How to judge whether two addresses are in same page or not in Windows? -
specifically, if @ different time, read addresses pointed esp register(containing stack top address), how judge 2 addresses in same page or not? believe these addresses physical addresses rather virtual addresses,right?the 2 readings might come different processes. how windows page allocation?
added:maybe got it. if use 4kb page, mean addresses 0x....xxxx0000 0x....xxxx1000 in same page?
you got right. idea sound, range 0x????0000
0x????0fff
. if use dword_ptr
or ulong_ptr
mask out lower 12bit (ptr & 0xfff)
, compare 2 pointer values got. ulong_ptr
, dword_ptr
should work both on x64 , x86.
keep in mind system using huge pages. make sure use getnativesysteminfo
and/or getsysteminfo
respectively. looking value of dwallocationgranularity
in system_info
structure.
all of true within same process memory space only.
concerning question physical addresses: no, repeat no, user mode process gets see actual physical addresses unless driver or kernel screws up.
assuming talking addresses in dlls cannot make proper assumptions shared pages starting vista , aslr feature.
Comments
Post a Comment