Cheat Engine

[tombana]

Hi, I have a question about the IsAddressSafe function in memscan.c.

[Dark Byte]

that's the way windows has setup the pagetable and pagedirs
They could have put the pagedir's in front of the pagetable's but they didn't, making this calculation easier (If they wanted they could have kept the pagedir even outside of virtual memory and completly randomized)

anyhow, with the current setup:
0xc0000000 = base of PTE
0xc0300000 (0xc0600000 in PAE mode) = base of PDE

you can check that by giving a address of 0

When you divide the address by 0x1000 you are left with only the first 20 bits of the address
PTESize is 4 in a non-PAE system and 8 in a PAE system
This gets us a index into the PTE list

Getting the entry that describes the PTE will be a PDE

[tombana]

Thanks for the reply.
I didn't realize that dividing by 0x1000 would get you the first 20 bits, I thought you had to do something like (Address << 20) or w/e.

So because the pagetables are in front of the pagedirs, and all the page tables are right after each other without spaces in between, that means: instead of first taking 10 bits to find the pde, and then the next 10 bits to find the pte, you can use those 20 bits together to find the pte right away.
Then you can get the address of the pde by taking the first 20 bits of the address of the pte. This means there are (0x300000/4=0xc0000) page table's possible.

Thank's for clearing this out for me.

By the way, Dark Byte, how did you figure these things out when making cheat engine? Did you make this calculation yourself or did you get it from a site?

[Dark Byte]

yes, there are 0xc0000 page tables possible, and each pagetable describe 4KB so a max of 0xC0000000 (3GB) can be addressed.

Of course, because windows uses several 4MB page dir entries (e.g for the kernel) more memory can be allocated, and the unused spaces that could be used for pagetables will used for app-data


I did find from a few sites that the pagetable started at 0xc0000000 but I did find out myself that the pagetable is directly followed by the pagedir (and optional pagedirptr table) by inspecting the CR3 register and querying the physical address using MmGetPhysicalAddress()

[tombana]

Nice work on finding that out (And everything else in cheatengine offcourse)
But what about a virtual address like 0xDEADBEAf (above 0xc0000000). Then if you divide that by 0x1000 and do it times 4, and add it to 0xc0000000, you'll get some address even above the page dir, right? How does that work?