Virtual memory endpoint

Support

Support for KasperskyOS

KasperskyOS Community Edition

Developing security policies

Methods of KasperskyOS core endpoints

Virtual memory endpoint

August 2, 2023

ID kernel_methods_vmm

Get as PDF

This endpoint is intended for managing virtual memory.

Information about methods of the endpoint is provided in the table below.

Methods of the vmm.VMM endpoint (kl.core.VMM interface)

Method	Method purpose and parameters	Potential danger of the method
`Allocate`	Purpose Allocates a virtual memory region (reserves and optionally maps it to physical memory). Parameters [in] `addr` – preferred base address of the virtual memory region, or `0` for the base address to be selected automatically. [in] `size` – size of the virtual memory region in bytes. [in] `flags` – flags defining the parameters of the virtual memory region and its allocation. [out] `va` – base address of the allocated virtual memory region. [out] `rc` – return code.	Allows the following: Exhaust the kernel memory by creating a multitude of objects within it. Exhaust the RAM.
`Commit`	Purpose Maps the virtual memory region (or part of it) reserved by the `Allocate` method to physical memory. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the virtual memory region in bytes. [in] `flags` – flags defining the parameters of the virtual memory region. [out] `rc` – return code.	Lets you exhaust RAM.
`Decommit`	Purpose Cancels mapping of the virtual memory region to physical memory. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the virtual memory region in bytes. [out] `rc` – return code.	N/A
`Protect`	Purpose Modifies the access rights to the virtual memory region. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the virtual memory region in bytes. [in] `flags` – flags defining the access rights to the virtual memory region. [out] `rc` – return code.	N/A
`Free`	Purpose Frees up the virtual memory region. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the virtual memory region in bytes. [out] `rc` – return code.	N/A
`Query`	Purpose Lets you get information about a virtual memory page. Parameters [in] `va` – address included in the virtual memory page. [out] `info` – sequence containing information about a virtual memory page. [out] `rc` – return code.	N/A
`MdlCreate`	Purpose Creates an MDL buffer. Parameters [in] `size` – size of the MDL buffer in bytes. [in] `prot` – flags defining the access rights to the MDL buffer. [out] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer. [out] `rc` – return code.	Allows the following: Exhaust the kernel memory by creating a multitude of objects within it. Exhaust the RAM.
`MdlCreateFromVm`	Purpose Creates an MDL buffer from physical memory that is mapped to the defined virtual memory region and maps the created MDL buffer to this region. Parameters [in] `va` – base address of the virtual memory region. [in] `size` – size of the MDL buffer in bytes. [in] `flags` – flags defining the access rights to the MDL buffer. [out] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer. [out] `rc` – return code.	Allows the following: Exhaust the kernel memory by creating a multitude of objects within it. Exhaust the RAM.
`MdlGetSize`	Purpose Gets the size of the MDL buffer. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer. [out] `size` – size of the MDL buffer in bytes. [out] `rc` – return code.	N/A
`MdlMap`	Purpose Maps an MDL buffer to a virtual memory region. Parameters [in] `handle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the MDL buffer. [in] `offset` – offset (in bytes) in the MDL buffer where mapping should start. [in] `length` – size (in bytes) of the part of the MDL buffer that needs to be mapped. [in] `hint` – preferred base address of the virtual memory region, or `0` for the base address to be selected automatically. [in] `prot` – flags defining the access rights to the virtual memory region. [out] `address` – base address of the virtual memory region. [out] `rc` – return code.	Allows the following: Create shared memory for interprocess communication concealed from the security module if multiple processes own the handles of one MDL buffer (the handle permissions masks must allow mapping of the MDL buffer). Exhaust the kernel memory by creating a multitude of objects within it.
`MdlClone`	Purpose Creates an MDL buffer based on an existing one. The MDL buffer is created from the same regions of physical memory as the original buffer. Parameters [in] `originHandle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the original MDL buffer. [in] `offset` – offset (in bytes) in the original MDL buffer where duplication should start. [in] `length` – size of the part of the original MDL buffer that needs to be duplicated. [out] `cloneHandle` – value whose binary representation consists of multiple fields, including a handle field and a handle permissions mask field. The handle identifies the created MDL buffer. [out] `rc` – return code.	Allows the kernel memory to be used up by creating a multitude of objects within it.

Did you find this article helpful?

What can we do better?

Thank you for your feedback! You're helping us improve.