请教：尝试用minifilter中的post_create作文件驱动过滤出现PFN_LIST_CORRUPT (4e)。

zjlhmcd 2014-06-06 09:17:03

在XP下正常，在WIN7下出现问题
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000009a,
Arg2: 0007f380
Arg3: 00000006
Arg4: 00000002

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_9a

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 83f2970d to 83f1cd10

STACK_TEXT:
8f5f0af0 83f2970d 0000004e 0000009a 0007f380 nt!KeBugCheckEx+0x1e
8f5f0b08 83f5e823 00000000 00001000 00000000 nt!MiBadRefCount+0x26
8f5f0be8 83f5f43c 86b80000 00001000 18aa6123 nt!MiFreePoolPages+0x124
8f5f0c50 83eff066 86b80000 00000000 00000002 nt!ExFreePoolWithTag+0x436
8f5f0c64 840bb688 00000000 c000009a 83f747c0 nt!MmFreeAccessPfnBuffer+0x2f
8f5f0cc0 840bb33d 00000000 87de5030 00000000 nt!PfpFlushBuffers+0x2ba
8f5f0d50 8404e66d 83f747c0 b027154c 00000000 nt!PfTLoggingWorker+0xaa
8f5f0d90 83f000d9 840bb28d 83f747c0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiBadRefCount+26
83f2970d cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadRefCount+26

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc007

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_9a_nt!MiBadRefCount+26

BUCKET_ID: 0x4E_9a_nt!MiBadRefCount+26

Followup: MachineOwner
---------

...全文