The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I am looking into one system hung issue and my customer shared complete memory dump of the system(Win 8.1 64-bit OS). When I loaded the memory dump in 64-bit WinDbg, the message “The context is partially valid. Only x86 user-mode context is available.” is displayed. I do notice abnormal behavior after running some WinDbg commands (like !vm or !locks).
01cff940: Unable to get paged pool info
332089b0: Unable to get page file name
NonPagedPool Usage: 0 ( 0 Kb)
30fac000: Unable to get pool descriptor, paged pool usage may be wrong
PagedPool Usage: 0 ( 0 Kb)
Unable to read nt!_LIST_ENTRY.Flink at 01c843d0
**** DUMP OF ALL RESOURCE OBJECTS ****
01c72970: Unable to get value of ExpSystemResourcesList
I have also noticed that WinDbg commands will work normally after switching to x64(AMD). I want to know the reason for message “The context is partially valid. Only x86 user-mode context is available.”
NOTE: I have already referred https://support.microsoft.com/en-us/help/2528507 and in my case OS is Win 8.1, so this article is not related.
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|