Posted on
the addr in usermode and kernel mode it different. so while passing pointer to kernel mode, we should just pass a uint64 var to it.
then we can get it through function as a var.
it is more like a offset, later we can locate it.
argaddr works same like argint, it capture the arg of syscall from proc sturcture
then we can get the real address of the virtual address by its pagetable and offset easily
memmove part is pretty simple, kernel mode has the right to access all address
Join Lazar for a hands-on session where you’ll build it, break it, debug it, and fix it. You’ll set up Sentry, track errors, use Session Replay and Tracing, and leverage some good ol’ AI to find and fix issues fast.
For further actions, you may consider blocking this person and/or reporting abuse
Our desktop app, with its intelligent copilot, streamlines coding by generating snippets, extracting code from screenshots, and accelerating problem-solving.
Aarav Joshi -
Juan Blasco -
JetThoughts Dev -
DPC -
Top comments (0)