Shub-nigurrath
February 10th, 2006, 09:53
Hi,
I was trying to get the IDT values froma ring3 in WinXP with a peice of code such this one:
but when I reach the memcpy call inside the LoadINTVector I get regularly an exception.
What I'm missing?
10x a lot in advance.
I was trying to get the IDT values froma ring3 in WinXP with a peice of code such this one:
Code:
#pragma pack(1) // 2 works, too
typedef struct tagIDT
{
WORD wLimit;
DWORD dwBase;
} IDT, *PIDT;
#pragma pack()
VOID LoadIDT(OUT PIDT pIdt )
{
__asm {
MOV EAX, [pIdt] // load offset into EAX
SIDT [EAX]
}
}
#pragma pack(1)
typedef struct tagINT_VECTOR {
WORD wLowOffset; // LOWORD of the handler's offset
WORD wSelector; // selector of the handler's offset
BYTE bAccess; // 0-3: Type
// 4: ?(=0)
// 5-6: DPL
// 7: Present
BYTE wUnused; // 0, 0, 0, unused (binary)
WORD wHighOffset; // HIWORD of the handler's offset
} INT_VECTOR, *PINT_VECTOR;
#pragma pack()
VOID LoadINTVector( IN PIDT pIdt, IN UCHAR iVector, OUT PINT_VECTOR pVector ) {
__try {
DWORD dwBase = pIdt->dwBase + iVector * sizeof(INT_VECTOR);
memcpy( pVector, (const void *)dwBase, sizeof(INT_VECTOR) );
}
__except( 1 ) {
TRACE( "LoadINTVector failed: Exception\n" );
return;
}
TRACE( "LoadINTVector: Vector 0x%.2X successfully dumped\n", iVector);
}
int tst_IDT () {
IDT idt;
ULONG i=0x03; //breakpoint handler
INT_VECTOR Vec;
LoadIDT(&idt);
LoadINTVector( &idt, (UCHAR)i, &Vec);
//read the value corresponding to the breakpoint vector..
return 0;
}
but when I reach the memcpy call inside the LoadINTVector I get regularly an exception.
What I'm missing?
10x a lot in advance.