The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Whenever I get a BSOD during testing I just assume it's caused by my driver. I got this crash today though on a Win10 x64 box when restarting the system. My minifilter was already unloaded at the time. I looked at nt!KiPreBugcheckStackSaveArea and my driver isn't listed so, is there any other way to verify if my minifilter had any part in this? If it matters, DV is enabled for fltmgr.sys.
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arg1: ffffff0a3be90f90, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff80fd80615f7, if non-zero, the address which referenced memory.
Arg4: 000000000000000c, (reserved)
bae772d0 fffff80fd46f66fc luafv!LuafvPreWrite+0x47
bae77300 fffff80fd46f4cca FLTMGR!FltpPerformPreCallbacks+0x2dc
bae77420 fffff8019a33c972 FLTMGR!FltpPreFsFilterOperation+0x12a
bae774b0 fffff8019a7970b0 nt!FsFilterPerformCallbacks+0xd2
bae77510 fffff8019a468e64 nt!FsRtlAcquireFileForCcFlushEx+0xec
bae777c0 fffff8019a46882a nt!MiFlushControlArea+0xa4
bae77890 fffff8019a434f9d nt!MiDeleteCachedSegment+0xf2
bae778e0 fffff8019a23ee27 nt!MiDereferenceSegmentThread+0x9e29d
bae77b10 fffff8019a3cbf66 nt!PspSystemThreadStartup+0x47
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Internals & Software Drivers||15 November 2021||Live, Online|
|Writing WDF Drivers||TBD||Live, Online|
|Developing Minifilters||7 February 2022||Live, Online|
|Kernel Debugging||21 March 2022||Live, Online|