|
写了一个遍历内核EPROCESS 链表取得PEB并读取进程路径的驱动
使用了KeAttachProcess这样的切换进程函数，偶然的情况下驱动会蓝屏，出现
IRQL_NOT_LESS_OR_EQUAL (a)
CURRENT_IRQL: 1c
这个IRQL的中断看资料是时间硬件中断，不解，代码是如何进入这个中断级别的，该如何防止。暂时在KeAttachProcess与KeDetachProcess代码之间增加了对当前IRQL的判断以避免，但是这个蓝屏出现几率不是很高，也不知道这样是否能解决问题。
请教高手也来参详一下，多谢了！
以下附上详细的Crach Dump:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f9913, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 00000000
CURRENT_IRQL: 1c
FAULTING_IP:
nt!KeStartThread+11
804f9913 8b10 mov edx,dword ptr [eax]
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
MISALIGNED_IP:
nt!KeStartThread+11
804f9913 8b10 mov edx,dword ptr [eax]
LAST_CONTROL_TRANSFER: from 804f9a20 to 804f9913
STACK_TEXT:
b2fb5658 804f9a20 89583020 8945c020 8945c000 nt!KeStartThread+0x11
b2fb5678 b2ee037a 8945c000 89db2660 895086c0 nt!RtlAppendUnicodeToString+0x2f
WARNING: Stack unwind information not available. Following frames may be wrong.
b2fb56b0 b2edfb20 89676da0 89040000 00040000 Freezer+0x237a
b2fb56ec 804f0095 89676ce8 8b788f68 806e5428 Freezer+0x1b20
b2fb5720 8057f70a 8b788fd8 894fbaa0 8b788f68 nt!CcAcquireByteRangeForWrite+0x726
b2fb5734 8058056d 89676ce8 8b788f68 894fbaa0 nt!NtImpersonateThread+0xda
b2fb57d0 805790c2 00000f58 00000000 00000000 nt!NtQueryObject+0x107
b2fb5804 8054186c 00000f58 00000000 00000000 nt!NtCreateMutant+0x89
b2fb5834 7c90eb94 badb0d00 0012d9c4 00000000 nt!RtlIpv6StringToAddressA+0x17f
b2fb5844 0117ee48 b2fb58d0 8c17effc 8c17ee48 0x7c90eb94
00000000 00000000 00000000 00000000 00000000 0x117ee48
STACK_COMMAND: kb
FOLLOWUP_IP:
Freezer+237a
b2ee037a ?? ???
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Freezer+237a
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
BUCKET_ID: IP_MISALIGNED
Followup: MachineOwner
---------
|