Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Catch a bsod exception and send it through LWF?

Sooncheol_WonSooncheol_Won Member Posts: 25

Is it possible? If not is there an alternative way to notify the bsod exception(just code or stack trace or driver name) to another computer?
(Sending the memory.dmp file on next boot time is not an option..)

Comments

  • Don_BurnDon_Burn Member - All Emails Posts: 1,711

    No you can't do it through a LWF. By the time a BSOD happens you have to assume you do not have an operating system. With the KeRegisterBugCheckReasonCallback you can get called most of the time, and if you have a simple device you can talk to it directly. Most systems that want to do this use a dedicated device, because otherwise you have to worry about the devices state. At the time of the callback you basically have the ability to talk to the device, but no operating system support, for instance no memory allocation.

  • anton_bassovanton_bassov Member MODERATED Posts: 5,181

    Is it possible?

    https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/writing-a-bug-check-callback-routine

    [begin quote]

    A bug check callback routine executes at IRQL = HIGH_LEVEL, which imposes strong restrictions on what it can do.

    A bug check callback routine cannot:

    Allocate memory
    Access pageable memory
    Use any synchronization mechanisms
    Call any routine that must execute at IRQL = DISPATCH_LEVEL or below
    

    [end quote]

    Once NDIS routines that actually deal with sending and receiving data run at IRQL== DISPATCH_LEVEL, you are already not in a position to use the network services at the time your bugcheck callback routine gets invoked

    Anton Bassov

  • Pavel_APavel_A Member Posts: 2,739
    edited July 17

    If not is there an alternative way to notify the bsod exception(just code or stack trace or driver name) to another computer?

    Of course, there is a way. If the other computer is connected thru kernel debugger interface, it will see the BSOD and pull all the details.
    If the machine runs under hypervisor, there should be a way to pass some details to host.
    Want more ideas? ;)

    --pa

  • Don_BurnDon_Burn Member - All Emails Posts: 1,711

    Pavel, you can definitely do it through a hypervisor. I did it through a smart hardware device for a client almost 20 years ago, so a hypervisor interface should definitely work.

  • Sooncheol_WonSooncheol_Won Member Posts: 25
    edited July 17

    Thank you everyone!

  • anton_bassovanton_bassov Member MODERATED Posts: 5,181

    If the machine runs under hypervisor, there should be a way to pass some details to host.

    Assuming that the hypevisor provides the hypercalls that you can invoke in this situation, it definitely seems to be the right way to go.....

    Anton Bassov

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,374
    via Email
    A while ago I worked on a project that pulled the entire dump in real time
    out of a crashed vm and re-assembled it into a functional dump file. It is
    entirely do-able.

    Mark Roddy
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE