RE: User display in task manager

Hello Burkhard,

thanks for your quick answer! Yes, I saw the solution but I don't know how
to jmp to the KiTrap02! Do you have a source code sample to handle this
problem.

Regards,

Mario

"bcpauli" wrote:

Hi Mario,
Ok, some more off topic :-)
please see the discussion, at
<http://groups.google.de/group/microsoft.public.windowsxp.embedded/browse_thread/thread/fe6409d36fcf9d23/8a8863d71625c945?lnk=st&q=bcpauli&rnum=5#8a8863d71625c945>
there is a solution.

But the problem is the implementation of the NMI handling with a TaskGate.
There is no way in Windows XP to be sure that the state of the math Co
processor is correct after the iretd when you do it with a TaskGate ( it has
to do with the windows implementation of the INT07 and the EM-Bit handling in
CR0 by the TaskGate, remember NMIs can occure at any moment).

The only way to use NMIs, is to install a InterruptGate for the NMI and if
you want to use the FPU during NMI you have to save the FPU on entering and
restore it on before you iretd.

And be sure to disbale SMIs (System Management Interrupts), because they are
executed during an NMI and if you return from SMM the state that one NMI
can't be interuppted by another NMI is lost!

See Intel Docu "Intel Architecture Software Developer’s Manual, Volume 3:
System Programming Guide (Order Number 243192)"
Chapter 11.7 NMI HANDLING WHILE IN SMM

...
A special case can occur if an SMI handler nests inside an NMI handler and
then another NMI
occurs. During NMI interrupt handling, NMI interrupts are disabled, so
normally NMI interrupts
are serviced and completed with an IRET instruction one at a time. When the
processor
enters SMM while executing an NMI handler, the processor saves the SMRAM
state save map
but does not save the attribute to keep NMI interrupts disabled.
Potentially, an NMI could be
latched (while in SMM or upon exit) and serviced upon exit of SMM even
though the previous
NMI handler has still not completed. One or more NMIs could thus be nested
inside the first
NMI handler. The NMI interrupt handler should take this possibility into
consideration.
...

Regards,
Burkhard


"Mario Z" wrote:

Hello Burkhard,

I know that's not a answer of your question but it was difficult to find you.
2 Years ago you had a discussion with the subject "Handling NMIs on
XP/Win2003"!
I try to hook the nmi under WindowsXP/eXP but the system crash by IRETD.
I think you had found a solution of this problem? Perhaps you can help me?
What is to do after IRETD to handle KiTrap02, HalHandleNMI and BugCheck?
Thanks.

Best Regards,

Mario


"bcpauli" wrote:

I am investigating some problems with DCOM and so I wanted to see the
launching User Name in the task manager. But the column User Name ist always
empty execpt for the 'System Idle Process' (which has user SYSTEM).

Has anyone an idea what is needed to see entries in the User Name column?

When I use an external tool (TaskInfo.exe www.iarsn.com), I can see the
correct User Names, so I think it is only a problem of displaying in the task
manager.

Regards,
Burkhard
.

Relevant Pages

  • RE: User display in task manager
    ... But also rememder to add a jmp to the beginning of you code behind your iretd. ... But the problem is the implementation of the NMI handling with a TaskGate. ... During NMI interrupt handling, NMI interrupts are disabled, so ... enters SMM while executing an NMI handler, ...
    (microsoft.public.windowsxp.embedded)
  • RE: User display in task manager
    ... But the problem is the implementation of the NMI handling with a TaskGate. ... During NMI interrupt handling, NMI interrupts are disabled, so ... enters SMM while executing an NMI handler, ...
    (microsoft.public.windowsxp.embedded)
  • Re: [PATCH] NMI handler message passing / work deferral API
    ... * NMI producer/consumer, message queue, and defer callback implementations: ... +/* NMI producer/consumer interface. ... +/* The producer (NMI handler) calls this function to obtain a container to ... +/* A message buffer for tranferring information from NMI handler code. ...
    (Linux-Kernel)
  • Re: [PATCH, RFC, tip/core/rcu] v3 scalable classic RCU implementation
    ... so a following patch can use a "popf; ret" instead of iret to return ... which leads to NMI handler races if nmi handlers trap. ... - instrumented the return path to export the EIP, CS and EFLAGS values when ...
    (Linux-Kernel)
  • Re: Accessing user memory from NMI
    ... stack backtrace in an NMI handler? ... about making the pagefault handler NMI safe on x86 for .32. ... - instrumented the return path to export the EIP, CS and EFLAGS values when ...
    (Linux-Kernel)
Quantcast