bluescreen page fault in nonepaged area kernel driver
Hi guys,
I developed a kernel driver to read from the memory. Actually it is working well but just in the Editor of arma3
But if I connect to a server then comes a bluescreen with the message page fault in nonepaged area
Here is the function:
The Error comes in the ControlCode IOCTL_BUFFER_READMEM.
If I remove the function ReadMemory, then it works well but then it doenst read anything from the memory. So far I understand, the part that I want to read is not in the ram memory, it is in the file. Thats why, shows the bluescreen.
But I am not quite sure about that. And I don't habe any idea about a solution. Befor I attach the Process but also detach. I tried also to attached the PRocess before I read the memory and afther that to detach the Process.
Here is the ReadMemory function:
Does have anybody an idea?
I developed a kernel driver to read from the memory. Actually it is working well but just in the Editor of arma3
But if I connect to a server then comes a bluescreen with the message page fault in nonepaged area
Here is the function:
Code:
NTSTATUS MyFirstDriverIoControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
__try
{
PCHAR pInputBuffer;
PCHAR pOutputBuffer;
ULONG InputBufferLength;
ULONG IoControlCode;
DbgPrint("DriverIoControl Part 0");
PIO_STACK_LOCATION pIoStackLocation;
PCHAR ReturnChar = "0000000000";
PCHAR ReturnUnknown = "unknown";
ULONGLONG mLongReturn = 125054;
//PCHAR welcome = "T";
UINT dwDataRead = 0;
DbgPrint("DriverIoControl Part 1");
pIoStackLocation = IoGetCurrentIrpStackLocation(Irp);
DbgPrint("DriverIoControl Part 2");
WaitForDelay();
if (pIoStackLocation)
{
InputBufferLength = pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength;
DbgPrint("InputBufferLength gelesen");
WaitForDelay();
IoControlCode = pIoStackLocation->Parameters.DeviceIoControl****ControlCode;
DbgPrint("IoControlCode gelesen");
WaitForDelay();
pInputBuffer = (char *)pIoStackLocation->Parameters.DeviceIoControl.Type3InputBuffer;
DbgPrint("pInputBuffer gelesen");
WaitForDelay();
pOutputBuffer = (char *)Irp->UserBuffer;
DbgPrint("pInputBuffer gelesen");
WaitForDelay();
if ((pInputBuffer) && (pOutputBuffer))
{
DbgPrint("pInputBuffer");
__try {
ProbeForRead(pInputBuffer,
pIoStackLocation->Parameters.DeviceIoControl.InputBufferLength,
TYPE_ALIGNMENT(char));
DbgPrint("ProbeForRead");
WaitForDelay();
if (IoControlCode == IOCTL_BUFFER_BASEADDRESS)
{
//nothing yet
}
else
{
if (IoControlCode == IOCTL_BUFFER_READMEM)
{
DbgPrint("IOCTL_BUFFER_READMEM");
DbgPrint("ReadByte\n");
WaitForDelay();
ULONGLONG sourceAdd;
ULONGLONG targetAdd=0;
sourceAdd = atoi(pInputBuffer);
DbgPrint("Ausgabe sourceAdd und TargetInteger\n");
WaitForDelay();
ReadMemory((void*)sourceAdd,&targetAdd,4);
DbgPrint("targetAdd: %08x\n",targetAdd);
DbgPrint("Ausgabe TargetInteger\n");
WaitForDelay();
WaitForDelay();
RtlCopyMemory( pOutputBuffer, &targetAdd, sizeof(ULONGLONG) );
DbgPrint("Ausgabe RtlCopyMemory\n");
WaitForDelay();
DbgPrint("sizeof ULONGULONG: (%d)\n",sizeof(ULONGLONG));
Irp->IoStatus.Information = sizeof(ULONGLONG);
}
else
{
DbgPrint("IOCTL_BUFFER_TEST");
DbgPrint("pOutputBuffer");
RtlCopyMemory(pOutputBuffer,ReturnUnknown,strlen(ReturnUnknown));
DbgPrint("after RtlCopyMemory");
Irp->IoStatus.Information = strlen(ReturnUnknown);
}
}
} __except( EXCEPTION_EXECUTE_HANDLER ) {
DbgPrint("Fehler bei ProbeForRead");
}
}
}
// Finish the I/O operation by simply completing the packet and returning
// the same status as in the packet itself.
Irp->IoStatus.Status = STATUS_SUCCESS;
DbgPrint("DriverIoControl Part 5");
//Irp->IoStatus.Information = strlen(ReturnChar);
WaitForDelay();
DbgPrint("DriverIoControl Part 6");
IoCompleteRequest(Irp,IO_NO_INCREMENT);
DbgPrint("DriverIoControl Part 7");
WaitForDelay();
} __except(EXCEPTION_EXECUTE_HANDLER)
{
DbgPrint("Fehler2");
}
return STATUS_SUCCESS;
}
If I remove the function ReadMemory, then it works well but then it doenst read anything from the memory. So far I understand, the part that I want to read is not in the ram memory, it is in the file. Thats why, shows the bluescreen.
But I am not quite sure about that. And I don't habe any idea about a solution. Befor I attach the Process but also detach. I tried also to attached the PRocess before I read the memory and afther that to detach the Process.
Here is the ReadMemory function:
Code:
NTSTATUS ReadMemory(void *source, void *target, ULONGLONG size)
{
ULONG transferred;
if(!targetProcess) return STATUS_INVALID_PARAMETER_1;
DbgPrint("ReadMemory 1 \n");
WaitForDelay();
return MmCopyVirtualMemoryRoutine(targetProcess,source,currentProcess,target,size,KernelMode,&transferred);
}