c - Reach kernel session space from kernel driver -
i'm writing kernel driver, should read (and in cases, write) memory addresses in kernel session space (win32k.sys). i've read in topic example in windbg should change context random user process read memory of kernel session space (with .process /p). how can in kernel driver? should create user process communicate driver (that's idea now, hope there better solution) or there more simple solution this?
session space not mapped in system address space (that drivers share, if not attached process). why getting bsod while accessing win32k.
you need attached eprocess via kestackattachprocess perform operation. can session id zwqueryinformationprocess(processsessioninformation) function.
Comments
Post a Comment