoryTableBase
   +0x000 Pcb                    :
      +0x018 DirectoryTableBase     : [2] 0x23406e0

http://blogs.msdn.com/b/ntdebugging/arc ... sical.aspx