如何调试 Windows 中的内核驱动程序崩溃？
我编写了一个内核驱动程序，它挂接到一个进程并隐藏一个文件夹。这个驱动程序运行得很好，直到我连接了外部硬盘。
此时，我的操作系统（Windows XP 或 Server 2003）崩溃并出现蓝屏死机 (BSOD)。
导致此崩溃的原因是什么？如何修改驱动程序来解决该问题？
I wrote a kernel driver that hooks into a process and hides a folder. This driver works very well, until I connect an external hard disk.
At this point, my OS (either Windows XP or Server 2003) crashes with a blue screen of death (BSOD).
What could be causing this crash, and how can I modify my driver to solve it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
一般来说有两种方法：
不过，我同意你透露的细节太少了。你“上钩”吗？嗯，怎么样？ SSDT挂钩？或者您是否使用编写过滤器驱动程序的正确方法？如果有过滤驱动程序，哪个型号？迷你过滤器还是传统过滤器？
我刚刚注意到您的评论，您挂钩“NtOpenProcess 和 NtQueryDirectoryFile”，所以听起来像是 SSDT 挂钩。 您在实施过程中具体做了什么？我知道很多驱动程序都进行了不正确的 SSDT 挂钩。它从用于将钩子安装到位的方法开始，通常不会以大胆的实现结束。
请注意，对于实时调试，WinDbg 提供了一些优秀的功能来在启动时传输和加载最新的驱动程序版本。因此您无需额外准备即可调试最新版本。远程端的内核调试器和您计算机上的 WinDbg 将处理它。
另外，您可能想将您的问题发布到 OSR（即 NTDEV）的列表中。
There would be two ways in general:
However, I agree that you give way too few details. You "hook"? Well, how? SSDT-hooking? Or do you use the proper way of writing a filter driver? If a filter driver, which model? Mini-filter or legacy filter?
I just noticed your comment that you hook "NtOpenProcess and NtQueryDirectoryFile", so it sounds like SSDT-hooking. What exactly are you doing in your implementation? I know plenty of drivers that do improper SSDT-hooking. It starts with the method used to get the hook in place and usually does not end with a daring implementation.
Please note that for live debugging WinDbg offers some fine features to transfer and load your latest driver version at boot time. So you can debug your latest version without extra preparation. The kernel debugger on the remote end and WinDbg on your machine will take care of it.
Also, you may want to post your question to the lists over at OSR (namely NTDEV).
开发内核驱动程序时，通常您希望使用内核调试器连接（主机是调试器，VM 是被调试器）在虚拟机中测试它们。一些虚拟机环境提供对调试的直接支持。
当然，之后您需要在各种物理和虚拟硬件上进行调试。
When developing kernel drivers, typically you want to test them in a virtual machine, with a kernel debugger connection (host is debugger, VM is debuggee). Some of the virtual machine environments provide direct support for debugging.
Afterward of course you need to debug on a variety of physical and virtual hardware.
您几乎没有发布 BSOD 的技术细节，或者您的代码如何工作，因此不可能提供具体的答案。作为一般起点，我建议您分析小型转储以获取触发 BSOD 错误的一些具体信息。这是一个很好的入门指南。
http://forums.majorgeeks.com/showthread.php?p=1418737
You have posted almost no technical details of the BSOD, or how your code works, so it is impossible to provide a specific answer. As a general starting point, I would suggest you analyze the minidump to get some specifics of what went wrong to trigger the BSOD. Here is a good getting started guide.
http://forums.majorgeeks.com/showthread.php?p=1418737