Ok. Here is another related question.
I wanted to dump in memory PE image of a driver. I already know its base
address (BaseAddress) and size (SizeOfImage). I use the code below for this.
Everything works find up until call to MmUnlockPages().
mappedBuffer = NULL;
if (( Buffer = ExAllocatePool(PagedPool, SizeOfImage )) != NULL )
{
if (( mdl = IoAllocateMdl ((PVOID)BaseAddress, SizeOfImage,
FALSE, FALSE, NULL)) != NULL )
{
__try
{
MmProbeAndLockPages ( mdl, KernelMode, IoReadAccess );
pagesLocked = TRUE;
mappedBuffer = MmMapLockedPagesSpecifyCache(
mdl,
KernelMode,
MmCached,
NULL,
FALSE,
NormalPagePriority);
if(mappedBuffer)
{
RtlCopyMemory( Buffer, mappedBuffer, SizeOfImage );
}
else
{
ExFreePool(Buffer);
Buffer = NULL;
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
}
if(mappedBuffer)
{
MmUnmapLockedPages(mappedBuffer, mdl);
mappedBuffer = NULL;
}
if(pagesLocked)
{
MmUnlockPages(mdl);
pagesLocked = FALSE;
}
IoFreeMdl(mdl);
return Buffer;
}
}
Calling into MmUnlockPages() gives a bugcheck:
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 00000651, page frame number
Arg3: 000064db, current share count
Arg4: 00000000, 0
I check mdl->MdlFlags at every step in debug session all the way starting
from IoAllocateMdl(). Here is what I find.
After call to IoAllocateMdl
mdl->MdlFlags = 0
After call to MmProbeAndLockPages()
mdl->MdlFlags = MDL_PAGES_LOCKED
The above change in values of MdlFlags along with the code below seem to
contradict bugcheck description that “A driver has unlocked a page more
times than it locked it”. MmProbeAndLockPages() was called only *once* and
so was MmUnlockPages(). In all documentation relating to these calls I find
that a successful call to MmProbeAndLockPages() must be complimented by a
call to MmUnlockPages(). BTW, I also verified other fields of MDL structure
and they seem to look ok at every step. This code is not in a complicated
path where mdl gets passed below to a lower driver etc. This code simply
gets called to serve a IOCTL from a user app in a synchronous manner.
My primary objective is to obtain a dump of in memory PE image of a driver
and this is obviously not working. What is the reason for this bugcheck? Any
other good solution(s) for getting in memory PE image dump of a driver?
Thanks
Chandra
On 6/12/07, Maxim S. Shatskih wrote:
>
> Nonpaged pool has 2 parts:
>
> - the primary pool which is the identity-mapped pages, allocation is
> trivial.
> - expansion pool which is some address space range, allocation needs
> a)
> allocate a physical page b) allocate a PTE in this address space and set
> it to
> point to the page.
>
> So, you have MmNonPagedPoolStart as start of primary pool, which then
> ends
> and gives the space for paged pool. MmPagedPoolEnd is probably the
> expansion
> pool end.
>
> –
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> “chandra97 97” wrote in message news:xxxxx@ntdev…
> > Hi,
> >
> > I noticed the regions of non-paged and paged pool seem to overlap as
> seen in
> > the following windbg output:
> >
> > kd> dd MmNonPagedPoolStart l1
> > 8054fa58 80db0000
> > kd> dd MmNonPagedPoolEnd l1
> > 80546760 ffbe0000
> > kd> dd MmPagedPoolStart l1
> > 80546764 e1000000
> > kd> dd MmPagedPoolEnd l1
> > 8054fa54 edbfffff
> >
> > The paged pool region e1000000-edbfffff lies in the non-paged pool
> region
> > 80db0000-ffbe0000. Aren’t these two regions supposed to be
> non-overlapping?
> >
> > Another related question, I ran ‘lmi’ command in windbg and it dumps
> start
> > and end addresses of system modules (as in snip below).
> >
> > start end module name
> > f7e8b000 f7ed9a00 srv (pdb symbols) srv.sys
> > f7fca000 f7ff4280 mrxdav (pdb symbols) mrxdav.sys
> > f7ff5000 f8008520 hgfs (no symbols)
> > f8149000 f8169380 afd (pdb symbols) afd.sys
> > f82aa000 f82bf380 dump_atapi (pdb symbols) dump_atapi.sys
> >
> >
> > All these address ranges seem to lie in the non-paged pool region. Does
> it
> > mean all drivers images are loaded in non-paged pool region?
> >
> > Thanks
> > Chandra
> >
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>