Hello everybody,
I have two questions, one about the way process Ids are declared in windows and the other is about the PsLookupProcessByProcessId function doing something that I don’t expect.
About process IDs, it confuses me that sometimes a process ID is declared as a DWORD(like in the EPROCESS structure) and other times it is declared as a HANDLE(e.g. when passing it to the PsLookupProcessByProcessId function). Maybe this is a silly question but why is this mixed? We can just cast the HANDLE to a DWORD to obtain the numeric value of the ID, so actually my question comes down to:
If I want to store the process ID of some process that I opened, what is the most logical way to declare it, as DWORD or as HANDLE.
Secondly, the PsLookupProcessByProcessId function. I’ve defined it as following:
NTKERNELAPI NTSTATUS PsLookupProcessByProcessId( IN HANDLE ProcessId, OUT PEPROCESS *Process );
And I call it:
if( ! NT_SUCCESS( PsLookupProcessByProcessId( gClientInfo.hProcessId, &pEProcess ) ) )
DbgPrint( “PsLookupProcessByProcessId unsuccessful” );
With:
PEPROCESS pEProcess = NULL;
HANDLE hProcessId; // (In a structure)
If after the function call I print hProcessId and pEProcess->UniqueProcessId I get two different numeric values.
I am guessing that something in the PsLookupProcessByProcessId goes wrong so the EPROCESS is filled with garbage data, that I am casting to a DWORD when printing.
If this is the case, how can I check if the EPROCESS structure is filled correctly?
While writing this I actually got two another questions:
-
What is the ‘standard’ way to check a buffer before accessing it.
For example before I call RtlCopyMemory I should check if the address is valid, if I have access to perform the operation on it(check if page_fault will occur). I’ve read about a function that could check if a page fault will occur on a given address, I actually forgot the function name because I read it shouldn’t be used.
There will be a difference for UM or KM buffers I suppose, is ‘probeforread / write’ in a try/catch sufficient for UM buffers? -
When I read on OSR some information about certain bugchecks I noted a line saying: “This cannot be protected by try/catch it must be protected by Probe” (not an exact quote). I’ve tried to google for Probe in the contect of driver development but it’s quite a general word, could someone point me in the direction where to find more information about this?
Thank you all in advance for any help.