参考前辈的代码，
output=(char*)MmMapIoSpace(MmGetPhysicalAddress((void*)a), dwOutputbuff_Size,0);

通过ring3的DeviceIO模式传入的ring3内存地址，通过MmMapIoSpace在内核中来映射ring3物理内存，
这样ring0与ring3通讯，监控驱动创建的时候通知界面。

在关机的时候经常蓝屏：

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00000000, page frame number
Arg3: 00000001, current page state
Arg4: 00000000, 0

Debugging Details:
------------------

BUGCHECK_STR:  0x4E_99

PFN_PAGE_SINGLE_BIT_ERROR: Bugcheck args 2 and 3 differ by a bit, its hardware error.

MEMORY_CORRUPTOR:  ONE_BIT

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  test.exe

LAST_CONTROL_TRANSFER:  from 805230c8 to 804fae0b

STACK_TEXT:  
b9affbc0 805230c8 0000004e 00000099 00000000 nt!KeBugCheckEx+0x1b
b9affbf0 80511dab c0883f38 0000008f 831064e8 nt!MiDecrementShareCount+0x3a
b9affc14 805afccb 77c27101 831062f0 007ffff8 nt!MiDeleteValidAddress+0x177
b9affc34 8051384d 831062f0 83106428 831062f0 nt!MiDeleteAddressesInWorkingSet+0x65
b9affc68 805d1f99 001062f0 82a67198 c0000005 nt!MmCleanProcessAddressSpace+0x193
b9affcf0 805d207d c0000005 b9affd4c 804ffe85 nt!PspExitThread+0x621
b9affcfc 804ffe85 82a67198 b9affd48 b9affd3c nt!PsExitSpecialApc+0x23
b9affd4c 80541a7e 00000001 00000000 b9affd64 nt!KiDeliverApc+0x1af
b9affd4c 77c01ce9 00000001 00000000 b9affd64 nt!KiServiceExit2+0x3a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0112da38 00000000 00000000 00000000 00000000 0x77c01ce9

STACK_COMMAND:  kb

FOLLOWUP_NAME:  memory_corruption

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

dump显示PTE分页冲突，驱动传入错误的内存描述符列表错误 (可能2次释放导致)

MmMapIoSpace后必须MmUnmapIoSpace，不用会导致蓝屏？
多谢各位老大们指教，谢谢，项目里我的代码老蓝屏，组长快把我杀了

[课程]Android-CTF解题方法汇总！

上传的附件：

• dump.rar （28.71kb，12次下载）