Be careful with MmGetSystemRoutineAddress
Bill McKenzie reported on NTDEV that he re-discovered a nasty crash bug in MmGetSystemRoutineAddress. Apparently, all versions of Windows XP and everything before Windows Server 2003 SP1 will bugcheck if they’re passed an invalid system routine name.
This bug is fixed in Vista and is scheduled for fix in XP SP3.
Meanwhile, Peter Viscarola from OSR offers this advice:
The work-around is to always call MmGetSystemRoutineAddress from within a try/except block. If you get the exception, I guess you can assume the routine you’re seeking isn’t there…
UPDATE from Doron Holan:
FYI, using SEH to recover from this bug is *NOT* recommended. SEH is not a formal contract for this API and as such, we (MSFT) cannot guarantee that the OS is still in a stable state after you have caught the exception. I am working on a better solution, but for now, SEH is not the answer.
June 2nd, 2007 at 9:40 am
Does anyone know why that specific export causes this crash ?
June 2nd, 2007 at 11:22 am
There have been reports of it breaking with other exports as well - someone reported DbgPrintEx doing the same thing. I hope we’ll see additional clarification soon from Microsoft. Unless I get bored and reverse it first.