INVALID_PROCESS_ATTACH_ATTEMPT

Does anyone have any ideas how to debug this blue screen stop code? Any
ideas what the parameters are?

I believe it means that KeAttachProcess() was called for a thread that was
already attached. Attachment requests are not stackable until WIN2K where
you need to use the request KeStackAttachProcess(). As for the parameters,
I have no clue. If they look like addresses, I suggest using the !obj,
!obja, or !object command in Windbg. One of these may tell you the type of
objects pointed to by the addresses. If I were to guess, I would suspect
one parameter might be the address of the process that is already attached.

I hope this helps.

Regards,

Rob

-----Original Message-----
From: Jerry Willett [mailto:xxxxx@digitaldelivery.com]
Sent: Thursday, April 20, 2000 9:58 AM
To: File Systems Developers
Subject: [ntfsd] INVALID_PROCESS_ATTACH_ATTEMPT

Does anyone have any ideas how to debug this blue screen stop
code? Any
ideas what the parameters are?


You are currently subscribed to ntfsd as: xxxxx@nsisw.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

> you need to use the request KeStackAttachProcess(). As for the
parameters,

I have no clue. If they look like addresses, I suggest using the !obj,

First parameter - KPROCESS pointer passed to KeAttachProcess (so, the
new process).
Second parameter - current thread’s process.
Third (I have doubts on it) - 1 is the thread is already attached to some
process, 0 otherwise???
Fourth - 1 is the attach attempt was on DPC level, 0 otherwise.

Max