Aftermath Labs · Mar 29, 2021

Hyperspace - Hidden Address Spaces

0Sign in to vote or save

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

Download link: Hyperspace Table Of Contents Introduction - Address Spaces Thread Scheduler - Trap Frames and Control Registers DKOM - Direct Kernel Object Manipulation Windows Memory Manager - MiStealPage Example - printf, malloc, etc Limitations - Crashes and Conclusions Introduction - Address Spaces An address space is defined as a region of memory. In this post I will be referring to an address…

Download link: Hyperspace

Introduction - Address Spaces
Thread Scheduler - Trap Frames and Control Registers
DKOM - Direct Kernel Object Manipulation
Windows Memory Manager - MiStealPage
Example - printf, malloc, etc
Limitations - Crashes and Conclusions

Introduction - Address Spaces

An address space is defined as a region of memory. In this post I will be referring to an address space in reference to a 64bit virtual address space on x86 architecture. Control Register Three (CR3) contains the PFN (Page Frame Number) of the current Page Map Level Four (PML4). It is also known as dirbase.

Read on /blog/29/03/2021/ ↗

Comments

Nothing yet. Say the first thing.