该楼层疑似违规已被系统折叠 隐藏此楼查看此楼
来看看汇编代码和注释:
IoCallDriver:
nt!IoCallDriver:
804f04f2 8bff mov edi,edi
804f04f4 55 push ebp
804f04f5 8bec mov ebp,esp
804f04f7 8b550c mov edx,dword ptr [ebp+0Ch]//irp,edx
804f04fa 8b4d08 mov ecx,dword ptr [ebp+8]//deviceobject,ecx
804f04fd ff1500d25480 call dword ptr [nt!pIofCallDriver (8054d200)]
804f0503 5d pop ebp
804f0504 c20800 ret 8
IopfCallDriver:
nt!IopfCallDriver:
804ef0e8 fe4a23 dec byte ptr [edx+23h]//CurrentLocation--
804ef0eb 8a4223 mov al,byte ptr [edx+23h]
804ef0ee 84c0 test al,al//CurrentLocation是否为0
804ef0f0 7f0e jg nt!IopfCallDriver+0x18 (804ef100)
804ef0f2 6a00 push 0
804ef0f4 6a00 push 0
804ef0f6 6a00 push 0
804ef0f8 52 push edx
804ef0f9 6a35 push 35h
804ef0fb e89aab0000 call nt!KeBugCheckEx (804f9c9a)//报错
804ef100 8b4260 mov eax,dword ptr [edx+60h]//Tail.Overlay.CurrentStackLocation
804ef103 83e824 sub eax,24h//IO_STACK_LOCATION为0x24字节
804ef106 56 push esi//--Tail.Overlay.CurrentStackLocation
804ef107 894260 mov dword ptr [edx+60h],eax//irpStack(PIO_STACK_LOCATION)
804ef10a 894814 mov dword ptr [eax+14h],ecx//irpStack->DeviceObject=deviceobject
804ef10d 0fb600 movzx eax,byte ptr [eax]//irpStack->MajorFunction
804ef110 8b7108 mov esi,dword ptr [ecx+8]//deviceobject->DriverObject
804ef113 52 push edx
804ef114 51 push ecx
804ef115 ff548638 call dword ptr [esi+eax*4+38h]//deviceobject->DriverObject->MajorFuntion[eax]
804ef119 5e pop esi
804ef11a c3 ret//返回到调用函数