寫驅(qū)動(dòng)的時(shí)候有個(gè)地方老是藍(lán)屏,看了dump發(fā)現(xiàn)數(shù)據(jù)被非法篡改了.
數(shù)據(jù)初始化如下
if(record_set_ptr != NULL )
{
record_set_ptr->look_aside_pool_ptr = g_user_control_context.look_aside_pools[type] ;
record_set_ptr->type = type ;
record_set_ptr->buffer_size = notify_count * unit_size_of ;
record_set_ptr->units_count = notify_count ;
record_set_ptr->complete_count = 0 ;
}
然后在調(diào)用ExFreeToNPagedLookasideList傳入record_set_ptr->look_aside_pool_ptr 的時(shí)候掛了,發(fā)現(xiàn)record_set_ptr->look_aside_pool_ptr已經(jīng)被改了.
為了跟蹤數(shù)據(jù)在哪里被修改了,先在數(shù)據(jù)初始化的地方下斷,然后記下record_set_ptr->look_aside_pool_ptr 的地址:0x85c16018
對(duì)這個(gè)內(nèi)存下個(gè)斷點(diǎn)
1: kd> ba w4 85c16018
w表示在寫入時(shí)斷下,4表示監(jiān)控范圍,單位是字節(jié)
整個(gè)命令的意思就是讓調(diào)試器在系統(tǒng)寫入內(nèi)存85c16018-85c1601b這個(gè)地址范圍的時(shí)候中斷
OK,命令下完,F5一下就立馬斷下來了
1: kd> g
Breakpoint 3 hit
nt!memcpy+0x33:
8053b583 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
此時(shí)edi的值: 0x85c16018
最后看一下函數(shù)堆棧,發(fā)現(xiàn)是字符串拷貝越界覆蓋了后面的數(shù)據(jù)....
后面又想到,出錯(cuò)時(shí)record_set_ptr->look_aside_pool_ptr 的值是0x005c0065
這么明顯的字符串特征竟然沒意識(shí)到....一看出錯(cuò)值就應(yīng)該知道是字符串覆蓋造成的.....