Hello,
I found that my driver uses the old fashioned function
“MmMapLockedPages” which should be replaced with newer
“MmMapLockedPagesSpecifyCache”. For the newer function you need to
specify the cache type e.g. cached or not cached.
I wounder which cache type the old function implies. Does anyone know?
Thank you,
/Uwe
you can disassemble MmMapLockedPages,
804ff168 8bff mov edi,edi
804ff16a 55 push ebp
804ff16b 8bec mov ebp,esp
804ff16d 6a20 push 20h
804ff16f 6a01 push 1
804ff171 6a00 push 0
804ff173 6a01 push 1
804ff175 ff750c push dword ptr [ebp+0Ch]
804ff178 ff7508 push dword ptr [ebp+8]
804ff17b e85be9feff call nt!MmMapLockedPagesSpecifyCache (804edadb)
804ff180 5d pop ebp
804ff181 c20800 ret 8
you can see, it calls MmMapLockedPagesSpecifyCache with CacheType=1,it is
MmCached
danny