// 得到ring3传入的虚拟地址size_t* pOutAddress = (size_t*)MmGetSystemAddressForMdlSafe(pIrp->MdlAddress, NormalPagePriority);VIRTUAL_ADDRESS virtualAddress = { 0 };virtualAddress.ulVirtualAddress = *pOutAddress;ULONG pdbr;_asm{mov eax,  cr3;mov pdbr, eax;}PHYSICAL_ADDRESS phyAddress = { 0 };phyAddress.LowPart = pdbr;PULONG pPdbr = (PULONG)MmMapIoSpace(phyAddress, sizeof(PHYSICAL_ADDRESS), MmNonCached);KdPrint(("pdbr = 0x%08X, 映射后的地址0x%p\n", pdbr, pPdbr));// pPdbr[ulDirBaseIdx] 页目录项ULONG ulDirBaseIdx = virtualAddress.stVirtualAddress.dirBaseIndex;ULONG ulDirIdx = virtualAddress.stVirtualAddress.dirIndex;KdPrint(("第一级，已找到页目录所在项:pPdbr[%d]:0x%08X", ulDirBaseIdx,pPdbr[ulDirBaseIdx]));ULONG ulDir = pPdbr[ulDirBaseIdx] & 0xFFFFF000;            // 抹去后3位得到真正的页目录项
ULONG ulDirPlus = ulDir + ulDirIdx * 4;                    // 页表项phyAddress.LowPart = ulDirPlus;PULONG pDirPlus = (PULONG)MmMapIoSpace(phyAddress, sizeof(PHYSICAL_ADDRESS), MmNonCached);KdPrint(("第二级，已找到页表项:ulDirPlus = 0x%08X, 映射后的地址0x%p\n", ulDirPlus, pDirPlus));ULONG ulPageTable = *pDirPlus & 0xFFFFF000;                // 抹去后3位得到真正的页表项// 得到物理地址ULONG ulPhyAddress = ulPageTable + virtualAddress.stVirtualAddress.offset;// 映射为虚拟地址，获取其值进行验证phyAddress.LowPart = ulPhyAddress;PWCHAR pPhyAddress = (PWCHAR)MmMapIoSpace(phyAddress, sizeof(PHYSICAL_ADDRESS), MmNonCached);KdPrint(("虚拟地址：0x%08X, 对应物理地址：0x%08X, Value:%S\n", *pOutAddress, ulPhyAddress, pPhyAddress));// 传出对应物理地址*pOutAddress = ulPhyAddress;

            // 得到传入的ring3层虚拟地址size_t* pOutAddress = (size_t*)MmGetSystemAddressForMdlSafe(pIrp->MdlAddress, NormalPagePriority);VIRTUAL_ADDRESS virtualAddress = { 0 };virtualAddress.ulVirtualAddress = *pOutAddress;ULONG pdbr;// 得到页目录指针物理地址
            _asm{mov eax,  cr3;mov pdbr, eax;}// 映射为虚拟地址以便取值PHYSICAL_ADDRESS phyAddress = { 0 };phyAddress.LowPart = pdbr;PULONG pPdbr = (PULONG)MmMapIoSpace(phyAddress, sizeof(PHYSICAL_ADDRESS), MmNonCached);KdPrint(("pdbr = 0x%08X, 映射后的地址0x%p\n", pdbr, pPdbr));// 定位页目录指针表并获取页目录表物理页地址// ulDirAddress 为页目录表物理页地址ULONG ulPointerIdx = virtualAddress.stVirtualAddress.dirPointer;ULONG ulDirBaseAddress = pPdbr[ulPointerIdx];ulDirBaseAddress &= 0xFFFFF000;            // 中间物理地址// 定位页表项ULONG ulDirAddress = ulDirBaseAddress + virtualAddress.stVirtualAddress.dirIndex * 0x8;phyAddress.LowPart = ulDirAddress;PULONG pPageTable = (PULONG)MmMapIoSpace(phyAddress, sizeof(PHYSICAL_ADDRESS), MmNonCached);ULONG ulPageTable = *pPageTable;ulPageTable &= 0xFFFFF000;                 // 中间物理地址// 定位物理页面ulPageTable += virtualAddress.stVirtualAddress.tableIndex * 0x8;phyAddress.LowPart = ulPageTable;PULONG pPageBase = (PULONG)MmMapIoSpace(phyAddress, sizeof(PHYSICAL_ADDRESS), MmNonCached);ULONG ulPageBase = *pPageBase;ulPageBase &= 0xFFFFF000;// 得到物理地址ULONG ulPhyAddress = ulPageBase + virtualAddress.stVirtualAddress.offset;// 映射为虚拟地址，获取其值进行验证phyAddress.LowPart = ulPhyAddress;PWCHAR pPhyAddress = (PWCHAR)MmMapIoSpace(phyAddress, sizeof(PHYSICAL_ADDRESS), MmNonCached);KdPrint(("虚拟地址：0x%08X, 对应物理地址：0x%08X, Value:%S\n", *pOutAddress, ulPhyAddress, pPhyAddress));// 传出对应物理地址*pOutAddress = ulPhyAddress;pIrp->IoStatus.Information = cout;

#define BUFFERSIZE    0x3000
char g_szMemInfo[BUFFERSIZE] = { 0 };// 以下code在 DriverEntry 中
    DWORD dwPE  = 0;                // Protection Enable    cr0[0]DWORD dwWP  = 0;                // Write Protect        cr0[16]DWORD dwPG  = 0;                // Paging                cr0[31]DWORD dwPAE = 0;                // 物理地址扩展            cr4[5]DWORD dwPSE = 0;                // Page Size Extension    cr4[4]DWORD dwCr0 = 0;DWORD dwCr4 = 0;// 注册卸载函数pDriverObj->DriverUnload = driverUnload;_asm{pushad;mov eax, cr0;mov dwCr0, eax;// PE标志位and eax, 0x01;mov dwPE, eax;mov eax, cr0;// WP标志位and eax, 0x10000;mov dwWP, eax;mov eax, cr0;// PG标志位and eax, 0x80000000;mov dwPG, eax;// PAE//mov eax, cr4; 机器码如下_emit 0x0F;_emit 0x20;_emit 0xE0;mov dwCr4, eax;and eax, 0x20;mov dwPAE, eax;// PSE_emit 0x0F;_emit 0x20;_emit 0xE0;and eax, 0x10;mov dwPSE, eax;popad;}KdPrint(("PE  = 0x%08X\r\n",dwPE));KdPrint(("WP  = 0x%08X\r\n",dwWP));KdPrint(("PG  = 0x%08X\r\n",dwPG));KdPrint(("PAE = 0x%08X\r\n",dwPAE));KdPrint(("PSE = 0x%08X\r\n",dwPSE));KdPrint(("Cr0 = 0x%08X\r\n",dwCr0));KdPrint(("Cr4 = 0x%08X\r\n",dwCr4));//----------------------------------------------------------------------------// PE标志位if (0 != dwPE){RtlStringCchCatNA(g_szMemInfo, BUFFERSIZE, "----------------------保护模式(PE=1)-------------------\r\n",BUFFERSIZE - sizeof("----------------------保护模式(PE=1)-------------------\r\n"));}else{RtlStringCchCatNA(g_szMemInfo,BUFFERSIZE ,"----------------------实地址模式(PE=0)-------------------\r\n",BUFFERSIZE - sizeof("----------------------实地址模式(PE=0)-------------------\r\n"));}//----------------------------------------------------------------------------// WP标志位if (0 != dwWP){RtlStringCchCatA(g_szMemInfo,BUFFERSIZE,"内存写保护(WP)开启...\r\n");}else{RtlStringCchCatA(g_szMemInfo,BUFFERSIZE,"内存写保护(WP)禁止...\r\n");}//----------------------------------------------------------------------------// PG标志位if (0 != dwPG){RtlStringCchCatA(g_szMemInfo,BUFFERSIZE,"页机制(PG)启用\r\n");}else{RtlStringCchCatA(g_szMemInfo,BUFFERSIZE,"页机制(PG)禁止\r\n");}//----------------------------------------------------------------------------// PAE标志位if (0 != dwPAE){RtlStringCchCatA(g_szMemInfo,BUFFERSIZE,"物理地址扩展(PAE)已开启\r\n");}else{RtlStringCchCatA(g_szMemInfo,BUFFERSIZE,"物理地址扩展(PAE)未启用\r\n");}//----------------------------------------------------------------------------// PSE标志位if (0 != dwPSE){RtlStringCchCatA(g_szMemInfo,BUFFERSIZE,"页面大小扩展(PSE)已开启\r\n");}else{RtlStringCchCatA(g_szMemInfo,BUFFERSIZE,"页面大小扩展(PSE)未启用\r\n");}KdPrint(("%s\r\n", g_szMemInfo));