Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IoCreateSystemThread and ExAllocateFromPagedLookasideList are deprecated? [SC] StartService FAILED 127:The specified procedure could not be found #31

Open
bludmaster6000 opened this issue Sep 22, 2024 · 3 comments

Comments

@bludmaster6000
Copy link

bludmaster6000 commented Sep 22, 2024

When i try to start the KMelody driver using sc start i get the error mentioned on the title, i have concluded that these two lines cause the error since when i comment them out i can start the service. After some googling i found out one of the reasons for this error: it occurs when the driver references functions that doesnt exist in the kernel's export table.

return IoCreateSystemThread(io_object, &member_thread_handle, THREAD_ALL_ACCESS, nullptr, NtCurrentProcess(), nullptr, play_melody, this); // IoObject is Driver or Device object

auto full_note = (FullNote*)ExAllocateFromPagedLookasideList(&member_lookaside);

The Project is built with Windows SDK Version: 10.0.22621.0 and Target OS Version "Windows 10 or higher"
i tried to run the Driver using sc start on a VMWare virtual machine with the Windows version "Win10 22H2 Build 19045.3803"

How can i use the aforementioned functions namely IoCreateSystemThread and ExAllocateFromPagedLookasideList ?
Or what are the alternatives i can use for both of these functions ?

@zodiacon
Copy link
Owner

The mentioned functions are not new: IoCreateSystemThread is Windows 8+, and ExAllocateFromPagedLookasideList is Windows 2000+. ExAllocateFromPagedLookasideList is now implemented inline. You can use the newer lookaside APIs available from Vista.
I'll see if I can update the sample with recent a WDK.

@bludmaster6000
Copy link
Author

bludmaster6000 commented Sep 22, 2024

It's really strange because i tried using the newer lookaside api as well, the following line causes the error 127:

ExFreeToLookasideListEx(&member_lookaside, note);

All the other newer lookaside functions such as "ExInitializeLookasideListEx, ExDeleteLookasideListEx, ExAllocateFromLookasideListEx" work as intended and i can load the driver without commenting these 3 functions, what i dont understand is why does the driver refuse to load and pop a "StartService FAILED 127" error when i try to use the "ExFreeToLookasideListEx" function.

@zodiacon
Copy link
Owner

IN later versions of the WDK, this function is implemented inline (rather than bound to exported function). Look at wdm.h:

#if (NTDDI_VERSION >= NTDDI_WIN10_NI)

__drv_allocatesMem(Mem)
_Must_inspect_result_
_IRQL_requires_max_(DISPATCH_LEVEL)
NTKERNELAPI
PVOID
ExAllocateFromLookasideListEx (
    _Inout_ PLOOKASIDE_LIST_EX Lookaside
    );

_IRQL_requires_max_(DISPATCH_LEVEL)
NTKERNELAPI
VOID
ExFreeToLookasideListEx (
    _Inout_ PLOOKASIDE_LIST_EX Lookaside,
    _In_ __drv_freesMem(Entry) PVOID Entry
    );

#else

ExAllocateFromLookasideListEx (
    _Inout_ PLOOKASIDE_LIST_EX Lookaside
    )
{

    PVOID Entry;

    Lookaside->L.TotalAllocates += 1;
    Entry = InterlockedPopEntrySList(&Lookaside->L.ListHead);
    if (Entry == NULL) {
        Lookaside->L.AllocateMisses += 1;
        Entry = (Lookaside->L.AllocateEx)(Lookaside->L.Type,
                                          Lookaside->L.Size,
                                          Lookaside->L.Tag,
                                          Lookaside);
    }

    return Entry;
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants