The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
In usermode I would normally implement this by reserving the desired maximum size of address-space, and incrementally committing as necessary to grow. ie.,:
Base = VirtualAlloc(..., 0x200000 /* Max size */, MEM_RESERVE) VirtualAlloc(Base + CurrentSize, 0x1000 /* Grow size */, MEM_COMMIT); CurrentSize += 0x1000;
I'm struggling however to understand the correct way to accomplish this in KM. My thought is that it should be fundamentally similar; grab a big chunk of system address-space, then to grow: allocate some physical pages for backing and map them (similar to how one would do it with AWE).
The technique I'm currently using entails:
MmAllocatePagesForMdlEx followed by
This does work, however:
MmMapLockedPagesWithReservedMapping specifies that the base address must be the base allocation (as returned by
MmAllocateMappingAddress) which thwarted his attempt (he reports it would bugcheck trying to pass an offsetted address). The problem is mine works, which suggests I'm doing something wrong -- driver verifier doesn't report anything, and nothing is blowing up.
MmAllocatePagesForMdlEx must be freed by providing the exact same MDL to
MmFreePagesFromMdl, which in this case would mean having to hold onto a potentially very large number of them. Is it maybe possible to, at teardown time, simply build an MDL describing the mapped region (since that PFN information previously in the MDLs would exist in the PTE) and free that?
|Upcoming OSR Seminars
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
|13-17 May 2024
|1-5 Apr 2024
|Internals & Software Drivers
|11-15 Mar 2024
|Writing WDF Drivers
|20-24 May 2024