Absolute address

This may be a very stupid question, but I've no idea where to find the answer so if you guys could help me out I'd be very great full.

Does anyone know how to get the absolute address of a running image in memory?

Assume that I have all the data available about this program (PE, size, path, name, register you name it)

Any api's to help me find the correct address?
(I'm not injected, and I'm in user mode)

PsSetLoadImageNotifyRoutine(LoadImageNotifyCallBac k);

VOID LoadImageNotifyCallBack(
IN PUNICODE_STRING FullImageName,
IN HANDLE ProcessId, // where image is mapped
IN PIMAGE_INFO ImageInfo
);

http://msdn.microsof*****m/en-us/library/ff559957.aspx

Or

PHYSICAL_ADDRESS MmGetPhysicalAddress(
__in PVOID BaseAddress
);

http://msdn.microsof*****m/en-us/libr...=VS.85%29.aspx

This was one of the reasons I gave up on drivers cause the documentation sucks and google has few results

All I know is RVA's, VA's, and Raw Data Offset. What would a Absoulute address be?

Originally Posted by why06

All I know is RVA's, VA's, and Raw Data Offset. What would a Absoulute address be?

Virtual Address = address relative to the address space of that image in memory(as in 0x00000000 - 0xFFFFFFFF)

Absolute/Physical(?) address = address relative to how the OS has them loaded, as in if you add enough bytes you're in the address space of the next process.

I guess thats what the OP means at least =3

Oh the real physical address that the kernel manages. why would you need that? I'm sure you might be able to fin it using some undocumented kernel function, but since all programs run in Virtual Memory, and things are move in and out of memory as the kernel sees fit, It's hard to even be sure it will still be there once you find it. =/

Originally Posted by Hell_Demon

PsSetLoadImageNotifyRoutine(LoadImageNotifyCallBac k);

VOID LoadImageNotifyCallBack(
IN PUNICODE_STRING FullImageName,
IN HANDLE ProcessId, // where image is mapped
IN PIMAGE_INFO ImageInfo
);

PsSetLoadImageNotifyRoutine (Windows Driver Kit)

Or

PHYSICAL_ADDRESS MmGetPhysicalAddress(
__in PVOID BaseAddress
);

MmGetPhysicalAddress (Windows Driver Kit)

This was one of the reasons I gave up on drivers cause the documentation sucks and google has few results

(I'm not injected, and I'm in user mode)

But I'll look them up for kernel mode

Page table - Wikipedia, the free encyclopedia that might be interesting as well =3

Absolute address

Post a Reply

Tags for this Thread