Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Why NdisAllocateCloneNetBufferList is not incrementing ChildRefCount member of source NBL and not changing ParentNetBufferList of destination NBL. It remains 0 after NdisAllocateCloneNetBufferList.
What typically must I do after cloning.
Is there any flag, that specifies MDL as shared between two NBLs (original and cloned) .
PNET_BUFFER_LIST cloneNBL = NdisAllocateCloneNetBufferList(pNBL, pFilter->NBLPoolHandle, pFilter->NBPoolHandle, NDIS_CLONE_FLAGS_USE_ORIGINAL_MDLS); DEBUGP(DL_WARN, "pNBL->ChildRefCount = %d", pNBL->ChildRefCount); //remains 0 DEBUGP(DL_WARN, "cloneNBL->ParentNetBufferList = %p", cloneNBL->ParentNetBufferList); //remains NULL NdisCopyReceiveNetBufferListInfo(cloneNBL, pNBL); cloneNBL->SourceHandle = pFilter->FilterHandle; // pNBL->ChildRefCount++; cloneNBL->ParentNetBufferList = pNBL; cloneNBL->Scratch = (PVOID)UlongToPtr(ReceiveFlags);
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Internals & Software Drivers||19-23 June 2023||Live, Online|
|Writing WDF Drivers||10-14 July 2023||Live, Online|
|Kernel Debugging||16-20 October 2023||Live, Online|
|Developing Minifilters||13-17 November 2023||Live, Online|
When I uninstall my driver, its hangs up. When I close the receive and return (doing bypass), its successfully uninstalling. So the problem is in receive path. I think it is because of clone.
freezing occurs in NdisFDeregisterFilterDriver, when I try to uninstall the driver. Some NBLs may not have been sent or received
How can I study this problem with windbg.
Who can say
why the code is enclosed in #if DBG - #endif pair
You attach a debugger and press Ctrl-Break to freeze the system when it hangs. Now you should be about to examine each CPU and see which one is handling shutdown.
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.