The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I am debugging one 0xD1 bugcheck and finding an inconsistency in the stack trace.
Here goes the stack trace:
# Child-SP RetAddr Call Site
15750468 fffff8040d1c6869 nt!KeBugCheckEx
15750470 fffff8040d1c2c8e nt!KiBugCheckDispatch+0x69
157505b0 fffff804675d3088 nt!KiPageFault+0x44e
15750740 fffff804675d35fb MyDriver!Function7+0x38
15750770 fffff804675f3005 MyDriver!Function4+0x39b
05 (Inline Function) --------
-------- MyDriver!Function3+0x10c 06 fffff804157507f0 fffff804
6760507f MyDriver!Function2+0x2e5 07 fffff80415750870 fffff804
6d87a6f8 MyDriver!Function1+0x34f 08 fffff80415750900 fffff804
0d067729 storport!RaidpAdapterTimerDpcRoutine+0x58 09 fffff80415750960 fffff804
0d0666e7 nt!KiProcessExpiredTimerList+0x159 0a fffff80415750a50 fffff804
0d1b8a5a nt!KiRetireDpcList+0x4a7 0b fffff80415750c60 00000000`00000000 nt!KiIdleLoop+0x5a
Note that Function7 is getting called from Function 4.
Here is the skeleton of Function 4:
In the WinDbg the line where Function6 is called is highlighted, which means the the control was passed from the previous line.
That happens to be a call to Function 5 using a pointer to that function. So in the stack Function5 should show up after Function 4, but is is Function7! The Function7 is never called from anywhere within Function4 anyway.
Any idea what can lead to this? If I execute a 'ln' command on the value of that function pointer (pFunction5) I correctly get Function 5!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|