简体   繁体   中英

Protection before reading paged memory from kernel

I have kernel driver and I want to read the memory of a usermode app.

How can I check the paged memory if swapping will be success or not (when pages are written to the disk and we have problems with disk or whatever)?

@RbMm's answer is correct. If you are not at dispatch level, you wrap the probing of the memory in a __try/__except block with the filter set to catch the exception. You need to figure out from the exception or Mm whether the page is indeed not-present due to being completely invalid (ie, never allocated) or paged-out/demand-zero-inited/copy-on-write/etc.

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM