Could use build MDL to lock SSDT shadow in nonpage memory

NTFSD
1

Hi,All:
I need to read some datas from KeServiceTableDescriptorShadow in
DriverEntry routine.You know ,the shadow table is in pageable memory . if It
is accessed directly ,BSOD will come with PAGE_FAULT_IN_NONPAGED_AREA error.
So I would like to use MDL to lock the memory used by shadow table in
nonpageable memory. code as follows.
PVOID *MapServiceTable()
{
KeServiceTableMdl = MmCreateMdl(0, ssdtshadow.ServiceTableBase,
ssdtshadow.NumberOfServices*4);

if( KeServiceTableMdl )
{
MmBuildMdlForNonPagedPool(KeServiceTableMdl);

KeServiceTableMdl->MdlFlags |=MDL_MAPPED_TO_SYSTEM_VA;

return (PVOID*)MmMapLockedPages(KeServiceTableMdl, KernelMode);
}

return NULL;
};

When I test the code, BOSD occurs again whe call MmBuildMdlForNonPagedPool.
information from windbg is:

PAGE_FAULT_IN_NONPAGED_AREA (50)
Arguments:
Arg1: c02fe65c, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804ed937, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000006, (reserved)
READ_ADDRESS: c02fe65c

FAULTING_IP:
nt!MmBuildMdlForNonPagedPool+80
804ed937 8b3411 mov esi,dword ptr [ecx+edx]

MM_INTERNAL_CODE: 6

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR: 0x50

PROCESS_NAME: System

eax=820f1150 ebx=820f1174 ecx=3e20d4f0 edx=820f116c esi=7e20d4f0
edi=00000000
eip=804ed937 esp=f89a3c58 ebp=f89a3c64 iopl=0 nv up ei pl nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010207
nt!MmBuildMdlForNonPagedPool+0x80:
804ed937 8b3411 mov esi,dword ptr [ecx+edx]
ds:0023:c02fe65c=???

f89a3bcc 804ed937 00000000 c02fe65c 00000000 nt!KiTrap0E+0xcc
f89a3c64 f4ca5e28 820f1150 f89a3c7c f4ca5c70
nt!MmBuildMdlForNonPagedPool+0x80
f89a3c70 f4ca5c70 00000000 f89a3d4c 805a3f27 hookdetect!MapServiceTable+0x38
[e:\workvc\drivers\hookdetect\hookdetect\driverentry.c @ 121]
f89a3c7c 805a3f27 821f7550 8215e000 00000000 hookdetect!DriverEntry+0x60
[e:\workvc\drivers\hookdetect\hookdetect\driverentry.c @ 57]
f89a3d4c 805a41fc 00000184 00000001 00000000 nt!IopLoadDriver+0x66c
f89a3d74 804e426b 00000184 00000000 823b53c8 nt!IopLoadUnloadDriver+0x45

What the error of my code? Any help is appreciated!

2

PVOID *MapServiceTable()
{
PVOID pAdress;
CSHORT oldMdlFlags;

KeServiceTableMdl = MmCreateMdl(0, ssdtshadow.ServiceTableBase,
ssdtshadow.NumberOfServices*4);

if( KeServiceTableMdl )
{
MmBuildMdlForNonPagedPool(KeServiceTableMdl);

oldMdlFlags = KeServiceTableMdl->MdlFlags;
ClearFlag(KeServiceTableMdl->MdlFlags,MDL_MAPPED_TO_SYSTEM_VA);
ClearFlag(KeServiceTableMdl->MdlFlags,MDL_SOURCE_IS_NONPAGED_POOL);
ClearFlag(KeServiceTableMdl->MdlFlags,MDL_PARTIAL_HAS_BEEN_MAPPED);
SetFlag(KeServiceTableMdl->MdlFlags,MDL_PAGES_LOCKED);

pAdress = MmMapLockedPages(g_RootData.pMDLService, KernelMode);

KeServiceTableMdl->MdlFlags = oldMdlFlags;
SetFlag(KeServiceTableMdl->MdlFlags,MDL_MAPPED_TO_SYSTEM_VA);
SetFlag(KeServiceTableMdl->MdlFlags,MDL_PAGES_LOCKED);

return (PVOID*)pAdress ;
}

return NULL;
};