| 63 | } |
| 64 | |
| 65 | void vdm_ctx::locate_syscall(std::uintptr_t address, std::uintptr_t length) const |
| 66 | { |
| 67 | const auto page_data = |
| 68 | reinterpret_cast<std::uint8_t*>( |
| 69 | VirtualAlloc( |
| 70 | nullptr, |
| 71 | PAGE_4KB, MEM_COMMIT | MEM_RESERVE, |
| 72 | PAGE_READWRITE |
| 73 | )); |
| 74 | |
| 75 | for (auto page = 0u; page < length; page += PAGE_4KB) |
| 76 | { |
| 77 | if (vdm::syscall_address.load()) |
| 78 | break; |
| 79 | |
| 80 | if (!read_phys(reinterpret_cast<void*>(address + page), page_data, PAGE_4KB)) |
| 81 | continue; |
| 82 | |
| 83 | // check the first 32 bytes of the syscall, if its the same, test that its the correct |
| 84 | // occurrence of these bytes (since dxgkrnl is loaded into physical memory at least 2 times now)... |
| 85 | if (!memcmp(page_data + nt_page_offset, ntoskrnl + nt_rva, 32)) |
| 86 | if (valid_syscall(reinterpret_cast<void*>(address + page + nt_page_offset))) |
| 87 | syscall_address.store( |
| 88 | reinterpret_cast<void*>( |
| 89 | address + page + nt_page_offset)); |
| 90 | } |
| 91 | VirtualFree(page_data, PAGE_4KB, MEM_DECOMMIT); |
| 92 | } |
| 93 | |
| 94 | bool vdm_ctx::valid_syscall(void* syscall_addr) const |
| 95 | { |
nothing calls this directly
no test coverage detected