Re: Q: What mechanism SoftICE BPR uses?

[nmotohiko@...]

Hello Ptasiek.

Thanks for your reply.

Through your explanation and program, I can roughly understand the BPR mechanism.

In following test cases, I look the PTE(Page Table Entry) of the page with D command of SoftICE.

(Test Case 1)
Using VirtalProtect(PAGE_NOACCESS), the PTE of the page is changed.
s/u flag is set to s(supervisor). When the page is accessed, Page Fault Exception raised.

(Test Case 2)
Using BPR, the PTE is not changed. s/u flag is u(user).
But checking with VirtualQuery, the page type is PAGE_NOACCESS. 

(Test Case 3)
Using BPR and VirtualProtect(PAGE_NOACCESS) to the same page, the PTE is not changed.
s/u flag is u. Exception doesn't raise.

Probably, SoftICE fool me. s/u flag must be set to s.