如何获得CR3值？
我怎样才能得到CR3值？
此外，我怎样才能获得进程A（比如Firefox）的CR3值？
有什么命令可以用来读取当前的 CR3 吗？
谢谢！
How can I get the CR3 value?
Furthermore, how can I get the CR3 value of process A (say Firefox)?
Is there any command I could use to read the current CR3?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
从此处：
因此，为了避免 TLB（转换后备缓冲区）刷新，内核仅使用当前用户模式进程中的 PGD，而在用户模式下，每次启动新进程时，CR3 寄存器都会更改，因为它们位于不同的虚拟地址，所以我猜它们的映射会不同。
From here:
So to avoid TLB (Translation Lookaside Buffer) flushes, the kernel just uses the PGD from the current user mode process, whereas in User Mode, the CR3 register would change each time a new process is started, as they are located at different virtual address, so their mapping would be different I guess.
但如今，在易受 Spectre 漏洞影响的英特尔处理器上，引入了一种新的缓解措施：KPTI（内核指针表隔离）。它使得进程的 cr3 仅映射内核的一小部分（仅访问中断/系统调用所必需的代码/结构）。接下来，cr3 寄存器被切换并替换为内核的 cr3，它相当于进程的 cr3，尽管它还映射了设置了 NX 位的所有内核和用户态页面（调用进程的）。
But today on intel processors vulnerable to for example the spectre vulnerability, a new mitigation has been introduced: KPTI (kernel pointer table isolation). It makes that the cr3 of your process maps only a very small part of the kernel (only the code / structures mandatory to access to the interrupts/syscalls). Next the cr3 register is switched and replaced by the cr3 of your kernel which is equivalent to the cr3 of your process albeit it also maps all the kernel and the userland pages (of the calling process) with the NX bit set.