 |
|
|
|
|
|
|
|
Windows内核调试
帖子发起人: superchao 发起时间: 2010-09-04 15:23 下午 回复: 1
  
|
|
帖子排序:
|
|
|
|
 2010-09-04, 15:23 下午
|
superchao
注册: 2010-03-29
发 贴: 18
|
![Zip it! [:#]](/emoticons/emotion-16.gif)
CURRENT_IRQL: ff 是指什么IRQL
|
|
|
|
|
!analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: e11e7000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8054d1cb, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_FF
CURRENT_IRQL: ff
FAULTING_IP:
nt!ExAllocatePoolWithTag+863
8054d1cb 8906 mov dword ptr [esi],eax
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
TRAP_FRAME: f8af15c4 -- (.trap 0xfffffffff8af15c4)
ErrCode = 00000002
eax=0c810600 ebx=825ef078 ecx=00000000 edx=825f2080 esi=e11e7000 edi=000001ff
eip=8054d1cb esp=f8af1638 ebp=f8af168c iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010046
nt!ExAllocatePoolWithTag+0x863:
8054d1cb 8906 mov dword ptr [esi],eax ds:0023:e11e7000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 8054d1cb to 805456e0
STACK_TEXT:
f8af15c4 8054d1cb badb0d00 825f2080 f8af1624 nt!KiTrap0E+0x238
f8af168c 805e6642 00000001 00000000 63416553 nt!ExAllocatePoolWithTag+0x863
f8af16b4 805e6b4f 00000000 00000000 00000000 nt!RtlpInheritAcl+0x28
f8af1790 805f1e39 00000000 e20c1718 f8af17e8 nt!RtlpNewSecurityObject+0x485
f8af17bc 805c0f55 00000000 00000000 f8af17e8 nt!SeAssignSecurity+0x4f
f8af17ec 805c4397 f8af1900 00000000 8242ca00 nt!ObAssignSecurity+0x35
f8af18d4 805d169a 8242ca00 f8af1900 00000000 nt!ObInsertObject+0x401
f8af1a24 805d212d f8af1a88 00000000 00000000 nt!PspCreateThread+0x5d0
f8af1a58 f89c6657 f8af1a88 00000000 00000000 nt!PsCreateSystemThread+0x33
f8af1ab0 805d10b0 f8af1cf8 00000000 f8af1b4c Hook!LoadImage+0x127 [d:\waigua\anti-restart\driver1.cpp @ 541]
f8af1ad0 805afd27 f8af1cf8 00000000 f8af1b4c nt!PsCallImageNotifyRoutines+0x36
f8af1c74 8058207b f8af1cf8 00000000 00000000 nt!MmLoadSystemImage+0x9e5
f8af1d54 80582487 80000470 00000001 00000000 nt!IopLoadDriver+0x371
f8af1d7c 8053976d 80000470 00000000 825b58b8 nt!IopLoadUnloadDriver+0x45
f8af1dac 805d0f64 b25a4cf4 00000000 00000000 nt!ExpWorkerThread+0xef
f8af1ddc 805470de 8053967e 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
Hook!LoadImage+127 [d:\waigua\anti-restart\driver1.cpp @ 541]
f89c6657 8945f4 mov dword ptr [ebp-0Ch],eax
FAULTING_SOURCE_CODE:
537:
538: WPOFF();
539: antirestart(ImageInfo->ImageBase);
540:
> 541: rc = PsCreateSystemThread(&hThread,0,0,0,0,ReHook,0);
542:
543: if(NT_SUCCESS(rc))//¨°¨°?a?¨°??2??¨′¨o1¨?????à¨2?¨′¨°?1??à???
544: {
545: ZwClose(hThread);
546: }
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: Hook!LoadImage+127
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Hook
IMAGE_NAME: Hook.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c80ab93
FAILURE_BUCKET_ID: 0xC5_FF_Hook!LoadImage+127
BUCKET_ID: 0xC5_FF_Hook!LoadImage+127
Followup: MachineOwner
---------
上面是在PsCreateSystemThread调用出的错，不知道是不是IRQL的问题.
|
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
|
2010-09-06, 13:38 下午
|
王宇
注册: 2007-05-08
发 贴: 306
|
Re: CURRENT_IRQL: ff 是指什么IRQL
|
|
|
|
|
|
基本功。建议按照提示开驱动校验跑您的 Hook.sys，这类问题 Verifier 会轻易帮您定位到。
|
|
|
|
IP 地址: 已记录
|
报告
|
|
|
|
|
高端调试 » 软件调试 » Windows内核调试 » CURRENT_IRQL: ff 是指什么IRQL
|
|
|
|
|
|