0

Is it possible to be aware of exception occurrence (In user-mode & kernel-mode) by monitoring IDT(Interrupt Descriptor Table)?

n1kita
  • 263
  • 1
  • 5
  • 15

1 Answers1

0

Yes, it's possible. However, actual implementation can only be done in kernel mode.

Monitoring a hardware exception requires a hook to an interrupt in IDT. This will need a write access to the IDT. In Windows, including any protected mode operating systems, it must be done in kernel mode using a device driver.

In user mode, it must be done with the help of a device driver, where exceptions are reported to the user mode application. So it's possible to monitor the exceptions indirectly in user mode. Meaning that the user mode application is not the one that actually monitors the exceptions.

Jay
  • 4,627
  • 1
  • 21
  • 30
  • You're right Jay, it has to be done with kernel privilages.So can we be aware of any exception accurrence in user-mode apps? or this procedure just inform us of exceptions or interrupts in a specific application? – n1kita Aug 22 '12 at 12:50
  • 1
    Exceptions are global (any code, kernel and user modes). Software generated exception may or may not trigger an exception interupt. – Jay Aug 22 '12 at 16:46