samedi 28 février 2015

Modify page table entry on Windows

For a stack address I have the following PDE / PTE info from Windgb:



kd> !pte 6EFFC
VA 0006effc
PDE at C0600000 PTE at C0000370
contains 0000000065D39867 contains 0000000000000020
pfn 65d39 ---DA--UWEV not valid
DemandZero
Protect: 1 - Readonly


How does WinDBG find out about the readonly state if even the PTE is not valid and how can it be changed? Has to be done via VAD?


Aucun commentaire:

Enregistrer un commentaire