A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #11637  by noppy
 Wed Feb 15, 2012 1:39 pm
hello everyone

as you may seen my topic about my problem about Dpc, page fault logging , ...
I know that topic have many wrong understanding about Dpc and interrupt :) , anyway

Here is my incomplete source code to logging page fault interrupt, it work but have a problem, I get 7F bugcheck (UNEXPECTED_KERNEL_MODE_TRAP) parameter Double Fault
I checkout some site and understand it is maybe because of kernel stack not have enough space, or actually the only reason
I thought maybe I get page page while previous page fault not complete and this cause stack to be full of not poped data

I want to ask if anybody have a time to see why this situation happened, or tell me some advise to solve the problem

thanks
Attachments
Page Fault Logger Soruce
(117.06 KiB) Downloaded 35 times