首先蓝屏时候，会发生文件转储，先开启蓝屏文件转储。
一般内核开发，选核心内存转储即可，下面就是生成文件的位置，为了学习把自动重新启动点掉，不然蓝屏后系统会自动重启。
下面写个蓝屏驱动让其发生BAD_POOL_CALLER(如果造成蓝屏的驱动是随系统启动而启动，会反复重启，则可以通过安全模式进入系统去拿dump文件)
dump文件在之前设置的目录中，一般不修改位置就在window目录里。就是MEMORY.DMP，拖到开发机来，然后用windbg开始分析他，选择file里open crash dump开始分析它。首先加载符号。然后设置源文件的路径。
然后运行命令!analyze -v,然后产生了如下图的一个蓝屏分析报告
kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_CALLER (c2) The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc. Arguments: Arg1: 00000099, Attempt to free pool with invalid address (or corruption in pool header) Arg2: 98acd700, Address being freed Arg3: 00000000, 0 Arg4: 00000000, 0 Debugging Details: ------------------ SYMSRV: BYINDEX: 0x5CF d:\symbols 7x86*http://msdl.microsoft.com/download/symbols ntkrpamp.exe 4CE78A09412000 SYMSRV: PATH: d:\symbols 7x86\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe SYMSRV: RESULT: 0x00000000 DBGHELP: d:\symbols 7x86\ntkrpamp.exe\4CE78A09412000\ntkrpamp.exe - OK SYMSRV: BYINDEX: 0x5D0 d:\symbols 7x86*http://msdl.microsoft.com/download/symbols UcOperDrv.sys 59ABCCDCc00 SYMSRV: UNC: d:\symbols 7x86\UcOperDrv.sys\59ABCCDCc00\UcOperDrv.sys - path not found SYMSRV: UNC: d:\symbols 7x86\UcOperDrv.sys\59ABCCDCc00\UcOperDrv.sy_ - path not found SYMSRV: UNC: d:\symbols 7x86\UcOperDrv.sys\59ABCCDCc00\file.ptr - path not found SYMSRV: HTTPGET: /download/symbols/UcOperDrv.sys/59ABCCDCc00/UcOperDrv.sys SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND SYMSRV: HTTPGET: /download/symbols/UcOperDrv.sys/59ABCCDCc00/UcOperDrv.sy_ SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND SYMSRV: HTTPGET: /download/symbols/UcOperDrv.sys/59ABCCDCc00/file.ptr SYMSRV: HttpQueryInfo: 80190194 - HTTP_STATUS_NOT_FOUND SYMSRV: RESULT: 0x80190194 DBGHELP: E:\MF\1firstl-Hello\dbgdemo\bsod\debug\i386\UcOperDrv.sys - OK KEY_VALUES_STRING: 1 STACKHASH_ANALYSIS: 1 TIMELINE_ANALYSIS: 1 DUMP_CLASS: 1 DUMP_QUALIFIER: 401 BUILD_VERSION_STRING: 7601.17514.x86fre.win7sp1_rtm.101119-1850 SYSTEM_MANUFACTURER: VMware, Inc. VIRTUAL_MACHINE: VMware SYSTEM_PRODUCT_NAME: VMware Virtual Platform SYSTEM_VERSION: None BIOS_VENDOR: Phoenix Technologies LTD BIOS_VERSION: 6.00 BIOS_DATE: 05/19/2017 BASEBOARD_MANUFACTURER: Intel Corporation BASEBOARD_PRODUCT: 440BX Desktop Reference Platform BASEBOARD_VERSION: None DUMP_TYPE: 1 BUGCHECK_P1: 99 BUGCHECK_P2: ffffffff98acd700 BUGCHECK_P3: 0 BUGCHECK_P4: 0 FAULTING_IP: UcOperDrv!OperUnicodeStr+2ab [d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c @ 70] 98acd6db 8be5 mov esp,ebp BUGCHECK_STR: 0xc2_99 CPU_COUNT: 1 CPU_MHZ: 9c5 CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: 3c CPU_STEPPING: 3 CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 25'00000000 (cache) 25'00000000 (init) DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ANALYSIS_SESSION_HOST: DESKTOP-4BL1C4H ANALYSIS_SESSION_TIME: 05-23-2019 22:50:18.0491 ANALYSIS_VERSION: 10.0.17763.1 amd64fre LAST_CONTROL_TRANSFER: from 84173f03 to 83f1bf20 STACK_TEXT: 807f18c4 84173f03 000000c2 00000099 98acd700 nt!KeBugCheckEx+0x1e 807f18e4 83f2d389 98acd700 98acd6f8 000001ff nt!VerifierBugCheckIfAppropriate+0x30 807f18f8 83f5eff9 98acd700 00000660 00000000 nt!VerifierFreeTrackedPool+0x24 807f1968 98acd6db 98acd700 00000000 0000000e nt!ExFreePoolWithTag+0x53e 807f19d0 98acd41a 807f1bbc 840012e6 86034190 UcOperDrv!OperUnicodeStr+0x2ab [d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c @ 70] 807f19d8 840012e6 86034190 86036000 00000000 UcOperDrv!DriverEntry+0xa [d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c @ 11] 807f1bbc 84004d98 00000001 00000000 807f1be4 nt!IopLoadDriver+0x7ed 807f1c00 83ebaaab 94f99bd0 00000000 85cdf798 nt!IopLoadUnloadDriver+0x70 807f1c50 84046f5e 00000001 a76e1e35 00000000 nt!ExpWorkerThread+0x10d 807f1c90 83eee219 83eba99e 00000001 00000000 nt!PspSystemThreadStartup+0x9e 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19 THREAD_SHA1_HASH_MOD_FUNC: cb829f32645adac3007376ebdc069b62c0d10643 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6973de209d28a1de8ac3d73dd48d1020a3075ae5 THREAD_SHA1_HASH_MOD: 589add185ebdeba4826121bc925fe3e22f690d15 FOLLOWUP_IP: UcOperDrv!OperUnicodeStr+2ab [d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c @ 70] 98acd6db 8be5 mov esp,ebp FAULT_INSTR_CODE: c35de58b FAULTING_SOURCE_LINE: d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c FAULTING_SOURCE_FILE: d:\mallocfree_2017\windows\1firstl-hello\dbgdemo\bsod\main.c FAULTING_SOURCE_LINE_NUMBER: 70 FAULTING_SOURCE_CODE: 66: DbgPrint("%wZ\n", &uStr4); 67: 68: ExFreePool(uStr4.Buffer); 69: > 70: } SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: UcOperDrv!OperUnicodeStr+2ab FOLLOWUP_NAME: MachineOwner MODULE_NAME: UcOperDrv IMAGE_NAME: UcOperDrv.sys DEBUG_FLR_IMAGE_TIMESTAMP: 59abccdc STACK_COMMAND: .thread ; .cxr ; kb FAILURE_BUCKET_ID: 0xc2_99_UcOperDrv!OperUnicodeStr+2ab BUCKET_ID: 0xc2_99_UcOperDrv!OperUnicodeStr+2ab PRIMARY_PROBLEM_CLASS: 0xc2_99_UcOperDrv!OperUnicodeStr+2ab TARGET_TIME: 2019-05-23T13:35:36.000Z OSBUILD: 7601 OSSERVICEPACK: 1000 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 SUITE_MASK: 272 PRODUCT_TYPE: 1 OSPLATFORM_TYPE: x86 OSNAME: Windows 7 OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2010-11-20 16:42:49 BUILDDATESTAMP_STR: 101119-1850 BUILDLAB_STR: win7sp1_rtm BUILDOSVER_STR: 6.1.7601.17514.x86fre.win7sp1_rtm.101119-1850 ANALYSIS_SESSION_ELAPSED_TIME: c68 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0xc2_99_ucoperdrv!operunicodestr+2ab FAILURE_ID_HASH: {6ef3c91d-9314-e8dd-6cc0-f9889f201760} Followup: MachineOwner ---------然后通过报告去看引起错误的地方，这里可以通过.open -a UcOperDrv!OperUnicodeStr+0x2ab查看
#include <ntddk.h> VOID OperUnicodeStr(VOID); NTSTATUS DriverEntry( IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegPath) { OperUnicodeStr(); return STATUS_SUCCESS; } VOID OperUnicodeStr(VOID) { UNICODE_STRING uStr1 = {0}; UNICODE_STRING uStr2 = {0}; UNICODE_STRING uStr3 = {0}; UNICODE_STRING uStr4 = {0}; ANSI_STRING aStr1 = {0}; RtlInitUnicodeString(&uStr1, L"hello"); RtlInitUnicodeString(&uStr2, L"Goodbye"); DbgPrint("uStr1=%wZ\n", uStr1); DbgPrint("uStr2=%wZ\n", uStr2); RtlInitAnsiString(&aStr1, "Ansi string"); DbgPrint("aStr1=%Z\n", aStr1); RtlCopyUnicodeString(&uStr3, &uStr1); DbgPrint("uStr3=%wZ\n", uStr3); RtlAppendUnicodeToString(&uStr1, L"world"); DbgPrint("uStr1=%wZ\n", uStr1); RtlAppendUnicodeStringToString(&uStr1, &uStr2); DbgPrint("uStr1=%wZ\n", uStr1); if (RtlCompareUnicodeString(&uStr1, &uStr2, TRUE) == 0)//TRUE:case sensible { DbgPrint("%wZ == %wZ\n", uStr1, uStr2); } else { DbgPrint("%wZ != %wZ\n", uStr1, uStr2); } RtlAnsiStringToUnicodeString(&uStr3, &aStr1, TRUE);//TRUE: memory allocation for uStr1 and should be freed by RtlFreeUnicodeString DbgPrint("%wZ\n", uStr3); RtlFreeUnicodeString(&uStr3); uStr4.Buffer = ExAllocatePoolWithTag(PagedPool, wcslen(L"Nice to meet u")+sizeof(WCHAR), 'POCU'); if (uStr4.Buffer == NULL) { return; } RtlZeroMemory(uStr4.Buffer, wcslen(L"Nice to meet u")+sizeof(WCHAR)); uStr4.Length = 0; uStr4.MaximumLength = wcslen(L"Nice to meet u")+sizeof(WCHAR); RtlInitUnicodeString(&uStr4, L"Nice to meet u"); DbgPrint("%wZ\n", &uStr4); ExFreePool(uStr4.Buffer); }就可以分析，一般造成蓝屏原因比如
关闭了无效handle
在没有ObReferenceObject（pFileObject）下ObDereferenceObject（pFileObject)
引用NULL指针
内存访问越界 BAD POOL HEADER
高中断访问了缺页内存 DRIVER_IRQL_NOT_LESS_OR_EQUAL
另外可以参考微软文档
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
