| View previous topic :: View next topic |
| Author |
Message |
NotReq
Expert Cheater
 Reputation: 0
Joined: 02 Jan 2007
Posts: 201
|
 Posted: Wed Oct 31, 2007 2:50 pm Post subject: BSOD while using Kernel mode APIs |
 |
|
OK, so I'm sitll working on my GG crc bypass (I've been working on it for a week so far and I still haven't improved much ;_; ), I'm trying to hook a certain function like DB suggested but I already get an error trying to get its address. This is my first expirience creating a driver so I have like completely no clue what's the problem.
| Code: | #include "ntddk.h"
PUNICODE_STRING APIFunctionName;
PKIRQL oldIRQL;
void DriverUnload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("Driver unloaded.\n");
}
DriverEntry(
IN OUT PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
DbgPrint("Driver loaded.\n");
NTSTATUS ntStatus;
ULONG a;
DriverObject->DriverUnload = DriverUnload;
KeRaiseIrql(PASSIVE_LEVEL, oldIRQL);
RtlInitUnicodeString(APIFunctionName, L"ZwReadVirtualMemory");
a = (ULONG)MmGetSystemRoutineAddress(APIFunctionName);
ntStatus = STATUS_SUCCESS;
DbgPrint("Driver init complete.\n");
return ntStatus;
} |
KiKi was right when he told me that I'd get sick of kernel programming really fast (though I didn't that I could get sick of it THAT fast), I get BSOD no matter what I do and it's really annoying :/ .
|
|
| Back to top |
|
 |
appalsap
Moderator
 Reputation: 0
Joined: 27 Apr 2006
Posts: 6753
Location: Pakistan
|
| Posted: Wed Oct 31, 2007 2:58 pm Post subject: |
|
|
I bet you got compiler warnings about this and ignored them. You declared a pointer to a UNICODE_STRING but it doesn't point anywhere, same with the IRQL. Nothing special about kernelmode, if you did this in usermode it would crash and burn too.
_________________
|
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25823
Location: The netherlands
|
| Posted: Wed Oct 31, 2007 2:59 pm Post subject: |
|
|
it always helps reading the BSOD message. It tells you why it crashed
also, why KeRaiseIrql(PASSIVE_LEVEL, oldIRQL); ?
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
NotReq
Expert Cheater
Reputation: 0
Joined: 02 Jan 2007
Posts: 201
|
| Posted: Wed Oct 31, 2007 3:05 pm Post subject: |
|
|
Thanks, I feel like a total noob, I was rushing and hence I didn't really pay attention to what was written in MSDN, I thought those function allocate the memory themselves.
| Dark Byte wrote: | it always helps reading the BSOD message. It tells you why it crashed
also, why KeRaiseIrql(PASSIVE_LEVEL, oldIRQL); ? |
| Quote: | | This routine can only be called at IRQL = PASSIVE_LEVEL. |
Hm... If I understand this right I have to raise IRQL level to PASSIVE or else this function won't work. Well reading BSOD message sure would help if only it wasn't corrupted, there must be something wrong with my windows because the BSOD messages are all messed up, the only thing you can decipher is the address where the error occured (not even sure about this part)
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 471
Joined: 09 May 2003
Posts: 25823
Location: The netherlands
|
| Posted: Wed Oct 31, 2007 3:09 pm Post subject: |
|
|
you're already at passive level in driverentry if you load the driver yourself.
and, if you raise the irql, it always HAS to go with lowering the irql at the end
and, passive level is irql 0 , if you raise it, it can only go lower
about the bsod, the top part sometimes says something like :"page fault in nonpaged area" or "fuck you dumb shit" or "irql less than or equal", etc...
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
the_undead
Expert Cheater
 Reputation: 1
Joined: 12 Nov 2006
Posts: 235
Location: Johannesburg, South Africa
|
| Posted: Wed Oct 31, 2007 3:10 pm Post subject: |
|
|
You're BSOD'ing so frequently due to inexperience. Keep messing around with it - you'll get there - its not that hard.
_________________
|
|
| Back to top |
|
|
NotReq
Expert Cheater
Reputation: 0
Joined: 02 Jan 2007
Posts: 201
|
| Posted: Thu Nov 01, 2007 4:06 am Post subject: |
|
|
Another noob question of mine.
How can you acess (read/write) user mode space of a particular application? And what should I use to allocate large amounts of memory for my needs?
|
|
| Back to top |
|
|
DeletedUser14087
I post too much
![]() Reputation: 2
Joined: 21 Jun 2006
Posts: 3069
|
| Posted: Thu Nov 01, 2007 4:26 am Post subject: |
|
|
Tip:
Buy a $100 Computer (Offline, without a network) install MSVC++ and Delphi 7.0e there, and start programming and learning how to use kernelmode api
|
|
| Back to top |
|
|
assaf84
Expert Cheater
![]() Reputation: 0
Joined: 03 Oct 2006
Posts: 238
|
| Posted: Thu Nov 01, 2007 4:42 am Post subject: |
|
|
| Kaspersky wrote: | Tip:
Buy a $100 Computer (Offline, without a network) install MSVC++ and Delphi 7.0e there, and start programming and learning how to use kernelmode api |
So how would he check stuff in MSDN?
|
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 471
Joined: 09 May 2003
Posts: 25823
Location: The netherlands
|
| Posted: Thu Nov 01, 2007 5:01 am Post subject: |
|
|
you can install msdn locally
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
NotReq
Expert Cheater
Reputation: 0
Joined: 02 Jan 2007
Posts: 201
|
| Posted: Thu Nov 01, 2007 5:09 am Post subject: |
|
|
| Kaspersky wrote: | Tip:
Buy a $100 Computer (Offline, without a network) install MSVC++ and Delphi 7.0e there, and start programming and learning how to use kernelmode api |
Why would I need MSVC++ or even Delphi? All you need is already included in DDK.
| Quote: | Accessing User-Space Memory
Drivers cannot allocate user-space virtual memory because they run in kernel mode. In addition, a driver cannot access memory through user-mode virtual addresses unless it is running in the context of the user-mode thread that caused the driver’s current I/O operation and it is using that thread’s virtual addresses.
Only highest-level drivers, such as FSDs, can be sure their dispatch routines will be called in the context of such a user-mode thread. A highest-level driver can call MmProbeAndLockPages to lock down a user buffer before setting up an IRP for lower drivers.
Lowest-level and intermediate drivers that set up their device objects for buffered I/O or direct I/O can rely on the I/O Manager or a highest-level driver to pass valid access to locked-down user buffers or to system-space buffers in IRPs.
|
So if there's no way to access user mode memory how can I create a copy of memory region of some application?
|
|
| Back to top |
|
|
DeletedUser14087
I post too much
![]() Reputation: 2
Joined: 21 Jun 2006
Posts: 3069
|
| Posted: Thu Nov 01, 2007 5:48 am Post subject: |
|
|
| assaf84 wrote: | | Kaspersky wrote: | Tip:
Buy a $100 Computer (Offline, without a network) install MSVC++ and Delphi 7.0e there, and start programming and learning how to use kernelmode api |
So how would he check stuff in MSDN? |
The one he's using now to chat on forums 
|
|
| Back to top |
|
|
NotReq
Expert Cheater
Reputation: 0
Joined: 02 Jan 2007
Posts: 201
|
| Posted: Thu Nov 01, 2007 6:27 am Post subject: |
|
|
Now I get BSOD when I set up a hook 
| Code: | void HookFunction(IN OUT PMDL MemoryDescriptorList,
IN KPROCESSOR_MODE AccessMode,
IN LOCK_OPERATION Operation)
{
DbgPrint("MmProbeAndLockPages call");
RtlCopyMemory((void*)originalAddress, (void*)oldBytes, 6);
((void (__stdcall*)(IN OUT PMDL, IN KPROCESSOR_MODE, IN LOCK_OPERATION))originalAddress)
(MemoryDescriptorList, AccessMode, Operation);
RtlCopyMemory((void*)originalAddress, nonCachedHookMemory, 6);
} |
oldBytes = 0x6A 0x6C 0x68 0x68 0x92 0x4D , this is the first 6 bytes of hooked function (I copy them during driver init step)
nonCachedHookMemory = 0x68 &HookFunction 0xC3
Basically
| Code: |
push addr HookFunction
ret
|
The BSOD message says the following
* STOP : 0x0000007f (0x0000000D, 0x00000000, 0x00000000)
p.s. and please stop spamming in my thread, if you want to discuss something just create your own.
|
|
| Back to top |
|
|
XxOsirisxX
Grandmaster Cheater Supreme
 Reputation: 0
Joined: 30 Oct 2006
Posts: 1597
|
| Posted: Thu Nov 01, 2007 6:35 am Post subject: |
|
|
Maybe this could helps you.  I hope so.
It was on spanish, translated on google, so in case you see any problem reading it, you may know why. ^^
| Quote: | STOP 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)
CAUSE: Drivers incompatibles or bad made
EXPLANATION: This error means that a process or a kernel mode driver attempted to access a memory address for which it has no permit. It often results in the code because there is a pointer that refers to a portion of memory that does not correspond to the process. This leads to a violation of the separation of processes in Windows and a stop to prevent an overwrite code or data to another process.
ARTICLES
General Information on STOP 0x0000000A
Troubleshooting “Stop 0x0A” Messages in Windows
Troubleshooting a Stop 0x0000000A Error in Windows XP
STOP 0x0000000A Error Message When You Change from AC Power to DC Power
Windows XP Restarts When You Try to Shut Down Your Computer
STOP 0x0000000A Irql_Not_Less_or... During Windows XP Upgrade
0x0000000A Error Message When You Fast Switch Between Users
STOP 0x0000000A Windows XP restarts when you try to shut down your computer
STOP 0x0000000A Computer automatically restarts after you upgrade to Windows XP
STOP 0x0000001D or STOP 0x000000A Stop Error Occurs in Ndis.sys
STOP 0x0000000A How to Troubleshoot Hardware and Software Driver Problems in Windows XP
STOP 0x0000000A How to Debug a System After You Receive Stop Error IRQL_NOT_LESS_OR_EQUAL
STOP 0x0000000A Error Occurs After You Install an HP ScanJet 5100c or 5200c Scanner
STOP 0x0000000A Error Message Occurs When You Use Routing and Remote Access with NAT and VPN
Eject Request May Cause "Stop 0xA" Error Message
STOP 0x0000000A Error Message and Computer Stops Responding When You Use Dial-up RAS Connection
STOP 0x0000000A When You Dual Boot with Windows NT 4.0 on the Same Partition
STOP 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)
CAUSE: Drivers incompatible or poorly made software serious bugs, defective hardware.
EXPLANATION: The kernel exception handler has detected a process trying to start an invalid instruction.
ARTCLES:
Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors
STOP 0x0000001E Error Message During Setup
STOP 0x0000001E Error Message During Windows XP Setup
STOP 0x0000001E Error Message in Ntoskrnl.exe
STOP 0x0000001E KMODE_EXCEPTION_NOT_HANDLED in Win2k.sys
STOP 0x0000001E KMODE_EXCEPTION_NOT_HANDLED Error Message from Aspi32.sys
STOP 0x0000001E Error Occurs in Win32k.sys in Windows 2000
STOP 0x0000001E Error Message in Win32k.sys in Windows XP
STOP 0x0000001E in Usbhub.sys with Surprise Removal of Plug and Play USB Hub
STOP 0x0000001E in Win32k.sys When You Quit a Program
STOP 0x0000001E in Win32k.sys When Using Animated Mouse Pointers
STOP 0x0000001E on Windows 2000 Server
STOP 0x0000001E Error Message After Changing Color Depth
STOP 0x0000001E Error Message Printing with HP DesignJet Printer Driver from a Terminal Services Client
STOP 0x0000001E Error Message When You Print from a Windows 2000 Terminal Services Client
STOP 0x00000024 (NTFS_FILE_SYSTEM)
CAUSE: Hard disk damaged cables in bad condition, damaged file system
EXPLANATION:Windows can not access the NTFS partition where your files.
ARTICLES:
STOP 0x00000024 in Ntfs.sys
Troubleshooting Stop 0x24 or NTFS_FILE_SYSTEM Error Messages
STOP 0x23 (or STOP 0x24) When restarting PC after installing PC-Magic Encrypted Magic Folders
STOP 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)
CAUSE: Drivers inconsistent, incompatible software, RAM flawed, defective board or card.
EXPLANATION: A driver or program has requested a page of a memory address invalid.
ARTICLES:
Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors
Easy CD Creator 5.0 Does Not Function In Windows XP
STOP 0x00000050 Error starting Windows after connecting a scanner
You Receive a STOP 0x00000050 Error When You Restart Microsoft Message Queuing
Damaged Font Causes STOP 0x00000050 Error Message in the Win32k.sys File in Windows 2000
Stop Error Occurs When You Start the Computer for the First Time
STOP 0x00000050 Error Message When You Are Using a CD-ROM
STOP 0x00000050 Error Message While Installing Windows NT 4.0
STOP 0x00000050 in Usbhub.sys with Surprise Removal of Plug and Play USB Hub
STOP 0x00000050 in Udfs.sys Viewing Files on DVD
STOP 0x00000050 Error Message Printing to Windows NT 4.0 Print Server
"Stop 0x1E" or "Stop 0x50" with Terminal Services Client Print Session
STOP 0x00000050 in Win32k.sys Error Message
STOP 0x00000050 Error Message When USB Device Is Connected
STOP 0x00000050 Error Message When You Rename a Large Number of Files on Windows 2000
STOP 0x00000050 Error Message When You View Files on a DVD
STOP 0x00000050 Page_Fault_In_Non-Paged_Area Error After Installing Service Pack 1 (SP1)
STOP 0x00000050 Error starting Windows after connecting a scanner
STOP 0x00000050 (0xffffffe0, 0x00000001, 0xf30da010, 0x00000000) PAGE_FAULT_IN_NONPAGED_AREA
STOP 0x00000077 (KERNEL_STACK_INPAGE_ERROR)
CAUSE: Fields flawed in the swap, IDE cables defective viruses.
EXPLANATION: One page of memory requested by the kernel could not be read from the swap file into RAM.
ARTICLES:
Common Causes of STOP Messages 0x00000077 and 0x0000007A
Troubleshooting Stop 0x00000077 or KERNEL_STACK_INPAGE_ERROR
STOP 0x0000007B (INACCESSIBLE_BOOT_DEVICE)
CAUSE: Changing plate or controlling change disk to another PC viruses
EXPLANATION: Windows can not find the partition where your files. It is a situation similar to the error 0x000000ED
ARTICLES:
After relocating boot disk
Troubleshooting STOP 0x0000007B or 0x4,0,0,0 Error
STOP 0x0000007B Error After Moving Windows 2000 System Disk to Another System
STOP 0x0000007B Error After You Move the Windows XP System Disk to Another Computer
STOP 0x0000007B Error Message When You Start Your Computer
STOP 0x0000007B Error Message When You Restart Computer
STOP 0x0000007B Caused by Missing [SysprepMassStorage] Section on Windows XP sysprep Images
STOP 0x0000007B Error Occurs When You Press F6 to Load Drivers During Unattended Windows Setup
Troubleshooting STOP 0x0000007B Errors in Windows XP
STOP 0x0000007B Is Generated When You Boot to a Mirrored Dynamic Disk
STOP 0x0000007B Error Message Is Generated While Converting Basic Disk to Dynamic
Using Sysprep May Result in "Stop 0x7b (Inaccessible Boot Device)" on Some Computers
STOP 0x0000007B After you remove or reinstall Roxio Easy CD Creator 5
STOP 0x0000007B Cannot Upgrade with the MSDN Version of Windows XP
Installing Windows 2000 from a USB CD-ROM Drive May Cause a "Stop 0x7B" Error
Windows Hangs at "Loading Machine Info" with HighPoint UltraDMA ATA/66 Controller
Error: "INACCESSIBLE_BOOT_DEVICE" after cloning to a different size drive
How to use Sysprep with Ghost
NOTE: Before you move a disk with Windows 2000 or XP PC to another, it must be loaded into the system some drivers generic IDE:
Extrac Atapi.sys, Intelide.sys, Pciide.sys, y Pciidex.sys de %SystemRoot%\Driver Cache\I386\Driver.cab (o SPx.CAB), and copy to %SystemRoot%\System32\Drivers.
Download this file and double-click on it to add it to register
The article is the official Microsoft.
STOP 0x0000007E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED)
CAUSE: Drivers or incompatible software, BIOS inconsistent, incompatible hardware.
EXPLANATION: A process of the system has generated an exception that has not been processed by the exception handler.
If the error occurs when connecting a USB device, it is because the USB bus is being used at 100% now. Connect this device to another controller or stop another USB device before connecting again.
If the error is in Kbdclass.sys, is caused by the utility Logitech iTouch. Download the latest version of http://www.logitech.com.
ARTICLES:
STOP 0x0000007E Error in Kbdclass.sys When You Try to Shut Down WinXP
STOP 0x0000007E Error Message After You Upgrade to Windows XP
STOP 0x0000007E Error When Registering Olemsg32.dll or Cdo.dll Files
STOP 0x0000007E Occurs in Usbhub.sys If USB Bandwidth Consumption Exceeds 100 Percent
STOP 0x0000007E" Error Message When You Install Windows XP Disk Image from a Remote Installation Services Server
STOP 0x0000007F (UNEXPECTED_KERNEL_MODE_TRAP)
CAUSE: Hardware defective, usually RAM or motherboard, incompatible software.
EXPLANATION:A process of the kernel or a driver has been found that there is not enough space on the stack for the operation that intended.
One of the most common causes is Norton Antivirus (see official information from Symantec here).
ARTICLES:
General Causes of STOP 0x0000007F Errors
STOP 0x0000007F Errors - General Causes
STOP 0x0000007F Error Message or Your Computer Unexpectedly Restarts
STOP 0x0000007F Windows Stops Responding With STOP Error 0x7F
STOP 0x0000007F Computer Turns Off During Text-Mode Setup if it is too hot
STOP 0x0000007F During Setup on Hewlet Packard Pavilion 7840
STOP 0x0000007F on Windows 2000 with InoculateIT Enterprise Edition Installed
STOP 0x0000007F on Windows 2000 Using Veritas Netbackup with Open File Manager Software
Terminal Server Unexpectedly Restarts or You Receive STOP Error 0x0000007F
STOP 0x0000007F Error Message May Be Displayed When the WQuinn QuotaAdvisor 4.1 Program Is Installed
Devices Server
STOP 0x0000008E (KERNEL_MODE_EXCEPTION_NOT_HANDLED)
CAUSE:Hardware drivers or BIOS inconsistent. The most common RAM is defective or nvidia drivers.
EXPLANATION: A process kernel has been an exception is not processed by the exception handler. It is similar to the error 0x0000007F.
ARTICLES:
STOP 0x0000008E Error Message During Windows XP Setup
STOP 0x0000008E Error Message Occurs in Wdmaud.sys
STOP 0x0000008E Error Message Occurs When You Change the Hardware Acceleration Setting
STOP 0x0000008E Error Message on a Blue Screen and Your Computer Does Not Enter Hibernation or Standby After You Remove an IEEE 1394 Storage Device
STOP 0x0000008E "Failed To Install Product Catalog" Error Message When You Install Windows XP
STOP 0x0000009F (DRIVER_POWER_STATE_FAILURE)
CAUSE:Driver is not working properly with the functions of energy saving.
ARTICLES:
Troubleshooting STOP 0x0000009F Error Messages in Windows 2000
Troubleshooting a STOP 0x0000009F Error in Windows XP
STOP 0x0000009F in Ntoskrnl.exe When Shutting Down or Restarting Computer
STOP 0x0000009F Computer hangs at shutdown or "Cannot find enough resources"
Cluster Server May Generate STOP 0x0000009F During Shutdown
STOP 0x000000C2 (BAD_POOL_CALLER)
CAUSA: Driver or wrong software.
ARTICLES:
How to Debug or Stop 0x000000C2 Error Messages
How to Debug Stop 0x000000C2 Error Messages in Windows XP
STOP 0x000000C2 Computer with ATI FURY MAXX hangs after upgrade to Windows XP
STOP 0x000000C2 After you install IomegaWare
STOP 0x000000C2 Bad_Pool_Caller When you upgrade from Windows 2000
"Stop 0xC2 BAD_POOL_CALLER" Error Message on Print Server
A "Stop 0x000000C2" Error Occurs When You Try to Close a File on a Network Share
STOP 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)
CAUSE: Driver wrong
EXPLANATION: The cause is the same as the error 0x0000000A, but this time we know that it is a safe driver.
ARTICLES:
STOP 0x000000D1 Error Message in Tcpip.sys
STOP 0x000000D1 Error Message When You Turn Your Computer Off
STOP 0x000000D1 Error Message When You Start Windows XP
STOP 0x000000D1 Second Mylex AcceleRAID SCSI Controller Causes Error Message
STOP 0x000000D1 WRQ AtGuard Program causes error message in Windows XP
STOP 0x000000D1 Kbdclass.sys Error Message When You Try to Shut Down the Computer
STOP 0x000000D1 Error Message With RAM Problems or Damaged Virtual Memory Manager
STOP 0x000000D1 Error in Atmlane.sys
Error Message Reports STOP 0x000000D1 in Serial.sys When Serial Device or Driver Verifier Is in Use
STOP 0x000000D1 Computer Restarts After You Quickly Insert and Remove a PC Card
STOP 0x000000EA (THREAD_STUCK_IN_DEVICE_DRIVER)
CAUSE: Driver, typically the graphics card, improper.
EXPLANATION: The driver has entered into an unending cycle, repeating the same instructions over and over again.
ARTICLES:
STOP 0x000000EA ErrMsg Running Video-Intensive Programs
STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER
STOP 0x000000ED (UNMOUNTABLE_BOOT_VOLUME)
CAUSE: Changing board or controller, IDE cables defective or inadequate, changes in the connection of disks.
EXPLANATION: Windows can not access the partition where your files.
ARTICLES:
STOP 0x000000ED Error Message When Volume on IDE Drive with Caching Enabled Is Mounted
STOP 0x000000ED Error Message When You Restart Your Computer or Upgrade to Windows XP
STOP 0xC0000005
"Unhandled Exception c0000005" Error Message During Windows Startup
PRB- Printing Reports Causes Exception C0000005 Error
FIX- C0000005 Error With CLOSE ALL in Project Hook BeforeBuild
FIX- C0000005 Fatal Error With TRANSFORM() on Long Strings
FIX- C0000005 Error With Repeated SQL SELECTs Using BETWEEN(á)
FIX- C0000005 Fatal Error Using DIRECTORY("---dirname")
FIX- C0000005 Fatal Error With MODIFY WINDOW SCREEN in EXE
FIX- C0000005 Fatal Error With Invalid Property Name
FIX- C0000005 Fatal Error with Unknown Var in Include File
FIX- C0000005 Fatal Error Saving FormSet After Add Cancel in DE
STOP 0xC0000218 (UNKNOWN_HARD_ERROR)
CAUSE: Files damaged or erased from the register, defective RAM.
EXPLANATION: Windows could not load the files in the registry that are missing or damaged.
ARTICLES:
0xC0000218 - UNKNOWN_HARD_ERROR
How to Recover from a Corrupted Registry that Prevents Windows XP from Starting
How to Troubleshoot a Stop 0xC0000218 Error
STOP 0xC000021A (STATUS_SYSTEM_PROCESS_TERMINATED)
CAUSE: Software or drivers incompatible
EXPLANATION: A subsystem in user mode (WinLogon or CSRSS for example) has had a serious mistake.
ARTICLES:
How to Troubleshoot a Stop 0xC000021A
STOP 0xC000021A Computer Hangs When you log on to a Terminal Services Session
STOP 0xC000021A Error Message Occurs If You Download a RIPrep Image
STOP 0xC000021A Caused by GoBack
STOP 0xC000021A in Winlogon Caused by PCAnywhere
STOP 0xC000021A Installing Internet Information Services Can Cause Problems in Windows XP
STOP 0xC0000221 (STATUS_IMAGE_CHECKSUM_MISMATCH)
CAUSES: Files modified errors in accessing the disk, RAM defective.
EXPLANATION: To verify that the files loaded at boot Windows have not been modified, a checksum is calculated at the time of load and compared against the stored there. If they are not equal, this error is generated. |
_________________
|
|
| Back to top |
|
|
NotReq
Expert Cheater
Reputation: 0
Joined: 02 Jan 2007
Posts: 201
|
| Posted: Thu Nov 01, 2007 7:41 am Post subject: |
|
|
| I think I get BSOD when a different thread calls MmProbeAndLockPages while the function is only half-restored or something, could be it at least. And if it's the case then how should I properly hook the function not to cause BSODs and not to disrupt the work of other system processes?
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
