Quantcast
Channel: Active questions tagged kernel - Stack Overflow
Viewing all articles
Browse latest Browse all 6502

How to get process stack size from kernel mod

$
0
0

I'm developing a kernel mod driver and I need to get all the stack sizes of some process.

I use ZwQuerySystemInformation to find the processand then I use ZwQuerySystemInformation to get the THREAD_BASIC_INFORMATIONand then I read memory from TebBaseAddress to NT_TIB structthen I have the tib.StackLimit, tib.StackBase

if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)process_id, &process))) {        if (NT_SUCCESS(MmCpy(process, (PVOID)info.TebBaseAddress, PsGetCurrentProcess(), &tib, sizeof(NT_TIB)))) {            //DbgPrintEx(0, 0, "StackLimit: %#010x to StackBase: %#010x \n", tib.StackLimit, tib.StackBase);            tempStackArea = { 0 };            tempStackArea.Base = (uintptr_t)tib.StackBase;            tempStackArea.Limit = (uintptr_t)tib.StackLimit;            memcpy((PVOID)((ULONG_PTR)StackAreaList + (i * sizeof(StackArea))), &tempStackArea, sizeof(StackArea));        }    }

but I don't know if the size is

tib.StackBase - tib.StackLimit

I want to read all the stack memory from tib.StackLimit to tib.StackBase and search some valueIs it okay to use it this way or it's wrong, and there's another solution?


Viewing all articles
Browse latest Browse all 6502

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>