能力值:
( LV5,RANK:70 )
2 楼
MODULE_NAME: rdbss
FAULTING_MODULE: 804d8000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 48025ee6
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
458b51e8
CURRENT_IRQL: 2
FAULTING_IP:
nt+28eeb
80500eeb 3b51fc cmp edx,dword ptr [ecx-4]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 80500fdf to 80500eeb
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
8054aae0 80500fdf fff79b90 ffffffff 6dfc91a6 nt+0x28eeb
8054aafc 804f9e57 fff79b90 ffffffff f5b9e2d0 nt+0x28fdf
8054ab1c 804f9efe 00b9e2a0 fff79b90 ffffffff nt+0x21e57
8054ab38 f5b94405 f5b9e2a0 fff79b90 ffffffff nt+0x21efe
8054ab64 80500d98 f5b9e2e0 00000000 c9ee20d8 rdbss+0x405
8054ac80 80500eaf 80553a20 805537c0 ffdff000 nt+0x28d98
8054acac 80542b9d 80553e20 00000000 0005a1fe nt+0x28eaf
8054acb0 80553e20 00000000 0005a1fe 00000000 nt+0x6ab9d
8054acb4 00000000 0005a1fe 00000000 805537c0 nt+0x7be20 STACK_COMMAND: kb
FOLLOWUP_IP:
rdbss+405
f5b94405 ?? ???
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: rdbss+405
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: rdbss.sys
BUCKET_ID: WRONG_SYMBOLS 貌似是rdbss.sys的问题,你的机器应该2000的吧
升级一下你的系统应该可以
http://support.microsoft.com/kb/329175
能力值:
( LV2,RANK:10 )
3 楼
谢谢啊,不过我的是win XP Sp3
能力值:
( LV5,RANK:70 )
4 楼
你虚拟机是什么系统?
能力值:
( LV2,RANK:10 )
5 楼
我是实机测试
能力值:
( LV2,RANK:10 )
6 楼
修改CR0的时候要先保护EAX吧
PUSH EAX
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
POP EAX
这句有点冗余
NTSTATUS rc ;
rc = OldZwCreateFile (FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock,AllocationSize,
FileAttributes,ShareAccess,CreateDisposition,CreateOptions, EaBuffer,EaLength);
return rc;
直接return OldZwCreateFile (FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock,AllocationSize,
FileAttributes,ShareAccess,CreateDisposition,CreateOptions, EaBuffer,EaLength);
能力值:
( LV5,RANK:70 )
7 楼
windbg上显示的就是我发的那段,应该是rdbss.sys的问题
实在找不到的话就开windbg双机调一下
能力值:
(RANK:680 )
8 楼
hook unhook 早日修成正果
能力值:
( LV9,RANK:380 )
9 楼
你是加载的时候蓝屏,还是卸载的时候蓝屏?
能力值:
( LV3,RANK:20 )
10 楼
你没搞明白extern关键字和__declspec(dllimport)如果是用extern的话这句“extern ServiceDescriptorTableEntry_t KeServiceDescriptorTable;” 应该改成“extern PServiceDescriptorTableEntry_t KeServiceDescriptorTable;”然后下面的宏定义的“#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]” 应该改成“#define SYSTEMSERVICE(_function) KeServiceDescriptorTable->ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]”
当然如果你觉得这样麻烦就只需要把第一句“extern ServiceDescriptorTableEntry_t KeServiceDescriptorTable;” 改成“__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;”即可
extern
能力值:
( LV2,RANK:10 )
11 楼
谢谢10楼,已经解决了