Click here to Skip to main content
15,796,507 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
I am developing a simple device driver for study. With a lot of testing, I am creating so many errors which finally leads my computer to blue screen. I am sure that the reason for this is memory crash. So now I want to check if my code can access to Kernel memory before going further.
My question is what function can check whether it is accessible or not in kernel memory. For instance, there is a pointer structure with two fields and I want to access the first field which is also a pointer but do now know whether it really has an accessible value or just trash value.
In this given context, I need to check it out to make sure that I am not getting blue screen.
Thanks in advance!

What I have tried:

Updated 4-Aug-17 22:26pm
Richard MacCutchan 3-Aug-17 10:40am    
In kernel mode it is difficult to do this, as you have access to kernel memory, so it is easy to trash the system. You just need to do more desk checking of your code. There are various code analysis tools available; check via Google.
MinYoung Lee 3-Aug-17 10:45am    
Yeah, I have to.. I'm still trying to figure out and I forgot to mention what OS, language I am using. C++, Windows7 they are.
Dave Kreskowiak 3-Aug-17 10:53am    
In kernel mode, you can go anywhere and do anything, so really, what's "invalid" in this context? Nothing...
MinYoung Lee 3-Aug-17 11:40am    
Yes, Dave Kreskowiak you are right. So I am considering to set the range of kernel memory to see if it is valid or has accessible values. I am new to this kernel programming, feel really challenging but interesting.
Dave Kreskowiak 3-Aug-17 11:53am    
You're looking at this the wrong way. Since, in the kernel, EVERYTHING IS VALID AND ACCESSIBLE, it's not so much that you can't get a value, it's that you're getting a value that makes no sense to your code, which causes the crash.

You may think that your pointer is correct when it's actually pointing to somewhere else you didn't expect, returning a value your code didn't expect, working on that value, resulting in the crash.

1 solution


Your question is unclear. You need to specify who allocated the buffer... usermode or kernelmode? Also you need to clarify which ring is reading the buffer... usermode or kernelmode.

I think you may be looking for the MmIsAddressValid function[^].

If the buffer you are passing to kernelmode has come from a usermode application you may need to call the ProbeForRead function[^] to validate read access to buffers that are allocated in user space.

Best Wishes,
-David Delaune
Share this answer

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900