shar123
驱动牛犊
驱动牛犊
  • 注册日期2009-05-12
  • 最后登录2009-10-09
  • 粉丝0
  • 关注0
  • 积分59分
  • 威望461点
  • 贡献值0点
  • 好评度0点
  • 原创分0分
  • 专家分0分
阅读:2031回复:2

请帮我看看错误

楼主#
更多 发布于:2009-06-04 16:24
我创建设备绑定到硬盘的所有分区上,但是却出现这个错误
SXS: BasepSxsCreateFileStream() NtOpenFile(\??\C:\WINDOWS\system32\svchost.exe.Manifest) failed
SXS: BasepSxsCreateFileStream() NtOpenFile(\??\C:\WINDOWS\system32\svchost.exe.Manifest)
现象是当打开文件的时候,操作系统最下面(状态栏中)没有所打开对象的标签

请大家帮我分析分析


Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


PROCESS_NAME:  Idle

FAULTING_IP:
nt!RtlpBreakWithStatusInstruction+0
80528bdc cc              int     3

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 80528bdc (nt!RtlpBreakWithStatusInstruction)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 3
   Parameter[0]: 00000000
   Parameter[1]: 8054bd4c
   Parameter[2]: 000003f8

ERROR_CODE: (NTSTATUS) 0x80000003 - {

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - <Unable to get error code text>

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  8054bd4c

EXCEPTION_PARAMETER3:  000003f8

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x0

STACK_TEXT:  
8054abac 8054209d 00000001 86df3a02 000000d1 nt!RtlpBreakWithStatusInstruction
8054abac ba9ca162 00000001 86df3a02 000000d1 nt!KeUpdateSystemTime+0x165
8054ac50 80542af0 00000000 0000000e 00000000 intelppm!AcpiC1Idle+0x12
8054ac54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x10


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!RtlpBreakWithStatusInstruction+0
80528bdc cc              int     3

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!RtlpBreakWithStatusInstruction+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4802516a

BUCKET_ID:  MANUAL_BREAKIN

Followup: MachineOwner

我该从哪里下手啊  
uljtg
驱动牛犊
驱动牛犊
  • 注册日期2006-03-23
  • 最后登录2011-12-03
  • 粉丝0
  • 关注0
  • 积分19分
  • 威望210点
  • 贡献值0点
  • 好评度46点
  • 原创分0分
  • 专家分0分
沙发#
发布于:2009-06-05 12:35
没有代码谁也帮不了你
shar123
驱动牛犊
驱动牛犊
  • 注册日期2009-05-12
  • 最后登录2009-10-09
  • 粉丝0
  • 关注0
  • 积分59分
  • 威望461点
  • 贡献值0点
  • 好评度0点
  • 原创分0分
  • 专家分0分
板凳#
发布于:2009-06-05 17:00
不好意思 现在补上
NTSTATUS DriverEntry(    IN PDRIVER_OBJECT DriverObject,    IN PUNICODE_STRING RegistryPath )
{
    int i;
    NTSTATUS status;
    UNICODE_STRING nameString;
    UNICODE_STRING DosNameLink;
    PDEVICE_OBJECT FilterDevice;
    WCHAR          filename[] = L"\\DosDevices\\A:\\";
    
    KdPrint(("DriverEntry: DriverObject->DriverName======== %s\n",&(DriverObject->DriverName)));
    
    //首先创建一个CDO
    RtlInitUnicodeString(&nameString, L"\\Device\\FileEncipter");
    status = IoCreateDevice(
                            DriverObject,
                            0,
                            &nameString,
                            FILE_DEVICE_DISK_FILE_SYSTEM,
                            FILE_DEVICE_SECURE_OPEN,
                            FALSE,
                            &g_CDO    
                            );
    if (!NT_SUCCESS(status))
    {
        KdPrint(("DriverEntry:Error Create cdo, status = %08x\n", status));
        return status;
    }    
    
    g_CDO->Flags |= DO_DIRECT_IO;
  g_CDO->Flags &= ~DO_DEVICE_INITIALIZING;
    
    for (i=0; i<=IRP_MJ_MAXIMUM_FUNCTION; i++)
    {
        DriverObject->MajorFunction = SfPassThrough;
    }
    
    DriverObject->DriverUnload = DriverUnload;

    RtlInitUnicodeString(&DosNameLink,L"\\DosDevices\\FileEncipter");    
  status=IoCreateSymbolicLink(&DosNameLink,&nameString);
  if (!NT_SUCCESS(status))
    {
        KdPrint(("DriverEntry:Error IoCreateSymbolicLink, status = %08x\n", status));
        return status;
    }        
    
                     //FastIO中的所有函数我让它都只返回FALSE
     InitFastIo(DriverObject);

  i = 2;
    {
         filename[12] = (CHAR)('A'+i);
         FilterDevice = NULL;
         RtlInitUnicodeString(&nameString, filename);
         if (!AttachToDiskDevice(&nameString, &FilterDevice))
       {
           KdPrint(("Filemon: 绑定驱动器 %c失败\n", 'A'+i ));
           if(FilterDevice!=NULL)
           IoDeleteDevice(FilterDevice);
       }
       else
       {    
       KdPrint(("Filemon: 成功绑定驱动器 %c\n", 'A'+i ));
     }  
     }
/*-----------------------------------------------------------------*/

绑定函数是

BOOLEAN AttachToDiskDevice(IN PUNICODE_STRING pDiskName, OUT PDEVICE_OBJECT *pOurDevice)
{
    int               i;
    NTSTATUS          status;
    PDEVICE_EXTENSION DevEx;
    PDEVICE_OBJECT    DiskDeviceObject,pDevice;
    PDEVICE_OBJECT    NewDeviceObject;

    IO_STATUS_BLOCK    ioStatus;
    OBJECT_ATTRIBUTES  objectAttributes;
    PFILE_OBJECT       fileObject = NULL;
    HANDLE             ntFileHandle;
    
    InitializeObjectAttributes(&objectAttributes, pDiskName, OBJ_CASE_INSENSITIVE, NULL, NULL );
    status = ZwCreateFile(&ntFileHandle, SYNCHRONIZE|FILE_ANY_ACCESS,
                            &objectAttributes, &ioStatus, NULL, 0,
                            FILE_SHARE_READ|FILE_SHARE_WRITE,
                            FILE_OPEN, FILE_SYNCHRONOUS_IO_NONALERT|FILE_DIRECTORY_FILE,
                            NULL, 0);
    if (!NT_SUCCESS(status))
    {
        KdPrint(("AttachToDiskDevice: Could not open drive\n"));
        return FALSE;
    }
    KdPrint(("AttachToDiskDevice:Open Device is OK ,status = %08x\n",status));
    
    status = ObReferenceObjectByHandle(ntFileHandle, FILE_READ_DATA, NULL, KernelMode, &fileObject, NULL);
    if(!NT_SUCCESS(status))
    {
        KdPrint(("AttachToDiskDevice: Could not get fileobject from handle\n"));
        ZwClose(ntFileHandle);
        return FALSE;            
    }
    KdPrint(("AttachToDiskDevice:Get reference object handle OK ,status = %08x\n",status));

    DiskDeviceObject = IoGetRelatedDeviceObject(fileObject);
    if(!DiskDeviceObject)
    {
        KdPrint(("AttachToDiskDevice: Could not get related device object\n"));
        goto ErrHand;
    }
    
    
    //创建挂载设备
    status = IoCreateDevice(g_CDO->DriverObject,
                            sizeof(DEVICE_EXTENSION),
                            NULL,
                            DiskDeviceObject->DeviceType,
                            FILE_DEVICE_SECURE_OPEN,
                            FALSE,
                            &NewDeviceObject
                            );
    if (!NT_SUCCESS(status))
    {
        goto ErrHand;
    }    
    
    NewDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
    
    *pOurDevice = NewDeviceObject;

    DevEx = NewDeviceObject->DeviceExtension;
    DevEx->PhysicDevice = DiskDeviceObject;
    DevEx->DeviceName.Length = 0;
    DevEx->DeviceName.MaximumLength = sizeof(DevEx->DeviceNameBuffer);
    DevEx->DeviceName.Buffer = DevEx->DeviceNameBuffer;
    SfGetObjectName(g_CDO, &(DevEx->DeviceName));

    //执行挂载
    DevEx->AttachedToDevice = IoAttachDeviceToDeviceStack(NewDeviceObject, DiskDeviceObject);
    if (!DevEx->AttachedToDevice)
    {
        goto ErrHand;
    }

    KdPrint(("AttachToDiskDevice:Attath Device is OK\n"));
    ObDereferenceObject(fileObject);
    ZwClose(ntFileHandle);
    return TRUE;

ErrHand:
    KdPrint(("AttachToDiskDevice:AttachDevice Failed status %08x\n", status));
    ObDereferenceObject(fileObject);
    ZwClose(ntFileHandle);
    return  FALSE;
}

    return status;
}

默认分发函数是
NTSTATUS SfPassThrough(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    IoSkipCurrentIrpStackLocation(Irp);
    return IoCallDriver(((PDEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedToDevice, Irp);
}
游客

返回顶部