A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #8564  by Flopik
 Wed Sep 14, 2011 5:31 pm
Is there a way to detect if Windows as crashed in kernel mode? To prevent the driver from loading again and crash loop the system. If start mode is 0. I just found out about :
InitSafeBootMode but that doesnt check if Windows has crashed
 #8573  by r2nwcnydc
 Thu Sep 15, 2011 12:35 pm
I don't know if there is an easy way to do this, but you could probably use KeRegisterBugCheckCallback to do something similar... Changing the registry might be a problem, because the callback gets called with irql = HIGH_LEVEL so you cannot use the Nt/Zw registry functions.

Some possible work arounds:
If you know your driver will get loaded before any faulting driver, you could write to some temporary location, read that location when your driver loads, and modify the registry if it matches some criteria.

Or if you know the driver that you think will cause the crash loop, you could try (when your driver loads) mapping its registry key into virtual memory, then create a physical mapping to the memory, and then (assuming the mapping doesn't get torn down before the bug check callback is called) you can modify the key from the callback by simply writing to the memory address. This could fail for a couple of different reasons. 1) The mapping gets destroyed before the callback is called. 2) The changes to the virtual memory don't get written to disk; making the changed key temporary until reboot (which is about to happen).

You could try to find the location of all driver's registry keys on disk then some how use READ_PORT_XXX, READ_REGISTER_XXX, WRITE_PORT_XXX, and/or WRITE_REGISTER_XXX to overwrite the start type.

MSDN articles:
BugCheckCallback - http://msdn.microsoft.com/en-us/library ... s.85).aspx
KeRegisterBugCheckCallback - http://msdn.microsoft.com/en-us/library ... s.85).aspx
BugCheckDumpIoCallback - http://msdn.microsoft.com/en-us/library ... s.85).aspx
BugCheckSecondaryDumpDataCallback - http://msdn.microsoft.com/en-us/library ... s.85).aspx