Hi all, i'm writing an Olly plugin that use a driver to hook functions and other stuff, i've successfully hooked some ISR and the plugin work fine but when i try to hook int0e (page fault handler) it give me some problem.
There is something different in that routine?
thanks.

Hi

You can take a look at the source code of Ollybone (Joe Stewart) as well as the ShadowWalker POC (Sherri Sparks/Jamie Butler) that olly plugin is somewhat based on. Both use page fault hooks.

What kind of problems are you having?

Sorry, I just noticed you mentioned this is on x64, that might be a whole new issue and one I'm not familiar with.

Hi,yes, indeed I have seen that there are several differences from x86 to x64, the problem is that some times i get a bugcheck (access violation) from user land that crash the system, for me seems that it doesn't swap context from kernel mode to user mode.
I use a code similar this:

seen that the error appears occasionally, can depend on the values ​​of eflags or some segment register?

I have solved that, the problem was that i didn't save the cr2 register at the beginning of the routine.

This informative" register.

Problem in the T-frame.

Hi Indy,now that the handler works, I wish I could change the protection flags of a user memory address(from kernel), you know how could I do?

Yes, but I will not say. Mod Cr3 is a dirty hack. More complex is not available to you, how I understand )

I think I misunderstood your previous message (I do not understand English very well).
why my handler should not work?
I save the cr2 register at beginning of routine and then I put it back in the register at the end of routine to handle the page fault whit the original handler.

MmProtectMdlSystemAddress()

Thank you for your answer but i prefer modify pte because MmProtectMdlSystemAddress doesn't work with user_shared_data