4MB to 1024 x 4KB...

By: c0de90e7


Have you used pagetable tricks ( INT 0Eh hooking + P bit clearing in PTEs ) for execution breakpoints in code pages ?

This is something I wrote some time ago when playing around with pagetable tricks. Now I have added some comments and ascii art schematics, but it is far from being good enough for general use out of PoC field...

Well, back then, I was experimenting all kind of page tricks and one thing I thought of was using page tricks for executable code breakpoints ( i.e., not data access ones but code execution access ones, why ? because I wanted to do hooks without touching the code itself -similar to DRx...- ).

So I implemented the thing and everything was fine... until I tried the experiments in a machine with far more ram... ntoskrnl.exe module was mapped into a 4MB page so problems were evident:

- If I wanted to put a breakpoint in, say, ntosknrl.exe!NtOpenFile and ntoskrnl.exe was mapped in a 4MB page, I would need to mark the whole 4MB page as nonpresent, making the OS almost unable to run with that many pagefaults.

- INT 0Eh handler itself was into that 4MB page, so even if I hooked INT 0Eh by IDT entry manipulation, many problems would arise...

- Other later and more subtle problems which I don't fully remember, but not important, since first problem already made the thing unviable...

So I thought, ok, I could disable 4MB page use in boot time ( by registry keys and in other ways ) and it would be ok. But that wouldn't do in direct load scenarios, I need to split those 4MB pages on the fly.

That's what led me to write the routine:

http://www.rootkit.com/vault/c0de90e7/SPLIT4M-4K.INC

The theory behind it is pretty simple, as the tittle says, just change the 4MB PDE into a 1024x4KB PDE and create a PT with 1024 PTEs that map the same physical address space by aliasing those 4MBs.

It was written in NASM ( I use NASM whenever I experiment with stuff or have an idea... ). I might write a driver in C and implement this and PAE supporting routines also, I don't know.

P.S.: Just in case you someone wonders... when I try ideas and so on that need ring0, I use a small loader that goes ring0 by /Device/PhysicalMemory edition. It's just a quick&easy template for NASM experiments