HyperBone icon indicating copy to clipboard operation
HyperBone copied to clipboard

Dead Lock on DriverUnload

Open sidyhe opened this issue 7 years ago • 1 comments

Hi! I found that a dead-lock happen on my Windows7 (VMWare) via debug, it is mybe locked at EptFreeIdentityMap so, try to this:

NTSTATUS EptFreeIdentityMap( IN PEPT_DATA pEPT )
{
	if (pEPT->PML4Ptr == NULL)
		return STATUS_SUCCESS;

	pEPT->PML4Ptr = NULL;

	// Reset used preallocations
	pEPT->Preallocations = 0;
	return STATUS_SUCCESS;
}

and free memory at FreeGlobalData

VOID FreeGlobalData( IN PGLOBAL_DATA pData )
{
	if (pData == NULL)
		return;

	ULONG cpu_count = KeQueryActiveProcessorCountEx(ALL_PROCESSOR_GROUPS);
	for (ULONG i = 0; i < cpu_count; i++)
	{
		PVCPU Vcpu = &pData->cpu_data[i];
		PLIST_ENTRY ListHead = &Vcpu->EPT.PageList;

		if (Vcpu->VMXON)
			MmFreeContiguousMemory(Vcpu->VMXON);
		if (Vcpu->VMCS)
			MmFreeContiguousMemory(Vcpu->VMCS);
		if (Vcpu->VMMStack)
			MmFreeContiguousMemory(Vcpu->VMMStack);

		for (ULONG j = 0; j < EPT_PREALLOC_PAGES; j++)
		{
			PVOID Ptr = Vcpu->EPT.Pages[j];

			if (Ptr != NULL)
				MmFreeContiguousMemory(Ptr);
		}

		// free here
		while (!IsListEmpty(ListHead))
		{
			PLIST_ENTRY pListEntry = RemoveHeadList(ListHead);
			PEPT_PAGES_ENTRY pEntry = CONTAINING_RECORD(pListEntry, EPT_PAGES_ENTRY, link);

			for (ULONG64 k = 0; k < pEntry->count; k++)
			{
				PVOID Ptr = pEntry->pages[k];

				if (Ptr != NULL)
					MmFreeContiguousMemory(Ptr);
			}

			ExFreePoolWithTag(pListEntry, HB_POOL_TAG);
		}
	}

	if (pData->Memory)
		ExFreePoolWithTag(pData->Memory, HB_POOL_TAG);
	if (pData->MSRBitmap)
		ExFreePoolWithTag(pData->MSRBitmap, HB_POOL_TAG);

	ExFreePoolWithTag(pData, HB_POOL_TAG);
}

now it is worked fine, is that right ?

sidyhe avatar Jan 27 '18 13:01 sidyhe

i got same problem.and i tryed u code on win10 1607.not works if dont free memory on stopvm.dead lock not happen. emmm are u solve now?

DragonQuestHero avatar Feb 17 '19 13:02 DragonQuestHero