A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #11364  by noppy
 Tue Jan 31, 2012 12:17 pm
hello

There is a situation that I want to use DPC Routine after completion of page fault interrupt
my question is where I must define dpc routine, I mean It must be inside my Interrupt Handler or can be everywhere
if everywhere how windows know for which interrupt we define dpc routin :)

Or I ask completely incorrect question

thanks
 #11365  by lorddoskias
 Tue Jan 31, 2012 12:51 pm
This means you will have to hook the page fault handler. Execute the original ISR and then in your handler queue the DPC routine. Unless you are absolutely sure what you are doing I won't recommend you doing this.
 #11378  by noppy
 Tue Jan 31, 2012 6:11 pm
Yes I hook page fault interrupt from IDT, actually my problem is I cannot get page fault :)
I change attribution of specific process's pages, for example I clear Writable and Owner attribute of process's pages to force it to make page fault, but nothing happen
or some how original handler ignore this kinda page fault (if any occur), so I want to Log every page fault to see what address make page fault, this s why I use DPC, there is a buffer and I fill it in my ISR, then DPC routine must write it to fie or use DbgPrint.

well my main problem completely different from topic I created 8-) , maybe this part must be in separate thread, sorry if it should be :)

and after all, Are you recommend this method of logging.

thanks