Techwiki:Ntoskrnl/MMVAD
MMVAD from Windows XP
// Protection bits: #define MM_ZERO_ACCESS 0 // this value is not used. #define MM_READONLY 1 #define MM_EXECUTE 2 #define MM_EXECUTE_READ 3 #define MM_READWRITE 4 // bit 2 is set if this is writable. #define MM_WRITECOPY 5 #define MM_EXECUTE_READWRITE 6 #define MM_EXECUTE_WRITECOPY 7
#define COMMIT_SIZE 19 // (32 bits system)
typedef struct _MMVAD_FLAGS {
ULONG_PTR CommitCharge : COMMIT_SIZE; // limits system to 4k pages or bigger!
ULONG_PTR PhysicalMapping : 1;
ULONG_PTR ImageMap : 1;
ULONG_PTR UserPhysicalPages : 1;
ULONG_PTR NoChange : 1;
ULONG_PTR WriteWatch : 1;
ULONG_PTR Protection : 5;
ULONG_PTR LargePages : 1;
ULONG_PTR MemCommit : 1;
ULONG_PTR PrivateMemory : 1; // used to tell VAD from VAD_SHORT
} MMVAD_FLAGS;
typedef struct _MMVAD_FLAGS2 {
ULONG_PTR FileOffset : 24;
ULONG_PTR SecNoChange : 1;
ULONG_PTR OneSecured : 1;
ULONG_PTR MultipleSecured : 1;
ULONG_PTR ReadOnly : 1;
ULONG_PTR LongVad : 1;
ULONG_PTR ExtendableFile : 1;
ULONG_PTR Inherit : 1;
ULONG_PTR CopyOnWrite : 1;
} MMVAD_FLAGS2;
typedef struct _MMVAD
{
ULONG_PTR StartingVpn;
ULONG_PTR EndingVpn;
struct _MMVAD *Parent;
struct _MMVAD *LeftChild;
struct _MMVAD *RightChild;
union
{
ULONG_PTR LongFlags;
MMVAD_FLAGS VadFlags;
} u;
PCONTROL_AREA ControlArea;
PMMPTE FirstPrototypePte;
PMMPTE LastContiguousPte;
union
{
ULONG LongFlags2;
MMVAD_FLAGS2 VadFlags2;
} u2;
} MMVAD, *PMMVAD;
