Re: 一个由菜鸟编写的文件过滤驱动引发的蓝屏事件......

Windows驱动开发

一个由菜鸟编写的文件过滤驱动引发的蓝屏事件......

---

ReverseMan 2010-09-19, 16:43 下午

开发的一个文件过滤驱动程序，主要就是绑定卷设备，然后过滤信息就Ok了。开始的时候调用了IoRegisterFsRegistrationChange注册了个回调。现在程序只是个DEMO，运行的时候就蓝了。烦请各位调试大牛帮帮忙哈~~~~

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: f000ff67, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf931019, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

READ_ADDRESS:  f000ff67

FAULTING_IP:
win32k!_WOWCleanup+95
bf931019 0fb74814        movzx   ecx,word ptr [eax+14h]

MM_INTERNAL_CODE:  0

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  41107f7a

MODULE_NAME: win32k

FAULTING_MODULE: bf800000 win32k

DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

TRAP_FRAME:  f7a86830 -- (.trap 0xfffffffff7a86830)
ErrCode = 00000000
eax=f000ff53 ebx=00000002 ecx=00000000 edx=00000000 esi=00000084 edi=00000088
eip=bf931019 esp=f7a868a4 ebp=f7a86900 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
win32k!_WOWCleanup+0x95:
bf931019 0fb74814        movzx   ecx,word ptr [eax+14h]   ds:0023:f000ff67=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 805338e7 to 804e4b25

STACK_TEXT: 
f7a86380 805338e7 00000003 f000ff67 00000000 nt!RtlpBreakWithStatusInstruction
f7a863cc 805343be 00000003 806ee03c c03c003c nt!KiBugCheckDebugBreak+0x19
f7a867ac 805349ae 00000050 f000ff67 00000000 nt!KeBugCheck2+0x574
f7a867cc 805256fb 00000050 f000ff67 00000000 nt!KeBugCheckEx+0x1b
f7a86818 804e2ff1 00000000 f000ff67 00000000 nt!MmAccessFault+0x6f5
f7a86818 bf931019 00000000 f000ff67 00000000 nt!KiTrap0E+0xcc
f7a86900 bf814008 bc600940 00000082 00000000 win32k!_WOWCleanup+0x95
f7a86940 bf80f470 bc600940 00000082 00000000 win32k!xxxSendMessageTimeout+0x18a
f7a86964 bf8fbb67 bc600940 00000082 00000000 win32k!xxxSendMessage+0x1b
f7a869b0 bf8fc169 bc600940 f7a869cc e1695430 win32k!xxxFreeWindow+0xbe
f7a869d8 bf8fbb58 bc600818 e1695430 bc600818 win32k!xxxFW_DestroyAllChildren+0x6b
f7a86a18 bf8fb5de bc600818 f7a86a58 00000000 win32k!xxxFreeWindow+0xaf
f7a86a68 bf8aabf1 00000000 00000022 0079fff4 win32k!xxxDestroyWindow+0x42d
f7a86d30 bf8c8602 bf9a8980 00000001 f7a86d54 win32k!xxxDesktopThread+0x71a
f7a86d40 bf800ff4 bf9a8980 f7a86d64 0079fff4 win32k!xxxCreateSystemThreads+0x6a
f7a86d54 804e006b 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
f7a86d54 7c92ebab 00000000 00000022 00000000 nt!KiFastCallEntry+0xf8
0079ffe0 764e53d6 764eb10b 00000000 00000022 ntdll!KiIntSystemCall+0x6
00000000 f000ff53 f000ff53 f000ff53 f000ff53 winsrv!NtUserCallOneParam+0xc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 f000ff53 f000ff53 f000ff53 0xf000ff53

STACK_COMMAND:  kb

FOLLOWUP_IP:
win32k!_WOWCleanup+95
bf931019 0fb74814        movzx   ecx,word ptr [eax+14h]

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  win32k!_WOWCleanup+95

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  0x50_win32k!_WOWCleanup+95

BUCKET_ID:  0x50_win32k!_WOWCleanup+95

Followup: MachineOwner
---------

似乎我的程序里面也没用啥和win32k.sys相关的原料呀... 不解

Re: 一个由菜鸟编写的文件过滤驱动引发的蓝屏事件......

---

格蠹老雷 2010-09-20, 19:44 下午
内存使用不当，开启verifier看能否拦截到不当现场