Сбой драйвера.ч

Во время перехвата возникает BSOD.
WinDBG:

Код (Text):

1. MODULE_NAME:  HookSDT
2.  
3. FAULTING_MODULE: 804d7000 nt
4.  
5. DEBUG_FLR_IMAGE_TIMESTAMP:  458831c6
6.  
7. WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
8. unable to get nt!MmSpecialPoolEnd
9. unable to get nt!MmPoolCodeStart
10. unable to get nt!MmPoolCodeEnd
11.  ffffffe8
12.  
13. FAULTING_IP:
14. nt+2079
15. 804d9079 0fc101           xadd    [ecx],eax
16.  
17. MM_INTERNAL_CODE:  0
18.  
19. CUSTOMER_CRASH_COUNT:  1
20.  
21. DEFAULT_BUCKET_ID:  DRIVER_FAULT
22.  
23. BUGCHECK_STR:  0x50
24.  
25. LAST_CONTROL_TRANSFER:  from f3f25180 to 804d9079
26.  
27. STACK_TEXT:  
28. WARNING: Stack unwind information not available. Following frames may be wrong.
29. b26d0c60 f3f25180 00000000 b26d0d54 f3f25303 nt+0x2079
30. b26d0c6c f3f25303 00000000 b26d0c7c 00000020 HookSDT+0x1180
31. b26d0d54 804de7ec 00000000 00000000 0012ff7c HookSDT+0x1303
32. b26d0d64 7c90eb94 badb0d00 0012fe88 b2d2bd98 nt+0x77ec
33. b26d0d68 badb0d00 0012fe88 b2d2bd98 b2d2bdcc 0x7c90eb94
34. b26d0d6c 0012fe88 b2d2bd98 b2d2bdcc 00000000 0xbadb0d00
35. b26d0d70 b2d2bd98 b2d2bdcc 00000000 00000000 0x12fe88
36. b26d0d74 b2d2bdcc 00000000 00000000 00000000 0xb2d2bd98
37. b26d0d78 00000000 00000000 00000000 00000000 0xb2d2bdcc
38.  
39.  
40. STACK_COMMAND:  kb
41.  
42. FOLLOWUP_IP:
43. HookSDT+1180
44. f3f25180 ??               ???
45.  
46. FAULTING_SOURCE_CODE:  
47.  
48.  
49. SYMBOL_STACK_INDEX:  1
50.  
51. FOLLOWUP_NAME:  MachineOwner
52.  
53. SYMBOL_NAME:  HookSDT+1180
54.  
55. IMAGE_NAME:  HookSDT.sys
56.  
57. BUCKET_ID:  WRONG_SYMBOLS
58.  
59. Followup: MachineOwner
60. ---------
61.  
62. kd> r
63. eax=ffffffff ebx=00000000 ecx=ffffffe8 edx=b26d0c7c esi=0012fe90 edi=ffffffe8
64. eip=804d9079 esp=b26d0c4c ebp=b26d0c60 iopl=0         nv up ei pl zr na po nc
65. cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
66. nt+0x2079:
67. 804d9079 0fc101           xadd    [ecx],eax         ds:0023:ffffffe8=????????

Видно, что адрес не из моего кода :\
Код:

Код (Text):

1. void GetProcessNameByPointer(PVOID pProcess, char *pszName){
2.     if (!pProcess){
3.         pszName[0] = ' ';
4.         pszName[1] = 0;
5.         return;
6.     }
7.     strncpy(pszName, (PCHAR)pProcess + dwProcessNameOffset, 16);
8.     pszName[16] = 0;
9. }
10.  
11. void GetProcessNameByHandle(HANDLE hProcess, char *pszName){
12.     PVOID pProc;
13.  
14.     ObReferenceObjectByHandle(hProcess, 0, 0, KernelMode, &pProc, NULL);
15.     GetProcessNameByPointer(pProc, pszName);
16.     ObDereferenceObject(pProc);
17. }
18.  
19. void WriteToLog(char *pszTarget, char *pszTerminator){
20.     UNICODE_STRING usFile;
21.     OBJECT_ATTRIBUTES oaFile;
22.     IO_STATUS_BLOCK iosb;
23.     HANDLE hFile;
24.     ULONG OutLen;
25.     char Out[300];
26.  
27.     RtlInitUnicodeString(&usFile, L"\\??\\C:\\log.txt");
28.     InitializeObjectAttributes(&oaFile, &usFile, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
29.     ZwCreateFile(&hFile, FILE_APPEND_DATA | SYNCHRONIZE, &oaFile, &iosb, NULL, 0,
30.         0, FILE_OPEN_IF, FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE, NULL, 0);
31.     OutLen = _snprintf(Out, 300, "%s terminate %s\r\n", pszTerminator, pszTarget);
32.     ZwWriteFile(hFile, 0, NULL, NULL, &iosb, Out, OutLen, NULL, NULL);
33.     ZwClose(hFile);
34. }
35.  
36. NTSTATUS NewNtTerminateProcess(HANDLE ProcessHandle, NTSTATUS ExitStatus){
37.     NTSTATUS ns;
38.     char ProcName[100], Terminator[100];
39.  
40.     IoAcquireRemoveLock(PREMOVE_LOCK, NULL);
41.     GetProcessNameByHandle(ProcessHandle, ProcName);
42.     GetProcessNameByPointer(PsGetCurrentProcess(), Terminator);
43.     WriteToLog(ProcName, Terminator);
44.     ns = ((NTTERMINATEPROCESS)NtTerminateProcess_Old)(ProcessHandle, ExitStatus);
45.     IoReleaseRemoveLock(PREMOVE_LOCK, NULL);
46.     return ns;
47. }

 

n0name
Приложи плиз, мылый дамп

 

Код (Text):

1. program exmpl;
2.  
3. uses
4.  Windows,
5.  DriverControl;
6.  
7. var
8.  hDrv: THandle;
9.  br: DWORD;
10.  SI: TStartupInfo;
11.  PI: _PROCESS_INFORMATION;
12.  
13. begin
14.  hDrv := AddDriver('HookSDT.sys', 'HookSDT', true);
15.  if hDrv <> DWORD(-1) then
16.   begin
17.    DeviceIoControl(hDrv, $08000004, nil, 0, nil, 0, br, nil);
18.    ZeroMemory(@SI, sizeof(SI));
19.    SI.cb := sizeof(SI);
20.    CreateProcess(nil, 'notepad', nil, nil, false, 0, nil, nil, SI, PI);
21.    TerminateProcess(PI.hProcess, 0);
22.    CloseHandle(hDrv);
23. //   DeleteDriver(hDrv);
24.   end;
25.  Sleep(2000);
26. end.

BSOD появляется после завершения самой программы.