Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

how to tell if dump mode or hiber mode

James_HarperJames_Harper Member Posts: 1,615
Is there a way to tell from a storport driver if I am in dump mode or hiber mode, preferably from DriverEntry? I know if I'm being called in dump/hiber mode, but not which of the two.

I'm guessing not as it doesn't seem to be documented anywhere, but it would be useful to know. In dump mode I need to patch the DebugPrint hooks, but in hiber mode I don't (and doing so causes double prints).

Thanks

James

Comments

  • Girish_BasrurGirish_Basrur Member Posts: 96
    Which OS version is this for? If Win 2012, the PORT_CONFIGURATION_INFORMATION has a member "DumpMode" which will provide this information. Of course, this will be in the HwStorInitialize routine.
    For versions prior to Win 2012, I do not think there is a means to identify this.

    Regards,
    Girish.
  • Paul_DurrantPaul_Durrant Member Posts: 45
    On 15 February 2013 12:00, James Harper <xxxxx@bendigoit.com.au> wrote:
    > Is there a way to tell from a storport driver if I am in dump mode or hiber mode, preferably from DriverEntry? I know if I'm being called in dump/hiber mode, but not which of the two.
    >
    > I'm guessing not as it doesn't seem to be documented anywhere, but it would be useful to know. In dump mode I need to patch the DebugPrint hooks, but in hiber mode I don't (and doing so causes double prints).
    >

    Happily there is a way :-) Look at the registry path you're given and
    your service should have been prefixed with either hiber_ or dump_.

    Paul

    --
    Paul Durrant
    http://www.linkedin.com/in/pdurrant
  • James_HarperJames_Harper Member Posts: 1,615
    > > Is there a way to tell from a storport driver if I am in dump mode or hiber
    > > mode, preferably from DriverEntry? I know if I'm being called in dump/hiber
    > > mode, but not which of the two.
    > >
    > > I'm guessing not as it doesn't seem to be documented anywhere, but it
    > > would be useful to know. In dump mode I need to patch the DebugPrint
    > > hooks, but in hiber mode I don't (and doing so causes double prints).
    > >
    >
    > Happily there is a way :-) Look at the registry path you're given and
    > your service should have been prefixed with either hiber_ or dump_.
    >

    RegistryPath passed to DriverEntry is always NULL in either mode

    James
  • James_HarperJames_Harper Member Posts: 1,615
    >
    > Which OS version is this for? If Win 2012, the
    > PORT_CONFIGURATION_INFORMATION has a member "DumpMode" which
    > will provide this information. Of course, this will be in the HwStorInitialize
    > routine.
    > For versions prior to Win 2012, I do not think there is a means to identify this.
    >

    Windows 8 is where I really care about it because by default 8 will hibernate instead of shut down, so having it not work would be a pain.

    The other alternative is that I don't claim to support hibernate... seems like the sort of thing WLK might take exception to though.

    James
  • Daniel_TerhellDaniel_Terhell Member Posts: 1,349
    "James Harper" wrote in message news:xxxxx@ntdev...
    >RegistryPath passed to DriverEntry is always NULL in either mode

    How can RegistryPath be NULL ? I think RegistryPath is never NULL. If yes,
    what type of driver do I write to achieve that ?

    //Daniel
  • James_HarperJames_Harper Member Posts: 1,615
    >
    > "James Harper" wrote in message news:xxxxx@ntdev...
    > >RegistryPath passed to DriverEntry is always NULL in either mode
    >
    > How can RegistryPath be NULL ? I think RegistryPath is never NULL. If yes,
    > what type of driver do I write to achieve that ?
    >

    The RegistryPath passed to DriverEntry is NULL in either of dump mode or hiber mode. From http://msdn.microsoft.com/en-us/library/windows/hardware/ff564084(v=vs.85).aspx

    "The operating system passes NULL arguments to the miniport driver's DriverEntry routine."

    My testing on Windows 2000 - 2012 confirms this.

    James
  • Don_BurnDon_Burn Member - All Emails Posts: 1,653
    Any time you get the crash dump driver (from one of the storage models)
    it is NULL. The normal invocation is fine, but the dump.


    Don Burn
    Windows Filesystem and Driver Consulting
    Website: http://www.windrvr.com
    Blog: http://msmvps.com/blogs/WinDrvr




    "xxxxx@resplendence.com" <xxxxx@resplendence.com> wrote in message
    news:xxxxx@ntdev:

    > "James Harper" wrote in message news:xxxxx@ntdev...
    > >RegistryPath passed to DriverEntry is always NULL in either mode
    >
    > How can RegistryPath be NULL ? I think RegistryPath is never NULL. If yes,
    > what type of driver do I write to achieve that ?
    >
    > //Daniel
  • James_HarperJames_Harper Member Posts: 1,615
    > >
    > > Which OS version is this for? If Win 2012, the
    > > PORT_CONFIGURATION_INFORMATION has a member "DumpMode"
    > which
    > > will provide this information. Of course, this will be in the HwStorInitialize
    > > routine.
    > > For versions prior to Win 2012, I do not think there is a means to identify
    > this.
    > >
    >
    > Windows 8 is where I really care about it because by default 8 will hibernate
    > instead of shut down, so having it not work would be a pain.
    >
    > The other alternative is that I don't claim to support hibernate... seems like
    > the sort of thing WLK might take exception to though.
    >

    I can call AuxKlibGetBugCheckData() - if the BugCheckCode == 0 then it probably isn't a bug check.

    James
  • Paul_DurrantPaul_Durrant Member Posts: 45
    Actually in my case I have an export driver linked to my miniport. The
    registry path to its DllInitialize is prefixed appropriately.

    Paul
    On Feb 15, 2013 11:14 PM, "James Harper"
    wrote:

    > > > Is there a way to tell from a storport driver if I am in dump mode or
    > hiber
    > > > mode, preferably from DriverEntry? I know if I'm being called in
    > dump/hiber
    > > > mode, but not which of the two.
    > > >
    > > > I'm guessing not as it doesn't seem to be documented anywhere, but it
    > > > would be useful to know. In dump mode I need to patch the DebugPrint
    > > > hooks, but in hiber mode I don't (and doing so causes double prints).
    > > >
    > >
    > > Happily there is a way :-) Look at the registry path you're given and
    > > your service should have been prefixed with either hiber_ or dump_.
    > >
    >
    > RegistryPath passed to DriverEntry is always NULL in either mode
    >
    > James
    >
    >
    >
    > ---
    > NTDEV is sponsored by OSR
    >
    > OSR is HIRING!! See http://www.osr.com/careers
    >
    > For our schedule of WDF, WDM, debugging and other seminars visit:
    > http://www.osr.com/seminars
    >
    > To unsubscribe, visit the List Server section of OSR Online at
    > http://www.osronline.com/page.cfm?name=ListServer
    >
  • Girish_BasrurGirish_Basrur Member Posts: 96
    <Windows 8 is where I really care about it because by default 8 will hibernate
    <instead of shut down, so having it not work would be a pain.

    The DumpMode flag mentioned previously is available for Win8 (http://msdn.microsoft.com/en-us/library/windows/hardware/ff563901(v=vs.85).aspx)
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Developing Minifilters 29 July 2019 OSR Seminar Space
Writing WDF Drivers 23 Sept 2019 OSR Seminar Space
Kernel Debugging 21 Oct 2019 OSR Seminar Space
Internals & Software Drivers 18 Nov 2019 Dulles, VA