阅读:1772回复:1
TDI过滤卸载蓝屏(急)
tdi过滤
参考了tdifw1.4.4 上网查询了下 两种方式的过滤都试过,在建立过滤对象机制中会出现蓝屏,网上是说在卸载的时候还会有irp过来,导致蓝屏。 而使用hook则不会出现这种情况。 但是我修改了代码发现hook也是会出现蓝屏的。 我考虑了下发现如果在hook模式,也会出现irp信息送过来的问题撒,不知道我这想法正确不 DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: f73acdd0, memory referenced Arg2: d0000002, IRQL Arg3: 00000008, value 0 = read operation, 1 = write operation Arg4: f73acdd0, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: f73acdd0 CURRENT_IRQL: 2 FAULTING_IP: JAHT_NET_MON>+dd0 f73acdd0 ?? ??? CUSTOMER_CRASH_COUNT: 12 DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP BUGCHECK_STR: 0xD1 PROCESS_NAME: Idle TRAP_FRAME: 80894360 -- (.trap 0xffffffff80894360) ErrCode = 00000010 eax=00000000 ebx=00000000 ecx=82017902 edx=820179bc esi=82017928 edi=8201799b eip=f73acdd0 esp=808943d4 ebp=80894400 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 <Unloaded_JAHT_NET_MON>+0xdd0: f73acdd0 ?? ??? Resetting default scope |
|
沙发#
发布于:2011-09-16 12:54
哪种方式都蓝屏吧 。360 卸载后仍然保留驱动,重启后则卸载驱动
|
|
|