[QQemka]

Hello. I hooked one funtion in SSDT. In the hook i get caller Process id from EPROCESS structure by calling PsGetCurrentProcess(), then i call NtQuerySystemInformation by SSDT index to get list of processes (i need to get this information inside hook for own purpose), but for some reason, NtQuerySystemInformation fails in about 30% cases. I see in DbgView all log with detailed processes information, but sometimes call returns "NtStatus error C0000005, bufsize 00002000, bytes written 000018DF"

The part of code which generates this strange error is

Code: Select all

PSYSTEM_PROCESS_INFORMATION pCurr, pNext;
	NTSTATUS ntStatus = STATUS_INFO_LENGTH_MISMATCH;
	int bufsize = 0x1000;
	int cbWritten;
	PVOID buffer = MmAllocateNonCachedMemory(bufsize);
	while(ntStatus == STATUS_INFO_LENGTH_MISMATCH){
		//DbgPrint("Double bufsize");
		MmFreeNonCachedMemory(buffer, bufsize);
		bufsize *= 2;
		buffer = MmAllocateNonCachedMemory(bufsize);
		ntStatus = NtQuerySystemInformation(5, buffer, bufsize, &cbWritten);
	}
	if (!NT_SUCCESS(ntStatus)){
		DbgPrint("NtStatus error %p %p %p", ntStatus, bufsize, cbWritten);
		MmFreeNonCachedMemory(buffer, bufsize);
		return 2;
	}
	//below is table parsing which works ok

Whats wrong?

[EP_X0FF]

then i call NtQuerySystemInformation by SSDT index

And why are you doing this unexplained perversion? If it called with PreviousMode == UserMode this routine will expect input buffer to be in usermode. Since you are doing it from SSDT hook this function will generate you fail/success etc. Use ZwQuerySystemInformation instead.