Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Is exist Microsoft tools Utility for checking correct size IRP

Gova_GimerGova_Gimer Member - All Emails Posts: 40
edited November 25 in NTFSD

Hello,

I developping a driver disk file system .

I had a BSOD on ntfs.sys fat (it's not my driver !!!).

BSOD completely indebuggable!

Pardon,

Is exist a microsoft tool for check if
the size returned 'irp-> iostatus.information' is correct (not overrun buffer) according to disk system system IRP (eg. IRP_MJ_QUERY_INFORMATION,IRP_MJ_QUERY_VOLUME_INFORMATION) sended ?

[LINK REMOVED BY MODERATORS]

Thank.

Post edited by Peter_Viscarola_(OSR) on

Comments

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,505

    BSOD completely indebuggable!

    According to who? Do you mean YOU don't know how to debug it?

    Is exist a microsoft tool for check

    No such tool exists.

    Please post the output from !analyze -v from your crash and we can try to help with your problem.

    Peter

    Regarding the mod action on your post: I don't know what that link was... but we don't want people directed to random links with "stuff" to download from this forum.

    Peter Viscarola
    OSR
    @OSRDrivers

  • Gova_GimerGova_Gimer Member - All Emails Posts: 40

    Resultat :

    Microsoft (R) Windows Debugger Version 10.0.15063.468 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    BugCheck 12B, {ffffffffc00002c4, 558, a080dd0dd0, ffffd00020d0f000}

    *** WARNING: Unable to verify timestamp for NTFS.sys
    *** ERROR: Module load completed but symbols could not be loaded for NTFS.sys
    Probably caused by : ntkrnlmp.exe ( nt!ST_STORE::StDmPageError+e5 )

    Followup: MachineOwner

    1: kd> !analyze -v

    FAULTY_HARDWARE_CORRUPTED_PAGE (12b)
    This bugcheck indicates that a single bit error was found in this page. This is a hardware memory error.
    Arguments:
    Arg1: ffffffffc00002c4, virtual address mapping the corrupted page
    Arg2: 0000000000000558, physical page number
    Arg3: 000000a080dd0dd0, zero
    Arg4: ffffd00020d0f000, zero

    Debugging Details:

    DUMP_CLASS: 1

    DUMP_QUALIFIER: 400

    BUGCHECK_P1: ffffffffc00002c4

    BUGCHECK_P2: 558

    BUGCHECK_P3: a080dd0dd0

    BUGCHECK_P4: ffffd00020d0f000

    BUGCHECK_STR: 0x12B_c00002c4_StCtDecompressFailed

    CPU_COUNT: 2

    DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

    PROCESS_NAME: System

    CURRENT_IRQL: 1

    ANALYSIS_VERSION: 10.0.15063.468 amd64fre

    TRAP_FRAME: ffffd00154a2c4d0 -- (.trap 0xffffd00154a2c4d0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=00000000000000ff rbx=0000000000000000 rcx=ffffc0017c5ac300
    rdx=ffffc0017e93f701 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff802fdb1fdc3 rsp=ffffd00154a2c660 rbp=ffffe0001ef226c8
    r8=000000000002abe7 r9=0000ffffffffffff r10=ffffc00182f36750
    r11=ffffc0017c5ac300 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na pe nc
    nt!RebalanceNode+0x1b:
    fffff802fdb1fdc3 418a4218 mov al,byte ptr [r10+18h] ds:ffffc00182f36768=??
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff802fdcb89f9 to fffff802fdbc3c20

    STACK_TEXT:
    ffffd00154a2bbd8 fffff802fdcb89f9 : 000000000000012b ffffffffc00002c4 0000000000000558 000000a080dd0dd0 : nt!KeBugCheckEx
    ffffd00154a2bbe0 fffff802fdc36c69 : 0000000000000003 ffffe00021e10050 ffffe00021e10050 0000000000000001 : nt!ST_STORE::StDmPageError+0xe5
    ffffd00154a2bc50 fffff802fdb87ffe : ffffe00020f3c0f0 ffffe2e862f05acc ffffe00026581040 fffff802fdb897cc : nt! ?? ::FNODOBFM::string'+0x64469 ffffd00154a2bd30 fffff802fdb87e05 : 0000000000000002 ffffe000268072e0 ffffe00021e10050 0000000000000008 : nt!ST_STORE<SM_TRAITS>::StDmSinglePageTransfer+0xb6 ffffd00154a2bd90 fffff802fdb87b3d : ffffe000ffffffff 00000000000010dd fffff8020000003f ffffe00020f3c0f0 : nt!ST_STORE<SM_TRAITS>::StDmpSinglePageRetrieve+0x1e1 ffffd00154a2be30 fffff802fdb871fd : ffffd00154a2c020 ffffe00020f3c0f0 0000000000000040 ffffe0002246cbc0 : nt!ST_STORE<SM_TRAITS>::StDmPageRetrieve+0xc1 ffffd00154a2bef0 fffff802fdb87131 : ffffe00021e10000 ffffe00020f3c0f0 ffffe00021e10000 fffff802fdb87118 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadIssue+0x91 ffffd00154a2bf60 fffff802fdaf32f5 : ffffe00020f3c0f0 ffffd00154a2c020 ffffe00021e111d4 fffff802fdb5ca40 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadCallout+0x19 ffffd00154a2bf90 fffff802fdb87043 : 0000000000000003 fffff802fddba1c0 ffffe00026581000 ffffe00021e10000 : nt!KeExpandKernelStackAndCalloutInternal+0x85 ffffd00154a2bfe0 fffff802fdb85b08 : ffffe00020f3c0f0 0000000000000801 ffffe00021e10000 0000000000000002 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectRead+0xb7 ffffd00154a2c0b0 fffff802fdb857af : ffffe00020f3c0f0 ffffe00020f3c0f0 ffffe00021e10000 fffff802fddba1c0 : nt!SMKM_STORE<SM_TRAITS>::SmStWorkItemQueue+0x1c8 ffffd00154a2c110 fffff802fdb83951 : 000000000000000c ffffe0001f4f6820 0000000000000001 ffffe0001f4f6770 : nt!SMKM_STORE_MGR<SM_TRAITS>::SmIoCtxQueueWork+0xc7 ffffd00154a2c1a0 fffff802fdb837e5 : ffffe0001f4f6720 ffffd00154a2c260 ffffd00100000001 fffff6e000000000 : nt!SMKM_STORE_MGR<SM_TRAITS>::SmPageRead+0x165 ffffd00154a2c220 fffff802fdaa8981 : ffffd0012000845e ffffe0001f4f6770 ffffd00154a2c300 fffff802fdb837e5 : nt!SmPageRead+0x75 ffffd00154a2c260 fffff802fdaa6be8 : 0000000000000002 fffff802fddb9ab8 ffffe0001f4f6720 0000000000000000 : nt!MiIssueHardFaultIo+0x129 ffffd00154a2c2e0 fffff802fda9633d : 00000000c0033333 fffff802fddb9ab8 ffffc00182f36768 ffffc0017121ffa0 : nt!MiIssueHardFault+0x168 ffffd00154a2c380 fffff802fdbcccbd : ffffe2e862f0242c ffffd00154a2c4f0 ffffe00024ae38a0 0000000000000000 : nt!MmAccessFault+0x39d ffffd00154a2c4d0 fffff802fdb1fdc3 : ffffe0007866744e ffffe00024b948f0 ffffe0001ef22180 0000000000000705 : nt!KiPageFault+0x13d ffffd00154a2c660 fffff802fdb1f4a8 : ffffc0017e93f710 fffff801f54e7f9d 0000000000000010 0000000000010286 : nt!RebalanceNode+0x1b ffffd00154a2c690 fffff802fdb1f315 : ffffe0001ef226c8 0000000000000745 ffffe00024fb3ea0 0000000000000745 : nt!DeleteNodeFromTree+0x160 ffffd00154a2c6d0 fffff802fdb1f201 : ffffe0001ef226c8 ffffe00024fb3ea0 ffffe00021d493a8 ffffc00180013010 : nt!RtlDeleteElementGenericTableAvlEx+0x21 ffffd00154a2c700 fffff801f54bcdb7 : ffffd00154a2c7e0 0000000000000745 ffffc0017e93f710 ffffe0001ef22180 : nt!RtlDeleteElementGenericTableAvl+0x25 ffffd00154a2c730 ffffd00154a2c7e0 : 0000000000000745 ffffc0017e93f710 ffffe0001ef22180 000100000002abe7 : NTFS+0xbcdb7 ffffd00154a2c738 0000000000000745 : ffffc0017e93f710 ffffe0001ef22180 000100000002abe7 ffffc00180013420 : 0xffffd00154a2c7e0
    ffffd00154a2c740 ffffc0017e93f710 : ffffe0001ef22180 000100000002abe7 ffffc00180013420 ffffc00180013010 : 0x745
    ffffd00154a2c748 ffffe0001ef22180 : 000100000002abe7 ffffc00180013420 ffffc00180013010 ffffc00180013000 : 0xffffc0017e93f710 ffffd00154a2c750 000100000002abe7 : ffffc00180013420 ffffc00180013010 ffffc00180013000 ffffe00021d493a8 : 0xffffe0001ef22180
    ffffd00154a2c758 ffffc00180013420 : ffffc00180013010 ffffc00180013000 ffffe00021d493a8 ffffd00154a2ca40 : 0x000100000002abe7 ffffd00154a2c760 ffffc00180013010 : ffffc00180013000 ffffe00021d493a8 ffffd00154a2ca40 ffffc00180013010 : 0xffffc00180013420
    ffffd00154a2c768 ffffc00180013000 : ffffe00021d493a8 ffffd00154a2ca40 ffffc00180013010 ffffe0001ef22180 : 0xffffc00180013010 ffffd00154a2c770 ffffe00021d493a8 : ffffd00154a2ca40 ffffc00180013010 ffffe0001ef22180 ffffc00180013010 : 0xffffc00180013000
    ffffd00154a2c778 ffffd00154a2ca40 : ffffc00180013010 ffffe0001ef22180 ffffc00180013010 0000000000000000 : 0xffffe00021d493a8 ffffd00154a2c780 ffffc00180013010 : ffffe0001ef22180 ffffc00180013010 0000000000000000 ffffc00180013048 : 0xffffd00154a2ca40
    ffffd00154a2c788 ffffe0001ef22180 : ffffc00180013010 0000000000000000 ffffc00180013048 fffff801f540c71b : 0xffffc00180013010 ffffd00154a2c790 ffffc00180013010 : 0000000000000000 ffffc00180013048 fffff801f540c71b ffffc00180013000 : 0xffffe0001ef22180
    ffffd00154a2c798 0000000000000000 : ffffc00180013048 fffff801f540c71b ffffc00180013000 0000000000000000 : 0xffffc001`80013010

    STACK_COMMAND: kb

    THREAD_SHA1_HASH_MOD_FUNC: 8693ecd1480a9c0d27460385a366c5c7eb0c0624

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a1b06e4f3a41769bab1116163a7bc3a675a1b54b

    THREAD_SHA1_HASH_MOD: 63182674c6c8431d83a1bf4f7c6379a605c12d86

    FOLLOWUP_IP:
    nt!ST_STORE::StDmPageError+e5
    fffff802`fdcb89f9 cc int 3

    FAULT_INSTR_CODE: 848b44cc

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!ST_STORE::StDmPageError+e5

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 559f3c1a

    IMAGE_VERSION: 10.0.10240.16384

    BUCKET_ID_FUNC_OFFSET: e5

    FAILURE_BUCKET_ID: 0x12B_c00002c4_StCtDecompressFailed_nt!ST_STORE_SM_TRAITS_::StDmPageError

    BUCKET_ID: 0x12B_c00002c4_StCtDecompressFailed_nt!ST_STORE_SM_TRAITS_::StDmPageError

    PRIMARY_PROBLEM_CLASS: 0x12B_c00002c4_StCtDecompressFailed_nt!ST_STORE_SM_TRAITS_::StDmPageError

    TARGET_TIME: 2019-11-25T19:10:36.000Z

    OSBUILD: 10240

    OSSERVICEPACK: 16384

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK: 272

    PRODUCT_TYPE: 1

    OSPLATFORM_TYPE: x64

    OSNAME: Windows 10

    OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

    OS_LOCALE:

    USER_LCID: 0

    OSBUILD_TIMESTAMP: 2015-07-10 05:29:30

    BUILDDATESTAMP_STR: 150709-1700

    BUILDLAB_STR: th1

    BUILDOSVER_STR: 10.0.10240.16384

    ANALYSIS_SESSION_ELAPSED_TIME: 84c

    ANALYSIS_SOURCE: KM

    FAILURE_ID_HASH_STRING: km:0x12b_c00002c4_stctdecompressfailed_nt!st_store_sm_traits_::stdmpageerror

    FAILURE_ID_HASH: {c6a6bb4d-3b77-dff6-2d9b-75f5d0f61a50}

    Followup: MachineOwner

    1: kd> .trap 0xffffd00154a2c4d0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=00000000000000ff rbx=0000000000000000 rcx=ffffc0017c5ac300
    rdx=ffffc0017e93f701 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff802fdb1fdc3 rsp=ffffd00154a2c660 rbp=ffffe0001ef226c8
    r8=000000000002abe7 r9=0000ffffffffffff r10=ffffc00182f36750
    r11=ffffc0017c5ac300 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na pe nc
    nt!RebalanceNode+0x1b:
    fffff802fdb1fdc3 418a4218 mov al,byte ptr [r10+18h] ds:ffffc00182f36768=??

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,505

    There are a number of very similar crashes online.

    Does this crash happen on only one specific system?

    If I had to guess, and it is JUST a guess, I would say this problem is caused by a hardware problem.

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • Gova_GimerGova_Gimer Member - All Emails Posts: 40

    I think it's cause by my disk system file driver.
    But where to find the bug?
    is it an IRP overrun buffer which is returned ?

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Writing WDF Drivers 21 Oct 2019 OSR Seminar Space & ONLINE
Internals & Software Drivers 18 Nov 2019 Dulles, VA
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 27 Apr 2020 OSR Seminar Space & ONLINE