Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

A tip, and a question

OSR_Community_UserOSR_Community_User Member Posts: 110,217
First the tip:
I want to display the contents of memory referenced by a local pointer
variable. Since the pointer is changing frequently, its far easier to deref
the pointer in the memory window than to copy the address and paste it into
the offset. If I paste the name of the pointer variable into the offset, I
get the contents of the local, which is the address of the memory I want to
see. It doesn't get deref'd. So to deref the pointer, I used
poi(pVariable), and it worked. Cool! Caused a bazillion "Unable to verify
Timestamp" warnings, though.

Now the question:
Is it possible to use WinDBG to trap system call exceptions? As an example,
I would like to trace into ZwCreateFile() to find out why I am unable to
open a file, no matter what combination of parameters I give it. I think it
may be an issue of not giving it a path it understands at a very early point
in the boot process, but I don't know that until I can step through it, and
maybe not even then. ZwCreateFile() stuffs 0x20 into EAX, then loads a
pointer to the top of the stack into EDX, and then executes int 2E. So I
tried adding Exception 0x2E and Exception 46 to the event filters, but it
doesn't do any good. When I try to trace into the exception handler, I end
up back at the routine that called ZwCreateFile. Any suggestions?

In case you were thinking to address the ZwCreateFile issue directly, I
welcome anyone's suggestions, but here's the situation: My driver is the
boot ATAPI driver, replacing atapi.sys, and I am trying to open a file from
the disk during initialization, which is the only time I am ever called at
any IRQL < DIRQL. So the runtime file system isn't initialized yet, because
it is waiting for my driver to startup properly. I don't know whether
ZwCreateFile will use the startup file loader or not, so I am trying
different forms of the file name, even tried Arc format several different
ways, without any success whatsoever. The error codes do change, so if I
pass known bogus parameters, I get error codes appropriate to the bad
parameter. But never does it actually succeed. I'm not sure it can, but I
would like to investigate further before I conclude that.



* Philip D. Barila | (503) 264-8386
* Intel Corp. | M/S JF2-53 Office JF2-2-G6
* Storage Architecture and Performance
* Internet Systems Lab

You are currently subscribed to windbg as: $subst('Recip.EmailAddr')
To unsubscribe send a blank email to leave-windbg-$subst('Recip.MemberIDChar')
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 24 January 2022 Live, Online
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online