NtDll errors: How does the kernel know the difference between read and write?

[jj2007]

Tedd & qWord,
Thanks a lot.
qWord had the right idea:

Code Select Expand

mov ecx, [edx.EXCEPTION_RECORD.ExceptionInformation]
0 for read, 1 for write access.

[zooba]

The IsBad***Ptr functions have been around since Windows 95.

Funny, all the MSDN pages for them say "Minimum Client: Windows XP"? Maybe something got messed up in the docs when they updated the functions to be deprecated... (I never tried to use them before WinXP, so I'll accept they may have been there, but not that the kernel uses them to determine read/write AVs  )

Code Select Expand

mov ecx, [edx.EXCEPTION_RECORD.ExceptionInformation]
0 for read, 1 for write access.

EXCEPTION_RECORD is filled in by the interrupt handler in the kernel, not the processor itself. If this answers the question, great  , but don't misunderstand which part of the system is responsible for sorting it out.

Cheers,
Zooba  :t

[Antariy]

Ah. Solution already have been posted

[jj2007]

EXCEPTION_RECORD is filled in by the interrupt handler in the kernel, not the processor itself.

I had not assumed that Intel & AMD hardwire "EXCEPTION_RECORD", but thanks anyway  ;)