SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Viewed 56

OK so I'm trying to obtain the total size of code section of Ntoskrnl.exe by walking the PE header of this file. I have been told that the there maybe multiple code sections but I don't think my code below properly addresses this scenario.

I'm getting the above BSOD (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) blue screen stop error and when I load the Memory.DMP in Windbg.exe it says the offending line is the line enclosed between >>> offending line <<<.

extern IMAGE_DOS_HEADER* NtBase;
GetPEHeaderInfo()
{

    PIMAGE_DOS_HEADER pdosHeader = (PIMAGE_DOS_HEADER)NtBase;
>>> PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((UCHAR*)pdosHeader + pdosHeader->e_lfanew); <<<
    PIMAGE_FILE_HEADER pFileHeader = (PIMAGE_FILE_HEADER)&pNTHeader->FileHeader;
    PIMAGE_OPTIONAL_HEADER64 pOptionalHeader = (PIMAGE_OPTIONAL_HEADER)&pNTHeader->OptionalHeader;
    PIMAGE_SECTION_HEADER pSectionHeader = (PIMAGE_SECTION_HEADER)((UCHAR*)pNTHeader + sizeof(IMAGE_NT_HEADERS) + (pFileHeader->NumberOfSections - 1) * sizeof(IMAGE_SECTION_HEADER));

    patch_Info.pStartOfCode = (UINT64*)NtBase + pSectionHeader->VirtualAddress;
    patch_Info.nSizeofCode = pSectionHeader->Misc.VirtualSize;
    patch_Info.pEndOfCode = patch_Info.pStartOfCode + patch_Info.nSizeofCode;
    patch_Info.pImageBase = (UINT64*)(pOptionalHeader->ImageBase);
}

Please correct my code as I'm unable to fix this error. I've uploaded a copy of the Crash Dump Analysis see here.

0 Answers
Related