search

DarthTon / Blackbone

Windows memory hacking library
MIT License
4.85k stars 1.34k forks source link

Small question about changing PTE entry #437

Open elchv opened 4 years ago

elchv commented 4 years ago

Hello, i have a small question about PTE/PDE, whenever you change PTE/PDE shouldn't flush tlb? For example at this line: https://github.com/DarthTon/Blackbone/blob/43bc59f68dc1e86347a76192ef3eadc0bf21af67/src/BlackBoneDrv/Routines.c#L498, you remove NX but doesn't flush tlb, has any problem if you doesn't flush tlb after disable NX in PTE?

ghost commented 3 years ago

The processor does not consult these tables for each virtual address generated, instead caching them in a structure called Translation Lookaside Buffer, or TLB. However, when changes to the page tables are made, the TLB needs to be flushed. On Intel 80386 processors, this flush would be done by reloading (mov) CR3 with the top level page directory address, or a task switch. This supposedly unconditionally flushes all the TLB entries.