首页
社区
课程
招聘
[求助]KeSetEvent蓝屏问题
发表于: 2009-10-12 17:44 11636

[求助]KeSetEvent蓝屏问题

2009-10-12 17:44
11636
环境:从用户态通过DeviceIoControl传入一个Event变量,驱动层在满足条件的时候,调用KeSetEvent出发该事件。

代码:
KIRQL oldirql;
       
ASSERT(KeGetCurrentIrql()<= DISPATCH_LEVEL);
KeRaiseIrql(DISPATCH_LEVEL,&oldirql);
  
if( KeyBoardWatchFlag == ENABLE_KEYBOARD_WATCH )
{

    KeSetEvent( gpevtKeyPressNotify, IO_NO_INCREMENT, FALSE );
}       
KeLowerIrql(oldirql);

问题报告:
STACK_TEXT:  
f7a427b0 8053f0c7 00000003 f7a42b0c 00000000 nt!RtlpBreakWithStatusInstruction
f7a427fc 8053fb9e 00000003 00000012 804eeddb nt!KiBugCheckDebugBreak+0x19
f7a42bdc 804e9a9c 0000000a 00000012 0000001c nt!KeBugCheck2+0x574
f7a42bdc 804eeddb 0000000a 00000012 0000001c nt!KiTrap0E+0x238
f7a42c7c f7981180 84541108 00000000 00000000 nt!KeSetEvent+0x32
f7a42c98 f7980ead 804e340f 00000001 00000000 MyDriver!SendKeyPressNotify+0x60 [d:\¹¤×÷Îĵµ\רҵ°æ°²×°³ÌÐò\MyDriver\kbwatchimpl.c @ 197]
f7a42cb8 804ea8ef 845fd8d8 858a1780 00000000 MyDriver!IrpFDOReadCompletionRoutine+0x9d [d:\¹¤×÷Îĵµ\רҵ°æ°²×°³ÌÐò\MyDriver\irpfdoread.c @ 88]
f7a42ce8 f791831c 85e1bca0 85e1bd40 00000002 nt!IopfCompleteRequest+0xa2
f7a42d04 f73f0ccd 0000000c 85e1bd4c 858a18ec kbdclass!KeyboardClassServiceCallback+0x182
f7a42d28 f7949ace 00000001 f7a42d44 00000001 kbdhid!KbdHid_InsertCodesIntoQueue+0x8b
f7a42d3c f7949b54 0000009e 00000000 f73f0c42 HIDPARSE!HidP_KbdPutKey+0x30
f7a42d58 f7949e3a 00000004 00000000 857ef050 HIDPARSE!HidP_TranslateUsage+0x7a
f7a42d88 f73f0f16 857ef0ed 0000000e 00000000 HIDPARSE!HidP_TranslateUsageAndPagesToI8042ScanCodes+0x64
f7a42dbc 804ea8ef 00000000 017ef238 85e1bca0 kbdhid!KbdHid_ReadComplete+0x16e
f7a42dec f7798e70 f7a42df4 f7a42df4 85e3f740 nt!IopfCompleteRequest+0xa2
f7a42e08 f7799044 02e3f728 85eb19c0 00000009 HIDCLASS!HidpDistributeInterruptReport+0xae
f7a42e48 804ea8ef 00000000 8581e008 857fa0fc HIDCLASS!HidpInterruptReadComplete+0x17a
f7a42e78 f7391ee5 8581e008 852cfdb8 85e68028 nt!IopfCompleteRequest+0xa2
f7a42ee0 f7392b57 85e53650 00000000 85e687d8 USBPORT!USBPORT_CompleteTransfer+0x373
f7a42f10 f7393754 026e6f44 85e680e0 85e680e0 USBPORT!USBPORT_DoneTransfer+0x137
f7a42f48 f7394f6a 85e68028 804ee6ec 85e68230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
f7a42f74 f73a2fb0 85e68028 804ee6ec 85e68028 USBPORT!USBPORT_DpcWorker+0x224
f7a42fb0 f73a3128 85e68028 00000001 85e3ebe0 USBPORT!USBPORT_IsrDpcWorker+0x37e
f7a42fcc 804e5d12 85e6864c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f7a42ff4 804e587d f5be4d44 00000000 00000000 nt!KiRetireDpcList+0x61
f7a42ff8 f5be4d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
WARNING: Frame IP not in any known module. Following frames may be wrong.
804e587d 00000000 00000009 0081850f bb830000 0xf5be4d44

STACK_COMMAND:  kb

FOLLOWUP_IP:
MyDriver!SendKeyPressNotify+60 [d:\¹¤×÷Îĵµ\רҵ°æ°²×°³ÌÐò\MyDriver\kbwatchimpl.c @ 197]
f7981180 8a4dff          mov     cl,byte ptr [ebp-1]

FAULTING_SOURCE_CODE:  
   193: #endif
   194:                 KeSetEvent( gpevtKeyPressNotify, IO_NO_INCREMENT, FALSE );
   195:         }
   196:        
>  197:         KeLowerIrql(oldirql);
   198: }?2?kMicrosoft C/C++ MSF 7.00
DS

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  MyDriver!SendKeyPressNotify+60

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MyDriver

IMAGE_NAME:  MyDriver.dat

DEBUG_FLR_IMAGE_TIMESTAMP:  4ad2ebea

FAILURE_BUCKET_ID:  0xA_MyDriver!SendKeyPressNotify+60

BUCKET_ID:  0xA_MyDriver!SendKeyPressNotify+60

Followup: MachineOwner

错误码:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000012, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804eeddb, address which referenced memory

望大牛们指点.....

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 0
支持
分享
最新回复 (12)
雪    币: 7651
活跃值: (523)
能力值: ( LV9,RANK:610 )
在线值:
发帖
回帖
粉丝
2
KeSetEvent时缺页?Set前检查一下变量gpevtKeyPressNotify的值
2009-10-12 18:01
0
雪    币: 97
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
应该不是吧,错误指示在KeLowerIrql(oldirql)这句上面
2009-10-12 18:32
0
雪    币: 2
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
wdk 文档 里对  KeSetEvent 的Wait 参数有这样的说明:

If Wait is set to FALSE, the caller can be running at IRQL <= DISPATCH_LEVEL. Otherwise, callers of KeSetEvent must be running at IRQL <= APC_LEVEL and in a nonarbitrary thread context.

但事实上  keSetEvent 太高的中断级别而蓝屏
2009-10-12 19:10
0
雪    币: 7651
活跃值: (523)
能力值: ( LV9,RANK:610 )
在线值:
发帖
回帖
粉丝
5

你好好看调用栈
2009-10-12 19:36
0
雪    币: 522
活跃值: (10)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
6
ZwWaitForSingleObject 多方便   直接用句柄  
2009-10-12 20:00
0
雪    币: 7651
活跃值: (523)
能力值: ( LV9,RANK:610 )
在线值:
发帖
回帖
粉丝
7

用句柄必须Attach到相应的进程中去,麻烦啊
2009-10-12 20:05
0
雪    币: 635
活跃值: (101)
能力值: ( LV12,RANK:420 )
在线值:
发帖
回帖
粉丝
8
其实ring3传event进去这个方式是有问题的,可引发内核提权,,具体不说了
2009-10-12 20:18
0
雪    币: 170
活跃值: (90)
能力值: ( LV12,RANK:210 )
在线值:
发帖
回帖
粉丝
9
我不吃知道什么地方问题啊
2009-10-12 22:18
0
雪    币: 251
活跃值: (15)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
10
那个event不太靠谱
2009-10-12 23:31
0
雪    币: 97
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
11
那用什么方法好了,以前我用起来一直都还挺好的,昨天突然发现不停的蓝屏
2009-10-13 09:16
0
雪    币: 215
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
rsa
12
IRQL太高了。根本是缺页。
2009-10-13 10:13
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
13
用 MmLockPagableDataSection 锁定该内核事件
2009-11-6 11:00
0
游客
登录 | 注册 方可回帖
返回
//