The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I'm debugging a problem with kernel-mode memory corruption on the system running Windows 10 x64 Build 17763.107. I'm using latest Windbg version 10.0.17763.132 AMD64.
I'm executing under Verifier and I'm using Special pool with granularity 0x20
Whenever I'm trying to use !pool command, I'm receiving a message "Failed to read heap key". For example:
3: kd> !vm 0x20 ************ NO PAGING FILE ********************* Physical Memory: 1048284 ( 4193136 Kb) ... NonPagedPool Usage: 0 ( 0 Kb) NonPagedPoolNx Usage: 1425 ( 5700 Kb) NonPagedPool Max: 4294967296 (17179869184 Kb) PagedPool 0: 0 ( 0 Kb) PagedPool 1: 0 ( 0 Kb) PagedPool 2: 0 ( 0 Kb) PagedPool 3: 0 ( 0 Kb) PagedPool 4: 0 ( 0 Kb) PagedPool Usage: 0 ( 0 Kb) PagedPool Maximum: 4294967296 (17179869184 Kb) ... System Region Base Address NumberOfBytes UltraZero : ffff828000000000 100000000000 ... PagedPool : ffffc30000000000 100000000000 ... SpecialPoolPaged : ffffde8000000000 8000000000 NonPagedPool : ffffdf0000000000 100000000000 ... SpecialPoolNonPaged : fffffd0000000000 8000000000 3: kd> !pool fffffd0000000000 Failed to read heap key 3: kd> !pool ffffdf0000000000 Failed to read heap key
Do I miss something? How else can I enforce verification of the Non-Paged (special) pool at the WinDbg break?
Thank you in advance,
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|