我在看寒江独钓 的文件系统过滤驱动那一章,自己模仿书上写了一个,文件系统的CDO已经Attach
成功了,Volume也Attach成功了,至少从单步调试结果可以确认这点,但是在处理
IRP_MJ_FILE_SYSTEM_CONTROL中IRP_MN_USER_FS_REQUEST这个IRP时蓝了,蓝的天旋
地转,windbg调试结果报 MULTIPLE_IRP_COMPLETE_REQUESTS (44) 说是某个IRP已经完
成了,但是我又去完成了一次. 下面这个是我处理IRP_MJ_FILE_SYSTEM_CONTROL的代码
NTSTATUS FileSystemFilterCtrl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
NTSTATUS status=STATUS_SUCCESS;
PIO_STACK_LOCATION irpstack=IoGetCurrentIrpStackLocation(Irp);
PFileSystemFilterEx devext=(PFileSystemFilterEx)DeviceObject->DeviceExtension;
if(devext->FSFTYPE==FSFTYPECDO)
return status;
switch (irpstack->MinorFunction)
{
case IRP_MN_MOUNT_VOLUME:
return FSFilterVolumeMount(DeviceObject,Irp);
break;
case IRP_MN_LOAD_FILE_SYSTEM:
DbgPrint("IRP_MN_LOAD_FILE_SYSTEM\n");
break;
case IRP_MN_USER_FS_REQUEST:
if(FSCTL_DISMOUNT_VOLUME==irpstack->Parameters.FileSystemControl.FsControlCode)
{
DbgPrint("DISMOUNT VOLUME\n");
}
break;
}
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(((PFileSystemFilterEx)DeviceObject->DeviceExtension)->nextDeviceObject,Irp);
}
下面这段是我把IRPTRACE设置成BOOT模式后在系统启动时捕获到的处理
IRP_MJ_FILE_SYSTEM_CONTROL的日志,搜索 8163f488 可以看到这个IRP,NTFS驱动确
实完成了两次,不懂为什么,附件里面FSF.TXT就是下面这个IRPTRACE的日志,
FileSystemFilter.rar是我的驱动代码,解压后里面有个BIN目录,只要把编译出来的驱动放到这
个目录下,然后执行一下里面的sfilterInstall.cmd,就可以安装驱动了,默认安装到
c:\windows\system32\drivers目录下面,请在虚拟机里面试。我现在没别的招了,好在还有个
sfilter示例,我只能一步修改一下sfilter看看把哪个步骤改掉会出现跟我的驱动一样的错误了。
希望高手不吝赐教,在此先谢过了。
===============================================================================
======================== Begin Trace IRPDRV Operations ========================
===============================================================================
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815F41A0, IRP:81430CA8, Proc:System, Thr:8
* IRP_MN_MOUNT_VOLUME
> Vpb: 8142E1D8
DeviceObject: 815F5D80 (#815F5D80)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:Ntfs, IRP:81430CA8, Proc:System, Thr:8
Control: E0 (SL_INVOKE_ON_CANCEL | SL_INVOKE_ON_SUCCESS | SL_INVOKE_ON_ERROR)
CompletionRoutine: F9F52930 (FileSystemFilter.sys+930h)
Context: F9E6D1D8
* IRP_MN_MOUNT_VOLUME
> Vpb: 8142E1D8
DeviceObject: 815F5D80 (#815F5D80)
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:Ntfs, IRP:81430CA8- STATUS_SUCCESS (Proc:System, Thr:20)
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815F41A0, IRP:81430CA8- STATUS_SUCCESS (Proc:System, Thr:8)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:81430CA8, Proc:System, Thr:7C
FileObject: 8131A6A0
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:81430CA8- *Skipped* (Proc:System, Thr:7C)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:81430CA8, Proc:System, Thr:7C
FileObject: 8131A6A0
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:81430CA8- STATUS_SUCCESS (Proc:System, Thr:7C)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:81430CA8, Proc:System, Thr:7C
FileObject: 8131A6A0
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:81430CA8- *Skipped* (Proc:System, Thr:7C)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:81430CA8, Proc:System, Thr:7C
FileObject: 8131A6A0
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:81430CA8- STATUS_SUCCESS (Proc:System, Thr:7C)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:813881C8, Proc:smss.exe, Thr:180
FileObject: 816F8A18
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:813881C8- *Skipped* (Proc:smss.exe, Thr:180)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:813881C8, Proc:smss.exe, Thr:180
FileObject: 816F8A18
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:813881C8- STATUS_SUCCESS (Proc:smss.exe, Thr:180)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:813881C8, Proc:autochk.exe, Thr:198
FileObject: 816F8600
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:813881C8- *Skipped* (Proc:autochk.exe, Thr:198)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:813881C8, Proc:autochk.exe, Thr:198
FileObject: 816F8600
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:813881C8- STATUS_SUCCESS (Proc:autochk.exe, Thr:198)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:813881C8, Proc:System, Thr:1A8
Flags: 05 (0x5)
FileObject: 812E46F8
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:813881C8- *Skipped* (Proc:System, Thr:1A8)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:81696BB0, Proc:System, Thr:1AC
Flags: 05 (0x5)
FileObject: 8142A5D8
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:81696BB0- *Skipped* (Proc:System, Thr:1AC)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D5CD8, Proc:System, Thr:1B0
Flags: 05 (0x5)
FileObject: 814D8898
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D5CD8- *Skipped* (Proc:System, Thr:1B0)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D1620, Proc:System, Thr:1B4
Flags: 05 (0x5)
FileObject: 8142A408
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D1620- *Skipped* (Proc:System, Thr:1B4)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:8163F488, Proc:System, Thr:1B8
Flags: 05 (0x5)
FileObject: 8142A238
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:8163F488- *Skipped* (Proc:System, Thr:1B8)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:813881C8, Proc:System, Thr:1A8
Flags: 05 (0x5)
FileObject: 812E46F8
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:813881C8- STATUS_SUCCESS (Proc:System, Thr:14)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:813881C8, Proc:System, Thr:1A8
Flags: 05 (0x5)
FileObject: 812E4E30
* IRP_MN_USER_FS_REQUEST
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:81696BB0, Proc:System, Thr:1AC
Flags: 05 (0x5)
FileObject: 8142A5D8
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:81696BB0- STATUS_SUCCESS (Proc:System, Thr:14)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:81696BB0, Proc:System, Thr:1AC
Flags: 05 (0x5)
FileObject: 812E4930
* IRP_MN_USER_FS_REQUEST
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:816D5CD8, Proc:System, Thr:1B0
Flags: 05 (0x5)
FileObject: 814D8898
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:816D5CD8- STATUS_SUCCESS (Proc:System, Thr:1B0)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:816D1620, Proc:System, Thr:1B4
Flags: 05 (0x5)
FileObject: 8142A408
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:816D1620- STATUS_SUCCESS (Proc:System, Thr:14)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:8163F488, Proc:System, Thr:1B8
Flags: 05 (0x5)
FileObject: 8142A238
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:8163F488- STATUS_SUCCESS (Proc:System, Thr:14)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:8163F488, Proc:System, Thr:1B8
Flags: 05 (0x5)
FileObject: 8168AF28
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:813881C8- *Skipped* (Proc:System, Thr:1A8)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:813881C8, Proc:System, Thr:1A8
Flags: 05 (0x5)
FileObject: 812E4E30
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:81696BB0- *Skipped* (Proc:System, Thr:1AC)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:81696BB0, Proc:System, Thr:1AC
Flags: 05 (0x5)
FileObject: 812E4930
* IRP_MN_USER_FS_REQUEST
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D5CD8, Proc:System, Thr:1B0
Flags: 05 (0x5)
FileObject: 814D8898
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D5CD8- *Skipped* (Proc:System, Thr:1B0)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D1620, Proc:System, Thr:1B4
Flags: 05 (0x5)
FileObject: 812E43F8
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D1620- *Skipped* (Proc:System, Thr:1B4)
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:8163F488- *Skipped* (Proc:System, Thr:1B8)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:8163F488, Proc:System, Thr:1B8
Flags: 05 (0x5)
FileObject: 8168AF28
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:813881C8- STATUS_SUCCESS (Proc:System, Thr:14)
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:81696BB0- STATUS_SUCCESS (Proc:System, Thr:14)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:816D5CD8, Proc:System, Thr:1B0
Flags: 05 (0x5)
FileObject: 814D8898
* IRP_MN_USER_FS_REQUEST
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:816D1620, Proc:System, Thr:1B4
Flags: 05 (0x5)
FileObject: 812E43F8
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:816D1620- STATUS_SUCCESS (Proc:System, Thr:14)
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:8163F488- STATUS_SUCCESS (Proc:System, Thr:14)
*** Fatal System Error: 0x00000044
(0x81696BB0,0x00001BC0,0x00000000,0x00000000)
*** Fatal System Error: 0x00000044
(0x813881C8,0x00001BC0,0x00000000,0x00000000)
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:Ntfs, Dev:#81474020, IRP:816D5CD8- STATUS_SUCCESS (Proc:System, Thr:14)
>> IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D5CD8, Proc:System, Thr:1B0
Flags: 05 (0x5)
FileObject: 8168A6B0
* IRP_MN_USER_FS_REQUEST
<< IRP_MJ_FILE_SYSTEM_CONTROL Drv:FileSystemFilter, Dev:#815FC720, IRP:816D5CD8- *Skipped* (Proc:System, Thr:1B0)
*** Fatal System Error: 0x00000044
(0x8163F488,0x00001BC0,0x00000000,0x00000000)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
Connected to Windows XP 2600 x86 compatible target at (Wed Apr 6 16:58:31.368 2011 (GMT+8)), ptr64 FALSE
Loading Kernel Symbols
...............................................................
.................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 44, {8163f488, 1bc0, 0, 0}
Probably caused by : FileSystemFilter.sys
Followup: MachineOwner
---------
nt!RtlpBreakWithStatusInstruction:
804e4592 cc int 3
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed. This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened. Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it. The
first actually works, and the second fails. Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second. However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 8163f488, Address of the IRP
Arg2: 00001bc0
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
IRP_ADDRESS: 8163f488
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x44
PROCESS_NAME: System
DEVICE_OBJECT: 815fc720
DRIVER_OBJECT: 815f4f38
IMAGE_NAME: FileSystemFilter.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d9c29e1
MODULE_NAME: FileSystemFilter
FAULTING_MODULE: f9f52000 FileSystemFilter
LAST_CONTROL_TRANSFER: from 80533747 to 804e4592
STACK_TEXT:
f96d145c 80533747 00000003 f96d17b8 00000000 nt!RtlpBreakWithStatusInstruction
f96d14a8 8053421e 00000003 8142a238 8163f488 nt!KiBugCheckDebugBreak+0x19
f96d1888 8053480e 00000044 8163f488 00001bc0 nt!KeBugCheck2+0x574
f96d18a8 8051ce0f 00000044 8163f488 00001bc0 nt!KeBugCheckEx+0x1b
f96d18d0 804ed9cb 8163f488 00000103 806f12d0 nt!IopFreeIrp+0xe9
f96d1920 80568ed5 8163f4c8 f96d1964 f96d1950 nt!IopCompleteRequest+0x316
f96d1948 805753a9 815fc720 00000000 8142a238 nt!IopSynchronousServiceTail+0xb8
f96d19f0 804df7ec 800005b4 800005b8 00000000 nt!NtReadFile+0x580
f96d19f0 804de519 800005b4 800005b8 00000000 nt!KiFastCallEntry+0xf8
f96d1a8c 805aef36 800005b4 800005b8 00000000 nt!ZwReadFile+0x11
f96d1adc 805af039 e1464b60 800005b4 f96d1b0c nt!CmpFileRead+0x86
f96d1b04 805af5d5 00000000 f96d1b3c f96d1b24 nt!HvpGetHiveHeader+0x71
f96d1b58 805ae411 e1464b60 00000000 00000001 nt!HvMapHive+0x22
f96d1b70 805ae1dc e1464c01 00000005 00000002 nt!HvInitializeHive+0x3da
f96d1bdc 805af44d f96d1c18 00000005 00000002 nt!CmpInitializeHive+0x26d
f96d1c34 805bbc97 f96d1c94 00000002 f96d1c78 nt!CmpInitHiveFromFile+0xa3
f96d1dac 8057beff 00000005 00000000 00000000 nt!CmpLoadHiveThread+0x19f
f96d1ddc 804f98ea 805bbb07 00000005 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: 0x44_IMAGE_FileSystemFilter.sys_RECENT
BUCKET_ID: 0x44_IMAGE_FileSystemFilter.sys_RECENT
Followup: MachineOwner
---------
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
上传的附件: