Rational behind s_ulSystemRegionHighLowerBound

[m417z]

s_ulSystemRegionHighLowerBound seems to allow an arbitrarily large area to be excluded. When is it expected for the condition to be true, and why s_ulSystemRegionHighLowerBound is set to this value?

KNSoft.SlimDetours/Source/KNSoft.SlimDetours/Memory.c

Lines 126 to 130 in 6745f6d

	if (s_ulSystemRegionLowLowerBound < SYSTEM_RESERVED_REGION_LOWEST)
	{
	s_ulSystemRegionHighLowerBound = s_ulSystemRegionLowLowerBound + SYSTEM_RESERVED_REGION_SIZE;
	s_ulSystemRegionLowLowerBound = SYSTEM_RESERVED_REGION_LOWEST;
	}

[RatinCN]

As the artical in technique wiki "Avoid Occupying System Reserved Region When Allocating Trampoline" said:

Note that this range may be split into two blocks

In 64-bit NT6+, system reserved range for ASLR is [0x00007FF7FFFF0000 (SYSTEM_RESERVED_REGION_LOWEST) .. 0x00007FFFFFFF0000), 32GB, we reserved 1GB after ntdll.dll.

• If the range is one block:
  • The block is [s_ulSystemRegionLowUpperBound (end of ntdll.dll) .. s_ulSystemRegionLowLowerBound (1GB after ntdll)].
  • The if condition will be FALSE.
• Or the ntdll.dll is loaded in a low position near by SYSTEM_RESERVED_REGION_LOWEST, the range (1GB after ntdll) will be split into two blocks:
  • A block in bottom [s_ulSystemRegionLowUpperBound (end of ntdll.dll) .. s_ulSystemRegionLowLowerBound (SYSTEM_RESERVED_REGION_LOWEST)] and a block wrapped to the top [SYSTEM_RESERVED_REGION_HIGHEST .. s_ulSystemRegionHighLowerBound].
  • The if condition will be TRUE.
  • The memory layout diagram drawn in "SlimDetours implementation" section.

  • KNSoft.SlimDetours/Source/KNSoft.SlimDetours/Memory.c

    Lines 206 to 217 in 6745f6d

    	BOOL
    	detour_memory_is_system_reserved(
    	_In_ PVOID Address)
    	{
    	return
    	((ULONG_PTR)Address >= s_ulSystemRegionLowLowerBound && (ULONG_PTR)Address <= s_ulSystemRegionLowUpperBound)
    	#if defined(_WIN64)
    	|| ((ULONG_PTR)Address >= s_ulSystemRegionHighLowerBound &&
    	(ULONG_PTR)Address <= SYSTEM_RESERVED_REGION_HIGHEST)
    	#endif
    	;
    	}

    The first condition checks the bottom block, and condition within #if defined(_WIN64) checks the top block.

Similar to microsoft#307.