hello To Experts.
thought i have posted this issue before too. i need to ask a quation about this
i am help less in this situation. how to do this
here is the source
i got some idea from anton bassov code form code project.
i have 4 functions
(1) Hook
(2) Unhook
(2) SetProtection/ ClearProtection
(3) NewZwCreateSection()
i did hooking with the help of this function
ClearWriteProtect(); // clear Cr0 Register
InterlockedExchange( (LONG *)ORG_SYSCALL_PTR(ZwCreateSection), (LONG) RealZwCreateSection);
SetWriteProtect(); //// restore Cr0 Register
it works
i changed the Code of that article to like this
switch (ioControlCode)
{
case IOCTL_INSTALL_HOOK:
if (!bHooked)
{
hook();
bHooked =TRUE;
}
break;
case IOCTL_UNINSTALL_HOOK:
if(bHooked)
{
unhook();
bHooked =FALSE;
}
break;
case 1000: //
buff=(UCHAR*)Irp->AssociatedIrp.SystemBuffer;
memmove(&a,&buff[4],4);
output=(char*)MmMapIoSpace(MmGetPhysicalAddress((void*)a),256,0);
break;
}
// this code works on 2k3 also.
i have not provided the Unload Routine . so that Driver remains Loaded. but i think i have to provide some way for “MmUnmapIoSpace(output,256);” if my client application closes unexpectedly. i did that at “IRP_MJ_CLOSE”. as this is bound to come if my application closes . but this raise the “PAGE_FAULT_IN_NONPAGED_AREA” exception . i debugged and found that it is crashing at this source…
while(1)
{
KeDelayExecutionThread(KernelMode,0,&li);
memmove(&a,&output[0],4); // problem is here
if(!a)break;
}
i have diagonosed it. it is because i have unmaped the address and still using it.
i tried to user probForRead() but no success
could some one tell me how could i remove it.
regards