小弟刚学驱动，最近帮忙测试一个Ndis hook的驱动，在win 2k 环境下还比较稳定，但是在win xp环境下会有比较高的概率蓝屏。希望有人帮忙给个方向！
蓝屏情况如下：
驱动是开机自启动，主要实现通信数据的抓取。
用户打开exe文件，在windows xp环境下，有一定的几率蓝屏（目前没有找到比较稳定的触发条件）；
一旦蓝屏，重启后再次打开exe就蓝屏。
蓝屏信息：
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 81a7ca60, The pool entry we were looking for within the page.
Arg3: 81a7ca70, The next pool entry.
Arg4: 1a020001, (reserved)
Debugging Details:
------------------
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: 81a7ca60
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from 80544c86 to 804f9925
STACK_TEXT:
f77a7a44 80544c86 00000019 00000020 81a7ca60 nt!FsRtlRemoveMcbEntryPrivate+0x68
f77a7a94 804f488c 81a7ca68 00000000 816679e0 nt!`string'+0x22
f77a7ae8 804fdfbf 816679e0 f77a7b34 f77a7b28 nt!MmUnmapViewInSystemCache+0x2b5
f77a7b38 806d1c35 00000000 00000000 f77a7b50 nt!KeWaitForMultipleObjects+0xe5
f77a7b50 806d1861 badb0d00 00000000 c3077700 hal!IoFreeAdapterChannel+0xcb
f77a7be0 804f1498 816679e0 81691370 00000000 hal!HalpCopyBufferMap+0x39
f77a7c14 f99edec5 81667a10 804d2160 81a7ca68 nt!CcUnpinFileData+0x11e
WARNING: Stack unwind information not available. Following frames may be wrong.
f77a7c34 804eedf9 81b93810 816679a0 806d12d0 Nmdriver+0x1ec5
f77a7c58 805759d1 81b93810 816679a0 81691370 nt!MmCheckCachedPageState+0x1eb
f77a7d00 8056e33c 00000070 00000000 00000000 nt!NtProtectVirtualMemory+0x84
f77a7d34 8053d808 00000070 00000000 00000000 nt!NtQueryInformationToken+0x5c7
f77a7d64 7c92eb94 badb0d00 0012fc10 f7833d98 nt!ObpPushStackInfo+0x75
f77a7d70 f7833d98 f7833dcc 00000000 00000000 0x7c92eb94
f77a7d74 f7833dcc 00000000 00000000 00000000 0xf7833d98
f77a7d78 00000000 00000000 00000000 00000000 0xf7833dcc
FOLLOWUP_IP:
Nmdriver+1ec5
f99edec5 ?? ???
SYMBOL_STACK_INDEX: 7
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: Nmdriver+1ec5
MODULE_NAME: Nmdriver
IMAGE_NAME: Nmdriver.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48913c9e
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0x19_20_Nmdriver+1ec5
BUCKET_ID: 0x19_20_Nmdriver+1ec5
Followup: MachineOwner
[课程]Android-CTF解题方法汇总！
