首页
社区
课程
招聘
[求助]AddDevice的调用时机
2010-8-14 18:05 5100

[求助]AddDevice的调用时机

2010-8-14 18:05
5100
我将以下这段再简单不过的代码注册成磁盘上层过滤驱动后,重启系统后,为什么无法进入AddDevice函数呢

代码如下:
#include <ntddk.h>
#include <wdm.h>

NTSTATUS MyAddDevice(PDRIVER_OBJECT DriverObject,PDEVICE_OBJECT PhysicalDeviceObject)
{
        _asm int 3
       
        DbgPrint("enter MyAddDevice..");
       
        return STATUS_SUCCESS;
}

VOID MyDriverUnload(PDRIVER_OBJECT DriverObject)
{
        return;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
{
        int i;
       
        _asm int 3
       
        DriverObject->DriverUnload=MyDriverUnload;
        DriverObject->DriverExtension->AddDevice=MyAddDevice;
       
        return STATUS_SUCCESS;
}

[培训]二进制漏洞攻防(第3期);满10人开班;模糊测试与工具使用二次开发;网络协议漏洞挖掘;Linux内核漏洞挖掘与利用;AOSP漏洞挖掘与利用;代码审计。

收藏
点赞0
打赏
分享
最新回复 (2)
雪    币: 998
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
programfan 2010-8-15 01:59
2
0
注册表中把此驱动服务的type改成0
雪    币: 4
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
梦醒心碎 2010-8-15 11:36
3
0
INACCESSIBLE_BOOT_DEVICE (7b)
During the initialization of the I/O system, it is possible that the driver
for the boot device failed to initialize the device that the system is
attempting to boot from, or it is possible for the file system that is
supposed to read that device to either fail its initialization or to simply
not recognize the data on the boot device as a file system structure that
it recognizes.  In the former case, the argument (#1) is the address of a
Unicode string data structure that is the ARC name of the device from which
the boot was being attempted.  In the latter case, the argument (#1) is the
address of the device object that could not be mounted.
If this is the initial setup of the system, then this error can occur if
the system was installed on an unsupported disk or SCSI controller.  Note
that some controllers are supported only by drivers which are in the Windows
Driver Library (WDL) which requires the user to do a custom install.  See
the Windows Driver Library for more information.
This error can also be caused by the installation of a new SCSI adapter or
disk controller or repartitioning the disk with the system partition.  If
this is the case, on x86 systems the boot.ini file must be edited or on ARC
systems setup must be run.  See the "Advanced Server System Administrator's
User Guide" for information on changing boot.ini.
If the argument is a pointer to an ARC name string, then the format of the
first two (and in this case only) longwords will be:
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
That is, the first longword will contain something like 00800020 where 20
is the actual length of the Unicode string, and the next longword will
contain the address of buffer.  This address will be in system space, so
the high order bit will be set.
If the argument is a pointer to a device object, then the format of the first
word will be:
    USHORT Type;
That is, the first word will contain a 0003, where the Type code will ALWAYS
be 0003.
Note that this makes it immediately obvious whether the argument is a pointer
to an ARC name string or a device object, since a Unicode string can never
have an odd number of bytes, and a device object will always have a Type
code of 3.
Arguments:
Arg1: f8ac9528, Pointer to the device object or Unicode string of ARC name
Arg2: c000000e
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x7B

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 804f8bad to 80528bec

STACK_TEXT:  
f8ac9090 804f8bad 00000003 f8ac93ec 00000000 nt!RtlpBreakWithStatusInstruction
f8ac90dc 804f979a 00000003 00000000 80087000 nt!KiBugCheckDebugBreak+0x19
f8ac94bc 804f9cc5 0000007b f8ac9528 c000000e nt!KeBugCheck2+0x574
f8ac94dc 80687d69 0000007b f8ac9528 c000000e nt!KeBugCheckEx+0x1b
f8ac9644 8068be8a 80087000 00000000 80087000 nt!IopMarkBootPartition+0xf5
f8ac9694 80688bc8 80087000 f8ac96b0 00043000 nt!IopInitializeBootDrivers+0x4ba
f8ac983c 8068705d 80087000 00000000 825b9548 nt!IoInitSystem+0x712
f8ac9dac 805c71ec 80087000 00000000 00000000 nt!Phase1Initialization+0x9b5
f8ac9ddc 80542de2 806866a8 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!IopMarkBootPartition+f5
80687d69 8d85e0feffff    lea     eax,[ebp-120h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!IopMarkBootPartition+f5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  48a3fbd8

FAILURE_BUCKET_ID:  0x7B_nt!IopMarkBootPartition+f5

BUCKET_ID:  0x7B_nt!IopMarkBootPartition+f5

Followup: MachineOwner
---------
上面是用windbg调试出来的东西,是什么意思
游客
登录 | 注册 方可回帖
返回