CODEWITHSUNDEEP
x86masmosdev
jay
jay

Reputation: 1071

How do I run my code after the default page fault handler of windows has done execution?

For some reason I want to run my code after the page fault handler of windows has executed to ensure the page is now located in physcial memory. I used code below as the new int 0E handler:

    pushfd                      // eflags
    push cs
    call __Next
__Next:
    add dword ptr [esp], 0x0E           // eip
    push dword ptr [esp + 0x0C]         // error code
    jmp OldInt0EHandler
    // After the int 0e has run, EIP returns here.
    // TODO: add code here after the code has done
    add esp, 4
    iretd

But I get BSOD when I replace the handler with my new one. How do I do it right?

Upvotes: 1

Views: 147

Answers (1)

Keeley Hoek
Keeley Hoek

Reputation: 543

You will have to disable Windows kernel patch protection in order to do this. Otherwise, it will trigger the BOSD for (obvious) security reasons.

Upvotes: 1

Related Questions