首页 > 代码库 > 人要是倒霉，电脑都蓝屏
人要是倒霉，电脑都蓝屏
今天，笔记本又蓝屏了，dump嗷嗷奇怪，
Win10 x64的系统，用WinDbg10加载dmp 之后，竟然无法正确下载符号。
擦，这要我怎么办，手动下载符号？
好吧，手动下载符号之后，
.reload 之后，
!analyze -v
结果就给我这些破玩艺。。。
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000fff6a322, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 00000000000000ca, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff803e7d0ed17, address which referenced memory
其实，这里出现了两个问题：
1：这异常，十分可怕啊，调用时的IRQL竟然是0xFF，这是怎么搞得，为什么IRQL会这么高，X64下，没记错的话，应该是R8保存着IRQL，R8的值确实就是这个值
2：
1 fffff803`e7d0ecfc 654c8b042520000000 mov r8,qword ptr gs:[20h] 2 fffff803`e7d0ed05 4caf scas qword ptr [rdi] 3 fffff803`e7d0ed07 35f4a2f6ff xor eax,0FFF6A2F4h 4 fffff803`e7d0ed0c 458bdf mov r11d,r15d 5 fffff803`e7d0ed0f 4d8b8840060000 mov r9,qword ptr [r8+640h] 6 fffff803`e7d0ed16 fd std 7 fffff803`e7d0ed17 8b4024 mov eax,dword ptr [rax+24h] 8 fffff803`e7d0ed1a 498b9188310000 mov rdx,qword ptr [r9+3188h] 9 fffff803`e7d0ed21 418b8c8640a33a00 mov ecx,dword ptr [r14+rax*4+3AA340h]10 fffff803`e7d0ed29 410fb68051870000 movzx eax,byte ptr [r8+8751h]11 fffff803`e7d0ed31 83e13f and ecx,3Fh12 fffff803`e7d0ed34 410fb79992000000 movzx ebx,word ptr [r9+92h]13 fffff803`e7d0ed3c 480fb3ca btr rdx,rcx14 fffff803`e7d0ed40 498b4940 mov rcx,qword ptr [r9+40h]
上面代码是dmp 里面得到的代码，注意看第6行处
1 .text:0000000140095CFC 65 4C 8B 04 25 20 00 00 00 mov r8, gs:20h 2 .text:0000000140095D05 4C 8D 35 F4 A2 F6 FF lea r14, cs:140000000h 3 .text:0000000140095D0C 45 8B DF mov r11d, r15d 4 .text:0000000140095D0F 4D 8B 88 40 06 00 00 mov r9, [r8+640h] 5 .text:0000000140095D16 41 8B 40 24 mov eax, [r8+24h] 6 .text:0000000140095D1A 49 8B 91 88 00 00 00 mov rdx, [r9+88h] 7 .text:0000000140095D21 41 8B 8C 86 40 A3 3A 00 mov ecx, ds:rva KiProcessorIndexToNumberMappingTable[r14+rax*4] 8 .text:0000000140095D29 41 0F B6 80 51 06 00 00 movzx eax, byte ptr [r8+651h] 9 .text:0000000140095D31 83 E1 3F and ecx, 3Fh10 .text:0000000140095D34 41 0F B7 99 92 00 00 00 movzx ebx, word ptr [r9+92h]11 .text:0000000140095D3C 48 0F B3 CA btr rdx, rcx12 .text:0000000140095D40 49 8B 49 40 mov rcx, [r9+40h]
这段代码，是我反汇编WinDbg工具集里面那个pdb下载工具，下载回来的exe得到的代码，
代码长度不同啊，我电脑里面跑着的内核内存被改了，为什么被改，被谁改了，怎么改的，擦，
一个又一个问题啊，
先工作，有空回头再来看。
人要是倒霉，电脑都蓝屏