I need to writte a program entrypoint onwards when its loaded from disk to memory. In order to do that i use PsSetLoadImageNotifyRoutine to check when image is loaded. When i get that the .exe file is beeing loaded i get its addres entry point (base addres of the image that i get from Imager_INFO + reading the header to get the offset entry point).
The problem comes when i try to writte the memory as i get a STATUS_ACCESS_VIOLATION which i supoused that is happening due to the fact that the memory does not have write permission (correctme if wrong and is due to another thing). Then what i would like to do is to use MmProtectMdlSystemAddress to change permissions, writte it and restore permissions. In order to do that i use IoAllocateMdl+ MmProbeAndLockPages+... But it gets stuck on ProbeAndLock due to the fact that system handles a lock to it (Doc: To avoid deadlocks, load-image notify routines must not call system routines that map, allocate, query, free, or perform other operations on user-space virtual memory.).
In order to solve this i read this option https://stackoverflow.com/questions/50610741/windows-kernel-driver-zwallocatevirtualmemory-causing-thread-to-terminate but the instruction KeInitializeApc to insert the APC is not documented. What should i do? Should i use KeInitializeApc or is there another aproach to modify the memory without using it?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Writing WDF Drivers||21 Oct 2019||OSR Seminar Space & ONLINE|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|
|Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||27 Apr 2020||OSR Seminar Space & ONLINE|