运行我的驱动2个小时候，蓝屏，dump信息如下：

CRITICAL_STRUCTURE_CORRUPTION (109)

This bugcheck is generated when the kernel detects that critical kernel code or

data have been corrupted. There are generally three causes for a corruption:

1) A driver has inadvertently or deliberately modified critical kernel code

 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx

2) A developer attempted to set a normal kernel breakpoint using a kernel

 debugger that was not attached when the system was booted. Normal breakpoints,

 "bp", can only be set if the debugger is attached at boot time. Hardware

 breakpoints, "ba", can be set at any time.

3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.

Arguments:

Arg1: a39fd5daa811f5b8, Reserved

Arg2: b3b6e260fa94be54, Reserved

Arg3: ffff968135b5d040, Failure type dependent information

Arg4: 0000000000000005, Type of corrupted region, can be

0 : A generic data region

1 : Modification of a function or .pdata

2 : A processor IDT

3 : A processor GDT

4 : Type 1 process list corruption

5 : Type 2 process list corruption

6 : Debug routine modification

7 : Critical MSR modification

Debugging Details:

------------------

DUMP_FILE_ATTRIBUTES: 0x8

  Kernel Generated Triage Dump

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x109

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff803593adb90

STACK_TEXT:  

ffffd087`531b6878 00000000`00000000 : 00000000`00000109 a39fd5da`a811f5b8 b3b6e260`fa94be54 ffff9681`35b5d040 : nt!KeBugCheckEx

STACK_COMMAND:  kb

FOLLOWUP_IP: 

nt+1aab90

fffff803`593adb90 48894c2408      mov     qword ptr [rsp+8],rcx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+1aab90

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5ddf4fa0

IMAGE_VERSION:  10.0.17134.1184

FAILURE_BUCKET_ID:  0x109_nt+1aab90

BUCKET_ID:  0x109_nt+1aab90

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x109_nt+1aab90

FAILURE_ID_HASH:  {a1fa6256-df92-7f0a-5054-fe84230d0ca9}

Followup: MachineOwner

我的驱动应该没有触发PatchGuard，怎么会有这个蓝屏呢。

这个dump也没有表示是哪里触发了PatchGuard，像CRITICAL_STRUCTURE_CORRUPTION (109)的dump应该怎么分析?

已经使用!chkimg命令分析过内核，没有发现patch。

另外Arg4: 0000000000000005，代表 5 : Type 2 process list corruption，是什么进程链表损坏了？

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)