[求助]在DriverUnload间歇出现这种问题
发表于:
2010-5-29 14:25
[求助]在DriverUnload间歇出现这种问题
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
而Unload如下：
VOID DriverUnload(PDRIVER_OBJECT pDrvObject)
{
UNICODE_STRING strLink;
UnHookSSDT();
RtlInitUnicodeString(&strLink, LINK_NAME);
IoDeleteSymbolicLink(&strLink);
IoDeleteDevice(pDrvObject->DeviceObject);
dprintf("[filemonitor] Unloaded\n");
}
VOID HookSSDT()
{
//初始化服务号
InitSystemCallIndex();
//映射MDL
g_pMdlSystemCall = MmCreateMdl( NULL,
KeServiceDescriptorTable->ServiceTableBase,
KeServiceDescriptorTable->NumberOfServices*4);
if(!g_pMdlSystemCall)
return ;
MmBuildMdlForNonPagedPool(g_pMdlSystemCall);
g_pMdlSystemCall->MdlFlags = g_pMdlSystemCall->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA;
MappedSystemCallTable = MmMapLockedPages(g_pMdlSystemCall, KernelMode);
//调用HOOK宏
HOOK_SYSCALL( ZwOpenFileIndex, MyZwOpenFile, OrigZwOpenFile );
HOOK_SYSCALL( ZwCreateFileIndex, MyZwCreateFile, OrigZwCreateFile );
HOOK_SYSCALL( ZwReadFileIndex, MyZwReadFile, OrigZwReadFile );
HOOK_SYSCALL( ZwWriteFileIndex, MyZwWriteFile, OrigZwWriteFile );
}
VOID UnHookSSDT()
{
UNHOOK_SYSCALL( ZwOpenFileIndex, MyZwOpenFile, OrigZwOpenFile );
UNHOOK_SYSCALL( ZwCreateFileIndex, MyZwCreateFile, OrigZwCreateFile );
UNHOOK_SYSCALL( ZwReadFileIndex, MyZwReadFile, OrigZwReadFile );
UNHOOK_SYSCALL( ZwWriteFileIndex, MyZwWriteFile, OrigZwWriteFile );
//Unlock and Free MDL
if(g_pMdlSystemCall)
{
MmUnmapLockedPages( MappedSystemCallTable, g_pMdlSystemCall );
IoFreeMdl(g_pMdlSystemCall);
}
}
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
不懂
