Re: KdVersionBlock in x64
PostPosted:Sun Jan 22, 2012 10:24 pm
Changed as purposed but still nothing:
Code: Select all
Any more ideas? Also, the members in debuggerdata are pointers or the actual value? Because MmHighestUserAddress is declared as PVOID, so it is a pointer not the value, whereas the member in the debuggerdata might be the actual data?void findKdDebuggerBlock(PDRIVER_OBJECT DriverObject) {
DWORD bytesScanned;
DWORD sectionSize = 0;
PVOID kernelbase = GetNtosBaseAddr(DriverObject);
PVOID sectionAddress = GetDataSectionAddress(kernelbase, §ionSize);
char *debugData = (char *)sectionAddress;
for(bytesScanned = 0; bytesScanned < sectionSize; bytesScanned++) {
if(((PKDDEBUGGER_DATA64)debugData)->MmHighestUserAddress == MmHighestUserAddress &&
((PKDDEBUGGER_DATA64)debugData)->MmSystemRangeStart == MmSystemRangeStart &&
((PKDDEBUGGER_DATA64)debugData)->MmUserProbeAddress == MmUserProbeAddress ) {
DbgPrint("Found KDEVERSIOIN BLOCK AT 0x%p\n", debugData);
break;
}
debugData++;
}
DbgPrint("Exhausted search space and found nothing\n");
}