search

can1357 / ByePg

Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI.
804 stars 182 forks source link

Handle exception cause by a specific module #7

Closed YangKi1902 closed 4 years ago

YangKi1902 commented 4 years ago

hello, is there a way i can detect and only handle exception of a specific module or current module ?, example mydriver.sys, thanks.

can1357 commented 4 years ago 
void* ImageBase; 
RtlPcToFileHeader(ContextRecord->Rip, &ImageBase);

This will give you the module image base at ImageBase, simply compare it against the module you want to handle exceptions of. "Normal" exceptions from other modules will not reach your exception handler anyways as they are not supposed to bug-check unless there is something wrong.