From 04e92516123dd094bcfa3fd14b4d0d59c8e4eaf0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Gardou?= Date: Mon, 10 May 2021 19:09:53 +0200 Subject: [PATCH] [NTOS:PS] Use KD routine to safely read memory from thread stack Should fix a crash when hitting TAB+(Whatever I typed that triggerred this) --- ntoskrnl/ps/debug.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/ntoskrnl/ps/debug.c b/ntoskrnl/ps/debug.c index b7ea2db32eb..0a2f3e05517 100644 --- a/ntoskrnl/ps/debug.c +++ b/ntoskrnl/ps/debug.c @@ -70,9 +70,24 @@ PspDumpThreads(BOOLEAN IncludeSystem) /* Walk it */ while(Ebp != 0 && Ebp >= (PULONG)Thread->Tcb.StackLimit) { - /* Print what's on the stack */ - DbgPrint("%.8X %.8X%s", Ebp[0], Ebp[1], (i % 8) == 7 ? "\n" : " "); - Ebp = (PULONG)Ebp[0]; + ULONG EbpContent[2]; + ULONG MemoryCopied; + NTSTATUS Status; + + /* Get stack frame content */ + Status = KdpCopyMemoryChunks((ULONG64)(ULONG_PTR)Ebp, + EbpContent, + sizeof(EbpContent), + sizeof(EbpContent), + MMDBG_COPY_UNSAFE, + &MemoryCopied); + if (!NT_SUCCESS(Status) || (MemoryCopied < sizeof(EbpContent))) + { + break; + } + + DbgPrint("%.8X %.8X%s", EbpContent[0], EbpContent[1], (i % 8) == 7 ? "\n" : " "); + Ebp = (PULONG)EbpContent[0]; i++; }