64bit sys BSOD check plz.

c++ / delphi package - dll injection and api hooking

Re: 64bit sys BSOD check plz.

Postby iconic » Mon Jan 01, 2018 5:01 pm

Yes, kernel local stack space is indeed very small compared to usermode especially on x86 targets :D

--Iconic
iconic
 
Posts: 838
Joined: Wed Jun 08, 2005 5:08 am

Re: 64bit sys BSOD check plz.

Postby madshi » Mon Jan 01, 2018 6:12 pm

Yes, but I would have hoped Windows would properly report that a thread has run out of stack space instead of reporting "memory corruption". Finding and fixing the problem would have been so much easier and faster if the OS had complained properly... :(
madshi
Site Admin
 
Posts: 9756
Joined: Sun Mar 21, 2004 5:25 pm

Re: 64bit sys BSOD check plz.

Postby iconic » Mon Jan 01, 2018 6:18 pm

Agreed. Main problem with a double stack fault is the original calling code has run over the limited stack space and hit a page guard. After this, the OS itself will push the exception record info onto the same stack, resulting in twice the problem. The DDK/WDK has some run-time APIs such as IoGetStackLimits(), IoGetRemainingStackSize() etc. to help you determine how much actual space is left but since local vars are statically declared beforehand it's not overly helpful unless you're using something like recursion and checking in between calls. Another thing, not that I recommend it but it can be useful, if you call PsConvertToGuiThread() (first call to any Win32k service does this auto-magically) the stack size is then converted to a "large"(r) stack. Ideally, just allocate memory dynamically from within the OS when you can which eliminates stack space restrictions

--Iconic
iconic
 
Posts: 838
Joined: Wed Jun 08, 2005 5:08 am

Re: 64bit sys BSOD check plz.

Postby madshi » Mon Jan 01, 2018 6:21 pm

Yes, I've converted those large local arrays to allocated pointers.

Fixing is usually easy, once you know what's wrong... :D
madshi
Site Admin
 
Posts: 9756
Joined: Sun Mar 21, 2004 5:25 pm

Previous

Return to madCodeHook

Who is online

Users browsing this forum: No registered users and 1 guest