阅读:2667回复:0
请高手帮忙解答,在做透明加密驱动的时候,启动透明加密驱动就出来蓝屏,查看dump文件如下,帮忙看看什么问题
0: kd> !analyze -v
******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (d4) A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc. The broken driver's name is displayed on the screen. When possible, the guilty driver's name (Unicode string) is printed on the bugcheck screen and saved in KiBugCheckDriver. An attempt was made to access the driver at raised IRQL after it unloaded. If kernel debugger is available get stack backtrace. Arguments: Arg1: a8f79a58, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: 805383e2, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: a8f79a58 CURRENT_IRQL: 2 FAULTING_IP: nt!ExpScanGeneralLookasideList+1e 805383e2 8b51e0 mov edx,dword ptr [ecx-20h] DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xD4 PROCESS_NAME: System TRAP_FRAME: ba52bca8 -- (.trap 0xffffffffba52bca8) ErrCode = 00000000 eax=00000000 ebx=00000040 ecx=a8f79a78 edx=00000000 esi=00000000 edi=00000004 eip=805383e2 esp=ba52bd1c ebp=ba52bd2c iopl=0 nv up ei pl nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206 nt!ExpScanGeneralLookasideList+0x1e: 805383e2 8b51e0 mov edx,dword ptr [ecx-20h] ds:0023:a8f79a58=???????? Resetting default scope LAST_CONTROL_TRANSFER: from 805383e2 to 805456f0 STACK_TEXT: ba52bca8 805383e2 badb0d00 00000000 00000000 nt!KiTrap0E+0x238 ba52bd2c 805389ae 80565c50 80565c48 80540f73 nt!ExpScanGeneralLookasideList+0x1e ba52bd38 80540f73 00000000 8a5f47d0 00000000 nt!ExAdjustLookasideDepth+0x32 ba52bdac 805d0f70 00000000 00000000 00000000 nt!KeBalanceSetManager+0x8d ba52bddc 805470ee 80540ee6 00000000 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!ExpScanGeneralLookasideList+1e 805383e2 8b51e0 mov edx,dword ptr [ecx-20h] SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!ExpScanGeneralLookasideList+1e FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrpamp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3 FAILURE_BUCKET_ID: 0xD4_nt!ExpScanGeneralLookasideList+1e BUCKET_ID: 0xD4_nt!ExpScanGeneralLookasideList+1e Followup: MachineOwner --------- |
|