驱动开发：BSOD 0x7E(8000003)或命中断点卡住，__security_init_cookie导致

最新推荐文章于 2023-08-11 17:07:13 发布

wull_

最新推荐文章于 2023-08-11 17:07:13 发布

阅读量868

点赞数

分类专栏： # 蓝屏文章标签：内核 c# 驱动程序

本文链接：https://blog.csdn.net/wull_/article/details/107630602

版权

在学习hook驱动时，作者遇到x64系统运行驱动导致的蓝屏问题，卡在__security_init_cookie函数。本文介绍了该函数的原理，以及三种解决方法：调整VS平台设置、使用KernelBufferOverflowLib库或关闭安全检查。作者最终发现错误是由于修改了win32属性而非x64平台设置所致。

摘要由CSDN通过智能技术生成

这两天在学hook的时候，写了一个很简单的测试驱动，结果发现在x86能正常运行，而到了x64就直接蓝屏了（签名正常），这个时候双机调试发现连DriverEntry函数都没进去，直接在__security_init_cookie函数就跳到KeBugCheck了。

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) 
This is a very common bugcheck.  Usually the exception address pinpoints 
the driver/function that caused the problem.  Always note this address 
as well as the link date of the driver/image that contains this address.
 Some common problems are exception code 0x80000003.  This means a hard 
 coded breakpoint or assertion was hit, but this system was booted 
 /NODEBUG.  This is not supposed to happen as developers should never have 
 hardcoded breakpoints in retail code, but ... 
 If this happens, make sure a debugger gets connected