0 
/*
typedef struct _HRFS_VOLUME_CONTROL_BLOCK
{
    
    FSRTL_ADVANCED_FCB_HEADER VolumeFileHeader;
    ULONG nodeType;
    FAST_MUTEX AdvancedFcbHeaderMutex;
    ....
};
*/
DumpFileObject(*(pVolDev->fileObject));
Vcb = (HRFS_VOLUME_CONTROL_BLOCK_PTR)ExAllocatePool(PagedPool, sizeof(HRFS_VOLUME_CONTROL_BLOCK));

pVolDev->fileObject->SectionObjectPointer = \
    (PSECTION_OBJECT_POINTERS)ExAllocatePool(PagedPool, sizeof(SECTION_OBJECT_POINTERS));;
pVolDev->fileObject->WriteAccess = TRUE;
pVolDev->fileObject->ReadAccess = TRUE;
pVolDev->fileObject->DeleteAccess = TRUE;
pVolDev->fileObject->FsContext = &HrfsData.gVolume;
pVolDev->fileObject->Vpb = Vpb;

CC_FILE_SIZES fileSize;
fileSize.AllocationSize.QuadPart =    fileSize.FileSize.QuadPart = sizeof(PACKED_BOOT_SECTOR);
fileSize.ValidDataLength.QuadPart = 0xFFFFFFFFFFFFFFFF;
            
CcInitializeCacheMap(pVolDev->fileObject,
                &fileSize,
                TRUE,
                &HrfsData.CacheManagerNoOpCallbacks,
                Vcb);

在此代码段中，当我调用 CcInitializeCacheMap 函数时发生了崩溃。

FILE_OBJECT 和转储信息如下：

文件对象大小：d8
文件对象.DeviceObject：c2221670
文件对象.Vpb：c39302e0
 文件对象.FsContext：32166f0
文件对象.FsContext2：0
文件对象.SectionObjectPointer：0
文件对象.PrivateCacheMap：0
文件对象.FinalStatus：0
文件对象.相关文件对象：0
 文件对象.LockOperation：0
文件对象.DeletePending：0
 文件对象.ReadAccess：1
文件对象.WriteAccess：1
文件对象。删除访问：1
文件对象.SharedRead：0
文件对象.SharedWrite：0
文件对象.SharedDelete：0
文件对象.标志：40100
文件对象.文件名：247bb70
文件对象.CurrentByteOffset：0
fileObject.Waiters：0
文件对象.忙：0
文件对象.LastLock：0
文件对象.文件对象扩展：0

堆栈文本如下：

fffff880`0247bac0 fffff880`03241c78 : fffff880`00000000 00000000`00000000 00000000`00000001 fffff880`032166c8 : nt!CcInitializeCacheMap+0xd3
fffff880`0247bba0 fffff880`0323e095 : fffffa80`c303b010 fffffa80`c2222040 fffffa80`c39302e0 fffffa80`c3d56a40 : fastfatDemo!FatMountVolume+0xaf8 [G:\BaiduNetdiskDownload\fastfat_V1G13\fastfat_File_System_Driver\FsCtrl.c @ 1460]
fffff880`0247c2f0 fffff880`0323ecb7 : fffffa80`c303b010 fffffa80`c259bb40 00000000`00000065 00000000`00000003 : fastfatDemo!FatCommonFileSystemControl+0xe5 [G:\BaiduNetdiskDownload\fastfat_V1G13\fastfat_File_System_Driver\FsCtrl.c @ 1053]
fffff880`0247c340 fffff880`0113d4bc : fffffa80`c3d56a40 fffffa80`c259bb40 00000000`00000000 00000000`00000000 : fastfatDemo!FatFsdFileSystemControl+0x127 [G:\BaiduNetdiskDownload\fastfat_V1G13\fastfat_File_System_Driver\FsCtrl.c @ 969]
fffff880`0247c3a0 fffff880`01138971：fffffa80`c3d56450 00000000`00000000 fffffa80`c3024200 fffffa80`c3129cb0：fltmgr！FltpFsControlMountVolume+0x28c
fffff880`0247c470 fffff800`04334e6b：fffffa80`c3d56450 00000000`00000000 fffffa80`c3d56450 fffffa80`c259bb40：fltmgr！FltpFsControl+0x101
fffff880`0247c4d0 fffff800`040789e7 : fffff880`0247c7c0 fffff880`0247c701 fffffa80`c2221600 00000000`00000000 : nt!IopMountVolume+0x28f
fffff880`0247c590 fffff800`044fac6d : 00000000`00000025 00000000`00000000 fffff880`0247c7c0 fffff880`0247c768 : nt!IopCheckVpbMounted+0x1b7
fffff880`0247c600 fffff800`044229a4：fffffa80`c2221670 00000000`00000000 fffffa80`c31dbb10 fffff8a0`00000001：nt！IopParseDevice+0xb4d
fffff880`0247c760 fffff800`042fd756 : 00000000`00000000 fffff880`0247c8e0 00000000`00000040 fffffa80`c15c07b0 : nt!ObpLookupObjectName+0x784
fffff880`0247c860 fffff800`044c9d88 : fffffa80`c3d20cb0 00000000`00000000 00000000`00000401 fffff800`043fdef6 : nt!ObOpenObjectByName+0x306
fffff880`0247c930 fffff800`0435d7f4：fffffa80`c629f870 fffff8a0`80100080 00000000`0029f4f8 00000000`0029f448：nt！IopCreateFile+0xa08
fffff880`0247c9e0 fffff800`040b4bd3：fffffa80`c3539b00 00000000`00000001 fffffa80`c629f870 fffff800`042fe1e4：nt！NtCreateFile+0x78
fffff880`0247ca70 00000000`77629dda : 000007fe`fd3760d6 00000000`00000000 00000000`80000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0029f428 000007fe`fd3760d6 : 00000000`00000000 00000000`80000000 00000000`00000000 00000000`000c0000 : ntdll!ZwCreateFile+0xa
00000000`0029f430 00000000`773b0add : 00000000`0034bec0 00000000`80000000 00000000`00000003 00000000`0029f892 : KERNELBASE!CreateFileW+0x2cd
00000000`0029f590 000007fe`f1971c1e : 00000000`00000000 00000000`00000000 00000000`01d14280 00000000`0029f830 : kernel32!CreateFileWImplementation+0x7d
00000000`0029f5f0 00000000`00000000：00000000`00000000 00000000`01d14280 00000000`0029f830 00000000`00000003：FVEAPI+0x1c1e

我追踪到 nt!CcInitializeCacheMap+0xd3 的地址，发现有一条比较指令。

那么我的程序导致 CcInitializeCacheMap 崩溃的原因是什么？

4

1 回答 1

0

此代码不应设置为 PagedPool Type 。

//ErrorCode:
Vcb = (HRFS_VOLUME_CONTROL_BLOCK_PTR)ExAllocatePool(PagedPool, sizeof(HRFS_VOLUME_CONTROL_BLOCK));
pVolDev->fileObject->SectionObjectPointer = \
    (PSECTION_OBJECT_POINTERS)ExAllocatePool(PagedPool, sizeof(SECTION_OBJECT_POINTERS));;
于 2020-07-03T02:40:59.473 回答