bugaga

{$apptype console}
program CR3Info; uses DrvUnit;

var
    R : cardinal = 0;
    LinearAddr : cardinal = 0;

procedure SkipExcept;
asm mov esp, fs:0
    pop dword ptr fs:0 // restore some shit
    pop ebp      // get fucking address
    add ebp, 5+5 // skip jmp &call SEH fucking shit for R3
    xchg ebp,[esp] // get ebp and set correct ret addr
end;

procedure R0;
var i:integer;
    IDT:^TIDT64;
    SaveVect:array[0..$13] of int64;
begin
    IDT:=GetIDT();
    for i:= 0 to $13 do SaveVect[i] := IDT[i];
    for i:= 0 to $13 do IDT[i] := A32ToV64(@SkipExcept);

try //fs:0 prolog with offset to fucking jmp & call

    R:= pInteger(LinearAddr shr 10 + $C0000000)^;

except //a fucking jmp  @@HandleAnyException
end;   //call  @@DoneExcept

    for i:= 0 to $13 do IDT[i] := SaveVect[i];
end;

var i:integer;

BEGIN
for i:=$0000 to $FFFFF do begin
    LinearAddr := i shl 12;
    CallR0(@R0);
 if (R and not $FFF) =$FEC00000
 then
 writeln(
    'lin: ', IntToHex(LinearAddr, 8),
    ' - phys; ',IntToHex(R, 8));
end;
end.