Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


strange behavior when the driver contain call of ExAllocateFromPagedLookasideList

yu_shangyu_shang Member Posts: 39
edited July 14 in NTFSD

Hi dear all,
I found that if a driver contain call of ExAllocateFromPagedLookasideList , the driver will not get loaded, even it is in a dead code path like this

if(FALSE) {
  ExAllocateFromPagedLookasideList(...); // if I comment out this line, everything is ok
}

How does this happen? I'm not sure if this is related with the last step of build : ApiValidator. Many thanks!

Comments

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,494

    This API can be inline or an import depending on the target OS (see WDM.H). Which OS are you targeting in your build setting and which OS are you running on?

    -scott
    OSR

  • yu_shangyu_shang Member Posts: 39
    edited July 14

    I'm using a building template copied from the WDK sample

    ...
    <TargetVersion>Windows10</TargetVersion>
    <UseDebugLibraries>True</UseDebugLibraries>
    <DriverTargetPlatform>Universal</DriverTargetPlatform>
    <DriverType>WDM</DriverType>
    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
    <ConfigurationType>Driver</ConfigurationType>
    ...
    

    The actual running OS is Windows LTSC (1809 17763.107)
    Update : Not sure if this API is exported by the actual running OS.

    Post edited by yu_shang on
  • yu_shangyu_shang Member Posts: 39
    edited July 14

    Thank you. Found the reason : the driver use the import version of ExAllocateFromPagedLookasideList , but the actual OS is not exporting the function.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 12 September 2022 Live, Online
Internals & Software Drivers 23 October 2022 Live, Online
Kernel Debugging 14 November 2022 Live, Online
Developing Minifilters 5 December 2022 Live, Online