Re: 求助：DRIVER_IRQL_NOT_LESS_OR_EQUAL错误

Windows内核调试

求助：DRIVER_IRQL_NOT_LESS_OR_EQUAL错误

---

maxsjm 2011-05-28, 11:23 上午
我写的是一个键盘驱动。可看见成功卸载，但卸载后再按一下键盘，就蓝屏了。各位能帮帮我吗？
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f9f18d30, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: f9f18d30, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: f9f18d30

CURRENT_IRQL: 2

FAULTING_IP:
key+d30
f9f18d30 ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

TRAP_FRAME: 8054ab0c -- (.trap 0xffffffff8054ab0c)
ErrCode = 00000010
eax=815c5b48 ebx=00000000 ecx=81597607 edx=8054abe1 esi=81597610 edi=81597737
eip=f9f18d30 esp=8054ab80 ebp=8054abac iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
+0xd30:
f9f18d30 ?? ???
Resetting default scope

IP_MODULE_UNLOADED:
key+d30
f9f18d30 ?? ???

LAST_CONTROL_TRANSFER: from 804f8b9d to 80528bdc

FAILED_INSTRUCTION_ADDRESS:
key+d30
f9f18d30 ?? ???

STACK_TEXT:
8054a6c0 804f8b9d 00000003 8054aa1c 00000000 nt!RtlpBreakWithStatusInstruction
8054a70c 804f978a 00000003 f9f18d30 f9f18d30 nt!KiBugCheckDebugBreak+0x19
8054aaec 80541683 0000000a f9f18d30 00000002 nt!KeBugCheck2+0x574
8054aaec f9f18d30 0000000a f9f18d30 00000002 nt!KiTrap0E+0x233
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054ab7c 804f169e 815c5b48 81597610 815c5b48 +0xd30
8054abac f9c5d314 00000000 8182a0d8 80542310 nt!IopfCompleteRequest+0xa2
8054abc8 f9a4c712 0000000c 818165d4 81597734 kbdclass!KeyboardClassServiceCallback+0x182
8054ac2c 80542b8d 8182a284 0182a020 00000000 i8042prt!I8042KeyboardIsrDpc+0xf0
8054ac50 80542b06 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46
8054ac54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26


STACK_COMMAND: kb

FOLLOWUP_IP:
key+d30
f9f18d30 ?? ???

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: key+d30

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: key

IMAGE_NAME: key.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_key+d30

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_key+d30

Followup: MachineOwner
---------
期待回答。。

Re: 求助：DRIVER_IRQL_NOT_LESS_OR_EQUAL错误

---

maxsjm 2011-05-28, 11:55 上午
再问一个问题：一个驱动向I/O管理器注册了一个完成函数，当把这个驱动生成的过滤设备解除绑定并删除后，这个完成函数还起作用吗？

Re: 求助：DRIVER_IRQL_NOT_LESS_OR_EQUAL错误

---

格蠹老雷 2011-05-28, 22:39 下午
这个蓝屏充分证明还起作用啊 :-)
这样的过滤驱动通常不要单独卸载，不然的话要谨慎的维护RemoveLock，参见toaster\filter\filter.c