Greetings,
I’m registering a image loading notification routine via PSLoadImageNotifyRoutine(), and a process creation/destruction notification routine via PsSetCreateProcessNotifyRoutineEx().
I track specific processes, and when a module is loaded to one of these processes and i get a notification about it from the image load routine, i lock it’s code regions(after parsing the PE), using MmProbeAndLockPages() after i change to the virtual address space of the target process via:
KeStackAttachProcess()
…
MmProbeAndLockPages()
…
KeUnstackDeatchProcess()
When the process dies and i get a notification about it from the PsSetCreateProcessNotifyRoutineEx(), i change to its virtual address space(just to be sure i’m running in the right VMA) i unlock every locked region that i locked.
This work perfectly on Windows 7, but on Windows 10, when one of the processes dies, i got a BSOD without any message and then an instant reboot…
I’m not really sure what is the problem here. When i remove the locking of the pages everything works. Are you guys familiar with the reason behind this? Am i doing something i shouldn’t do? I’m pretty sure all the code i described runs either in PASSIVE_LEVEL or APC_LEVEL, so it’s fine to lock/unlock pages.
Thanks.