Im trying to write memory to a user mode process with kernel driver,
the current address im trying to write memory for is read only, I want to write 4 bytes to the current address,
the thing is if i change protection ( page ) of the process with VirtualProtectEx , it works and it writes the memory but this is only on user mode level, my intention is to change the protection of the process from kernel mode, i want to make it READWRITE, then change it back to READ from kernel space,
Now what I tried to do is giving me a BSOD ( blue screen of death ) with error : Kmode_exception_not_handld
I cant understand what in my code is triggering this BSOD my PC have very limited specs and i cant debug in VM to know..
I will write the code that works but in user mode , and what the code is not working for me in kernel space:
here the code that works:
void dispatch::handler(void* info_struct){ PINFO_STRUCT info = (PINFO_STRUCT)info_struct; if (info->code == CODE_READ_MEMORY) { PEPROCESS target_process = NULL; if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)info->process_id, &target_process))) { memory::read_memory(target_process, (void*)info->address, &info->buffer, info->size); } DbgPrintEx(0, 0, "[TEST]: Read Memory\n"); } else if (info->code == CODE_WRITE_MEMORY) { PEPROCESS target_process = NULL; if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)info->process_id, &target_process))) { memory::write_memory(target_process, &info->buffer, (void*)info->address, info->size); } DbgPrintEx(0, 0, "[TEST]: Write Memory\n"); }}NTSTATUS memory::write_memory(PEPROCESS target_process, void* source, void* target, size_t size){ if (!target_process) { return STATUS_INVALID_PARAMETER; } size_t bytes = 0; NTSTATUS status = MmCopyVirtualMemory(IoGetCurrentProcess(), source, target_process, target, size, KernelMode, &bytes); if (!NT_SUCCESS(status) || !bytes) { return STATUS_INVALID_ADDRESS; } return status;}int main(){DWORD oldprtULONG writeTest1 = 3204497152;VirtualProtectEx(ProcManager::hProcess, (PVOID)(testAddr), 4, PAGE_READWRITE, &oldprt);driver_control::write_memory(process_id, testAddr, writeTest1);VirtualProtectEx(ProcManager::hProcess, (PVOID)(testAddr), 4, PAGE_READONLY, &oldprt);return 0;}Now what I want to do is stop using the VirtualProtectEx, and change the PAGE protection to READWRITE from kernel space, so what i did is add this in the dispatch::handler function:
else if (info->code == CODE_WRITE_MEMORY){ PEPROCESS target_process = NULL; if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)info->process_id, &target_process))) { PMDL Mdl = IoAllocateMdl((void*)info->address, info->size, FALSE, FALSE, NULL); if (!Mdl) return false; // Locking and mapping memory with RW-rights: MmProbeAndLockPages(Mdl, KernelMode, IoReadAccess); PVOID Mapping = MmMapLockedPagesSpecifyCache(Mdl, KernelMode, MmNonCached, NULL, FALSE, NormalPagePriority); MmProtectMdlSystemAddress(Mdl, PAGE_READWRITE); memory::write_memory(target_process, &info->buffer, (void*)info->address, info->size); // Resources freeing: MmUnmapLockedPages(Mapping, Mdl); MmUnlockPages(Mdl); IoFreeMdl(Mdl); } DbgPrintEx(0, 0, "[TEST]: Write Read Only Memory\n");}So this what I've added caused the BSOD, but why I cannot understand, what am i doing wrong here?
here is the info struct if needed to understand more, :
#define CODE_READ_MEMORY 0x1#define CODE_WRITE_MEMORY 0x2typedef struct _INFO_STRUCT{ ULONG code; ULONG process_id; ULONG address; ULONG buffer; ULONG size;}INFO_STRUCT, * PINFO_STRUCT;any suggestions on solving this problem?