MmCopyVirtualMemory failing, code is correct

Question

My situation is that MmCopyVirtualMemory almost always (%99 of the time) returns STATUS_PARTIAL_COPY. (Im operating in a Ring0 Driver)

I've tried so many different things, like using different variables sizes and types, different addresses etc... It always returns STATUS_PARTIAL_COPY.

Nothing online has helped either, its not a really common error.

Error description:

{Partial Copy} Due to protection conflicts not all the requested bytes could be copied.

My way of reading a processes memory:

DWORD64 Read(DWORD64 SourceAddress, SIZE_T Size)
{

 SIZE_T Bytes;
 NTSTATUS Status = STATUS_SUCCESS;
 DWORD64 TempRead;

 DbgPrintEx(0, 0, "\nRead Address:%p\n", SourceAddress); // Always Prints     Correct Address
 DbgPrintEx(0, 0, "Read szAddress:%x\n", Size); // Prints Correct Size 8 bytes

 Status = MmCopyVirtualMemory(Process, SourceAddress, PsGetCurrentProcess(), &TempRead, Size, KernelMode, &Bytes);

 DbgPrintEx(0, 0, "Read Bytes:%x\n", Bytes); // Copied bytes - prints 0
 DbgPrintEx(0, 0, "Read Output:%p\n", TempRead); // prints 0 as expected since it failed

 if (!NT_SUCCESS(Status))
 {
      DbgPrintEx(0, 0, "Read Failed:%p\n", Status);
      return NULL;
 }

 return TempRead;
}

Example of how I use it:

NetMan = Read(BaseAddr + NET_MAN, sizeof(DWORD64));
//BaseAddr is a DWORD64 and NetMan is also a DWORD64

I've tripped checked my code to many times, all of it appears to be right.

After investigating MiDoPoolCopy (MmCopyVirtualMemoy calls this) it seems that its failing during the move operation:

// MiDoPoolCopy function
// Probe to make sure that the specified buffer is accessible in
// the target process.

//Wont execute (supplied KernelMode)
if ((InVa == FromAddress) && (PreviousMode != KernelMode)){ 
   Probing = TRUE;
   ProbeForRead (FromAddress, BufferSize, sizeof(CHAR));
   Probing = FALSE;
}

//Failing either here, copying inside the target process's address space to     the buffer
RtlCopyMemory (PoolArea, InVa, AmountToMove); 

KeUnstackDetachProcess (&ApcState);

KeStackAttachProcess (&ToProcess->Pcb, &ApcState); 
//
// Now operating in the context of the ToProcess.
//

//Wont execute (supplied KernelMode)
 if ((InVa == FromAddress) && (PreviousMode != KernelMode)){ 
    Probing = TRUE;
    ProbeForWrite (ToAddress, BufferSize, sizeof(CHAR));
    Probing = FALSE;
}

Moving = TRUE;

//or failing here - moving from the Target Process to Source (target process->Kernel)
RtlCopyMemory (OutVa, PoolArea, AmountToMove);

Here's the SEH returning STATUS_PARTIAL_COPY (wrapped in try and except)

//(wrapped in try and except)
//
// If the failure occurred during the move operation, determine
// which move failed, and calculate the number of bytes
// actually moved.
//

*NumberOfBytesRead = BufferSize - LeftToMove;
if (Moving == TRUE) {
    //
    // The failure occurred writing the data.
    //

    if (ExceptionAddressConfirmed == TRUE) {
       *NumberOfBytesRead = (SIZE_T)((ULONG_PTR)(BadVa -         (ULONG_PTR)FromAddress));
     }
}
return STATUS_PARTIAL_COPY;

MmCopyVirtualMemory (undocumented struct)

NTSTATUS NTAPI MmCopyVirtualMemory
(
    PEPROCESS SourceProcess,
    PVOID SourceAddress,
    PEPROCESS TargetProcess,
    PVOID TargetAddress,
    SIZE_T BufferSize,
    KPROCESSOR_MODE PreviousMode,
    PSIZE_T ReturnSize
);

Here is the source for both MmCopyVirtualMemory and MiDoPoolCopy: https://lacicloud.net/custom/open/leaks/Windows%20Leaked%20Source/wrk-v1.2/base/ntos/mm/readwrt.c

Any help would be greatly appreciated, I've been stuck on this for to long...

Answer 1

I know this is old, but because I had the same issue and fixed it, maybe someone else will stumble on this in the future.

Reading your code the issue is the target address you want to copy the data. You are using a single defined DWORD64, which is when running the function a simple variable (register or on stack) and not a memory region where you can write to.

The solution is to provide a correct buffer for which you allocated memory before with malloc.

Example (you want to read a DWORD64, based on your code with some adjustments):

DWORD64* buffer = malloc(sizeof(DWORD64))
Status = MmCopyVirtualMemory(Process, (void*)SourceAddress, PsGetCurrentProcess(), (void*)buffer, sizeof(DWORD64), UserMode, &Bytes);

Do not forget to free your buffer after using to prevent a memory leak.