首页
社区
课程
招聘
[求助]非常怪异的驱动蓝屏
发表于: 2009-6-29 15:07 4029

[求助]非常怪异的驱动蓝屏

2009-6-29 15:07
4029
有谁知道下面的蓝屏是怎么引起的吗?

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: termdd

FAULTING_MODULE: 80800000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  45d69640

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

FAULTING_IP:
termdd!IcaChannelInput+af7
f761ab8d 8b710c          mov     esi,dword ptr [ecx+0Ch]

TRAP_FRAME:  b9a4e2d8 -- (.trap 0xffffffffb9a4e2d8)
ErrCode = 00000000
eax=88a31fd8 ebx=88a31fd8 ecx=00000000 edx=89dadfc8 esi=88a31f68 edi=89dadf10
eip=f761ab8d esp=b9a4e34c ebp=b9a4e35c iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
termdd!IcaChannelInput+0xaf7:
f761ab8d 8b710c          mov     esi,dword ptr [ecx+0Ch] ds:0023:0000000c=????????
Resetting default scope

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8082d820 to 80827c83

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
b9a4dea4 8082d820 0000008e c0000005 f761ab8d nt!KeBugCheckEx+0x1b
b9a4e268 8088a292 b9a4e284 00000000 b9a4e2d8 nt!KeTerminateThread+0xee2
b9a4e35c f761ad20 88a31f68 88a31fd8 89dadf10 nt!Kei386EoiHelper+0x1d2
b9a4e374 8081df85 89dadf10 88a31f68 00000200 termdd!IcaChannelInput+0xc8a
b9a4e388 808ed7a9 00000114 00000000 00000000 nt!IofCallDriver+0x45
b9a4e5d8 ba354627 89dadf10 b9a4e5ec 00000174 nt!RtlVolumeDeviceToDosName+0x89
b9a4e5f4 ba354751 88b06ac0 b9a4e624 b9a4e854 Safe3FP+0x1627
b9a4e828 808897bc 00000174 00000114 00000000 Safe3FP+0x1751
b9a4e8d8 80a601ae 0120027f 00000000 4c534341 nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb64
b9a4e8ec 80a603d9 00000002 00001f80 80a603f4 hal!KfRaiseIrql+0xfa
b9a4e908 80a60456 00000004 e2c5b37c b9a4e9c0 hal!KeRaiseIrqlToSynchLevel+0x8d
b9a4e920 8096a719 e103dbc8 00000000 0000000c hal!KfLowerIrql+0x62
b9a4e9f0 8096e8d2 b9a4ea40 8096e9a9 01000003 nt!SeQueryInformationToken+0xd0f
00000000 00000000 00000000 00000000 00000000 nt!SeOpenObjectAuditAlarm+0xf8

STACK_COMMAND:  kb

FOLLOWUP_IP:
termdd!IcaChannelInput+af7
f761ab8d 8b710c          mov     esi,dword ptr [ecx+0Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  termdd!IcaChannelInput+af7

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  termdd.sys

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

蓝屏文件下载地址点击下载

[课程]FART 脱壳王!加量不加价!FART作者讲授!

收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 290
活跃值: (20)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
2
公司下载不了,估计是RtlVolumeDeviceToDosName出错,没有检测DeviceObject是否合法。
2009-6-29 15:21
0
雪    币: 635
活跃值: (101)
能力值: ( LV12,RANK:420 )
在线值:
发帖
回帖
粉丝
3
RtlVolumeDeviceToDosName非常危险~不怕蓝屏卡死的快去调~

发给只认FileObject的设备就死定了~
2009-6-29 15:47
0
游客
登录 | 注册 方可回帖
返回
//