Reply To: TDI FILTER driver

Home Forums Discussions General TDI FILTER driver Reply To: TDI FILTER driver

#6328
Dmitry_177
Participant

    Вот, вроде получилось:

    kd> !analyze -v
    
    *******************************************************************************
    
    *                                                                             *
    
    *                        Bugcheck Analysis                                    *
    
    *                                                                             *
    
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    
    An attempt was made to access a pageable (or completely invalid) address at an
    
    interrupt request level (IRQL) that is too high.  This is usually
    
    caused by drivers using improper addresses.
    
    If kernel debugger is available get stack backtrace.
    
    Arguments:
    
    Arg1: 7eec42a7, memory referenced
    
    Arg2: 00000002, IRQL
    
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    
    Arg4: ffa68b9c, address which referenced memory
    
    Debugging Details:
    
    WRITE_ADDRESS:  7eec42a7
    
    CURRENT_IRQL:  2
    
    FAULTING_IP:
    
    +ffffffffffa68b9c
    
    ffa68b9c 888cbcff000000  mov     byte ptr [esp+edi*4+0FFh],cl
    
    DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  Idle
    
    TRAP_FRAME:  805487d4 -- (.trap ffffffff805487d4)
    
    ErrCode = 00000002
    
    eax=ffa68b94 ebx=00000a20 ecx=80eef1b8 edx=ffa780a0 esi=80dd5e70 edi=ffa5ee58
    
    eip=ffa68b9c esp=80548848 ebp=8054887c iopl=0         ov up ei pl nz ac pe cy
    
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010a17
    
    ffa68b9c 888cbcff000000  mov     byte ptr [esp+edi*4+0FFh],cl ss:0010:7eec42a7=??
    
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from 804f79d7 to 80526fc8
    
    STACK_TEXT:
    
    80548388 804f79d7 00000003 805486e4 00000000 nt!RtlpBreakWithStatusInstruction
    
    805483d4 804f85c4 00000003 7eec42a7 ffa68b9c nt!KiBugCheckDebugBreak+0x19
    
    805487b4 8053fa73 0000000a 7eec42a7 00000002 nt!KeBugCheck2+0x574
    
    805487b4 ffa68b9c 0000000a 7eec42a7 00000002 nt!KiTrap0E+0x233
    
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    
    80548844 fb0e9c1f ffa68b94 80eef1b8 00000a20 0xffa68b9c
    
    8054887c f92a362d ffa780a0 80eef1b8 00000a20 tdifilter_testdriver+0xc1f
    
    805488e0 f92a8e39 80eef1b8 00001150 80548a00 tcpip!IndicateData+0x225
    
    80548968 f929cef5 ffbb9bf0 2201a8c0 fec12ecf tcpip!TCPRcv+0x160d
    
    805489c8 f92bae4d 00000020 ffbb9bf0 f929f076 tcpip!DeliverToUser+0x18e
    
    80548a7c f929b922 ffbb9bf0 fa536822 00000134 tcpip!IPRcvPacket+0x670
    
    80548abc f929b84d 00000000 ffb419b8 fa536800 tcpip!ARPRcvIndicationNew+0x149
    
    80548af8 fa895c9f ffbba008 00000000 fa717b40 tcpip!ARPRcvPacket+0x68
    
    80548b4c fa71201d 00b40c88 ffb81150 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x1c2
    
    80548b60 fa7121b4 ffb567a0 ffb81150 00000001 psched!PsFlushReceiveQueue+0x15
    
    80548b84 fa7125f9 ffb3b158 00000000 ffb567a0 psched!PsEnqueueReceivePacket+0xda
    
    80548b9c fa895d40 ffb3b150 80f26008 80f26014 psched!ClReceiveComplete+0x13
    
    80548bec fae05387 00b40c88 80548e0c 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x5a4
    
    80549014 fa88bf09 80f26008 80551d80 80551b20 vmxnet+0x2387
    
    8054902c 80540f7d 80f264bc 80f264a8 00000000 NDIS!ndisMDpcX+0x21
    
    80549050 80540ef6 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46
    
    80549054 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP:
    
    tdifilter_testdriver+c1f
    
    fb0e9c1f 8945f4          mov     dword ptr [ebp-0Ch],eax
    
    SYMBOL_STACK_INDEX:  5
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: tdifilter_testdriver
    
    IMAGE_NAME:  tdifilter_testdriver.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  469b8e19
    
    SYMBOL_NAME:  tdifilter_testdriver+c1f
    
    FAILURE_BUCKET_ID:  0xD1_W_tdifilter_testdriver+c1f
    
    BUCKET_ID:  0xD1_W_tdifilter_testdriver+c1f
    
    Followup: MachineOwner