Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

RtlAllocateHeapSlowly

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Hi all,

In my previous mail I had said that there is no trace of my driver in the
stack trace I do. The driver still crashes with IRQL_NOT_LESS_OR_EQUAL
error code. And bumps upon a breakpoint in the RtlAllocateHeapSlowly in
ntoskrnl. But I am still not able to find out the problem area.

Can anybody tell me whats happening?

Regards.

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Hi there,

    What you can do is the following:
    Add on strategic points in your code a message what you have done and where
    you have entered/left a function. When doing this you can find out where
    the problem lies globally. When you also use binary bits to enable or
    disable a specific debugmessage popping up you can specify on which
    action/section in your driver the fault is to be reported. Add a timer
    which checks your registry once a second and you will be able to get
    specific debug logging at the moment you start an action where you expect a
    BSOD to happen. Connect a Serial/IEEE cable and you're halfways

    Best regards,
    Marco van Nieuwenhoven
    ThunderStore

    At 06:03 AM 3/6/2002 -0500, you wrote:
    >Hi all,
    >
    >In my previous mail I had said that there is no trace of my driver in the
    >stack trace I do. The driver still crashes with IRQL_NOT_LESS_OR_EQUAL
    >error code. And bumps upon a breakpoint in the RtlAllocateHeapSlowly in
    >ntoskrnl. But I am still not able to find out the problem area.
    >
    >Can anybody tell me whats happening?
    >
    >Regards.
    >
    >
    >---
    >You are currently subscribed to windbg as: [email protected]
    >To unsubscribe send a blank email to %%email.unsub%%
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Gee, how many times has this list seen that? "there is no trace of my driver
    in the stack trace ..."

    So? Since there is "No trace of your driver in the stack", does that mean it
    ain't your driver causing the problem? Since you are asking the question I
    think not. Your driver did something, or is doing something, that is causing
    heartburn in the system. It very possibly completed an IRP when it shouldn't
    have, and when the IRP is then later referenced it looks like someone else
    has the problem.

    !analyze -v helps by the way, and can many times point you to the critical
    point in your driver. What you need to do is pay very close attention to how
    you are synchronizing and serializing access to your IRPs and any queues
    that they may be on.

    My money is on the fact that you completed an IRP when you shouldn't have
    and didn't pop it from all referencing queues.

    Although ... I did see this once when I was allocating memory using the size
    of the pointer to a structure, and then clearing the size of the structure.
    Oh my was that nasty.

    --
    Gary G. Little
    [email protected]
    [email protected]

    wrote in message news:[email protected]
    >
    > Hi all,
    >
    > In my previous mail I had said that there is no trace of my driver in the
    > stack trace I do. The driver still crashes with IRQL_NOT_LESS_OR_EQUAL
    > error code. And bumps upon a breakpoint in the RtlAllocateHeapSlowly in
    > ntoskrnl. But I am still not able to find out the problem area.
    >
    > Can anybody tell me whats happening?
    >
    > Regards.
    >
    >
    >
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 24 January 2022 Live, Online
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online