zhuimeng_cc
驱动牛犊
驱动牛犊
  • 注册日期2006-10-20
  • 最后登录2010-06-03
  • 粉丝0
  • 关注0
  • 积分149分
  • 威望66点
  • 贡献值1点
  • 好评度15点
  • 原创分0分
  • 专家分0分
阅读:2667回复:0

请高手帮忙解答,在做透明加密驱动的时候,启动透明加密驱动就出来蓝屏,查看dump文件如下,帮忙看看什么问题

楼主#
更多 发布于:2010-05-17 11:22
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (d4)
A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
An attempt was made to access the driver at raised IRQL after it unloaded.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: a8f79a58, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 805383e2, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  a8f79a58

CURRENT_IRQL:  2

FAULTING_IP:
nt!ExpScanGeneralLookasideList+1e
805383e2 8b51e0          mov     edx,dword ptr [ecx-20h]

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD4

PROCESS_NAME:  System

TRAP_FRAME:  ba52bca8 -- (.trap 0xffffffffba52bca8)
ErrCode = 00000000
eax=00000000 ebx=00000040 ecx=a8f79a78 edx=00000000 esi=00000000 edi=00000004
eip=805383e2 esp=ba52bd1c ebp=ba52bd2c iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!ExpScanGeneralLookasideList+0x1e:
805383e2 8b51e0          mov     edx,dword ptr [ecx-20h] ds:0023:a8f79a58=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 805383e2 to 805456f0

STACK_TEXT:  
ba52bca8 805383e2 badb0d00 00000000 00000000 nt!KiTrap0E+0x238
ba52bd2c 805389ae 80565c50 80565c48 80540f73 nt!ExpScanGeneralLookasideList+0x1e
ba52bd38 80540f73 00000000 8a5f47d0 00000000 nt!ExAdjustLookasideDepth+0x32
ba52bdac 805d0f70 00000000 00000000 00000000 nt!KeBalanceSetManager+0x8d
ba52bddc 805470ee 80540ee6 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExpScanGeneralLookasideList+1e
805383e2 8b51e0          mov     edx,dword ptr [ecx-20h]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExpScanGeneralLookasideList+1e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  498c11d3

FAILURE_BUCKET_ID:  0xD4_nt!ExpScanGeneralLookasideList+1e

BUCKET_ID:  0xD4_nt!ExpScanGeneralLookasideList+1e

Followup: MachineOwner
---------
游客

返回顶部