Which types of exceptions cannot be handled?

NTDEV
1

Hey:)
I know some exceptions like PAGE_FAULT_IN_NONPAGED_AREA cannot be caught using __try and __except. Is there any resource detailing which types of exceptions cannot be caught? How can I know which exceptions cannot be caught?

I don’t need it for a specific reason, just because I’m curious (And don’t want to cause bugchecks)

2

There’s probably a really raucous religious discussion waiting to be had here. :wink:

I almost never use __try/__except in a kernel driver, unless I’m handling user-mode addresses in a METHOD_NEITHER ioctl. I tend to think it’s a crutch to spackle over lazy programming. If I have processing that might throw an exception, I’d rather get the BSOD so I can diagnose it and add protection. An ounce of prevention is better than a pound of cure.

That does mean my testing had better be pretty thorough.

3

I’m asking because one of the third party software drivers installed on my PC (again, I did not develop the driver) caused a blue screen today. Analyzing the blue screen I saw it happened because the driver accessed a pointer from user mode with __try (the developer of the driver passed the address of a kernel object he obtained from user mode using SystemHandleInformation… Heh) this object was already removed and that caused the fault in a nonpaged area, I removed this aweful driver. I don’t intend to do shady stuff in a kernel driver, I’m just curious.

4

You can only catch invalid user pointer accesses. If you touch an invalid kernel address it will crash the machine.

Analyzing the blue screen I saw it happened because the driver accessed a pointer from user mode with __try

Before you touch a pointer from user mode you need to call either ProbeForRead or ProbeForWrite on it. These will raise an exception if the address supplied by user mode is a kernel address.