Here's the list of options I can think of to able resolve the issue for may or may not be able to use __try/__except statements for testing invalid parameters.
- Override certain exported kernel function address, i.e.
KeRaiseIrqlToDpcLevel, to verify if it had been called.
- Pro: Very simple method to check if it did get called.
- Pro: May can be caught in __try/__except testing usage.
- Con: There may not be possible to restore internal condition back properly. It may depends on certain kernel API may needs another certain kernel API to do this.
- Create a special disassembly function to find first, or # counter, call instruction (asm instruction translation) and even in child function if necessary. Then have it return true or false for we cannot use __try/__except for invalid parameter(s) input.
- Pro: Likely easier to make things more accurate detection to prove using __try/__except is not possible and is up to the kernel developers to know what they are doing.
- Pro/Con: For this will need an utility library helper to do the task.
- Con: Require make a list of asm instructions and their predicted length to track next asm instruction until certain call function is found.
I figure it will be easier to make the list of direct kernel APIs that are not possible to use __try/__except testing usage. However, kernel functions such as KeResumeThread and KeSuspendThread, aka parent kernel calls, do not count for add to the list. Instead they, in the source code, need to be mentioned which of below kernel functions are being used and reference to this ticket.
- KeRaiseIrqlToDpcLevel
- Anything else?
Here's the list of options I can think of to able resolve the issue for may or may not be able to use __try/__except statements for testing invalid parameters.
KeRaiseIrqlToDpcLevel, to verify if it had been called.I figure it will be easier to make the list of direct kernel APIs that are not possible to use __try/__except testing usage. However, kernel functions such as KeResumeThread and KeSuspendThread, aka parent kernel calls, do not count for add to the list. Instead they, in the source code, need to be mentioned which of below kernel functions are being used and reference to this ticket.