Does anyone have any ideas how to debug this blue screen stop code? Any
ideas what the parameters are?
I believe it means that KeAttachProcess() was called for a thread that was
already attached. Attachment requests are not stackable until WIN2K where
you need to use the request KeStackAttachProcess(). As for the parameters,
I have no clue. If they look like addresses, I suggest using the !obj,
!obja, or !object command in Windbg. One of these may tell you the type of
objects pointed to by the addresses. If I were to guess, I would suspect
one parameter might be the address of the process that is already attached.
I hope this helps.
Regards,
Rob
-----Original Message-----
From: Jerry Willett [mailto:xxxxx@digitaldelivery.com]
Sent: Thursday, April 20, 2000 9:58 AM
To: File Systems Developers
Subject: [ntfsd] INVALID_PROCESS_ATTACH_ATTEMPTDoes anyone have any ideas how to debug this blue screen stop
code? Any
ideas what the parameters are?
You are currently subscribed to ntfsd as: xxxxx@nsisw.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)
> you need to use the request KeStackAttachProcess(). As for the
parameters,
I have no clue. If they look like addresses, I suggest using the !obj,
First parameter - KPROCESS pointer passed to KeAttachProcess (so, the
new process).
Second parameter - current thread’s process.
Third (I have doubts on it) - 1 is the thread is already attached to some
process, 0 otherwise???
Fourth - 1 is the attach attempt was on DPC level, 0 otherwise.
Max