A device driver or an operating system function running in kernel mode incurs an unhandled exception.
- A call to a kernel support routine results in a reschedule, such as waiting for an unsignaled dispacther object when the interrunpt request level(IRQL) is DPC/Dispatch level or higher.
- A page fault on memory backed by data in a paging file or a memory mapped file occures at an IRQL of DPC/Dispatch level or above (Which would require the memory manager to have to wait for an I/O operation to occur - and, as just stated, waits cannot occur at DPC/Dispatch level or higher because that would require a reschedule. )
- A device dirver or operating system function explicitly crashes the system (by calling the system function keBugCheckEx) because it detects an internal condition that indicates either a corruption or some other situation that indicates the system cannot continue execution w/o risking data corruption.
- A hardware error, such as a machine check or a nonmaskable interrupt(NMI), occurs.
The typical problems are that
- Unhandled exception
- OS or driver detects severe inconsistency
- Invalid memory references
- Hardware error
That's current windows solution. Can we improve it? Definitely, YES. I have developed utility as Proactive protection method. When I got appropriate FTP website, I will share to everyone.
To be continued...
没有评论:
发表评论