mark===

while (pDeObj!=NULL)
  {
    pDevEx=(PDEVICE_EXTENSION)pDeObj->DeviceExtension; //得到设备扩展
   
    //删除符号链接 and  设备
      pDeObj=pDeObj->NextDevice;

    IoDeleteSymbolicLink(&pDevEx->ustrSymLinkName);
    IoDeleteDevice(pDevEx->pDeviceIo);
   
  }
这样再试试

不行的

看下dump嘛

IoDeleteDevice(pDevEx->pDeviceIo);
你删啥？ 弄懂意思...

不行？？？
   IoDeleteDevice(pDevEx->pDeviceIo);
   
    pDeObj=pDeObj->NextDevice;
你看你把这个设备删了，还想再用这个设备对象里面的指针？

说错了。。。。

这个也是问题，应该先从当前Device得到NextDevice，然后再删除当前Device。。。

//得到设备扩展
        PDeExt=(PDEVICE_EXTENSION)pDeviceIo->DeviceExtension;

还有:
#pragma code_seg("INIT") 去掉

要会用windbg调试，楼主

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8065c88e, The address that the exception occurred at
Arg3: f88f6c5c, Exception Record Address
Arg4: f88f6958, Context Record Address

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

FAULTING_IP:
nt!IovUtilIsDeviceObjectMarked+0
8065c88e 8b81b0000000    mov     eax,dword ptr [ecx+0B0h]

EXCEPTION_RECORD:  f88f6c5c -- (.exr 0xfffffffff88f6c5c)
ExceptionAddress: 8065c88e (nt!IovUtilIsDeviceObjectMarked)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 000000b0
Attempt to read from address 000000b0

CONTEXT:  f88f6958 -- (.cxr 0xfffffffff88f6958)
eax=00000001 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=efb7db84
eip=8065c88e esp=f88f6d24 ebp=f88f6d34 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00210246
nt!IovUtilIsDeviceObjectMarked:
8065c88e 8b81b0000000    mov     eax,dword ptr [ecx+0B0h] ds:0023:000000b0=????????
Resetting default scope

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  000000b0

READ_ADDRESS:  000000b0

FOLLOWUP_IP:
test!UnloadDriver+4d [e:\dispatchtest\nt_driver\driver.cpp @ 86]
f8b277ed 8b4df8          mov     ecx,dword ptr [ebp-8]

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 806577e3 to 8065c88e

STACK_TEXT:  
f88f6d20 806577e3 f8b277ed 00000018 f8b277ed nt!IovUtilIsDeviceObjectMarked
f88f6d34 804f18e0 00000000 efb7db84 f88f6d58 nt!VerifierIoDeleteDevice+0x2d
f88f6d44 f8b277ed 00000000 82240bf8 82240cb0 nt!IoDeleteDevice+0x18
f88f6d58 80577863 823503a0 efb7db84 8055c0fc test!UnloadDriver+0x4d [e:\dispatchtest\nt_driver\driver.cpp @ 86]
f88f6d74 80535c02 efb7db84 00000000 8234dda8 nt!IopLoadUnloadDriver+0x19
f88f6dac 805c7160 efb7db84 00000000 00000000 nt!ExpWorkerThread+0x100
f88f6ddc 80542dd2 80535b02 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FAULTING_SOURCE_CODE:  
    82:     
    83:     IoDeleteSymbolicLink(&pDevEx->ustrSymLinkName);
    84:     IoDeleteDevice(pDevEx->pDeviceIo);
    85:     
>   86:     pDeObj=pDeObj->NextDevice;
    87:   }
    88: }

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  test!UnloadDriver+4d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: test

IMAGE_NAME:  test.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e256a55

STACK_COMMAND:  .cxr 0xfffffffff88f6958 ; kb

FAILURE_BUCKET_ID:  0x7E_VRF_test!UnloadDriver+4d

BUCKET_ID:  0x7E_VRF_test!UnloadDriver+4d

Followup: MachineOwner
---------

谢了 各位 我看下  

11楼已经很明显给出答案了。。。

设备对象都没了，还拿NextDevice