Kernel API for Reliable Physical Address Validation

62 Views Asked by At

Attempting to validate a physical address before performing a Physical->Virtual Buffer read in kernelmode. I figure, similarly to MmIsAddressValid there are exports which assist in the querying of a physical addresses validity. However I don't know them and cannot seem to find any readily available documentation on this let alone physical memory to begin with.

Basic Memory Copy Function

BOOL ReadPhysicalAddress(PVOID TargetAddress, PVOID Buffer, SIZE_T Size)
{
    memcpy(Buffer, TargetAddress, Size);
    return TRUE;
}

Personal Attempt at Address Validation

BOOL ReadPhysicalAddress(PVOID TargetAddress, PVOID Buffer, SIZE_T Size)
{
    PHYSICAL_ADDRESS TargetPhysicalAddress = { 0 };
    TargetPhysicalAddress.QuadPart = (LONGLONG)TargetAddress;

    LOGICAL IoSpaceActive = MmIsIoSpaceActive(TargetPhysicalAddress, Size); //Always 0?
    if (!IoSpaceActive)
        return FALSE;

    memcpy(Buffer, TargetAddress, Size);
    return TRUE;
}

Minimal Reproducible Example

...
short int MzValid;
ReadPhysicalAddress((PVOID)0xINSERTADDRESS, &MzValid, sizeof(MzValid)); //INSERTADDRESS = Any valid physical base address of a running system module

if (MzValid == 23117) //MZ
{
     DebugPrint("Valid MZ Read"); //Validate read functionality
}

ReadPhysicalAddress((PVOID)0x0, &MzValid, sizeof(MzValid)); //Purposely pass invalid address

DebugPrint("Invalid Address Caught"); //Otherwise we BSOD

All I am asking here, is for advice and or guidance on how to best validate a physical address passed, without needing to use different physical memory access functions (such as MmCopyMemory).

0

There are 0 best solutions below