win10 1909逆向----MiLocateAddress(查找虛擬地址的VAD)，再代碼實現。

//接下來用代碼實現，因爲懶，所以結構體能用就行，先上效果圖：

接着上代碼：

/*
功能：通過虛擬地址找到VAD【Virtual Address Descriptor虛擬地址描述符】
*/
#include <ntddk.h>


typedef struct _EX_PUSH_LOCK
{
	union
	{
		struct
		{

			UINT64 Locked : 1;
			UINT64 Waiting : 1;
			UINT64 Waking : 1;
			UINT64 MultipleShared : 1;
			UINT64 Shared : 60;
		};
		UINT64 Value;
		PVOID Ptr;
	};
}EX_PUSH_LOCK, *PEX_PUSH_LOCK;

typedef struct _MMVAD_SHORT
{

	RTL_BALANCED_NODE VadNode;
	UINT32 StartingVpn;
	UINT32 EndingVpn;
	UCHAR StartingVpnHigh;
	UCHAR EndingVpnHigh;
	UCHAR CommitChargeHigh;
	UCHAR SpareNT64VadUChar;
	INT32 ReferenceCount;
	EX_PUSH_LOCK PushLock;
	//下面用不到，省略
	UINT64 x1;
	UINT64 x2;

}MMVAD_SHORT, *PMMVAD_SHORT;

typedef struct _MMVAD
{
	MMVAD_SHORT Core;
	union
	{
		UINT32 LongFlags2;
		//現在用不到省略
		//MMVAD_FLAGS2 VadFlags2;

	}u2;
	PVOID Subsection;
	PVOID FirstPrototypePte;
	PVOID LastContiguousPte;
	LIST_ENTRY ViewLinks;
	PEPROCESS VadsProcess;
	PVOID u4;
	PVOID FileObject;
}MMVAD, *PMMVAD;

PMMVAD  MiLocateAddress(IN PVOID VirtualAddress, IN PEPROCESS pEprocess);

VOID Unload(PDRIVER_OBJECT pDriverObject)
{
	KdPrint(("end\n"));
	
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{

	NTSTATUS status = STATUS_SUCCESS;
	pDriverObject->DriverUnload = Unload;
	KdPrint(("start\n"));
    //首先找到要查找哪個進程的哪個虛擬地址
	PMMVAD Ret=MiLocateAddress((PVOID)0x400004,(PEPROCESS)0xffffdf8191cda080);
	KdPrint(("%llx\n", Ret));


	return status;
}
PMMVAD MiLocateAddress(IN PVOID VirtualAddress, IN PEPROCESS pEprocess)
{
	//首先得到進程的VADHINT，看是否有VAD命中,這樣就不需要從頭找起
	PMMVAD VadHint =(PMMVAD)(*(PUINT64)((UINT64)pEprocess + 0x660));
	PMMVAD VadRoot = (PMMVAD)(*(PUINT64)((UINT64)pEprocess + 0x658));
	if (VadHint == NULL)
	{
		return 0;
	}

	PUCHAR Vpn = (PUCHAR)((UINT64)VirtualAddress >> PAGE_SHIFT);
	//如果VPN在VADHINT範圍內，直接返回VadHint
	if ((Vpn >= ((UINT64)VadHint->Core.StartingVpnHigh << 32 | VadHint->Core.StartingVpn)) && (Vpn <= ((UINT64)VadHint->Core.EndingVpnHigh << 32 | VadHint->Core.EndingVpn)))
		return VadHint;

	//否則，從VadRoot開始遍歷
	while (TRUE)
	{
		if (Vpn > (VadRoot->Core.EndingVpnHigh << 32 | VadRoot->Core.EndingVpn))
		{
			VadRoot = VadRoot->Core.VadNode.Right;
		}
		else
		{
			if (Vpn >= (VadRoot->Core.StartingVpnHigh << 32 | VadRoot->Core.StartingVpn))
			{
				return VadRoot;
			}
			VadRoot = VadRoot->Core.VadNode.Left;
		}
		if (!VadRoot) return 0;
	}

	return 0;
}