[英]I don't understand Windows IRQL
http://msdn.microsoft.com/en-us/library/windows/hardware/ff553079(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/hardware/ff553079(v=vs.85).aspx
MSDN says KeRaiseIrql(newIrql, &oldIrql)
must be called with newIrql
which is >= currentIrql
. MSDN表示
KeRaiseIrql(newIrql, &oldIrql)
必须使用newIrql
调用,该newIrql
> = currentIrql
。
"If the new IRQL is less than the current IRQL, a bug check occurs."
“如果新的IRQL小于当前的IRQL,则会进行错误检查。”
But in below code KeRaiseIrql()
works well with newIrql
which is < currentIrql
. 但是在下面的代码中,
KeRaiseIrql()
与newIrql
配合newIrql
很好,它是< currentIrql
。 (Also, both loading and unloading this driver worked well.) (此外,加载和卸载此驱动程序都工作良好。)
Is there anyone to explain this? 有谁可以解释吗?
Test Environment: WinXp(32bit, Vmware Player), Win7(32bit, Vmware Player) 测试环境:WinXp(32位,Vmware Player),Win7(32位,Vmware Player)
#include <ntddk.h>
VOID DriverUnload
(
IN PDRIVER_OBJECT DriverObject
)
{
DbgPrint("BYE!\n");
}
NTSTATUS DriverEntry
(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
KIRQL oldIrql;
DriverObject->DriverUnload = DriverUnload;
DbgPrint("Hello!\n");
KeRaiseIrql(3, &oldIrql);
DbgPrint("%d\n", KeGetCurrentIrql()); // 3
KeRaiseIrqlToDpcLevel();
DbgPrint("%d\n", KeGetCurrentIrql()); // 2
KeRaiseIrql(1, &oldIrql);
DbgPrint("%d\n", KeGetCurrentIrql()); // 1
KeRaiseIrql(0, &oldIrql);
DbgPrint("%d\n", KeGetCurrentIrql()); // 0
DbgPrint("Yo!\n");
return STATUS_SUCCESS;
}
As someone above suggested it depends on the given OS implementation. 如上述建议,这取决于给定的OS实现。 If you have issues like this, the best is to use debugger.
如果遇到这样的问题,最好是使用调试器。
Eg in win xp sp2 release i386 I have: 例如在Win XP SP2版本I386中,我有:
hal!KfRaiseIrql:
806e43b8 0fb6d1 movzx edx,cl
806e43bb 0fb68a98436e80 movzx ecx,byte ptr hal!HalpIRQLtoTPR (806e4398)[edx]
806e43c2 a18000feff mov eax,dword ptr ds:[FFFE0080h]
806e43c7 890d8000feff mov dword ptr ds:[0FFFE0080h],ecx
806e43cd c1e804 shr eax,4
806e43d0 0fb68018f26e80 movzx eax,byte ptr hal!HalpVectorToIRQL (806ef218)[eax]
806e43d7 c3 ret
As you can see there's no previous irql checking. 如您所见,以前没有进行irql检查。 If you'd look into wrk sources you would find versions of KfRaiseIrql where it is checked, also keep in mind there is checked and free windows version.
如果您查看wrk的源代码,会发现KfRaiseIrql的版本已被检查,还请记住,这里有已检查和免费的Windows版本。 Most probabbly in checked version you would have bugcheck.
最有可能在检查版本中进行错误检查。
If you want to see bsod on your code, use Driver Verifier :) afair it is checking if raising/lowering irql are used correctly. 如果您想在代码上看到bsod,请使用Driver Verifier :),它正在检查是否正确使用了升高/降低irql。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.