ANTICHAT — форум по информационной безопасности, OSINT и технологиям

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {c0000005, b1b236ee, f89a3980, f89a367c}

*** ERROR: Module load completed but symbols could not be loaded for jammer.sys
Probably caused by : jammer.sys ( jammer+6ee )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: b1b236ee, The address that the exception occurred at
Arg3: f89a3980, Exception Record Address
Arg4: f89a367c, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

FAULTING_IP: 
jammer+6ee
b1b236ee 8b433c          mov     eax,dword ptr [ebx+3Ch]

EXCEPTION_RECORD:  f89a3980 -- (.exr 0xfffffffff89a3980)
ExceptionAddress: b1b236ee (jammer+0x000006ee)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0000003c
Attempt to read from address 0000003c

CONTEXT:  f89a367c -- (.cxr 0xfffffffff89a367c)
eax=f89a3ae4 ebx=00000000 ecx=000005ce edx=806830e0 esi=00000000 edi=00000000
eip=b1b236ee esp=f89a3a48 ebp=f89a3a60 iopl=0         nv up ei ng nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00210292
jammer+0x6ee:
b1b236ee 8b433c          mov     eax,dword ptr [ebx+3Ch] ds:0023:0000003c=????????
Resetting default scope

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  0000003c

READ_ADDRESS:  0000003c 

FOLLOWUP_IP: 
jammer+6ee
b1b236ee 8b433c          mov     eax,dword ptr [ebx+3Ch]

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from b1b23c67 to b1b236ee

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
f89a3a60 b1b23c67 00000000 b1b242e2 00000000 jammer+0x6ee
f89a3a98 b1b23d27 00000000 82301da0 00000000 jammer+0xc67
f89a3ab8 b1b24097 00000000 804d7000 f89a3ae4 jammer+0xd27
f89a3c74 b1b234b9 f89a3d4c 805a2ead 82301da0 jammer+0x1097
f89a3c7c 805a2ead 82301da0 81bda000 00000000 jammer+0x4b9
f89a3d4c 805a3182 00000b2c 00000001 00000000 nt!IopLoadDriver+0x66c
f89a3d74 804e426b 00000b2c 00000000 823c68b8 nt!IopLoadUnloadDriver+0x45
f89a3dac 8057cfce f877fcdc 00000000 00000000 nt!ExpWorkerThread+0x100
f89a3ddc 804f88fa 804e4196 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  jammer+6ee

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: jammer

IMAGE_NAME:  jammer.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bc72969

STACK_COMMAND:  .cxr 0xfffffffff89a367c ; kb

FAILURE_BUCKET_ID:  0x7E_jammer+6ee

BUCKET_ID:  0x7E_jammer+6ee

Followup: MachineOwner
---------

// функция установки и снятия перехвата
BOOL SetHook(USHORT id, ULONG NewAddr, PULONG OldAddr)
{
	BOOL ret = false;
	ULONG Addr;
	PHYSICAL_ADDRESS PhysicalAddr;
	ULONG VirtualAddr;
	
	Addr = (ULONG)KeServiceDescriptorTable->ServiceTable; // получаем адрес таблицы сервисов
	if (Addr) // если нет ошибки
	{
		Addr += 4 * id; // вычислим адрес функции которую необходимо перехватить
		if (OldAddr) // если указана память для сохранения старого значения
		{
			*(ULONG*)OldAddr = *(ULONG*)Addr; // сохраним старый адрес
		}
		
		// получим физический адрес, зная виртуальный
		PhysicalAddr = MmGetPhysicalAddress((void*)Addr);
		if (PhysicalAddr.QuadPart)
		{
			// выделим себе виртуальную память по физ. адресу
			VirtualAddr = (ULONG)MmMapIoSpace(PhysicalAddr, 4, 0);
			if (VirtualAddr)
			{
				*(ULONG*)VirtualAddr = NewAddr; // установим перехват
				ret = true;
				MmUnmapIoSpace((void*)VirtualAddr, 4); // освободим вирт. страницу памяти
			}
		}
	}
	
	return ret;
}