I'm using IDT modification to get to ring0.Then i get some mem with IFSMGR_HeapAlloc,
copy the following code and jump there.

.
.
.

int 20h
dd VMM_Get_Sys_VM_Handle ; get VM Handle in ebx

xor eax,eax ; MB_OK
lea ecx,[edx+BsodMsg]
lea edi,[edx+TitleMsg]
int 20h
dd SHELL_SYSMODAL_Message ; machine hangs here
iretd

BsodMsg db 'blablabla',0
.
.
.
.

This totally freezes my system. I know for sure that this snippet of code
works fine,if it's called by an IFSMGR Hook.So i assume the memory part
i got from HeapAlloc is somehow less privileged than the IFSHOOK.Could
someone please explain this?

tia,

blackcheck

check the source code for frogsice. he uses similar code (SHELL_SYSMODAL_Message), and it doesn't crash

> Then i get some mem with IFSMGR_HeapAlloc,

There's no such function in my IFSMgr and the
code you showed seems correct to me, but I
don't understand why you're using a IFSMgr
specific function for a general basic task. Try
a simple _HeapAllocate() instead, it always
worked fine for me.

it works with frogsice ,cause it's a vxd.
spath: it does not matter what kind of alloc function i use
( i used IFSMGR cause i know it from memory) .As i said,it must
be some kind of privileg issue.if my proc gets called due to
an ifs hook it works just fine,regardless of the memory location.

did you make sure that you setup the environment that the rest of the VxDs expects? most importantly, do you load DS/ES/FS with proper selectors? and i can imagine some other housekeeping is mandatory as well... take a look at what the VMM handlers do.

> spath: it does not matter what kind of alloc
> function i use. As i said,it must be some
> kind of privileg issue.if my proc gets called
> due to an ifs hook it works just fine,
> regardless of the memory location.

Yes, that's what you said and it is wrong.
Privilege has nothing to do there as long as
you call SHELL_SYSMODAL_Message from
a DPL0 selector (why do you think your call
to Get_Sys_VM_Handle is working ?).
This a functional problem in your code, not
a protection/privilege issue.

> most importantly, do you load DS/ES/FS with proper selectors?

ok,this explains why it worked as an IfsHook,but why is that required ? SHELL_SYSMODAL_Message seems to be the only
function i use,that needs it.
sorry for my bad mode of expression: by privilege i meant
'proper environment'