I have been trying to learn more about windows internals and to do that have been poking around at the kernel. I decided to try to see how interrupt handling works and placed a break point with windbg using the bp command at the first instruction of the general protection fault ISR. When I trigger a general protection fault from kernel mode it goes as you would expect, the break point is hit and everything goes on, but when the exception is triggered by a user mode processes the breakpoint is never hit and the entire system freezes. Further analysis with windbg shows that the stack that belongs to the CPU that executed the illegal instruction is flooded with page faults (this goes on till ffffc100391134d0
with a few more nt!KiDoubleFaultAbort
sprinkled in).
I proceeded to test if I got the same result on different machines and with different exception ISRs and the exact same thing happened. I then tested if it was the breakpoint or if any modification to the handlers would cause this and found that no matter what any modification (tried NOPs and JMPs) to the ISR's will cause this (I didn't test if there was a limit like if I modify +100 bytes into the ISR if this will still happen). Because I didn't need a debugger to do this I tried without one but it made no difference.
I have been thinking about it for hours but I just can't figure out why this happens. The instruction that the page faults appear to be coming from is test word ptr gs:[860h]
located at nt!KiPageFault+0x47
Register states are as follows
`rax=0000000000000001 rbx=000001bf7e3b5ad0 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000007b4fcffc78
rip=fffff8070203ee00 rsp=ffffb701129123a0 rbp=ffffb70112912450
r8=0000007b4fcffae8 r9=0000000000000000 r10=0000000000000000
r11=0000000000000246 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000 iopl=0
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00000046`
As for a minimal reproducible example all you need to do is open windbg, kernel debug a VM, set a breakpoint on an exception ISR and trigger an exception from user mode.