很难解释这个问题,我写了两个驱动程序,一个磁盘过滤器驱动程序和卷过滤器驱动程序,当我没有打开verfier.exe来验证我的驱动程序的特殊池时。每件事都很好。但是当我打开它,窗口无法关闭,它变成灰色屏幕。它只用于磁盘驱动程序,不用于卷驱动程序。
我用windbg调试它,我发现当系统向我的驱动程序发送Irp(IRP_MN_DEVICE_USAGE_NOTIFICATION)时,我分析它,如果这个irp的Parameters.UsageNotification.Type不是DeviceUsageTypePaging,我通过它,但它没有回来,它阻止; IRP_MN_DEVICE_USAGE_NOTIFICATION很有趣:
case IRP_MN_DEVICE_USAGE_NOTIFICATION:
{
BOOLEAN setPagable;
if (pIrpStack->Parameters.UsageNotification.Type != DeviceUsageTypePaging)
{
status = pOSNDf->PassThroughIrp(pOSNDiskDevice->GetTargetDeviceObject(),
pIrp);
COSNDf::MyReleaseRemoveLock(pOSNDiskDevice->GetRemoveLock(),pIrp);
return status;
}
//
// wait on the paging path event
//
status = KeWaitForSingleObject(&pOSNDiskDevice->PagingPathCountEvent,
Executive,
KernelMode,
FALSE,
NULL);
//
// if removing last paging device, need to set DO_POWER_PAGABLE
// bit here, and possible re-set it below on failure.
//
setPagable = FALSE;
if (!pIrpStack->Parameters.UsageNotification.InPath &&
pOSNDiskDevice->PagingPathCount == 1 )
{
//
// removing the last paging file
// must have DO_POWER_PAGABLE bits set
//
if (pDeviceObject->Flags & DO_POWER_INRUSH) {
} else {
pDeviceObject->Flags |= DO_POWER_PAGABLE;
setPagable = TRUE;
}
}
//
// send the irp synchronously
//
status = pOSNDf->SynchorousSendPnPIrpDown(pOSNDiskDevice->GetTargetDeviceObject(), pIrp);
//
// now deal with the failure and success cases.
// note that we are not allowed to fail the irp
// once it is sent to the lower drivers.
//
if (NT_SUCCESS(status))
{
IoAdjustPagingPathCount(
&pOSNDiskDevice->PagingPathCount,
pIrpStack->Parameters.UsageNotification.InPath);
if (pIrpStack->Parameters.UsageNotification.InPath)
{
if (pOSNDiskDevice->PagingPathCount == 1)
{
pDeviceObject->Flags &= ~DO_POWER_PAGABLE;
}
}
}
else
{
//
// cleanup the changes done above
//
if (setPagable == TRUE)
{
pDeviceObject->Flags &= ~DO_POWER_PAGABLE;
setPagable = FALSE;
}
}
//
// set the event so the next one can occur.
//
KeSetEvent(&pOSNDiskDevice->PagingPathCountEvent,
IO_NO_INCREMENT, FALSE);
//
// and complete the irp
//
IoCompleteRequest(pIrp, IO_NO_INCREMENT);
COSNDf::MyReleaseRemoveLock(pOSNDiskDevice->GetRemoveLock(),pIrp);
return status;
}
PassThroughIrp fun code;
NTSTATUS COSNDf::PassThroughIrp(PDEVICE_OBJECT pDeviceObject,PIRP pIrp)
{
IoSkipCurrentIrpStackLocation(pIrp);
return IoCallDriver(pDeviceObject, pIrp);
}
我调试它,pIrpStack-> Parameters.UsageNotification.Type是DeviceUsageTypeDumpFile;当调用iocalldriver这个irp时,阻塞系统函数是nt!ExpInterlockedPopEntrySListResume,它总是循环;任何人都可以帮助我吗?谢谢!