strange behavior when the driver contain call of ExAllocateFromPagedLookasideList

NTFSD
1

Hi dear all,
I found that if a driver contain call of ExAllocateFromPagedLookasideList , the driver will not get loaded, even it is in a dead code path like this

if(FALSE) {
  ExAllocateFromPagedLookasideList(...); // if I comment out this line, everything is ok
}

How does this happen? I’m not sure if this is related with the last step of build : ApiValidator. Many thanks!

2

This API can be inline or an import depending on the target OS (see WDM.H). Which OS are you targeting in your build setting and which OS are you running on?

1 Like
3

I’m using a building template copied from the WDK sample

...
<TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>True</UseDebugLibraries>
<DriverTargetPlatform>Universal</DriverTargetPlatform>
<DriverType>WDM</DriverType>
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
...

The actual running OS is Windows LTSC (1809 17763.107)
Update : Not sure if this API is exported by the actual running OS.

4

Thank you. Found the reason : the driver use the import version of ExAllocateFromPagedLookasideList , but the actual OS is not exporting the function.

5

Hi @yu_shang

I have encountered the same problem. Can I ask how you solved it? my OS is Windows 10, thank you.