How to flush/allocate virtual memory mapped with MmMapViewInSystemSpace?

NTFSD
1

I can map view in system space with MmMapViewInSystemSpace, but i can’t flush this view with ZwFlushVirtualMemory, i got STATUS_INVALID_PARAMETER_2 (PVOID *BaseAddress).
I tried to call it for Kernel process.

For ZwMapViewOfSection ZwFlushVirtualMemory, works, for MmMapViewInSystemSpace - not.

I assume that ZwFlushBuffersFile + ZwClose is not enough, i need to flush Virtual Memory also.

The same issue with ZwAllocateVirtualMemory for view mapped with MmMapViewInSystemSpace to extend view after creation.

2

NtFlushVirtualMemory worked only with ‘user space’ BaseAddress.
exist next check

…
PVOID CapturedBaseAddress = *BaseAddress;
…
if (CapturedBaseAddress > MmHighestUserAddress) return STATUS_INVALID_PARAMETER_2;
…

when MmMapViewInSystemSpace used for map CapturedBaseAddress > MmHighestUserAddress is true. need be call direct MmFlushVirtualMemory, but this function not exported…
dont know what here can be done

3

Call CcFlushCache, it will flush the backing section for you even if it isn’t mapped through the cache.

Tony
OSR