recently we received a bsod case that my exception filter won’t work, here is the code
__try
{
MmProbeAndLockPages( Mdl, KernelMode, IoWriteAccess);
}
__except((S = GetExceptionCode()) !=0x123456 ? EXCEPTION_EXECUTE_HANDLER:EXCEPTION_CONTINUE_SEARCH)
{
IoFreeMdl( Mdl );
Mdl = NULL;
}
and the stack when bsod occurs like :
2: kd> k
Child-SP RetAddr Call Site
fffffe82a895e648 fffff802
1afc7b63 nt!KeBugCheckEx
fffffe82a895e650 fffff802
1af7e68f nt!PspSystemThreadStartup$filt$0+0x44
fffffe82a895e690 fffff802
1afb66fd nt!_C_specific_handler+0x9f
fffffe82a895e700 fffff802
1ae1fa3a nt!RtlpExecuteHandlerForException+0xd
fffffe82a895e730 fffff802
1ae2020d nt!RtlDispatchException+0x4ba
fffffe82a895ee20 fffff802
1afc0ece nt!KiDispatchException+0x14d
fffffe82a895f4e0 fffff802
1afbc03b nt!KiExceptionDispatch+0xce
fffffe82a895f6c0 fffff800
c15f1a30 nt!KiSegmentNotPresentFault+0x3fb
which it seems i dont handle the exception well,but the value of S(assigned by GetExceptionCode()) is c0000005 for sure
3: kd> dd S
fffff808`c20851e8 c0000005
on the other hand ,i do another test,code like :
__try
{
MmProbeAndLockPages( Mdl, KernelMode, IoWriteAccess);
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
IoFreeMdl( Mdl );
Mdl = NULL;
}
no bsod !!!
so what is going on??
plus?i find out a driver with signature sha1 only was loaded on that machine
ps:asm code for the exception filter
xx!KlibMemEnableW$filt$0
76 fffff808c2083cc0 48894c2408 mov qword ptr [rsp+8],rcx 76 fffff808
c2083cc5 4889542410 mov qword ptr [rsp+10h],rdx
76 fffff808c2083cca 55 push rbp 76 fffff808
c2083ccb 4883ec30 sub rsp,30h
76 fffff808c2083ccf 488bea mov rbp,rdx 76 fffff808
c2083cd2 48894d40 mov qword ptr [rbp+40h],rcx
76 fffff808c2083cd6 488b4540 mov rax,qword ptr [rbp+40h] 76 fffff808
c2083cda 488b00 mov rax,qword ptr [rax]
76 fffff808c2083cdd 8b00 mov eax,dword ptr [rax] 76 fffff808
c2083cdf 894548 mov dword ptr [rbp+48h],eax
76 fffff808c2083ce2 8b4548 mov eax,dword ptr [rbp+48h] 76 fffff808
c2083ce5 8905fd140000 mov dword ptr [xx!gInjectionHandle+0x8 (fffff808c20851e8)],eax 76 fffff808
c2083ceb 8b05f7140000 mov eax,dword ptr [xx!gInjectionHandle+0x8 (fffff808c20851e8)] 76 fffff808
c2083cf1 3d56341200 cmp eax,123456h
76 fffff808c2083cf6 7409 je xx!KlibMemEnableW$filt$0+0x41 (fffff808
c2083d01)
xx!KlibMemEnableW$filt$0+0x38
76 fffff808c2083cf8 c7454c01000000 mov dword ptr [rbp+4Ch],1 76 fffff808
c2083cff eb07 jmp xx!KlibMemEnableW$filt$0+0x48 (fffff808`c2083d08)
xx!KlibMemEnableW$filt$0+0x41
76 fffff808`c2083d01 c7454c00000000 mov dword ptr [rbp+4Ch],0
xx!KlibMemEnableW$filt$0+0x48
76 fffff808c2083d08 8b454c mov eax,dword ptr [rbp+4Ch] 76 fffff808
c2083d0b 4883c430 add rsp,30h
76 fffff808c2083d0f 5d pop rbp 76 fffff808
c2083d10 c3 ret