Comparing Pointer values to NULL is resulting in crashing in kernel mode driver windows

0

I am getting a pointer from an API of POBJECT_ATTRIBUTES datatype in kernel mode driver in windows. and when I am comparing one of it's structure attribute with NULL, the driver crashes

let the variable is pobjAttr

if(pobjAttr->Attributes != NULL)

here is some log from windbg

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff804bb43a202, Address of the instruction which caused the bugcheck
Arg3: ffffa8014df517a0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 0

BUILD_VERSION_STRING:  14393.0.amd64fre.rs1_release.160715-1616

DUMP_TYPE:  0

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff804bb43a202

BUGCHECK_P3: ffffa8014df517a0

BUGCHECK_P4: 0

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

FAULTING_IP: 
NewSSDTDriverWindows10x64!printPObjectAttributes+b2 [c:\users\abdullah\desktop\new ssdt driver windows 10 x64\new ssdt driver windows 10 x64\hook.c @ 5657]
fffff804`bb43a202 83781800        cmp     dword ptr [rax+18h],0

CONTEXT:  ffffa8014df517a0 -- (.cxr 0xffffa8014df517a0)
rax=0000000000000000 rbx=ffffb98c7cd10080 rcx=0000000000000000
rdx=fffff804bb440480 rsi=0000000000100002 rdi=0000000000000000
rip=fffff804bb43a202 rsp=ffffa8014df521b0 rbp=ffffa8014df52b80
 r8=ffffa8014df51ab0  r9=ffffa8014df51600 r10=0000000000000000
r11=ffffa8014df519a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246

FAULTING_SOURCE_CODE:  

> 5657:     if (pobjAttr->Attributes != NULL)
  5658:     {
c
windows
kernel
driver
windows-kernel
asked on Stack Overflow Jun 18, 2020 by Abdullah Toqeer

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0