/cr3spy

Demo LKM to return a process's page table base register on x86/x86_64

Primary LanguageCMIT LicenseMIT

Kernel module for probing cr3

Extracted from old student code for Virtual Machine-Provided Context Sensitive Page Mappings, from way back. This project simply defines a kernel module that allows probing the process's cr3 register (i.e., the page table base register) via character device.

Usage

Requires, of course, Linux kernel headers for LKM development. Building & installing the module are straightforward:

make
insmod ./cr3spy_mod.ko
mknod /dev/cr3spy c 200 0

The probe subdirectory reads the cr3 register value via the character device and writes it to stdout.

License

MIT? Sure, MIT. I guess also Copyright © 2007-2015 Nathan Rosenblum.