BSOD when writing to named shared memory from win7 x86 driver - driver

Question

#include "ntddk.h"
NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath );
VOID DriverUnload( IN PDRIVER_OBJECT DriverObject );
INT InitializeGlobalAddressSpace(VOID);
#define BUF_SIZE 256
TCHAR szName[]=TEXT("\\BaseNamedObjects\\MyFileMappingObject");
char szMsg[]="New Message";
NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath )
{
NTSTATUS ntStatus = STATUS_UNSUCCESSFUL;
DriverObject->DriverUnload = DriverUnload;
DbgPrint("Hello World Driver Loaded!");
InitializeGlobalAddressSpace();
ntStatus = STATUS_SUCCESS;
return ntStatus;
}
VOID DriverUnload( IN PDRIVER_OBJECT DriverObject )
{
DbgPrint("Hello World Driver unloaded!");
}
INT InitializeGlobalAddressSpace(VOID)
{
OBJECT_ATTRIBUTES ObjectAttributes;
UNICODE_STRING PhysMemName = RTL_CONSTANT_STRING(L"\\BaseNamedObjects\\MyFileMappingObject");
NTSTATUS Status;
HANDLE PhysMemHandle;
PVOID BaseAddress;
PVOID NullAddress;
LARGE_INTEGER Offset;
ULONG ViewSize;
BaseAddress = NULL;
Offset.LowPart = 0;
Offset.HighPart = 0;
ViewSize = 0;
InitializeObjectAttributes(&ObjectAttributes,&PhysMemName,0,NULL,NULL);
Status = ZwOpenSection(&PhysMemHandle, SECTION_ALL_ACCESS, &ObjectAttributes);
if (!NT_SUCCESS(Status))
{
DbgPrint("Couldn't open Global\\MyFileMappingObject - error:%x\n",Status);
return(0);
}
Status = ZwMapViewOfSection(PhysMemHandle,ZwCurrentProcess(),&BaseAddress,0,0,&Offset,&ViewSize,ViewShare,0,PAGE_READWRITE);
if (!NT_SUCCESS(Status))
{
DbgPrint("Couldn't open Global\\MyFileMappingObject - error:%x\n",Status);
return(0);
}
DbgPrint("%s",Status);
try
{
memcpy((PVOID)Status, szMsg, (strlen(szMsg) * sizeof(TCHAR)));
}
except(EXCEPTION_EXECUTE_HANDLER)//will crash without this.
{
DbgPrint("error:%x");
}
return (1);
}
memcpy function causes the driver to crash the system, am i doing something wrong within the zwopensection/zwmapviewofsection to cause this to happen. Note: driver does not crash system with try/except function around it.

Answer 1

You are trying to write something in Status:
memcpy((PVOID)Status, szMsg, (strlen(szMsg) * sizeof(TCHAR)));
Actually you are supposed to write in BaseAddress ... :-)