windows driver response Power Event

最新推荐文章于 2023-08-22 10:13:32 发布

原创最新推荐文章于 2023-08-22 10:13:32 发布 · 708 阅读

0 ·

CC 4.0 BY-SA版权

win内核专栏收录该内容

63 篇文章

订阅专栏

这篇博客记录了一次Windows内核调试的过程，包括连接到Windows 7 19041版本的目标系统，初始化Kernel Debugger，处理设备驱动的启动、电源管理和系统状态变化。在调试过程中，提到了设备驱动的加载失败、设备关系查询以及系统从工作状态到休眠、重启和关闭的转换。此外，还涉及到驱动对系统电源状态的响应，如PowerSystemWorking和PowerSystemShutdown。

#S5->S0
Waiting to reconnect...
USB2: Write opened
Connected to Windows 7 19041 x64 target at (Sun Jun 6 13:33:03.551 2021 (UTC + 8:00)), ptr64 TRUE
Kernel Debugger connection established. (Initial Breakpoint requested)
Symbol search path is: srv*C:\Symbols*http://msdl.microsoft.com/download/symbols;E:\symbols\win10X6420H2
Executable search path is:
Windows 7 Kernel Version 19041 MP (1 procs) Free x64
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff807`23a00000 PsLoadedModuleList = 0xfffff807`2462a2b0
System Uptime: 0 days 0:00:00.203
minio\security\base\lsa\security\driver\asyncsspi.cxx - SspiInitAsyncInterface
IOINIT: Built-in driver \Driver\hwpolicy failed to initialize with status - 0xC000025E
KDTARGET: Refreshing KD connection
ImagePath = \
>> DeviceControlLayer::FwStorageAccessor::worker(179): FW reading worker has started
<< DeviceControlLayer::FwStorageAccessor::worker(244): FW reading worker has finished
BusEnum.SYS: Driver Entry
BusEnum.SYS: Add Device: 0xFFFFCA0FDD321DA0
BusEnum.SYS: AddDevice: FFFFCA0FDF6515D0 to FFFFCA0FDD321DA0->FFFFCA0FDD321DA0 (\Device\00000011)
BusEnum.SYS: FDO IRP_MN_QUERY_LEGACY_BUS_INFORMATION IRP:0xFFFFCA0FDD681060
BusEnum.SYS: FDO IRP_MN_FILTER_RESOURCE_REQUIREMENTS IRP:0xFFFFCA0FDD681060
BusEnum.SYS: FDO IRP_MN_START_DEVICE IRP:0xFFFFCA0FDD69C420
BusEnum.SYS: FDO IRP_MN_QUERY_ID IRP:0xFFFFCA0FDD69C420
BusEnum.SYS: FDO IRP_MN_QUERY_ID IRP:0xFFFFCA0FDD69C420
BusEnum.SYS: FDO IRP_MN_QUERY_CAPABILITIES IRP:0xFFFFCA0FDD69C420
BusEnum.SYS: FDO IRP_MN_QUERY_PNP_DEVICE_STATE IRP:0xFFFFCA0FDD69C420
BusEnum.SYS: FDO IRP_MN_QUERY_DEVICE_RELATIONS IRP:0xFFFFCA0FDD69C420
   QueryDeviceRelation Type: BusRelations
   #PDOS present = 0
   #PDOs reported = 0
BusEnum.SYS: FDO: unknown_syscontrol_irp
===========================================================================================================================================
#S0->S3
0: kd> g
[Router Dll]: >> Dot11ExtIhvProcessSessionChange[Router Dll]: no security plugin was loaded[Router Dll]: << RC for Dot11ExtIhvProcessSessionChange - 55CIntelCpLSPCONSvcModule::OnPowerEvent() 0x4 instance already created 000001BD57545F70
BusEnum.SYS: FDO IRP_MN_QUERY_POWER IRP:0xFFFFCA0FEE69CA20 PowerSystemWorking PowerDeviceD0
HAL: Wake in 4294967295 seconds on AC and in 4294967295 seconds on DC
BusEnum.SYS: FDO IRP_MN_SET_POWER IRP:0xFFFFCA0FEE17BA20 PowerSystemWorking PowerDeviceD0
   Request to set System state to PowerSystemSleeping3

#S3->S0
===========================================================================================================================================
#S0->S4
2: kd> g
BusEnum.SYS: FDO IRP_MN_QUERY_POWER IRP:0xFFFFCA0FEE688D30 PowerSystemWorking PowerDeviceD0
HAL: Wake in 4294967295 seconds on AC and in 4294967295 seconds on DC
BusEnum.SYS: FDO IRP_MN_SET_POWER IRP:0xFFFFCA0FEC9457A0 PowerSystemWorking PowerDeviceD0
Request to set System state to PowerSystemHibernate
Hibernate occurred
WARNING: Inaccessible path: 'C:\Users\burly\Documents\Visual Studio 2010\Projects'
Waiting to reconnect...

#S4->S0
2: kd> g
USB2: Write opened
Connected to Windows 7 19041 x64 target at (Sun Jun 6 13:46:58.697 2021 (UTC + 8:00)), ptr64 TRUE
Kernel Debugger connection established. (Initial Breakpoint requested)
Symbol search path is: srv*C:\Symbols*http://msdl.microsoft.com/download/symbols;E:\symbols\win10X6420H2
Executable search path is:
Windows 7 Kernel Version 19041 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff807`23a00000 PsLoadedModuleList = 0xfffff807`2462a2b0
Debug session time: Fri Feb 19 10:06:59.773 2021 (UTC + 8:00)
System Uptime: 0 days 0:09:47.287
BusEnum.SYS: FDO IRP_MN_SET_POWER IRP:0xFFFFCA0FEE8BD010 PowerSystemWorking PowerDeviceD0
Request to set System state to PowerSystemWorking
HAL: Wake in 4294967295 seconds on AC and in 4294967295 seconds on DC
===========================================================================================================================================
#S0->Restart
2: kd> g

BusEnum.SYS: FDO IRP_MN_SET_POWER IRP:0xFFFFCA0FED844C80 PowerSystemWorking PowerDeviceD0
Request to set System state to PowerSystemShutdown
Shutdown occurred at (Sun Jun 6 13:53:17.444 2021 (UTC + 8:00))...unloading all symbol tables.
WARNING: Inaccessible path: 'C:\Users\burly\Documents\Visual Studio 2010\Projects'
Waiting to reconnect...

Connected to Windows 7 19041 x64 target at (Sun Jun 6 13:54:56.624 2021 (UTC + 8:00)), ptr64 TRUE
Kernel Debugger connection established. (Initial Breakpoint requested)
Symbol search path is: srv*C:\Symbols*http://msdl.microsoft.com/download/symbols;E:\symbols\win10X6420H2
Executable search path is:
Windows 7 Kernel Version 19041 MP (1 procs) Free x64
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff806`76e00000 PsLoadedModuleList = 0xfffff806`77a2a2b0
System Uptime: 0 days 0:00:00.195
BusEnum.SYS: Driver Entry
BusEnum.SYS: Add Device: 0xFFFFB208468CCD70
BusEnum.SYS: AddDevice: FFFFB20848CC6260 to FFFFB208468CCD70->FFFFB208468CCD70 (\Device\00000011)
BusEnum.SYS: FDO IRP_MN_QUERY_LEGACY_BUS_INFORMATION IRP:0xFFFFB20846A8A520
BusEnum.SYS: FDO IRP_MN_FILTER_RESOURCE_REQUIREMENTS IRP:0xFFFFB20846A8A520
Thotkey LEDSTATE = 0x00000001
BusEnum.SYS: FDO IRP_MN_START_DEVICE IRP:0xFFFFB20846AAC020
BusEnum.SYS: FDO IRP_MN_QUERY_ID IRP:0xFFFFB20846AAC020
BusEnum.SYS: FDO IRP_MN_QUERY_ID IRP:0xFFFFB20846AAC020
BusEnum.SYS: FDO IRP_MN_QUERY_CAPABILITIES IRP:0xFFFFB20846AAC020
BusEnum.SYS: FDO IRP_MN_QUERY_PNP_DEVICE_STATE IRP:0xFFFFB20846AAC020
BusEnum.SYS: FDO IRP_MN_QUERY_DEVICE_RELATIONS IRP:0xFFFFB20846AAC020
   QueryDeviceRelation Type: BusRelations
   #PDOS present = 0
   #PDOs reported = 0
BusEnum.SYS: FDO: unknown_syscontrol_irp
===========================================================================================================================================
#S0->S5
3: kd> g
BusEnum.SYS: FDO IRP_MN_SET_POWER IRP:0xFFFFB20856502B00 PowerSystemWorking PowerDeviceD0
   Request to set System state to PowerSystemShutdown
Shutdown occurred at (Sun Jun 6 14:02:19.871 2021 (UTC + 8:00))...unloading all symbol tables.
WARNING: Inaccessible path: 'C:\Users\burly\Documents\Visual Studio 2010\Projects'
Waiting to reconnect...

USB2: Write opened
Connected to Windows 7 19041 x64 target at (Sun Jun 6 14:04:25.611 2021 (UTC + 8:00)), ptr64 TRUE
Kernel Debugger connection established. (Initial Breakpoint requested)
Symbol search path is: srv*C:\Symbols*http://msdl.microsoft.com/download/symbols;E:\symbols\win10X6420H2
Executable search path is:
Windows 7 Kernel Version 19041 MP (1 procs) Free x64
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff806`72c00000 PsLoadedModuleList = 0xfffff806`7382a2b0
System Uptime: 0 days 0:00:00.194
IOINIT: Built-in driver \Driver\hwpolicy failed to initialize with status - 0xC000025E
KDTARGET: Refreshing KD connection
ImagePath = \
BusEnum.SYS: Driver Entry
BusEnum.SYS: Add Device: 0xFFFFC30BFB4CBD70
BusEnum.SYS: AddDevice: FFFFC30BFD5CECD0 to FFFFC30BFB4CBD70->FFFFC30BFB4CBD70 (\Device\00000011)
BusEnum.SYS: FDO IRP_MN_QUERY_LEGACY_BUS_INFORMATION IRP:0xFFFFC30BFB691CE0
BusEnum.SYS: FDO IRP_MN_FILTER_RESOURCE_REQUIREMENTS IRP:0xFFFFC30BFB691CE0
BusEnum.SYS: FDO IRP_MN_START_DEVICE IRP:0xFFFFC30BFB6AC0E0
BusEnum.SYS: FDO IRP_MN_QUERY_ID IRP:0xFFFFC30BFB6AC0E0
BusEnum.SYS: FDO IRP_MN_QUERY_ID IRP:0xFFFFC30BFB6AC0E0
BusEnum.SYS: FDO IRP_MN_QUERY_CAPABILITIES IRP:0xFFFFC30BFB6AC0E0
BusEnum.SYS: FDO IRP_MN_QUERY_PNP_DEVICE_STATE IRP:0xFFFFC30BFB6AC0E0
BusEnum.SYS: FDO IRP_MN_QUERY_DEVICE_RELATIONS IRP:0xFFFFC30BFB6AC0E0
   QueryDeviceRelation Type: BusRelations
   #PDOS present = 0
   #PDOs reported = 0
BusEnum.SYS: FDO: unknown_syscontrol_irp