Пытаюсь узнать имя процесса по PID. В случайном порядке вываливается в БСОД 7F. Уже весь мозг сломал, пытаясь понять в чем дело, похоже, где-то портится стек. Может кто со свежим взглядом найдет ошибку.. Код (Text): PVOID GetProcessSectionObject(IN PEPROCESS peproc) { PVOID result = NULL; ULONG_PTR PseudoEPROC[300]; ULONG_PTR offset; DWORD32 i; for (i = 0; i < 300; i++) PseudoEPROC[i] = i; offset = (ULONG_PTR) PsGetProcessSectionBaseAddress((PEPROCESS) &PseudoEPROC); offset *= sizeof(ULONG_PTR); offset -= sizeof(PVOID); result = *((PSECTION_OBJECT*)((ULONG)peproc + offset)); return result; } VOID GetProcessEXEName(IN ULONG pid, OUT PWCHAR ExeName) { NTSTATUS Status; PSECTION_OBJECT SectionObj; PFILE_OBJECT FileObj; PEPROCESS pEproc; POBJECT_NAME_INFORMATION ObName = NULL; Status = PsLookupProcessByProcessId((HANDLE)pid, &pEproc); if (NT_SUCCESS(Status)) { SectionObj = (PSECTION_OBJECT)GetProcessSectionObject(pEproc); if (SectionObj) { if (SectionObj->Segment) { if (((PSEGMENT)SectionObj->Segment)->ControlArea) { FileObj = ((PSEGMENT)SectionObj->Segment)->ControlArea->FilePointer; if (FileObj) { if (FileObj->FileName.Buffer) { ExAcquireFastMutex(&GlobalData->Mutex); Status = VdoToVolumeLabel(FileObj->DeviceObject->Vpb->RealDevice, ExeName); ExReleaseFastMutex(&GlobalData->Mutex); if (NT_SUCCESS(Status)) RtlStringCchCatNW(ExeName, 260, FileObj->FileName.Buffer, FileObj->FileName.Length); else RtlStringCchCopyNW(ExeName, 260, FileObj->FileName.Buffer, FileObj->FileName.Length); } } } } } ObDereferenceObject(pEproc); if (!ExeName[0]) RtlStringCchCopyW(ExeName, 260, L"System"); } } Код (Text): !analyze -v UNEXPECTED_KERNEL_MODE_TRAP (7f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate use .tss on the part before the colon, then kv. Else if kv shows a trapframe use .trap on that value Else .trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap) Endif kb will then show the corrected stack. Arguments: Arg1: 00000008, EXCEPTION_DOUBLE_FAULT Arg2: 80042000 Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ BUGCHECK_STR: 0x7f_8 TSS: 00000028 -- (.tss 0x28) eax=00000000 ebx=81fcaaf0 ecx=e1000884 edx=81b9f020 esi=81dd0b10 edi=81f2f330 eip=b2401e29 esp=b2905f18 ebp=b29063d8 iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 DiskSpy!GetProcessSectionObject+0x9: b2401e29 c78540fbffff00000000 mov dword ptr [ebp-4C0h],0 ss:0010:b2905f18=???????? Resetting default scope DEFAULT_BUCKET_ID: DRIVER_FAULT PROCESS_NAME: VMwareUser.exe LAST_CONTROL_TRANSFER: from b2401ee1 to b2401e29 STACK_TEXT: b29063d8 b2401ee1 81b9f020 81b9f020 00000000 DiskSpy!GetProcessSectionObject+0x9 [f:\programming\diskspy\diskspy.cpp @ 908] b29063f8 b24012c9 00000720 b2906414 00000003 DiskSpy!GetProcessEXEName+0x31 [f:\programming\diskspy\diskspy.cpp @ 933] b290682c b24053e3 81f2f320 00000000 81e8f648 DiskSpy!StartLogIrp+0x59 [f:\programming\diskspy\diskspy.cpp @ 662] b2906854 804ee119 81e8f590 81f2f320 81f2f320 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b2906864 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b290689c 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b29068b8 80522bc1 81fcaaf0 00000000 81b62e58 nt!ObpRemoveObjectRoutine+0xe0 b29068dc b240134b 00000003 81e8f648 81b62fd8 nt!ObfDereferenceObject+0x5f b2906d08 b24053e3 81b62e48 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b2906d30 804ee119 81e8f590 81b62e48 81b62e48 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b2906d40 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2906d78 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2906d94 80522bc1 81fcaaf0 00000000 81f47600 nt!ObpRemoveObjectRoutine+0xe0 b2906db8 b240134b 00000003 81e8f648 81f47780 nt!ObfDereferenceObject+0x5f b29071e4 b24053e3 81f475f0 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b290720c 804ee119 81e8f590 81f475f0 81f475f0 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b290721c 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2907254 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2907270 80522bc1 81fcaaf0 00000000 81f2e630 nt!ObpRemoveObjectRoutine+0xe0 b2907294 b240134b 00000003 81e8f648 81f2e7b0 nt!ObfDereferenceObject+0x5f b29076c0 b24053e3 81f2e620 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b29076e8 804ee119 81e8f590 81f2e620 81f2e620 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b29076f8 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2907730 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b290774c 80522bc1 81fcaaf0 00000000 81f47e58 nt!ObpRemoveObjectRoutine+0xe0 b2907770 b240134b 00000003 81e8f648 81f47fd8 nt!ObfDereferenceObject+0x5f b2907b9c b24053e3 81f47e48 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b2907bc4 804ee119 81e8f590 81f47e48 81f47e48 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b2907bd4 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2907c0c 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2907c28 80522bc1 81fcaaf0 00000000 81c71a38 nt!ObpRemoveObjectRoutine+0xe0 b2907c4c b240134b 00000003 81e8f648 81c71bb8 nt!ObfDereferenceObject+0x5f b2908078 b24053e3 81c71a28 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b29080a0 804ee119 81e8f590 81c71a28 81c71a28 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b29080b0 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b29080e8 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2908104 80522bc1 81fcaaf0 00000000 81f3c388 nt!ObpRemoveObjectRoutine+0xe0 b2908128 b240134b 00000003 81e8f648 81f3c508 nt!ObfDereferenceObject+0x5f b2908554 b24053e3 81f3c378 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b290857c 804ee119 81e8f590 81f3c378 81f3c378 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b290858c 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b29085c4 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b29085e0 80522bc1 81fcaaf0 00000000 81e68e58 nt!ObpRemoveObjectRoutine+0xe0 b2908604 b240134b 00000003 81e8f648 81e68fd8 nt!ObfDereferenceObject+0x5f b2908a30 b24053e3 81e68e48 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b2908a58 804ee119 81e8f590 81e68e48 81e68e48 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b2908a68 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2908aa0 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2908abc 80522bc1 81fcaaf0 00000000 81b76480 nt!ObpRemoveObjectRoutine+0xe0 b2908ae0 b240134b 00000003 81e8f648 81b76600 nt!ObfDereferenceObject+0x5f b2908f0c b24053e3 81b76470 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b2908f34 804ee119 81e8f590 81b76470 81b76470 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b2908f44 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2908f7c 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2908f98 80522bc1 81fcaaf0 00000000 81cd9018 nt!ObpRemoveObjectRoutine+0xe0 b2908fbc b240134b 00000003 81e8f648 81cd9198 nt!ObfDereferenceObject+0x5f b29093e8 b24053e3 81cd9008 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b2909410 804ee119 81e8f590 81cd9008 81cd9008 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b2909420 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2909458 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2909474 80522bc1 81fcaaf0 00000000 81f44870 nt!ObpRemoveObjectRoutine+0xe0 b2909498 b240134b 00000003 81e8f648 81f449f0 nt!ObfDereferenceObject+0x5f b29098c4 b24053e3 81f44860 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b29098ec 804ee119 81e8f590 81f44860 81f44860 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b29098fc 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2909934 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2909950 80522bc1 81fcaaf0 00000000 81cff8a8 nt!ObpRemoveObjectRoutine+0xe0 b2909974 b240134b 00000003 81e8f648 81cffa28 nt!ObfDereferenceObject+0x5f b2909da0 b24053e3 81cff898 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] b2909dc8 804ee119 81e8f590 81cff898 81cff898 DiskSpy!DispatchMonitoring+0x73 [f:\programming\diskspy\diskspy.cpp @ 124] b2909dd8 80578eea 81fcaad8 00000000 00000000 nt!IopfCallDriver+0x31 b2909e10 805b0a8a 00fcaaf0 81fcaad8 00000000 nt!IopDeleteFile+0x132 b2909e2c 80522bc1 81fcaaf0 00000000 81f2d988 nt!ObpRemoveObjectRoutine+0xe0 b2909e50 b240134b 00000003 81e8f648 81f2db08 nt!ObfDereferenceObject+0x5f b290a27c b24053e3 81f2d978 00000000 81e8f648 DiskSpy!StartLogIrp+0xdb [f:\programming\diskspy\diskspy.cpp @ 673] STACK_COMMAND: .tss 0x28 ; kb FOLLOWUP_IP: DiskSpy!GetProcessSectionObject+9 [f:\programming\diskspy\diskspy.cpp @ 908] b2401e29 c78540fbffff00000000 mov dword ptr [ebp-4C0h],0 FAULTING_SOURCE_CODE: 904: 905: 906: PVOID GetProcessSectionObject(IN PEPROCESS peproc) 907: { > 908: PVOID result = NULL; 909: ULONG_PTR PseudoEPROC[300]; 910: ULONG_PTR offset; 911: DWORD32 i; 912: 913: for (i = 0; i < 300; i++) SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: DiskSpy!GetProcessSectionObject+9 FOLLOWUP_NAME: MachineOwner MODULE_NAME: DiskSpy IMAGE_NAME: DiskSpy.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4e67030a FAILURE_BUCKET_ID: 0x7f_8_DiskSpy!GetProcessSectionObject+9 BUCKET_ID: 0x7f_8_DiskSpy!GetProcessSectionObject+9
1. На стек вызовов обрати внимание. 2. Секция в объекте процесса типа SECTION. 3. Выгружаемость секций кода не играет, здесь обычно irql=0.
Код (Text): PLOG_RECORD StartLogIrp(PIRP Irp) { PLOG_RECORD LogRecord; PRECORD_IRP RecordIrp; WCHAR FilePath[260]; WCHAR Proc[260]; POBJECT_NAME_INFORMATION ObInfo = NULL; PIO_STACK_LOCATION Stack = IoGetCurrentIrpStackLocation(Irp); PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION) Stack->DeviceObject->DeviceExtension; FilePath[0] = L'\0'; Proc[0] = L'\0'; GetProcessEXEName((ULONG) PsGetCurrentProcessId(), Proc); if (Stack->FileObject) { ObReferenceObject(Stack->FileObject); if (Stack->FileObject->FileName.Buffer) { RtlStringCchCopyNW(FilePath, 260, pdx->VolumeName, 8); RtlStringCchCatNW(FilePath, 260, Stack->FileObject->FileName.Buffer, Stack->FileObject->FileName.Length); } ObDereferenceObject(Stack->FileObject); } if (GlobalData->Filtering) { if (!wcsstr(FilePath, GlobalData->PathForFiltering)) return NULL; } LogRecord = (PLOG_RECORD) ExAllocatePoolWithTag(NonPagedPool, sizeof(LOG_RECORD), 32); if (!LogRecord) return NULL; memset(LogRecord, 0, sizeof(LOG_RECORD)); RtlStringCchCopyNW(LogRecord->FilePath, 260, FilePath, 260); RtlStringCchCopyNW(LogRecord->ProcessName, 260, Proc, 260); LogRecord->Type = RECORD_LOG_IRP; LogRecord->Next = NULL; RecordIrp = &LogRecord->Record.RecordIrp; RecordIrp->IrpMj = Stack->MajorFunction; RecordIrp->IrpMn = Stack->MinorFunction; RecordIrp->IrpFlags = Irp->Flags; RecordIrp->ThreadID = (ULONG) PsGetCurrentThreadId(); return LogRecord; }
rttgedt А зачем так сложно? Неужели вытащить из EPROCESS имя - религия не позволяет? Код (Text): pEproc->ImageFileName
TermoSINteZ, ведь для этого прописывать смещения нужно для структуры EPROCESS для всех возможных версий ОС. А такой вариант без особых хлопот будет (я надеюсь) работать на всех системах от ХР и старше. И в pEproc->ImageFileName храниться только короткое имя без пути, или я ошибаюсь?
rttgedt Нет, полного пути там не бывает. Если нужен полный, то тогда конечно этот вариант не подходит.
Для доступа к EPROCESS::ImageFileName не обязательно обращаться к полям структуры напрямую, можно использовать недокументированную ф-ию PsGetProcessImageFileName. В случае rttgedt это немного не то, но может кому-то пригодится. http://www.osronline.com/article.cfm?article=472 -- а это хорошая статья об альтернативном способе (комментарии только прочитайте, там есть не очень приятный момент).
