首页
社区
课程
招聘
[旧帖] 调试驱动问题........ 0.00雪花
发表于: 2009-12-17 20:41 3045

[旧帖] 调试驱动问题........ 0.00雪花

2009-12-17 20:41
3045
为什么隐藏进程的驱动,在本机上可以运行,但是在虚拟机上调试的时候会报fatal error呢?
报出错代码位置是将新的函数地址写入SSDT的时候报写入只读。但是不用调试直接在虚拟机上加载驱动运行正常啊!
还有谁能给个简单得驱动,能够调试通过不报错得,我一直没试成功.....,用了几个都说fatal error....
还有环境是XP+SP3

[课程]Linux pwn 探索篇!

收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 59
活跃值: (41)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
2
出现个新问题.......怎么现在我WINDBG和虚拟机连上后就是WAIT TO connet 在虚拟机回车选择DEBUG后,WINDBG断下,然后我点G运行OS,结果虚拟机就直接蓝屏.....,以前没这情况啊,现在根本进不去了只要运行就直接蓝屏这什么意思?
2009-12-18 10:57
0
雪    币: 59
活跃值: (41)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
3
包得BUG:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 806a2ead, The address that the exception occurred at
Arg3: f9c3a714, Exception Record Address
Arg4: f9c3a410, Context Record Address

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

FAULTING_IP:
nt!MmInitSystem+1356
806a2ead 6683784005      cmp     word ptr [eax+40h],5

EXCEPTION_RECORD:  f9c3a714 -- (.exr 0xfffffffff9c3a714)
ExceptionAddress: 806a2ead (nt!MmInitSystem+0x00001356)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000040
Attempt to read from address 00000040

CONTEXT:  f9c3a410 -- (.cxr 0xfffffffff9c3a410)
eax=00000000 ebx=8055c1e0 ecx=00000000 edx=f970c000 esi=8198aa08 edi=8055c1c0
eip=806a2ead esp=f9c3a7dc ebp=f9c3a838 iopl=0         nv up ei pl nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010212
nt!MmInitSystem+0x1356:
806a2ead 6683784005      cmp     word ptr [eax+40h],5     ds:0023:00000040=????
Resetting default scope

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000040

READ_ADDRESS:  00000040

FOLLOWUP_IP:
nt!MmInitSystem+1356
806a2ead 6683784005      cmp     word ptr [eax+40h],5

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from 806a2771 to 806a2ead

STACK_TEXT:  
f9c3a838 806a2771 00000001 80087000 00000000 nt!MmInitSystem+0x1356
f9c3adac 8057beff 80087000 00000000 00000000 nt!Phase1Initialization+0x520
f9c3addc 804f98ea 806a22fa 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmInitSystem+1356

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  498c1a18

STACK_COMMAND:  .cxr 0xfffffffff9c3a410 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x7E_nt!MmInitSystem+1356

BUCKET_ID:  0x7E_nt!MmInitSystem+1356

Followup: MachineOwner
---------
2009-12-18 11:01
0
游客
登录 | 注册 方可回帖
返回
//