小弟在这里发过帖请教过,也感谢各位对我的帮助,致使我解决问题.我这个驱动我相信很多牛人已经看到过,经测试在虚拟机中完全无问题,但是一在真机中运行,再装QQ管家,就会蓝屏,或者装完重启了蓝屏,我这里的源码有没有牛人能帮忙看看哪里有无问题,在此拜谢

#include "ntifs.h"
#include <ntstrsafe.h>
#include <ntddk.h>
#include <string.h>
#define REGISTRY_POOL_TAG 'pRE'

NTSTATUS st;
LARGE_INTEGER g_CallbackCookie;
ANSI_STRING  astr;
VOID UnloadDriver(PDRIVER_OBJECT DriverObject);
NTSTATUS RegistryCallback(IN PVOID CallbackContext, IN PVOID Argument1, IN PVOID Argument2);
BOOLEAN GetRegistryObjectCompleteName(PUNICODE_STRING pRegistryPath, PUNICODE_STRING pPartialRegistryPath,PVOID pRegistryObject);

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{   
  
  DbgPrint("[RegRoutine]Loading!\n");
  
  DriverObject->DriverUnload = UnloadDriver;
   
  st = CmRegisterCallback(RegistryCallback,NULL,&g_CallbackCookie);
  if ( !NT_SUCCESS(st) )  
  {
    DbgPrint("[RegRoutine]CmRegisterCallback Failed!\n");
    return st;
  }
  
  DbgPrint("[RegRoutine]RegistryCallback Addr:0x%08X\n",RegistryCallback);  
  DbgPrint("[RegRoutine]Cookie.LowPart:0x%08X Cookie.HighPart:0x%08X\n",g_CallbackCookie.LowPart,g_CallbackCookie.HighPart);
  return st;
}

VOID UnloadDriver(PDRIVER_OBJECT DriverObject)
{
  CmUnRegisterCallback(g_CallbackCookie);
  DbgPrint("[RegRoutine]UnLoading!\n");
}

NTSTATUS
RegistryCallback( IN PVOID CallbackContext, IN PVOID Argument1, IN PVOID Argument2 )
{
  int type;
  BOOLEAN exception = FALSE;
  BOOLEAN registryEventIsValid = FALSE;
  UNICODE_STRING registryPath;
  UCHAR* registryData = NULL;
  ULONG registryDataLength = 0;
  ULONG registryDataType = 0;
  
  registryPath.Length = 0;
  registryPath.MaximumLength = NTSTRSAFE_UNICODE_STRING_MAX_CCH * sizeof(WCHAR);
  registryPath.Buffer = ExAllocatePoolWithTag(NonPagedPool, registryPath.MaximumLength, 'ConT');
  
  if(registryPath.Buffer == NULL)
  {
    DbgPrint("[RegRoutine]Allocate registryPath failed!\n");
    return STATUS_SUCCESS;
  }
  
  type = (REG_NOTIFY_CLASS)Argument1;
  try{
    switch(type)
    {

      case RegNtDeleteValueKey:
      {
        
        PREG_DELETE_VALUE_KEY_INFORMATION deleteValueKey = (PREG_DELETE_VALUE_KEY_INFORMATION)Argument2;
        if( MmIsAddressValid(deleteValueKey->ValueName))
        {
        registryEventIsValid = GetRegistryObjectCompleteName(®istryPath, NULL, deleteValueKey->Object);
        if((registryEventIsValid) && (deleteValueKey->ValueName->Length > 0))
        {
   
          RtlUnicodeStringToAnsiString(&astr,®istryPath,TRUE);
          DbgPrint("[RegDeletedKey]KeyName:%s!\n",astr.Buffer);
          RtlFreeAnsiString(&astr);
            RtlUnicodeStringToAnsiString(&astr,deleteValueKey->ValueName,TRUE);  
            DbgPrint("[RegDelValue]ValueName:%s!\n",astr.Buffer);
          if (!_stricmp(astr.Buffer,"Start Page") )
          {  
            
            DbgPrint("[RegDelValue]Forbin!\n");  
            DbgPrint("[RegDelValue]ForbinKeyName:%s!\n",deleteValueKey->ValueName);  
            RtlFreeAnsiString(&astr);  
            return STATUS_INVALID_PARAMETER;
          }  
          RtlFreeAnsiString(&astr);  
        }
      }
        break;  
      }

      case RegNtPreSetValueKey:
      {
        PREG_SET_VALUE_KEY_INFORMATION setValueKey = (PREG_SET_VALUE_KEY_INFORMATION)Argument2;
      if( MmIsAddressValid(setValueKey->ValueName) )
      {
        registryEventIsValid = GetRegistryObjectCompleteName(®istryPath, NULL, setValueKey->Object);
        
        if((registryEventIsValid) && (setValueKey->ValueName->Length > 0))
        {
          RtlUnicodeStringToAnsiString(&astr,®istryPath,TRUE);
          DbgPrint("[RegSetKey]KeyName:%s!\n",astr.Buffer);
          RtlFreeAnsiString(&astr);
           registryDataType = setValueKey->Type;
          registryDataLength = setValueKey->DataSize;
          registryData = ExAllocatePoolWithTag(NonPagedPool, registryDataLength, REGISTRY_POOL_TAG);
        }
        RtlUnicodeStringToAnsiString(&astr,setValueKey->ValueName,TRUE);  
        DbgPrint("[RegSetValue]ValueName:%s!\n",astr.Buffer);
         
          if(registryData != NULL)
          {
          if (!_stricmp(astr.Buffer,"Start Page") )  
          {  
            DbgPrint("[RegSetValue]Forbin!\n");  
            DbgPrint("[RegSetValue]ForbinKeyName:%s!\n",astr.Buffer);  
            RtlFreeAnsiString(&astr);  
            return STATUS_INVALID_PARAMETER;  
          }
          RtlFreeAnsiString(&astr);
          }
        
        }
        
        break;
      }

      
      default:
        break;
    }
  }
  except( EXCEPTION_EXECUTE_HANDLER )
  {
    DbgPrint("[RegRoutine]Catch a Expection!\n");
    exception = TRUE;
    registryEventIsValid = FALSE;
  }
  
  if(registryEventIsValid)
  {
   
    if(registryData != NULL)
    {
      ExFreePoolWithTag(registryData, REGISTRY_POOL_TAG);
    }  
      
  }
  
  if(registryPath.Buffer != NULL)
  {
    ExFreePoolWithTag(registryPath.Buffer, 'ConT');
  }  
   
   
  return STATUS_SUCCESS;
}

BOOLEAN GetRegistryObjectCompleteName(PUNICODE_STRING pRegistryPath, PUNICODE_STRING pPartialRegistryPath, PVOID pRegistryObject)
{
   BOOLEAN foundCompleteName = FALSE;
   BOOLEAN partial = FALSE;
   NTSTATUS status;
   ULONG returnedLength;
   PUNICODE_STRING pObjectName = NULL;

   //判断object的有效性
   if( (!MmIsAddressValid(pRegistryObject)) || (pRegistryObject == NULL) )
   {
     DbgPrint("[RegRoutine]pRegistryObject Invalid!\n");
     return FALSE;
   }
   

  if(pPartialRegistryPath != NULL)
  {
    if( (((pPartialRegistryPath->Buffer[0] == '\\') || (pPartialRegistryPath->Buffer[0] == '%')) ||
      ((pPartialRegistryPath->Buffer[0] == 'T') && (pPartialRegistryPath->Buffer[1] == 'R') &&
       (pPartialRegistryPath->Buffer[2] == 'Y') && (pPartialRegistryPath->Buffer[3] == '\\'))) )
    {
      RtlUnicodeStringCopy(pRegistryPath, pPartialRegistryPath);
      partial = TRUE;
      foundCompleteName = TRUE;
    }
  }
  
  
  if(!foundCompleteName)
  {
    //使用ObQueryNameString来得到object对应的名称
    status = ObQueryNameString(pRegistryObject, (POBJECT_NAME_INFORMATION)pObjectName, 0, &returnedLength );
   
    //第一次传的buffer长度为0，ObQueryNameString返回的结果必定是缓冲区大小不足
    if(status == STATUS_INFO_LENGTH_MISMATCH)  
    {
        pObjectName = ExAllocatePoolWithTag(NonPagedPool, returnedLength, 'ConT'); //申请内存
      if( pObjectName == NULL ) //申请内存失败则返回FALSE
      {
        DbgPrint("[RegRoutine]AllocatePool Failed!\n");
        return FALSE;
      }
      //查询名称
      status = ObQueryNameString(pRegistryObject, (POBJECT_NAME_INFORMATION)pObjectName, returnedLength, &returnedLength );
      if(NT_SUCCESS(status))
     {
        RtlUnicodeStringCopy(pRegistryPath, pObjectName);  //拷贝名称
        foundCompleteName = TRUE;
     }

      ExFreePoolWithTag(pObjectName, 'ConT');  //无论查询是否成功都应该释放内存   
     }  
      
  }
  

return foundCompleteName;

}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课