The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I'm trying to read the SSDT from Win32k.sys the address is set by KeAddSystemServiceTable as well as a counter.
struct _EX_CALLBACK Win32CallBack;
struct _KSERVICE_TABLE_DESCRIPTOR ServiceDescriptorTableShadow;
struct _KSERVICE_TABLE_DESCRIPTOR ServiceDescriptorTableFilter;
unsigned long *Base;
unsigned long *Reserved1;
unsigned long Limit;
unsigned int *Number;
my code successfully finds the ServiceDescriptorTableShadow with valid data
and as far as I can tell ServiceDescriptorTableShadow which contains the table for win32k.sys is also right as the Limit value is correct (the aforementioned counter)
The Base array and Number array points to a memory region owned by win32k.sys, according to process hacker,
so presumably the address should be valid. Also it seams to me that KiServiceInternal is accessing said address.
But when I try to read a value from that address in my driver I get a bug check (page fault) when testing with MmIsAddressValid it seams that i cant access any address from the range of the win32k.sys driver as well as no address from win32kbase.sys, win32kfull.sys and cdd.dll same behavior on different systems.
I have also noticed that the memory range of these 4 modules is different than the ranges used by all other drivers including ntoskrnl.exe
And on a random test it seams that I can read the base addresses of any other drivers except these 4.
So whats up with that?
1. why can't I read the memory at these addresses?
2. how does ntoskrnl.exe, when in KiServiceInternal or other function (KiSystemService and etc....), access this memory ?
My goal is to get the service routine addresses and call them directly from my driver, doing this for normal ntoskrnl.exe syscalls works just fine, just the win32k.sys seams particularly stubborn, and I don't understand why, the address is valid and plausible, yet it is not readable and causes a page fault.
There must be a way around this also I would like to understand why this odd behavior.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Internals & Software Drivers||15 November 2021||Live, Online|
|Writing WDF Drivers||TBD||Live, Online|
|Developing Minifilters||7 February 2022||Live, Online|
|Kernel Debugging||21 March 2022||Live, Online|