Windbg显示PAGE_FAULT_IN_NONPAGED_AREA (50)；我是刚接触内核编程技术，因为这个问题在网上搜了很久，也看了许多，但就弄不明白原因，不会解决。发个帖子求助。

下面是我的代码：

NTSTATUS DriverEntry(
    IN OUT PDRIVER_OBJECT   DriverObject,
    IN PUNICODE_STRING      RegistryPath
    )
{
    BOOLEAN        fSymbolicLink = FALSE;
    PDEVICE_OBJECT pdoDeviceObj = 0;
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    pdoGlobalDrvObj = DriverObject;

    // Create the device object.
    if(!NT_SUCCESS(status = IoCreateDevice(
        DriverObject,
        0,
        &usDeviceName,
        FILE_DEVICE_UNKNOWN,
        FILE_DEVICE_SECURE_OPEN,
        FALSE,
        &pdoDeviceObj
        )))
    {
        // Bail out (implicitly forces the driver to unload).
        return status;
    };

    // Now create the respective symbolic link object
    if(!NT_SUCCESS(status = IoCreateSymbolicLink(
        &usSymlinkName,
        &usDeviceName
        )))
    {
        IoDeleteDevice(pdoDeviceObj);
        return status;
    }
        fSymbolicLink = TRUE;
    // NOTE: You need not provide your own implementation for any major function that
    //       you do not want to handle. I have seen code using DDKWizard that left the
    //       *empty* dispatch routines intact. This is not necessary at all!
    DriverObject->MajorFunction[IRP_MJ_CREATE] =
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = DRIVER1_DispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DRIVER1_DispatchDeviceControl;
    DriverObject->DriverUnload = DRIVER1_DriverUnload;

  
    // Map the memory into our domain to change the permissions on the MDL
//    g_pmdlSystemCall = IoAllocateMdl(KeServiceDescriptorTable.ServiceTableBase,
  //      KeServiceDescriptorTable.NumberOfServices * 4,
    //    FALSE, FALSE, NULL);
    g_pmdlSystemCall = IoAllocateMdl(KeServiceDescriptorTable.ServiceTableBase,
        KeServiceDescriptorTable.NumberOfServices * 4,
        FALSE, FALSE, NULL);

    if (g_pmdlSystemCall == NULL)
    {
        status = STATUS_UNSUCCESSFUL;
        goto __failed;
    }

    MmBuildMdlForNonPagedPool(g_pmdlSystemCall);//这句就坏了
    // Change the flags of the MDL
    g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA;
    MappedSystemCallTable = (LONG*)MmMapLockedPages(g_pmdlSystemCall, KernelMode);

    // HOOK ZwQueryDirectoryFile 并保存原 ZwQueryDirectoryFile 函数地址
//    HOOK_SYSCALL(ZwQueryDirectoryFile, HookZwQueryDirectoryFile, OriginalZwQueryDirectoryFile);
        OriginalZwQueryDirectoryFile = (PFN_ZwQueryDirectoryFile)InterlockedExchange((PLONG)&MappedSystemCallTable[SYSCALL_INDEX(ZwQueryDirectoryFile)], (LONG)HookZwQueryDirectoryFile);
    g_bHooked = TRUE;

    if (NT_SUCCESS(status))
        {
        return status;
        }

__failed:
    if (fSymbolicLink)
        IoDeleteSymbolicLink(&usSymlinkName);

    if (pdoDeviceObj)
        IoDeleteDevice(pdoDeviceObj);

    return status;
}

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法