PAGE_FAULT_IN_NONPAGED_AREA globalpte

[fork1488]

I can't make it work, crash on this, can u help me? 22h2 win11 like pte not present

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffc5fc001f7790, memory referenced.
Arg2: 0000000000000003, X64: bit 0 set if the fault was due to a not-present PTE.
	bit 1 is set if the fault was due to a write, clear if a read.
	bit 3 is set if the processor decided the fault was due to a corrupted PTE.
	bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
	- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
	bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: ffffdf8e4e1f5830, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000008, (reserved)

void* deHandler = GetHandlerAddress(INTERRUPT_VECTOR_DE);
if (!deHandler || !PageSpacePatch(pml4, deHandler,
	deShellCode, sizeof(deShellCode), TABLE_LEVEL_PML4))

[fork1488]

`module start: 0xFFFFDF8E4E1F1000
KThread Offset: 0x188
KProcess Offset: 0xb8
DirectoryTableBase Offset: 0x28

PML4: 0xFFFFC5E2F178B000
Self referencing PML4 PFN: 0x1efbe6

ntoskrnl: 0xFFFFF8003E400000
ntoskrnl .text: 0xFFFFF8003E600000
mov cr3, rax gadget: 0xFFFFF8003E74AAB3
pop rax gadget: 0xFFFFF8003E64D92F
mov cr3, rcx: 0xFFFFF8003E81EB67
pop rcx gadget: 0xFFFFF8003E604D5D
pop rdx gadget: 0xFFFFF8003E71EE14
cli gadget: 0xFFFFF8003E7D4B6A
popfq gadget: 0xFFFFF8003E87F69B
iretq gadget: 0xFFFFF8003E740554
mov cr3, rsi: 0xFFFFF8003E623D38
mov [rdx], rax gadget: 0xFFFFF8003E75257D

New IDT: 0xFFFFDF8E534EE000
New module page space PML4: 0xFFFFDF8E566FF000
Module base: 0xFFFFDF8E4E1F1000
Custom CR3: 0x1d98ff002
Contextualized table: 0xFFFFDF8E537AD000
Address: 0xFFFFF8003EEF2100
PTE: 0xFFFFDF8E537AD790
pfn: 0x2015a9058`


PXE at FFFF904824120F80    contains 000000041FE0B063  pfn 41fe0b    ---DA--KWEV
PPE at FFFF9048241F0040    contains 100000041FE0C063  pfn 41fe0c    ---DA--KWEV  
PDE at FFFF90483E008B88    contains 0A00000100E000A1  pfn 100e00    --L-A--KREV
PTE at FFFF907C01171790    contains 0000000000000000

[fork1488]

I fixed the problem there, now it crashes after (create thread)

New IDT page space PML4: 0xFFFFA889B7257000
Transitional CR3: 0x10a657002

and it is impossible to debug

// Функция для временного отключения WP
KIRQL DisableWriteProtection()
{
	KIRQL oldIrql = KeRaiseIrqlToDpcLevel();
	_disable();

	__writecr0(__readcr0() & ~0x10000); // Сбрасываем бит WP (16 бит)
	_mm_sfence(); // Барьер памяти

	return oldIrql;
}

// Функция для восстановления WP
void EnableWriteProtection(KIRQL oldIrql)
{
	__writecr0(__readcr0() | 0x10000); // Устанавливаем бит WP
	_mm_sfence(); // Барьер памяти

	_enable();
	KeLowerIrql(oldIrql);
}

	KIRQL oldIrql = DisableWriteProtection();

	/*
		Check if we have already contextualized this entry or if
		we need to add a new custom mapping.
	*/
	if (pte->pfn == originalPTE->pfn)

[brew02]

Unfortunately these problems are quite difficult to debug as they involve lots of changes to critical system information. The best advice that I can offer for solving your problems is to use GDB and a virtual machine. I can recommend this article for setting up GDB debugging using IDA and VMWare. If you want to start debugging the application at a certain point, insert an infinite loop into the code at that point so that you can break into the program using the debugger.

[fork1488]

It looks like the problem with TLB
It comes out of this cycle

upd

handler 0FFFFFFFFFFFFFFD1h -2F