'MmProbeAndLockPages() failed while coding windows driver

I am coding a windows driver.

I try to probes a Virtual Memory Page using MmProbeAndLockPages() https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-mmprobeandlockpages

First I allocate the MDL using IoAllocateMdl(). Then I probes the virtual memory page. The code is like :

PMDL pMdl = IoAllocateMdl(Dest, (ULONG)Size, FALSE, FALSE, NULL);
if (pMdl) {
    __try {
        MmProbeAndLockPages(pMdl, KernelMode, IoModifyAccess);
        MmUnlockPages(pMdl);
    }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        status = GetExceptionCode();
    }
    IoFreeMdl(pMdl);
}

I also tried to attach to the process using KeStackAttachProcess() but it has no effect.

The Dest variable is a PVOID to a userland process' address. The address is valid because I can read from it.

Do you have an idea why MmProbeAndLockPages() failed and my code goes into the except branch?

The exception code is 0xC0000005 (which is an access violation) but I specified IoModifyAccess/IoWriteAccess and I should be able to write to a userland process from kernelland, right?

Even when I unset the WP bit of cr0, it doesn't work ... hum something weird is happening

I am using a windows 10.0.19044

Thanks

regards

Solution 1:^[1]

I have to change IoModifyAccess to IoReadAccess.

Then to call MmProtectMdlSystemAddress() with PAGE_READWRITE.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source
Solution 1	Jeremy Caney

'MmProbeAndLockPages() failed while coding windows driver

Solution 1:[1]

Sources

Related Questions

Solution 1:^[1]