Is exist Microsoft tools Utility for checking correct size IRP

NTFSD
1

Hello,

I developping a driver disk file system .

I had a BSOD on ntfs.sys fat (it’s not my driver !!!).

BSOD completely indebuggable!

Pardon,

Is exist a microsoft tool for check if
the size returned ‘irp-> iostatus.information’ is correct (not overrun buffer) according to disk system system IRP (eg. IRP_MJ_QUERY_INFORMATION,IRP_MJ_QUERY_VOLUME_INFORMATION) sended ?

[LINK REMOVED BY MODERATORS]

Thank.

2

BSOD completely indebuggable!

According to who? Do you mean YOU don’t know how to debug it?

Is exist a microsoft tool for check

No such tool exists.

Please post the output from !analyze -v from your crash and we can try to help with your problem.

Peter

Regarding the mod action on your post: I don’t know what that link was… but we don’t want people directed to random links with “stuff” to download from this forum.

3

Resultat :

Microsoft (R) Windows Debugger Version 10.0.15063.468 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

BugCheck 12B, {ffffffffc00002c4, 558, a080dd0dd0, ffffd00020d0f000}

*** WARNING: Unable to verify timestamp for NTFS.sys
*** ERROR: Module load completed but symbols could not be loaded for NTFS.sys
Probably caused by : ntkrnlmp.exe ( nt!ST_STORE<SM_TRAITS>::StDmPageError+e5 )

Followup: MachineOwner

1: kd> !analyze -v

FAULTY_HARDWARE_CORRUPTED_PAGE (12b)
This bugcheck indicates that a single bit error was found in this page. This is a hardware memory error.
Arguments:
Arg1: ffffffffc00002c4, virtual address mapping the corrupted page
Arg2: 0000000000000558, physical page number
Arg3: 000000a080dd0dd0, zero
Arg4: ffffd00020d0f000, zero

Debugging Details:

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUGCHECK_P1: ffffffffc00002c4

BUGCHECK_P2: 558

BUGCHECK_P3: a080dd0dd0

BUGCHECK_P4: ffffd00020d0f000

BUGCHECK_STR: 0x12B_c00002c4_StCtDecompressFailed

CPU_COUNT: 2

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 1

ANALYSIS_VERSION: 10.0.15063.468 amd64fre

TRAP_FRAME: ffffd00154a2c4d0 – (.trap 0xffffd00154a2c4d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000ff rbx=0000000000000000 rcx=ffffc0017c5ac300
rdx=ffffc0017e93f701 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802fdb1fdc3 rsp=ffffd00154a2c660 rbp=ffffe0001ef226c8
r8=000000000002abe7 r9=0000ffffffffffff r10=ffffc00182f36750
r11=ffffc0017c5ac300 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!RebalanceNode+0x1b:
fffff802fdb1fdc3 418a4218 mov al,byte ptr [r10+18h] ds:ffffc00182f36768=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff802fdcb89f9 to fffff802fdbc3c20

STACK_TEXT:
ffffd00154a2bbd8 fffff802fdcb89f9 : 000000000000012b ffffffffc00002c4 0000000000000558 000000a080dd0dd0 : nt!KeBugCheckEx
ffffd00154a2bbe0 fffff802fdc36c69 : 0000000000000003 ffffe00021e10050 ffffe00021e10050 0000000000000001 : nt!ST_STORE<SM_TRAITS>::StDmPageError+0xe5
ffffd00154a2bc50 fffff802fdb87ffe : ffffe00020f3c0f0 ffffe2e862f05acc ffffe00026581040 fffff802fdb897cc : nt! ?? ::FNODOBFM::string'+0x64469 ffffd00154a2bd30 fffff802fdb87e05 : 0000000000000002 ffffe000268072e0 ffffe00021e10050 0000000000000008 : nt!ST_STORE<SM_TRAITS>::StDmSinglePageTransfer+0xb6 ffffd00154a2bd90 fffff802fdb87b3d : ffffe000ffffffff 00000000000010dd fffff8020000003f ffffe00020f3c0f0 : nt!ST_STORE<SM_TRAITS>::StDmpSinglePageRetrieve+0x1e1 ffffd00154a2be30 fffff802fdb871fd : ffffd00154a2c020 ffffe00020f3c0f0 0000000000000040 ffffe0002246cbc0 : nt!ST_STORE<SM_TRAITS>::StDmPageRetrieve+0xc1 ffffd00154a2bef0 fffff802fdb87131 : ffffe00021e10000 ffffe00020f3c0f0 ffffe00021e10000 fffff802fdb87118 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadIssue+0x91 ffffd00154a2bf60 fffff802fdaf32f5 : ffffe00020f3c0f0 ffffd00154a2c020 ffffe00021e111d4 fffff802fdb5ca40 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadCallout+0x19 ffffd00154a2bf90 fffff802fdb87043 : 0000000000000003 fffff802fddba1c0 ffffe00026581000 ffffe00021e10000 : nt!KeExpandKernelStackAndCalloutInternal+0x85 ffffd00154a2bfe0 fffff802fdb85b08 : ffffe00020f3c0f0 0000000000000801 ffffe00021e10000 0000000000000002 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectRead+0xb7 ffffd00154a2c0b0 fffff802fdb857af : ffffe00020f3c0f0 ffffe00020f3c0f0 ffffe00021e10000 fffff802fddba1c0 : nt!SMKM_STORE<SM_TRAITS>::SmStWorkItemQueue+0x1c8 ffffd00154a2c110 fffff802fdb83951 : 000000000000000c ffffe0001f4f6820 0000000000000001 ffffe0001f4f6770 : nt!SMKM_STORE_MGR<SM_TRAITS>::SmIoCtxQueueWork+0xc7 ffffd00154a2c1a0 fffff802fdb837e5 : ffffe0001f4f6720 ffffd00154a2c260 ffffd00100000001 fffff6e000000000 : nt!SMKM_STORE_MGR<SM_TRAITS>::SmPageRead+0x165 ffffd00154a2c220 fffff802fdaa8981 : ffffd0012000845e ffffe0001f4f6770 ffffd00154a2c300 fffff802fdb837e5 : nt!SmPageRead+0x75 ffffd00154a2c260 fffff802fdaa6be8 : 0000000000000002 fffff802fddb9ab8 ffffe0001f4f6720 0000000000000000 : nt!MiIssueHardFaultIo+0x129 ffffd00154a2c2e0 fffff802fda9633d : 00000000c0033333 fffff802fddb9ab8 ffffc00182f36768 ffffc0017121ffa0 : nt!MiIssueHardFault+0x168 ffffd00154a2c380 fffff802fdbcccbd : ffffe2e862f0242c ffffd00154a2c4f0 ffffe00024ae38a0 0000000000000000 : nt!MmAccessFault+0x39d ffffd00154a2c4d0 fffff802fdb1fdc3 : ffffe0007866744e ffffe00024b948f0 ffffe0001ef22180 0000000000000705 : nt!KiPageFault+0x13d ffffd00154a2c660 fffff802fdb1f4a8 : ffffc0017e93f710 fffff801f54e7f9d 0000000000000010 0000000000010286 : nt!RebalanceNode+0x1b ffffd00154a2c690 fffff802fdb1f315 : ffffe0001ef226c8 0000000000000745 ffffe00024fb3ea0 0000000000000745 : nt!DeleteNodeFromTree+0x160 ffffd00154a2c6d0 fffff802fdb1f201 : ffffe0001ef226c8 ffffe00024fb3ea0 ffffe00021d493a8 ffffc00180013010 : nt!RtlDeleteElementGenericTableAvlEx+0x21 ffffd00154a2c700 fffff801f54bcdb7 : ffffd00154a2c7e0 0000000000000745 ffffc0017e93f710 ffffe0001ef22180 : nt!RtlDeleteElementGenericTableAvl+0x25 ffffd00154a2c730 ffffd00154a2c7e0 : 0000000000000745 ffffc0017e93f710 ffffe0001ef22180 000100000002abe7 : NTFS+0xbcdb7 ffffd00154a2c738 0000000000000745 : ffffc0017e93f710 ffffe0001ef22180 000100000002abe7 ffffc00180013420 : 0xffffd00154a2c7e0
ffffd00154a2c740 ffffc0017e93f710 : ffffe0001ef22180 000100000002abe7 ffffc00180013420 ffffc00180013010 : 0x745
ffffd00154a2c748 ffffe0001ef22180 : 000100000002abe7 ffffc00180013420 ffffc00180013010 ffffc00180013000 : 0xffffc0017e93f710 ffffd00154a2c750 000100000002abe7 : ffffc00180013420 ffffc00180013010 ffffc00180013000 ffffe00021d493a8 : 0xffffe0001ef22180
ffffd00154a2c758 ffffc00180013420 : ffffc00180013010 ffffc00180013000 ffffe00021d493a8 ffffd00154a2ca40 : 0x000100000002abe7 ffffd00154a2c760 ffffc00180013010 : ffffc00180013000 ffffe00021d493a8 ffffd00154a2ca40 ffffc00180013010 : 0xffffc00180013420
ffffd00154a2c768 ffffc00180013000 : ffffe00021d493a8 ffffd00154a2ca40 ffffc00180013010 ffffe0001ef22180 : 0xffffc00180013010 ffffd00154a2c770 ffffe00021d493a8 : ffffd00154a2ca40 ffffc00180013010 ffffe0001ef22180 ffffc00180013010 : 0xffffc00180013000
ffffd00154a2c778 ffffd00154a2ca40 : ffffc00180013010 ffffe0001ef22180 ffffc00180013010 0000000000000000 : 0xffffe00021d493a8 ffffd00154a2c780 ffffc00180013010 : ffffe0001ef22180 ffffc00180013010 0000000000000000 ffffc00180013048 : 0xffffd00154a2ca40
ffffd00154a2c788 ffffe0001ef22180 : ffffc00180013010 0000000000000000 ffffc00180013048 fffff801f540c71b : 0xffffc00180013010 ffffd00154a2c790 ffffc00180013010 : 0000000000000000 ffffc00180013048 fffff801f540c71b ffffc00180013000 : 0xffffe0001ef22180
ffffd00154a2c798 0000000000000000 : ffffc00180013048 fffff801f540c71b ffffc00180013000 0000000000000000 : 0xffffc001`80013010

STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 8693ecd1480a9c0d27460385a366c5c7eb0c0624

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a1b06e4f3a41769bab1116163a7bc3a675a1b54b

THREAD_SHA1_HASH_MOD: 63182674c6c8431d83a1bf4f7c6379a605c12d86

FOLLOWUP_IP:
nt!ST_STORE<SM_TRAITS>::StDmPageError+e5
fffff802`fdcb89f9 cc int 3

FAULT_INSTR_CODE: 848b44cc

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ST_STORE<SM_TRAITS>::StDmPageError+e5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 559f3c1a

IMAGE_VERSION: 10.0.10240.16384

BUCKET_ID_FUNC_OFFSET: e5

FAILURE_BUCKET_ID: 0x12B_c00002c4_StCtDecompressFailed_nt!ST_STORE_SM_TRAITS_::StDmPageError

BUCKET_ID: 0x12B_c00002c4_StCtDecompressFailed_nt!ST_STORE_SM_TRAITS_::StDmPageError

PRIMARY_PROBLEM_CLASS: 0x12B_c00002c4_StCtDecompressFailed_nt!ST_STORE_SM_TRAITS_::StDmPageError

TARGET_TIME: 2019-11-25T19:10:36.000Z

OSBUILD: 10240

OSSERVICEPACK: 16384

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2015-07-10 05:29:30

BUILDDATESTAMP_STR: 150709-1700

BUILDLAB_STR: th1

BUILDOSVER_STR: 10.0.10240.16384

ANALYSIS_SESSION_ELAPSED_TIME: 84c

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x12b_c00002c4_stctdecompressfailed_nt!st_store_sm_traits_::stdmpageerror

FAILURE_ID_HASH: {c6a6bb4d-3b77-dff6-2d9b-75f5d0f61a50}

Followup: MachineOwner

1: kd> .trap 0xffffd00154a2c4d0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000ff rbx=0000000000000000 rcx=ffffc0017c5ac300
rdx=ffffc0017e93f701 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802fdb1fdc3 rsp=ffffd00154a2c660 rbp=ffffe0001ef226c8
r8=000000000002abe7 r9=0000ffffffffffff r10=ffffc00182f36750
r11=ffffc0017c5ac300 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!RebalanceNode+0x1b:
fffff802fdb1fdc3 418a4218 mov al,byte ptr [r10+18h] ds:ffffc00182f36768=??

4

There are a number of very similar crashes online.

Does this crash happen on only one specific system?

If I had to guess, and it is JUST a guess, I would say this problem is caused by a hardware problem.

Peter

5

I think it’s cause by my disk system file driver.
But where to find the bug?
is it an IRP overrun buffer which is returned ?