[g4mbit]

Yes. I've looked into that already.

Non-Paged Pool

Non-Paged pool region starts immediately after the PFN database. The start of non-paged pool is stored in nt!MmNonPagedPoolStart. MiObtainSystemVa() allocates from this area when called with MiVaNonPagedPool. Allocations in this region are controlled by nt!MiNonPagePoolVaBitmap and the allocation hint is stored at nt!MiNonPagedPoolVaBitMapHint.

So about the 2nd part, the MmNonPagedPoolStart is actually stored in the PKDDEBBUGGER_DATA64 (KPCR->KdVersionBlock->DebuggerDataList->Flink)

From WinDbg

Code: Select all

kd> ? MmNonPagedPoolStart
Evaluate expression: -2103791316 = 829ab12c
kd> ? poi(MmNonPagedPoolStart)
Evaluate expression: -2079322112 = 84101000

From kernel driver

Code: Select all

//listEntry->MmNonPagedPoolStart is 0x829ab12c that is pointing to 0x84101000

So we got 2 pieces of data pointing to the same value and that would be that either 0x829ab2c or 0x84101000 would be the start of something.

From WinDbg

Code: Select all

kd> db 0x84101000
84101000    ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff
...
84101070    ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff
kd> db 0x829ab12c
829ab12c    00 10 10 84 00 f0 8f 02-ff e4 02 00 00 fc 07 00
829ab13c    00 10 10 84 00 00 00 80-00 00 00 00 01 00 00 00
829ab14c    88 30 40 c0 00 00 00 00-00 00 00 00 00 00 00 00
829ab15c    00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00
...
829ab19c    00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00

So it seems like 0x84101000 is the beginning of something and not a _POOL_DESCRIPTOR since the first field is supposed to be the PoolType and that it looks more like a bitfield. What structure could it be?

[g4mbit]

So I did get some relevant data from all this past research (and especially while going through this: http://mista.nu/research/kernelpool_infiltrate2011.pdf).

However, looking at what poolmon (http://msdn.microsoft.com/en-us/library ... 85%29.aspx) retrieves, I don't have near the same amount of data from the pools. I know poolmon uses NtQuerySystemInformation with SystemPoolTagInformation, but this only gives an overview of what is used (not the details of every entry, what I'm precisely trying to get).

Any ideas on how to retrieve individual pools allocated that would match what poolmon is getting?

Thanks
g4mbit