[COLOR="Black"][B]// Default is a 300 second life span for modified mapped pages -
// This can be overridden in the registry.
//

[FONT="微软雅黑"]ULONG MmModifiedPageLifeInSeconds = 300;[/FONT][/B][/COLOR]

[FONT="微软雅黑"][SIZE="4"][COLOR="Black"]HANDLE ThreadHandle;
 if (!NT_SUCCESS(PsCreateSystemThread (&ThreadHandle,
                                          THREAD_ALL_ACCESS,
                                          &ObjectAttributes,
                                          0,               [B] //第 4 个参数（HANDLE  ProcessHandle）指明要在哪个进程中创建系统线程，如果此参数为 NULL，就在 System 进程中创建系统线程。[/B]
                                          NULL,
                                          MiDereferenceSegmentThread,
                                          NULL))) {
        return FALSE;
    }
  ZwClose (ThreadHandle);[/COLOR][/SIZE][/FONT]

[FONT="微软雅黑"][SIZE="4"]1: kd> !vm
*** Virtual Memory Usage ***
Physical Memory: 851757 ( 3407028 Kb)
Page File: \??\C:\pagefile.sys
Current: 3407028 Kb Free Space: 3407024 Kb
Minimum: 3407028 Kb Maximum: 4193280 Kb
Available Pages: 699186 ( 2796744 Kb)
ResAvail Pages: 757454 ( 3029816 Kb)
Locked IO Pages: 0 ( 0 Kb)
Free System PTEs: 370673 ( 1482692 Kb)
Modified Pages: 9799 ( 39196 Kb)
Modified PF Pages: 9798 ( 39192 Kb)
NonPagedPool Usage: 0 ( 0 Kb)
NonPagedPoolNx Usage: 8735 ( 34940 Kb)
NonPagedPool Max: 522368 ( 2089472 Kb)
PagedPool 0 Usage: 17573 ( 70292 Kb)
PagedPool 1 Usage: 2417 ( 9668 Kb)
PagedPool 2 Usage: 0 ( 0 Kb)
PagedPool 3 Usage: 0 ( 0 Kb)
PagedPool 4 Usage: 28 ( 112 Kb)
PagedPool Usage: 20018 ( 80072 Kb)
PagedPool Maximum: 523264 ( 2093056 Kb)
Session Commit: 6218 ( 24872 Kb)
Shared Commit: 18591 ( 74364 Kb)
Special Pool: 0 ( 0 Kb)
Shared Process: 2151 ( 8604 Kb)
PagedPool Commit: 20031 ( 80124 Kb)
Driver Commit: 4531 ( 18124 Kb)
Committed pages: 179178 ( 716712 Kb)
Commit limit: 1702548 ( 6810192 Kb)
Total Private: 66073 ( 264292 Kb)
0a30 CCC.exe 11078 ( 44312 Kb)
0548 dwm.exe 6548 ( 26192 Kb)
091c MOM.exe 6103 ( 24412 Kb)[/SIZE][/FONT]

[FONT="微软雅黑"][SIZE="4"]C:\temp>testlimit -r 1 -c 800
Testlimit v5.2 - test Windows limits
Copyright (C) 2012 Mark Russinovich
Sysinternals - w600K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4&6M7$3W2F1N6r3g2J5L8X3q4D9M7#2)9J5k6h3y4G2L8b7`.`.
Process ID: 1544
Reserving private bytes 1 MB at a time ...
Leaked 800 MB of reserved memory (800 MB total leaked). Lasterror: 0
The operation completed successfully.[/SIZE][/FONT]

[FONT="微软雅黑"][SIZE="4"]C:\temp>testlimit -m 1 -c 800
Testlimit v5.2 - test Windows limits
Copyright (C) 2012 Mark Russinovich
Sysinternals - wa1fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4y4&6M7$3W2F1N6r3g2J5L8X3q4D9M7#2)9J5k6h3y4G2L8b7`.`.
Process ID: 2828
Leaking private bytes 1 KB at a time ...
Leaked 800 MB of private memory (800 MB total leaked). Lasterror: 0
The operation completed successfully.[/SIZE][/FONT]

[FONT="微软雅黑"][SIZE="4"][COLOR="Black"]HANDLE CreateFileMapping(
  HANDLE hFile,
  LPSECURITY_ATTRIBUTES lpFileMappingAttributes,
  DWORD flProtect,
  DWORD dwMaximumSizeHigh,
  DWORD dwMaximumSizeLow,
  LPCTSTR lpName 
);[/COLOR][/SIZE][/FONT]

[FONT="微软雅黑"][SIZE="4"][COLOR="Black"]typedef struct _SECURITY_ATTRIBUTES {
  DWORD  nLength;
  LPVOID lpSecurityDescriptor;      //只有该成员与安全性有关
  BOOL   bInheritHandle;
} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES;[/COLOR][/SIZE][/FONT]

[培训]科锐逆向工程师培训第53期2025年7月8日开班！