Привет всем. У меня стоял крэк для Висты, убивающий таймер активации -- timerstop.sys, и все было замечательно, пока я не поставил обновление. После этого крэк стал бсодить. Суть его работы: создаем таймер, по нему выходим на KiTimerTableListHead, там ищем таймер у которого DPC.DeferredRoutine заканчивается на 218h(типа автор крэка знал, что за дпц, а я -- нет =)), а просматривать все адреса в ядре на 0х218 не оч хочется), и отодвигал его на 30 дней. После установки апдейта бсод происходит тут: .text:000110C4 mov eax, [esi+_KTIMER.Dpc] говорит IRQL_NOT_LESS_OR_EQUAL, т.к. проход по спискам таймеров происходит на диспатч левеле, но походу esi+_KTIMER.Dpc просто не валидный.. Собственно больше непосредственно "перевзлома" интересует, почему такое может происходить, вроде бы KTIMER_TABLE_ENTRY не поменялась, по крайней мере в иде в новом ядре ничего подозрительного)), ну и собственно может кто-нибудь знает, что за загадочная функция на 0х218, и где ее смотреть. Вот собственно весь код: Код (Text): DoPatch proc near ; CODE XREF: start-2ED0p .text:00011080 .text:00011080 var_18 = dword ptr -18h .text:00011080 var_C = dword ptr -0Ch .text:00011080 var_8 = dword ptr -8 .text:00011080 NewIrql = byte ptr -1 .text:00011080 .text:00011080 mov edi, edi .text:00011082 push ebp .text:00011083 mov ebp, esp .text:00011085 sub esp, 0Ch .text:00011088 push ebx .text:00011089 push esi .text:0001108A push edi .text:0001108B call FindKiTimerTableListHead .text:00011090 and [ebp+var_8], 0 .text:00011094 and [ebp+var_C], 0 .text:00011098 mov cl, 2 ; NewIrql .text:0001109A call ds:KfRaiseIrql .text:000110A0 mov [ebp+NewIrql], al .text:000110A3 call FindKiTimerTableListHead .text:000110A8 mov esi, eax .text:000110AA push esi .text:000110AB push offset Format ; "TimerTable : %x\n" .text:000110B0 call DbgPrint .text:000110B5 pop ecx .text:000110B6 pop ecx .text:000110B7 mov ebx, esi .text:000110B9 .text:000110B9 loc_110B9: ; CODE XREF: DoPatch+91j .text:000110B9 mov edi, [ebx] .text:000110BB test edi, edi .text:000110BD jz short loc_11113 .text:000110BF jmp short loc_11100 .text:000110C1 ; --------------------------------------------------------------------------- .text:000110C1 .text:000110C1 loc_110C1: ; CODE XREF: DoPatch+82j .text:000110C1 lea esi, [edi-_KTIMER.TimerListEntry] .text:000110C4 mov eax, [esi+_KTIMER.Dpc] .text:000110C7 test eax, eax .text:000110C9 mov edi, [edi] .text:000110CB jz short loc_11100 .text:000110CD mov ecx, [eax+KDPC.DeferredRoutine] .text:000110D0 test ecx, ecx .text:000110D2 jz short loc_11100 .text:000110D4 push ecx .text:000110D5 call check_dpc_218h .text:000110DA test eax, eax .text:000110DC jz short loc_11100 .text:000110DE push [esi+_KTIMER.DueTime.u.HighPart] .text:000110E1 push [esi+_KTIMER.DueTime.u.LowPart] .text:000110E4 push ecx .text:000110E5 push offset aFoundDeferredr ; "Found DeferredRoutine %x QuadPart %lld\n"... .text:000110EA call DbgPrint .text:000110EF mov eax, [esi+_KTIMER.TimerListEntry.Flink] .text:000110F2 mov esi, [esi+_KTIMER.TimerListEntry.Blink] .text:000110F5 add esp, 10h .text:000110F8 inc [ebp+var_C] .text:000110FB mov [esi], eax .text:000110FD mov [eax+4], esi .text:00011100 .text:00011100 loc_11100: ; CODE XREF: DoPatch+3Fj .text:00011100 ; DoPatch+4Bj ... .text:00011100 cmp edi, ebx .text:00011102 jnz short loc_110C1 .text:00011104 inc [ebp+var_8] .text:00011107 add ebx, 10h .text:0001110A cmp [ebp+var_8], 500 .text:00011111 jb short loc_110B9 .text:00011113 .text:00011113 loc_11113: ; CODE XREF: DoPatch+3Dj .text:00011113 mov cl, [ebp+NewIrql] ; NewIrql .text:00011116 call ds:KfLowerIrql .text:0001111C mov eax, [ebp+var_C] .text:0001111F pop edi .text:00011120 pop esi .text:00011121 pop ebx .text:00011122 leave .text:00011123 retn .text:00011123 DoPatch endp Код (Text): FindKiTimerTableListHead proc near ; CODE XREF: sub_11080+Bp .text:00011006 ; sub_11080+23p .text:00011006 .text:00011006 Timer = _KTIMER ptr -28h .text:00011006 arg_8 = dword ptr 10h .text:00011006 .text:00011006 mov edi, edi .text:00011008 push ebp .text:00011009 mov ebp, esp .text:0001100B sub esp, 28h .text:0001100E push ebx .text:0001100F push esi .text:00011010 push edi .text:00011011 lea eax, [ebp+Timer] .text:00011014 push eax ; Timer .text:00011015 call ds:KeInitializeTimer .text:0001101B mov esi, ds:KeSetTimer .text:00011021 or ebx, 0FFFFFFFFh .text:00011024 mov edi, ebx .text:00011026 jmp short loc_1102E .text:00011028 ; --------------------------------------------------------------------------- .text:00011028 .text:00011028 loc_11028: ; CODE XREF: FindKiTimerTableListHead+34j .text:00011028 add edi, 0FFFFFFFFh .text:0001102B adc ebx, 0FFFFFFFFh .text:0001102E .text:0001102E loc_1102E: ; CODE XREF: FindKiTimerTableListHead+20j .text:0001102E push 0 ; Dpc .text:00011030 push ebx .text:00011031 push edi ; DueTime .text:00011032 lea eax, [ebp+Timer] .text:00011035 push eax ; Timer .text:00011036 call esi ; KeSetTimer .text:00011038 test al, al .text:0001103A jz short loc_11028 .text:0001103C mov esi, [ebp+Timer.TimerListEntry.Blink] .text:0001103F lea eax, [ebp+Timer] .text:00011042 push eax ; PKTIMER .text:00011043 call ds:KeCancelTimer .text:00011049 jmp short loc_1104E .text:0001104B ; --------------------------------------------------------------------------- .text:0001104B .text:0001104B loc_1104B: ; CODE XREF: FindKiTimerTableListHead+4Bj .text:0001104B sub esi, 10h .text:0001104E .text:0001104E loc_1104E: ; CODE XREF: FindKiTimerTableListHead+43j .text:0001104E cmp dword ptr [esi], 0 .text:00011051 jnz short loc_1104B .text:00011053 pop edi .text:00011054 lea eax, [esi+10h] .text:00011057 pop esi .text:00011058 pop ebx .text:00011059 leave .text:0001105A retn .text:0001105A FindKiTimerTableListHead endp
Собственно вот analize, а что накатил -- не знаю, т.к. виста сама скачала и поставила.. Код (Text): DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: a319cc05, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: a3b4d0cd, address which referenced memory Debugging Details: ------------------ Unable to load image \??\C:\Crack\timerstop.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for timerstop.sys *** ERROR: Module load completed but symbols could not be loaded for timerstop.sys READ_ADDRESS: GetPointerFromAddress: unable to read from 821315ac Unable to read MiSystemVaType memory at 821117e0 a319cc05 CURRENT_IRQL: 2 FAULTING_IP: timerstop+10cd a3b4d0cd ?? ??? CUSTOMER_CRASH_COUNT: 3 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: System TRAP_FRAME: 8378ba88 -- (.trap 0xffffffff8378ba88) ErrCode = 00000000 eax=a319cbf9 ebx=88285dd0 ecx=82053553 edx=00000016 esi=820f94d8 edi=88285ec8 eip=a3b4d0cd esp=8378bafc ebp=8378bb14 iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 timerstop+0x10cd: a3b4d0cd ?? ??? Resetting default scope LAST_CONTROL_TRANSFER: from a3b4d0cd to 8208fdc4 STACK_TEXT: 8378ba88 a3b4d0cd badb0d00 00000016 00000001 nt!KiTrap0E+0x2ac WARNING: Stack unwind information not available. Following frames may be wrong. 8378baf8 86dd91a0 86d61000 00000000 00000000 timerstop+0x10cd 8378bb14 a3b4d13a 821871d0 86dd91a0 86d61000 0x86dd91a0 8378bcfc 8218765f 00000001 00000000 8378bd24 timerstop+0x113a 8378bd44 82078fc0 a3bc3ce0 00000000 8631cad0 nt!IopLoadUnloadDriver+0x70 8378bd7c 8222553c a3bc3ce0 83780680 00000000 nt!ExpWorkerThread+0xfd 8378bdc0 820915fe 82078ec3 00000001 00000000 nt!PspSystemThreadStartup+0x9d 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: timerstop+10cd a3b4d0cd ?? ??? SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: timerstop+10cd FOLLOWUP_NAME: MachineOwner MODULE_NAME: timerstop IMAGE_NAME: timerstop.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4585d774 FAILURE_BUCKET_ID: 0xD1_timerstop+10cd BUCKET_ID: 0xD1_timerstop+10cd Followup: MachineOwner ---------
