Пожалуйста, подскажите, что здесь не так. Код (Text): QueryPnpDeviceState proc uses esi edi ebx pDeviceObject:PDEVICE_OBJECT local iosb:IO_STATUS_BLOCK mov esi, pDeviceObject assume esi:ptr DEVICE_OBJECT .if ( esi != NULL && [esi]._Type == IO_TYPE_DEVICE ) movzx eax, [esi].StackSize invoke IoAllocateIrp, eax, FALSE assume esi:nothing .if eax != NULL mov edi, eax assume edi:ptr _IRP mov [edi].IoStatus.Status, STATUS_NOT_SUPPORTED and [edi].IoStatus.Information, 0 mov iosb.Status, STATUS_NOT_SUPPORTED and iosb.Information, 0 lea eax, iosb mov [edi].UserIosb, eax assume edi:nothing IoGetNextIrpStackLocation edi mov ebx, eax assume ebx:ptr IO_STACK_LOCATION mov [ebx].MajorFunction, IRP_MJ_PNP mov [ebx].MinorFunction, IRP_MN_QUERY_PNP_DEVICE_STATE assume ebx:nothing invoke IoCallDriver, esi, edi .endif .endif ret QueryPnpDeviceState endp DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING local status:NTSTATUS mov status, STATUS_DEVICE_CONFIGURATION_ERROR invoke IoCreateDevice, pDriverObject, sizeof FiDO_DEVICE_EXTENSION, addr g_usDeviceName, FILE_DEVICE_UNKNOWN, \ 0, FALSE, addr KeyDeviceObject .if eax == STATUS_SUCCESS invoke IoCreateSymbolicLink, addr g_usSymbolicLinkName, addr g_usDeviceName .if eax == STATUS_SUCCESS invoke IoGetDeviceObjectPointer, addr g_usTargetDeviceName, FILE_READ_DATA, \ addr pTargetFileObject, addr pTargetDeviceObject mov eax, pDriverObject assume eax:PTR DRIVER_OBJECT mov ecx, IRP_MJ_MAXIMUM_FUNCTION + 1 .while ecx dec ecx mov [eax].MajorFunction[ecx*(sizeof PVOID)], offset DriverDispatch .endw mov [eax].DriverUnload, offset DriverUnload assume eax:nothing ;;; invoke QueryValueKey ;; invoke IoAttachDeviceToDeviceStack, KeyDeviceObject, pTargetDeviceObject ;;; .if eax != NULL and gggfSpy, TRUE mov edx, eax ; Fill filter device object extension mov ecx, KeyDeviceObject mov eax, (DEVICE_OBJECT ptr [ecx]).DeviceExtension assume eax:ptr FiDO_DEVICE_EXTENSION mov [eax].pNextLowerDeviceObject, edx push pTargetFileObject pop [eax].pTargetFileObject assume eax:nothing assume edx:ptr DEVICE_OBJECT assume ecx:ptr DEVICE_OBJECT mov eax, [edx].DeviceType mov [ecx].DeviceType, eax mov eax, [edx].Flags and eax, DO_DIRECT_IO + DO_BUFFERED_IO + DO_POWER_PAGABLE or [ecx].Flags, eax and [ecx].Flags, not DO_DEVICE_INITIALIZING assume edx:nothing assume ecx:nothing invoke QueryPnpDeviceState, pTargetDeviceObject