I am getting a pointer from an API of POBJECT_ATTRIBUTES
datatype in kernel mode driver in windows. and when I am comparing one of it's structure attribute with NULL, the driver crashes
let the variable is pobjAttr
if(pobjAttr->Attributes != NULL)
here is some log from windbg
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff804bb43a202, Address of the instruction which caused the bugcheck
Arg3: ffffa8014df517a0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 0
BUILD_VERSION_STRING: 14393.0.amd64fre.rs1_release.160715-1616
DUMP_TYPE: 0
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff804bb43a202
BUGCHECK_P3: ffffa8014df517a0
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
FAULTING_IP:
NewSSDTDriverWindows10x64!printPObjectAttributes+b2 [c:\users\abdullah\desktop\new ssdt driver windows 10 x64\new ssdt driver windows 10 x64\hook.c @ 5657]
fffff804`bb43a202 83781800 cmp dword ptr [rax+18h],0
CONTEXT: ffffa8014df517a0 -- (.cxr 0xffffa8014df517a0)
rax=0000000000000000 rbx=ffffb98c7cd10080 rcx=0000000000000000
rdx=fffff804bb440480 rsi=0000000000100002 rdi=0000000000000000
rip=fffff804bb43a202 rsp=ffffa8014df521b0 rbp=ffffa8014df52b80
r8=ffffa8014df51ab0 r9=ffffa8014df51600 r10=0000000000000000
r11=ffffa8014df519a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
FAULTING_SOURCE_CODE:
> 5657: if (pobjAttr->Attributes != NULL)
5658: {
User contributions licensed under CC BY-SA 3.0