What is a Proto-PTE and how Windows VMM works with it

 typedef struct _SECTION

{

      struct _RTL_BALANCED_NODE SectionNode;

      UINT64 StartingVpn; //starting virtual page number of mapping
      UINT64 EndingVpn; //ending virtual page number

      union

      {

            struct _CONTROL_AREA* ControlArea; //ptr to corresponding control area

            struct _FILE_OBJECT* FileObject; //or to file object

            struct

            {

                  UINT64 RemoteImageFileObject : 1; //for remote files cases

                  UINT64 RemoteDataFileObject : 1;

            };

      }u1;

      UINT64 SizeOfSection; //size of section

      union

      {

            ULONG32 LongFlags;

            struct _MMSECTION_FLAGS Flags; //flags from ZwCreateSection

      }u;
      struct
      {

            ULONG32 InitialPageProtection : 12;

            ULONG32 SessionId : 19;

            ULONG32 NoValidationNeeded : 1;

      };

{

      struct _SEGMENT* Segment; //ptr to corresponding segment

      union

      {

            struct _LIST_ENTRY ListHead;

            VOID* AweContext;

      };

      UINT64 NumberOfSectionReferences; 

      UINT64 NumberOfPfnReferences;

      UINT64 NumberOfMappedViews; //count of sections that have been mapped with this CA

      UINT64 NumberOfUserReferences;

    ...

      union

      {

            struct

            {

                  union

                 {                                                                                         

                        ULONG32 NumberOfSystemCacheViews;

                        ULONG32 ImageRelocationStartBit;

                  };                                                                                        

                 union

                 {

                       LONG32 WritableUserReferences;

                       struct

                       {

                             ULONG32 ImageRelocationSizeIn64k : 16;

                             ULONG32 LargePage : 1;

                             ULONG32 AweSection : 1;

                             ULONG32 SystemImage : 1;

                             ULONG32 StrongCode : 2;

                             ULONG32 CantMove : 1;

                             ULONG32 BitMap : 2;

                             ULONG32 ImageActive : 1;

                             ULONG32 ImageBaseOkToReuse : 1;

                       };

                 };

                 union

                 {

                       ULONG32 FlushInProgressCount;

                       ULONG32 NumberOfSubsections;

                       struct _MI_IMAGE_SECURITY_REFERENCE* SeImageStub;

                 };

            }e2;

      }u2;

      ...                                                                            

}CONTROL_AREA, *PCONTROL_AREA; //defines section's properties that are actual for all clients

When a client requests unmap view of section operation, Windows just removes links to corresponding PPTE entries from process's PTE that describes a view of mapped section. Thus, PPTE is comfortable and universal interface for attaching view and detaching it from the specific process address space. And this is its major purpose. The Segment structure contains pointer to PPTE table as we can see below.

typedef struct _SEGMENT

{

      struct _CONTROL_AREA* ControlArea; //-> ptr to corresponding CA

      ULONG32      TotalNumberOfPtes;

      struct _SEGMENT_FLAGS SegmentFlags;

      UINT64 NumberOfCommittedPages;

      UINT64 SizeOfSegment;

      ...

      struct _MMPTE* PrototypePte; //-> PPTE table that are pointing to Subsections

}SEGMENT, *PSEGMENT;

Another key structure for understanding how Windows uses PPTE to work with Section (memory-mapped file) is so-called Subsection (nt!_SUBSECTION). Subsection is a data structure that contains a necessary information for calculation an offset inside mapped file via PPTEs, which are described this file. For usual binary file there is always (with some exceptions) a single subsection, but for an executable PE files there is one subsection for each PE section plus another one for PE header. A subsection is intended for storing memory protection constants for all PTEs that contain specific PE file section, i. e. VMM will assign to all PTEs that are pointed by Subsection memory protection constant from Sybsection structure.

All PPTEs are referencing to specific subsection, in case of mapping section as binary, all PPTEs will point to single subsection, in case of mapping section as executable, PPTEs will point to specific PE's section subsection. A subsection contains so-called starting sector field that describes beginning of specific section inside PE file (takes this value from PE header - Raw Section Offset / SECTOR_SIZE). Also a subsection contains a pointer to first PPTE in the PPTE table of specific Segment and total number of PPTEs for itself (i. e. number of pages for specific PE section that, in fact, represents its VirtualSize that is rounded to be multiple with PAGE_SIZE).

If we have address of  PPTE, we can easy calculate offset inside PE file that this PTE describes (as a distance between base and current PTE). If Pte variable is a pointer to current PPTE, than we can calculate an address of Subsection.

(((PUCHAR)Pte - (PUCHAR)Subsection->SubsectionBase) / sizeof(PTE)) << PAGE_SHIFT + Subsection->StartingSector * SECTOR_SIZE

If Subsection – address of subsection, than first PPTE describes, FirstPte = &Subsection->SubsectionBase[0], and last range, LastPte = &Subsection->SubsectionBase[Subsection->PtesInSubsection]. I. e. if X – address of the section in memory and its Pte, than &Subsection->SubsectionBase[0] <= Pte < &Subsection->SubsectionBase[Subsection->PtesInSubsection].

typedef struct _SUBSECTION
{
      struct _CONTROL_AREA* ControlArea;
      struct _MMPTE* SubsectionBase;
      struct _SUBSECTION* NextSubsection;
    ...                                                                             
      union
      {
            ULONG32 LongFlags;
            struct _MMSUBSECTION_FLAGS SubsectionFlags;
      }u;                                                                                         
      ULONG32 StartingSector;                                                               
      ULONG32 NumberOfFullSectors;                                                           
      ULONG32 PtesInSubsection;                                                             
     ...
}SUBSECTION, *PSUBSECTION;

                 
typedef struct _MMSUBSECTION_FLAGS
{
      struct
      {
            UINT16 SubsectionAccessed : 1;
            UINT16 Protection : 5;
            UINT16 StartingSector : 10;
      };                                                                       
      struct
      {
            UINT16 SubsectionStatic : 1;
            UINT16 GlobalMemory : 1;
            UINT16 Spare : 1;
            UINT16 OnDereferenceList : 1;
            UINT16 SectorEndOffset : 12;
      };                                                                       
}MMSUBSECTION_FLAGS, *PMMSUBSECTION_FLAGS;      

Let's take a real example.

> !process 0 0

PROCESS ffffca0cabb485c0

    SessionId: 0  Cid: 07d0    Peb: ef0697b000  ParentCid: 0338

    DirBase: 13692000  ObjectTable: ffffb981ce2b7380  HandleCount: 149.

    Image: VSSVC.exe

> !handle 0 3 ffffca0cabb485c0

0030: Object: ffffb981c8277a50  GrantedAccess: 00000003 (Inherit) Entry: ffffb981ce3c70c0

Object: ffffb981c8277a50  Type: (ffffca0ca8c71c50) Directory

    ObjectHeader: ffffb981c8277a20 (new version)

        HandleCount: 43  PointerCount: 1407269

        Directory Object: ffffb981c7c16b20  Name: KnownDlls

        Hash Address          Type                      Name

        ---- -------          ----                      ----

         00  ffffb981c8287c10 Section                   kernel32.dll

We can also take a real example from my coursework for 32bit Windows XP SP3. Let's take a specific cache slot, because creation of PPTE may be delayed in Ring 3 process before someone performed access to it. Print list of slots. For example, at my machine, the next items are existing. In this case, cache manager mapped binary system registry file named NTUSER.DAT. As this file is mapped as binary, here will exist only one subsection for it.

> dt _control_area 0x81853008 

nt!_CONTROL_AREA

   +0x000 Segment          : 0xe1559ba0 _SEGMENT

   +0x004 DereferenceList  : _LIST_ENTRY [ 0x0 - 0x0 ]

   +0x00c NumberOfSectionReferences : 1

   +0x010 NumberOfPfnReferences : 0xe5

   +0x014 NumberOfMappedViews : 4

   +0x018 NumberOfSubsections : 1

   +0x01a FlushInProgressCount : 0

   +0x01c NumberOfUserReferences : 0

   +0x020 u                : __unnamed

   +0x024 FilePointer      : 0x81749818 _FILE_OBJECT

   +0x028 WaitingForDeletion : (null) 

   +0x02c ModifiedWriteCount : 0

   +0x02e NumberOfSystemCacheViews : 4

Number of subsections – 1, because it was mapped as binary. 

As a result.

Get an offset, from which into slot of the cache files was mapped (E15B7208 - e15b7008) / 4 *1000 + 0 = 80000, as we can see in VACB.Protection bits for virtual pages are granting maximum rights - MM_EXECUTE_READWRITE as we can see into PPTE Protection fiels – 110, i. e. 6.

Let's take more interesting stuff with executable section ole32.dll.