向int3中断 写入自己的跳转 但是加载驱动就蓝屏了 用windbg调试 出错的是下面120:这条指令mov byte ptr ds:[ebx],al   用!analyze -v显示:ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) 试图向只读存储器写入 但是我看郁金香老师写的代码  是一样的啊 他的能写入成功  但是我一载入就蓝屏  出错信息 都在下面了 请大牛帮我看下  多谢

push ebx
   117:                 push eax
   118:                 mov ebx,int3proc_addr
   119:                 mov eax,0xE9
>  120:                 mov byte ptr ds:[ebx],al
   121:                 mov eax,jmpaddr
   122:                 mov dword ptr ds:[ebx+1],eax
   123:                 pop eax
   124:                 pop ebx

==========================================
IDT_ENTRY size=8
IDT BASE=8003f400

int proc addr=804e089d

要写入的地址=79848e9e

*** Fatal System Error: 0x000000be
                       (0x804E089D,0x004E0121,0xF9C6EBE8,0x0000000B)

Driver at fault:
***  DDK_HelloWorld.sys - Address F9D298B7 base at F9D29000, DateStamp 5159738e
.
Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 804e089d, Virtual address for the attempted write.
Arg2: 004e0121, PTE contents.
Arg3: f9c6ebe8, (reserved)
Arg4: 0000000b, (reserved)

Debugging Details:
------------------

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  System

TRAP_FRAME:  f9c6ebe8 -- (.trap 0xfffffffff9c6ebe8)
ErrCode = 00000003
eax=000000e9 ebx=804e089d ecx=80500093 edx=804e08a6 esi=e1b273ce edi=81702ae8
eip=f9d298b7 esp=f9c6ec5c ebp=f9c6ec74 iopl=0         nv up ei ng nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
DDK_HelloWorld!HookInt3Proc+0x97:
f9d298b7 3e8803          mov     byte ptr ds:[ebx],al       ds:0023:804e089d=6a
Resetting default scope

LAST_CONTROL_TRANSFER:  from 8053377f to 804e45a2

STACK_COMMAND:  kb

FOLLOWUP_IP:
DDK_HelloWorld!HookInt3Proc+97 [h:\½Ì³ÌºÏ¼¯\Íâ¹Ò½Ì³Ì\Óô½ðÏã\Çý¶¯½Ì³Ì\Óô½ðÏãÇý¶¯42-46\mini_ddk\idt.h @ 120]
f9d298b7 3e8803          mov     byte ptr ds:[ebx],al

FAULTING_SOURCE_CODE:  
   116:         push ebx
   117:                 push eax
   118:                 mov ebx,int3proc_addr
   119:                 mov eax,0xE9
>  120:                 mov byte ptr ds:[ebx],al
   121:                 mov eax,jmpaddr
   122:                 mov dword ptr ds:[ebx+1],eax
   123:                 pop eax
   124:                 pop ebx
   125: }

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  DDK_HelloWorld!HookInt3Proc+97

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: DDK_HelloWorld

IMAGE_NAME:  DDK_HelloWorld.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5159738e

FAILURE_BUCKET_ID:  0xBE_DDK_HelloWorld!HookInt3Proc+97

BUCKET_ID:  0xBE_DDK_HelloWorld!HookInt3Proc+97

Followup: MachineOwner

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！