驱动高手来看看奇怪的有关问题,为什么简单的往用户写数据会蓝屏

驱动高手来看看奇怪的问题,为什么简单的往用户写数据会蓝屏

用DeviceIoControl和驱动通信,原来没事 ,现在不知道出现蓝屏,困惑很长时间了也不知道原因,请高手指教,

主要问题在 requestControl 函数中.







#include "stdio.h"
#include "pch.h"
#include "..\intrface.h"
#include "ntddk.h"

char dataBuffer[4096]={'\0'};
char zml[]="zheshizml";
PDRIVER_OBJECT thisDriverObject;
UNICODE_STRING ustrSymLinkName;
typedef struct _DEVICE_EXTENSION

{

  PDEVICE_OBJECT fdo; //功能设备对象FDO
  PDEVICE_OBJECT NextStackDevice; //FDO的下层驱动设备
  UNICODE_STRING ustrDeviceName; //设备名
  UNICODE_STRING ustrSymLinkName; //符号链接
}DEVICE_EXTENSION, *PDEVICE_EXTENSION;


typedef struct _SERVICE_DESCRIPTOR_TABLE
{
  PVOID ServiceTableBase;
  PULONG ServiceCounterTableBase;
  ULONG NumberOfService;
  ULONG ParamTableBase;
}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE; //由于KeServiceDescriptorTable只有一项,这里就简单点了
extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;

//__declspec(dllimport) ServiceDescriptorTableEntry KeServiceDescriptorTable;



NTSTATUS addDevice(IN PDRIVER_OBJECT DriverObject,
IN PDEVICE_OBJECT PhysicalDeviceObject);
NTSTATUS jiChaJiYong(IN PDEVICE_OBJECT fdo,
IN PIRP Irp);

NTSTATUS requestControl(IN PDEVICE_OBJECT DeviceObject, 

IN PIRP Irp);

NTSTATUS UnloadDriver (IN PDRIVER_OBJECT DriverObject);
NTSTATUS dataCopy ( void* newAddress,void* oldAddress,int copyLength );
NTSTATUS fileDispath (IN PDEVICE_OBJECT DeviceObject, 
IN PIRP Irp);

NTSTATUS DriverEntry(
  IN PDRIVER_OBJECT DriverObject,
  IN PUNICODE_STRING RegistryPath
  )
{ DEVICE_OBJECT pdo;
  DriverObject->DriverExtension->AddDevice =addDevice;
  DriverObject->MajorFunction[IRP_MJ_PNP] = jiChaJiYong;
  DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=requestControl; 
  DriverObject->MajorFunction[IRP_MJ_CREATE]=fileDispath;
  DriverObject->MajorFunction[IRP_MJ_CLOSE]=fileDispath;
  DriverObject->DriverUnload=UnloadDriver;
  thisDriverObject=DriverObject;
  addDevice(DriverObject,&pdo);

  return STATUS_SUCCESS; }
   
NTSTATUS addDevice(IN PDRIVER_OBJECT DriverObject,
IN PDEVICE_OBJECT PhysicalDeviceObject) {
 NTSTATUS status;
 PDEVICE_OBJECT device_object;
 PDEVICE_EXTENSION device_extension;
 UNICODE_STRING devName,symLinkName;
 WCHAR deviceNameBuffer[] = L"\\Device\\hello66";
 WCHAR dosDeviceNameBuffer[] = L"\\??\\hello66";

 RtlInitUnicodeString(&devName,deviceNameBuffer);
 RtlInitUnicodeString(&symLinkName,dosDeviceNameBuffer);
 
 status= IoCreateDevice ( DriverObject,sizeof(DEVICE_EXTENSION),
&devName,FILE_DEVICE_UNKNOWN,0,FALSE,&device_object);
 if ( !NT_SUCCESS (status ) ) {
return status ; }
 device_extension = (PDEVICE_EXTENSION)device_object->DeviceExtension;
 device_extension->fdo=device_object;
 //device_extension->NextStackDevice =
 //IoAttachDeviceToDeviceStack(device_object, PhysicalDeviceObject);
 device_object->Flags |=DO_DIRECT_IO|DO_BUFFERED_IO;
 device_object->Flags &= ~DO_DEVICE_INITIALIZING;
 device_extension->ustrSymLinkName=symLinkName;
 //device_object->Flags|= DO_BUFFERED_IO | DO_POWER_PAGABLE;


 IoCreateSymbolicLink(&symLinkName,&devName);
 ustrSymLinkName=symLinkName;