阅读:1382回复:5
过滤驱动在卡巴斯基下运行黑屏
写了个对某个目录文件过滤的驱动,在装有卡巴斯基的机器上一运行就黑屏,大家有知道是怎么回事吗,怎么解决
|
|
沙发#
发布于:2008-11-18 14:02
有路过了解的人能帮看下吗,先行谢过了
|
|
板凳#
发布于:2008-11-18 14:03
这是DUMP文件调试信息:
SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (d4) A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc. The broken driver's name is displayed on the screen. When possible, the guilty driver's name (Unicode string) is printed on the bugcheck screen and saved in KiBugCheckDriver. An attempt was made to access the driver at raised IRQL after it unloaded. If kernel debugger is available get stack backtrace. Arguments: Arg1: f7b91450, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: 804e73a1, address which referenced memory Debugging Details: ------------------ ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* MODULE_NAME: nt FAULTING_MODULE: 804d8000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 48a4023c READ_ADDRESS: unable to get nt!MmSpecialPoolStart unable to get nt!MmSpecialPoolEnd unable to get nt!MmPoolCodeStart unable to get nt!MmPoolCodeEnd f7b91450 CURRENT_IRQL: 2 FAULTING_IP: nt!KeInitializeDpc+93b 804e73a1 8b56e0 mov edx,[esi-0x20] DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xD4 LAST_CONTROL_TRANSFER: from 804e73a1 to 804e287f STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. f7a3dca8 804e73a1 badb0d00 00000000 00000000 nt!Kei386EoiHelper+0x2823 f7a3dd2c 804e73ef 80562af0 80562ae8 804e65fc nt!KeInitializeDpc+0x93b f7a3ddac 8057e17b 00000000 00000000 00000000 nt!KeInitializeDpc+0x989 f7a3dddc 804f927a 804e657a 00000000 00000000 nt!PsCreateSystemThread+0x70 00000000 00000000 00000000 00000000 00000000 nt!KeInitializeTimer+0x107 STACK_COMMAND: .bugcheck ; kb FOLLOWUP_NAME: MachineOwner BUCKET_ID: WRONG_SYMBOLS Followup: MachineOwner --------- |
|
地板#
发布于:2008-11-18 17:48
顶一下
|
|
地下室#
发布于:2008-11-18 22:44
Useless dump info. Fix your symbol path first.
|
|
5楼#
发布于:2008-11-19 14:59
dump文件里看不出来什么东西, 没列出来
卡巴应该也有filter driver, 是互操作不知道哪里出问题了 dbg看一下, |
|
|