錯用RtlFreeUnicodeString引發BAD_POOL_CALL藍屏

extern "C" NTSTATUS __stdcall DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)<br />{<br />//........................................<br />//建立調試記錄檔案<br />OBJECT_ATTRIBUTES Obj_ = {0};<br />RtlInitUnicodeString(&UseData.Unicode, L"//??//Z://Log.txt");<br />InitializeObjectAttributes(&Obj_, &UseData.Unicode, OBJ_KERNEL_HANDLE|OBJ_CASE_INSENSITIVE, NULL, NULL);<br />UseData.Status = NtCreateFile(&UseData.hFile, FILE_READ_DATA|FILE_WRITE_DATA, &Obj_, &UseData.Isb, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ|FILE_SHARE_WRITE, FILE_SUPERSEDE, FILE_NON_DIRECTORY_FILE, NULL, NULL);<br />RtlFreeUnicodeString(&UseData.Unicode);<br /> //......................................<br />}

 

 

上面摘取的驅動代碼怎麼看都不覺得有問題(對咱菜鳥來說滴), 編譯驅動也是成功的.但載入之後就藍屏BAD_POOL_CALL,調試了好久才定位到RtlFreeUnicodeString這個函數上(第一是偷懶不想裝調試工具,估計也沒啥用...,第二就是很難想到會是在User Mode裡正常調用的RtlFreeUnicodeString出錯,鬱悶...)。

 

 

查看DDK的文檔http://www.osronline.com/ddkx/kmarch/k109_0koi.htm 才發現還有這麼一句:Pointer to the Unicode string buffer previously allocated by RtlAnsiStringToUnicodeString or RtlUpcaseUnicodeString.

 

可見,RtlFreeUnicodeString只能處理經由RtlAnsiStringToUnicodeString和RtlUpcaseUnicodeString的記憶體,而我並未使用它們~~~~~~~~~~

 

 

唉.....還好有虛擬機器............................................ 下次注意!