Greetings,
I’m using the module loaded callback notification that is registered via PsSetLoadImageNotifyRoutine(). Now, on the time that this callback is called, i need to force the module’s memory to be resident, and then unresident it when i’m done with the callback. The problem is, in Windows 7 using MmProbeAndLockPages() works, even though Microsoft strongly advises to not use this in this callback because of a system-wide lock held. In Windows 10, i get random deadlocks.
I need the module’s memory to be resident(meaning the PTEs in the page table are present), so that i can read the GFNs of every virtual address from the hypervisor.
This must be synchronous, i cannot do it after the callback is done. Are you guys familiar with any more methods other than “MmProbeAndLockPages()”?
Thanks.