Код (Text): .386p option casemap:none .model flat, stdcall include \masm32\include\ntstatus.inc include \masm32\include\ntddk.inc include \masm32\include\ntoskrnl.inc include \masm32\include\ntddkbd.inc include \masm32\include\hal.inc includelib \masm32\lib\ntoskrnl.lib includelib \masm32\lib\hal.lib include \masm32\Macros\Strings.mac include common.inc .data CCOUNTED_UNICODE_STRING "\\Device\\KeyMouse", g_usDeviceName, 4 CCOUNTED_UNICODE_STRING "\\??\\KeyMouse", g_usSymbolicLinkName, 4 CCOUNTED_UNICODE_STRING "\\Device\\KeyboardClass0", g_usTargetDeviceName, 4 FALSE equ 0 TRUE equ 1 x dw ? y dw ? buttons dw ? KeyDeviceObject PDEVICE_OBJECT ? ;;;pTargetFileObject PFILE_OBJECT ? FiDO_DEVICE_EXTENSION STRUCT pNextLowerDeviceObject PDEVICE_OBJECT ? pTargetFileObject PFILE_OBJECT ? FiDO_DEVICE_EXTENSION ENDS PFiDO_DEVICE_EXTENSION typedef ptr FiDO_DEVICE_EXTENSION .code FiDO_DispatchPassThrough proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP IoSkipCurrentIrpStackLocation pIrp mov eax, pDeviceObject mov eax, (DEVICE_OBJECT ptr [eax]).DeviceExtension mov eax, (FiDO_DEVICE_EXTENSION ptr [eax]).pNextLowerDeviceObject invoke IoCallDriver, eax, pIrp ret FiDO_DispatchPassThrough endp DispatchCreateClose proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP mov eax, pIrp assume eax:ptr _IRP mov [eax].IoStatus.Status, STATUS_SUCCESS and [eax].IoStatus.Information, 0 assume eax:nothing fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT mov eax, STATUS_SUCCESS ret DispatchCreateClose endp CDO_DispatchDeviceControl proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP mov eax, pIrp assume eax:ptr _IRP mov [eax].IoStatus.Status, STATUS_SUCCESS and [eax].IoStatus.Information, 0 assume eax:nothing fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT mov eax, STATUS_SUCCESS ret CDO_DispatchDeviceControl endp DriverUnload proc pDriverObject:PDRIVER_OBJECT ;local KeyData:KEY_DATA invoke IoDeleteSymbolicLink, addr g_usSymbolicLinkName mov eax, pDriverObject invoke IoDeleteDevice, (DRIVER_OBJECT PTR [eax]).DeviceObject ret DriverUnload endp DriverDispatch proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP local status:NTSTATUS local dwMajorFunction:DWORD IoGetCurrentIrpStackLocation pIrp movzx eax, (IO_STACK_LOCATION PTR [eax]).MajorFunction mov dwMajorFunction, eax mov eax, pDeviceObject .if eax == KeyDeviceObject ; mov eax, dwMajorFunction ; .elseif eax == g_pControlDeviceObject ; Request is to our CDO. Let' see what our client want us do mov eax, dwMajorFunction .if eax == IRP_MJ_CREATE invoke DispatchCreateClose, pDeviceObject, pIrp mov status, eax .elseif eax == IRP_MJ_CLOSE invoke DispatchCreateClose, pDeviceObject, pIrp mov status, eax .elseif eax == IRP_MJ_DEVICE_CONTROL invoke CDO_DispatchDeviceControl, pDeviceObject, pIrp mov status, eax .else invoke FiDO_DispatchPassThrough, pDeviceObject, pIrp mov status, eax .endif .else mov ecx, pIrp mov (_IRP PTR [ecx]).IoStatus.Status, STATUS_INVALID_DEVICE_REQUEST and (_IRP PTR [ecx]).IoStatus.Information, 0 fastcall IofCompleteRequest, ecx, IO_NO_INCREMENT mov status, STATUS_INVALID_DEVICE_REQUEST .endif mov eax, status ret DriverDispatch endp .code INIT DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING local status:NTSTATUS local pTargetDeviceObject:PDEVICE_OBJECT local pTargetFileObject:PFILE_OBJECT mov status, STATUS_DEVICE_CONFIGURATION_ERROR invoke IoCreateDevice, pDriverObject, 0, addr g_usDeviceName, FILE_DEVICE_UNKNOWN, \ 0, FALSE, addr KeyDeviceObject .if eax == STATUS_SUCCESS invoke IoCreateSymbolicLink, addr g_usSymbolicLinkName, addr g_usDeviceName .if eax == STATUS_SUCCESS invoke IoGetDeviceObjectPointer, addr g_usTargetDeviceName, FILE_READ_DATA, \ addr pTargetFileObject, addr pTargetDeviceObject mov eax, pDriverObject assume eax:PTR DRIVER_OBJECT mov ecx, IRP_MJ_MAXIMUM_FUNCTION + 1 .while ecx dec ecx mov [eax].MajorFunction[ecx*(sizeof PVOID)], offset DriverDispatch .endw mov [eax].DriverUnload, offset DriverUnload assume eax:nothing invoke IoAttachDeviceToDeviceStack, KeyDeviceObject, pTargetDeviceObject mov status, STATUS_SUCCESS .else invoke IoDeleteDevice, KeyDeviceObject .endif .endif mov eax, status ret DriverEntry endp end DriverEntry Почему такой код приводит к синему экрану смерти??
Syser: Компьютер был перезагружен после критической ошибки: 0x1000008e (0xc0000005, 0xbae84293, 0xba373a00, 0x00000000). Crashdump прилагаю. Хватит?
Llirik Нульдереференс в вашем дрове по смещению 0x293, выше в SFC клиф, удалить кису. Смотреть дизасмом что вы скомпилили.
Код (Text): 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: bae84293, The address that the exception occurred at Arg3: ba373a00, Trap Frame Arg4: 00000000 Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text> FAULTING_IP: Keymouse+293 bae84293 8b00 mov eax,dword ptr [eax] TRAP_FRAME: ba373a00 -- (.trap 0xffffffffba373a00) ErrCode = 00000000 eax=00000000 ebx=889d3e80 ecx=8884ef18 edx=889d3e70 esi=88a44030 edi=88a5e680 eip=bae84293 esp=ba373a74 ebp=ba373a74 iopl=0 nv up ei ng nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282 Keymouse+0x293: bae84293 8b00 mov eax,dword ptr [eax] ds:0023:00000000=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x8E PROCESS_NAME: System LAST_CONTROL_TRANSFER: from bae8436f to bae84293 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. ba373a74 bae8436f 8884ef18 889d3e70 00000012 Keymouse+0x293 ba373a8c 8081818f 8884ef18 889d3e70 889d3e70 Keymouse+0x36f ba373a9c 808ac953 88a5e668 00000070 8a5dcca0 nt!IopfCallDriver+0x31 ba373acc 808e5a0a 8a5b9830 8884ef18 00000000 nt!IopCloseFile+0x26b ba373b00 808e5333 8a5b9830 00000001 8a5dcca0 nt!ObpDecrementHandleCount+0xd8 ba373b28 808e53d1 e1003e98 88a5e680 00000260 nt!ObpCloseHandleTableEntry+0x14d ba373b70 808e5509 00000260 00000000 00000000 nt!ObpCloseHandle+0x87 ba373b84 8086a61c 80000260 ba373c38 80828f31 nt!NtClose+0x1d ba373b84 80828f31 80000260 ba373c38 80828f31 nt!KiFastCallEntry+0xfc ba373c00 ad515db1 80000260 8084f67e 00000000 nt!ZwClose+0x11 ba373c38 ad5227df 88a5e680 ba373c64 ad5348a4 klif+0x18db1 ba373d78 ad5241ec ad5348a4 8955b7a4 ba373da8 klif+0x257df ba373d88 ad5242bf ad5243cb 00000000 8955b770 klif+0x271ec ba373da8 ad504127 808f8f64 00000000 00000000 klif+0x272bf ba373ddc 8086f0de ad504120 00000000 00000000 klif+0x7127 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: Keymouse+293 bae84293 8b00 mov eax,dword ptr [eax] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Keymouse+293 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Keymouse IMAGE_NAME: Keymouse.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4c6303ae FAILURE_BUCKET_ID: 0x8E_Keymouse+293 BUCKET_ID: 0x8E_Keymouse+293 Followup: MachineOwner --------- дело в вашем драйвере, в памяти это Keymouse+293, ida pro в руки и проверяйте, что это за функция и почему там разыменование нулевого указателя
FiDO_DispatchPassThrough proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP IoSkipCurrentIrpStackLocation pIrp mov eax, pDeviceObject mov eax, (DEVICE_OBJECT ptr [eax]).DeviceExtension <-- eax = (DeviceExtension == NULL) mov eax, (FiDO_DEVICE_EXTENSION ptr [eax]).pNextLowerDeviceObject <-- exception invoke IoCallDriver, eax, pIrp ret FiDO_DispatchPassThrough endp 1. почитай для чего поле DeviceExtension в структуре DEVICE_OBJECT 2. обрати внимание на параметр DeviceExtensionSize в IoCreateDevice 3. почитай про передачу IRP
Я указал структуру FiDO_DEVICE_EXTENSION в IoCreateDevice invoke IoCreateDevice, pDriverObject, sizeof FiDO_DEVICE_EXTENSION, addr g_usDeviceName, FILE_DEVICE_UNKNOWN, \ 0, FALSE, addr KeyDeviceObject но ничего не изменилось
Llirik Не знаеш? Отладчик в зУбы и в перед ... Бряку на DriverEntry; Код (Text): DispatchCreateClose proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP mov eax, pIrp assume eax:ptr _IRP mov [eax].IoStatus.Status, STATUS_SUCCESS and [eax].IoStatus.Information, 0 assume eax:nothing fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT mov eax, STATUS_SUCCESS ret DispatchCreateClose endp Где вы взяли этот код? больше от туда код не берете ... Как ниже стоящий драйвер узнает о создании Ссылки на него?
Всех благодарю за помощь! Я заполнил структуру FiDO_DEVICE_EXTENSION и драйвер заработал. Если у меня возникнут еще вопросы, я продолжу писать в этот топик
Вопрос такой: почему после загрузки моего драйвера перестают работать световые индикаторы клавиатуры и что с этим можно сделать? Код примерно тот же И ещё мне нужна информация про сканкоды клавиш стаблицей
