-
-
[旧帖] [求助]求内核大牛。。。。 0.00雪花
-
发表于: 2013-6-2 21:20
-
新手求助。。。想写一个NDIS中间层驱动程序，利用ReadFile将数据包数据读到用户态中。DeviceIoControl和ReadFile都可以正常返回数据，但是用户态程序关闭时，CloseHandle（）会造成程序蓝屏。。。
蓝屏时windbg调试信息：
Followup: MachineOwner
---------
nt!RtlpBreakWithStatusInstruction:
80528bdc cc int 3
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 1025b6a0, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 1025b6a0, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 1025b6a0
CURRENT_IRQL: 2
FAULTING_IP:
MSVCR100D+5b6a0
1025b6a0 ?? ???
PROCESS_NAME: open.exe
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
TRAP_FRAME: b2491d64 -- (.trap 0xffffffffb2491d64)
ErrCode = 00000004
eax=00000001 ebx=7ffde000 ecx=0012f594 edx=7c92e4f4 esi=0012f5ac edi=0012ff68
eip=1025b6a0 esp=0012f5a4 ebp=0012ff68 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
MSVCR100D+0x5b6a0:
001b:1025b6a0 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from 804f8b9d to 80528bdc
FAILED_INSTRUCTION_ADDRESS:
MSVCR100D+5b6a0
1025b6a0 ?? ???
STACK_TEXT:
b2491918 804f8b9d 00000003 b2491c74 00000000 nt!RtlpBreakWithStatusInstruction
b2491964 804f978a 00000003 1025b6a0 1025b6a0 nt!KiBugCheckDebugBreak+0x19
b2491d44 80541683 0000000a 1025b6a0 00000002 nt!KeBugCheck2+0x574
b2491d44 1025b6a0 0000000a 1025b6a0 00000002 nt!KiTrap0E+0x233
WARNING: Stack unwind information not available. Following frames may be wrong.
0012f5a0 004117ca 0041581c 00310031 00330031 MSVCR100D+0x5b6a0
0012ff68 00411f8f 00000001 003d2ad0 003d2f50 open+0x117ca
0012ffb8 00411dbf 0012fff0 7c817067 00310031 open+0x11f8f
0012ffc0 7c817067 00310031 00330031 7ffde000 open+0x11dbf
0012fff0 00000000 0041112c 00000000 78746341 kernel32!BaseProcessStart+0x23
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap0E+233
80541683 f7457000000200 test dword ptr [ebp+70h],20000h
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KiTrap0E+233
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlpa.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233
BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233
Followup: MachineOwner
---------
蓝屏时windbg调试信息：
Followup: MachineOwner
---------
nt!RtlpBreakWithStatusInstruction:
80528bdc cc int 3
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 1025b6a0, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 1025b6a0, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 1025b6a0
CURRENT_IRQL: 2
FAULTING_IP:
MSVCR100D+5b6a0
1025b6a0 ?? ???
PROCESS_NAME: open.exe
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
TRAP_FRAME: b2491d64 -- (.trap 0xffffffffb2491d64)
ErrCode = 00000004
eax=00000001 ebx=7ffde000 ecx=0012f594 edx=7c92e4f4 esi=0012f5ac edi=0012ff68
eip=1025b6a0 esp=0012f5a4 ebp=0012ff68 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
MSVCR100D+0x5b6a0:
001b:1025b6a0 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from 804f8b9d to 80528bdc
FAILED_INSTRUCTION_ADDRESS:
MSVCR100D+5b6a0
1025b6a0 ?? ???
STACK_TEXT:
b2491918 804f8b9d 00000003 b2491c74 00000000 nt!RtlpBreakWithStatusInstruction
b2491964 804f978a 00000003 1025b6a0 1025b6a0 nt!KiBugCheckDebugBreak+0x19
b2491d44 80541683 0000000a 1025b6a0 00000002 nt!KeBugCheck2+0x574
b2491d44 1025b6a0 0000000a 1025b6a0 00000002 nt!KiTrap0E+0x233
WARNING: Stack unwind information not available. Following frames may be wrong.
0012f5a0 004117ca 0041581c 00310031 00330031 MSVCR100D+0x5b6a0
0012ff68 00411f8f 00000001 003d2ad0 003d2f50 open+0x117ca
0012ffb8 00411dbf 0012fff0 7c817067 00310031 open+0x11f8f
0012ffc0 7c817067 00310031 00330031 7ffde000 open+0x11dbf
0012fff0 00000000 0041112c 00000000 78746341 kernel32!BaseProcessStart+0x23
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap0E+233
80541683 f7457000000200 test dword ptr [ebp+70h],20000h
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KiTrap0E+233
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlpa.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233
BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+233
Followup: MachineOwner
---------
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
