-
-
[求助]HOOK KeAttachProcess， BugCheck A 蓝屏疑惑
-
-
[求助]HOOK KeAttachProcess， BugCheck A 蓝屏疑惑
关于驱动进行的操作:
Win7下 Hook了KeAttachProcess来替换Cr3，替换的Cr3都是取系统进程_readcr3()出来的。
疑惑描述:
BugCheck A 第一个参数是20，导致的函数是MiGetProtoPteAddress()。百度了下是操作cr3的。可是cr3怎么会是20呢...
因为是替换的系统Cr3，所以要对Cr3做一些判断来确定是不是可以用来做替换吗。
疑惑..
BugCheck A, {20, 2, 0, fffff80258bafcbf}
Probably caused by : memory_corruption ( nt!MiGetProtoPteAddress+11282f )
PROCESS_NAME: System
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000002
rdx=00000000ffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff80258bafcbf rsp=ffff9101c8b475d0 rbp=0000000000000009
r8=ffffe70f89810948 r9=ffff9101c8b47680 r10=0000000000019600
r11=0000000000019610 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiGetProtoPteAddress+0x11282f:
fffff802`58bafcbf 488b4820 mov rcx,qword ptr [rax+20h] ds:00000000`00000020=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80258b7d0e9 to fffff80258b717d0
STACK_TEXT:
ffff9101`c8b472f8 fffff802`58b7d0e9 : 00000000`0000000a 00000000`00000020 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffff9101`c8b47300 fffff802`58b7b47d : ffffe70f`87b31001 ffff9101`c8b474e0 ffff9101`c8b47490 ffff9101`c8b47472 : nt!KiBugCheckDispatch+0x69
ffff9101`c8b47440 fffff802`58bafcbf : ffff9101`c8b47700 ffffe572`b95ca000 ffffe572`b95ca000 ffffe572`b9400000 : nt!KiPageFault+0x23d
ffff9101`c8b475d0 fffff802`58a9dcf0 : 00000000`19610000 ffffe500`000cb098 ffffe500`000cb090 00000000`00002000 : nt!MiGetProtoPteAddress+0x11282f
ffff9101`c8b47650 fffff802`58a9da04 : 00000000`19610000 ffffe500`000cb090 ffffaa81`7a007100 00000000`00000005 : nt!MiQueryAddressState+0x130
ffff9101`c8b476e0 fffff802`58f142a4 : ffff9101`c8b47848 00000000`00000005 00000000`00000005 00000000`19610000 : nt!MiQueryAddressSpan+0x164
ffff9101`c8b477a0 fffff802`58f13b2d : ffffc109`702315ee ffffaa81`7a0071c0 00000000`00000000 ffffe70f`8ed8f080 : nt!MmQueryVirtualMemory+0x764
ffff9101`c8b47940 fffff802`58b7cc53 : ffffaa81`88ead420 fffff802`58f3eb2b ffff9101`c8b479b0 00000000`00000000 : nt!NtQueryVirtualMemory+0x25
ffff9101`c8b47990 00007ffe`84fc02a4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000b0`c019dec8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`84fc02a4
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
最后于 2018-8-6 00:46
被萌克力编辑
，原因：
hzqst
