Access violation in Tdi Filter Driver

NTDEV
1

Hi all,
I have written a TDI Filter driver. I have created my
device and attached it over TCP device. (Using
IoCreateDecice() and IoAttachDevice() APIs). In all I
have 2 devices. One for myself and other for
attaching. I have a dispatch routine. It gets IRPs for
TCP as well as for my device. For TCP I am doing
IoSkipCurrentIrpStackLocation(Irp);
IoCallDriver(Irp);

I am transparently passing down all IRPs for TCP.

Now if I do following things,

1>net start filter
2>start telnet session with a local network machine.
3>run find / (contineously running and printing data)
4>net stop filter

I get an error
Access violation - code c0000005 (!!! second chance
!!!)
nt!IoBuildSynchronousFsdRequest+8b:
8041f61b ff548138 call dword ptr [ecx+eax*+0x38]

What can be wrong?
Thanks,
Jeevan

Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway
http://promotions.yahoo.com/design_giveaway/

2

You cannot unload TDI filters. Forget about this.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Jeevan”
To: “Windows System Software Devs Interest List”
Sent: Tuesday, April 13, 2004 10:06 AM
Subject: [ntdev] Access violation in Tdi Filter Driver

> Hi all,
> I have written a TDI Filter driver. I have created my
> device and attached it over TCP device. (Using
> IoCreateDecice() and IoAttachDevice() APIs). In all I
> have 2 devices. One for myself and other for
> attaching. I have a dispatch routine. It gets IRPs for
> TCP as well as for my device. For TCP I am doing
> IoSkipCurrentIrpStackLocation(Irp);
> IoCallDriver(Irp);
>
> I am transparently passing down all IRPs for TCP.
>
> Now if I do following things,
>
> 1>net start filter
> 2>start telnet session with a local network machine.
> 3>run find / (contineously running and printing data)
> 4>net stop filter
>
> I get an error
> Access violation - code c0000005 (!!! second chance
> !!!)
> nt!IoBuildSynchronousFsdRequest+8b:
> 8041f61b ff548138 call dword ptr [ecx+eax*+0x38]
>
> What can be wrong?
> Thanks,
> Jeevan
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Small Business $15K Web Design Giveaway
> http://promotions.yahoo.com/design_giveaway/
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Does that mean, I cannot even detach the device by
calling IoDetachDevice()?

— “Maxim S. Shatskih”
wrote:
> You cannot unload TDI filters. Forget about
> this.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> ----- Original Message -----
> From: “Jeevan”
> To: “Windows System Software Devs Interest List”
>
> Sent: Tuesday, April 13, 2004 10:06 AM
> Subject: [ntdev] Access violation in Tdi Filter
> Driver
>
>
> > Hi all,
> > I have written a TDI Filter driver. I have created
> my
> > device and attached it over TCP device. (Using
> > IoCreateDecice() and IoAttachDevice() APIs). In
> all I
> > have 2 devices. One for myself and other for
> > attaching. I have a dispatch routine. It gets IRPs
> for
> > TCP as well as for my device. For TCP I am doing
> > IoSkipCurrentIrpStackLocation(Irp);
> > IoCallDriver(Irp);
> >
> > I am transparently passing down all IRPs for TCP.
> >
> > Now if I do following things,
> >
> > 1>net start filter
> > 2>start telnet session with a local network
> machine.
> > 3>run find / (contineously running and printing
> data)
> > 4>net stop filter
> >
> > I get an error
> > Access violation - code c0000005 (!!! second
> chance
> > !!!)
> > nt!IoBuildSynchronousFsdRequest+8b:
> > 8041f61b ff548138 call dword ptr
> [ecx+eax*+0x38]
> >
> > What can be wrong?
> > Thanks,
> > Jeevan
> >
> >
> >
> >
> >
> > Do you Yahoo!?
> > Yahoo! Small Business $15K Web Design Giveaway
> > http://promotions.yahoo.com/design_giveaway/
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> xxxxx@storagecraft.com
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway
http://promotions.yahoo.com/design_giveaway/

4

Surely no.

This is because AFD and SRV are on top of you, and they (at least AFD)
cannot be safely unloaded.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Jeevan”
To: “Windows System Software Devs Interest List”
Sent: Tuesday, April 13, 2004 10:29 AM
Subject: Re: [ntdev] Access violation in Tdi Filter Driver

> Does that mean, I cannot even detach the device by
> calling IoDetachDevice()?
>
> — “Maxim S. Shatskih”
> wrote:
> > You cannot unload TDI filters. Forget about
> > this.
> >
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> >
> > ----- Original Message -----
> > From: “Jeevan”
> > To: “Windows System Software Devs Interest List”
> >
> > Sent: Tuesday, April 13, 2004 10:06 AM
> > Subject: [ntdev] Access violation in Tdi Filter
> > Driver
> >
> >
> > > Hi all,
> > > I have written a TDI Filter driver. I have created
> > my
> > > device and attached it over TCP device. (Using
> > > IoCreateDecice() and IoAttachDevice() APIs). In
> > all I
> > > have 2 devices. One for myself and other for
> > > attaching. I have a dispatch routine. It gets IRPs
> > for
> > > TCP as well as for my device. For TCP I am doing
> > > IoSkipCurrentIrpStackLocation(Irp);
> > > IoCallDriver(Irp);
> > >
> > > I am transparently passing down all IRPs for TCP.
> > >
> > > Now if I do following things,
> > >
> > > 1>net start filter
> > > 2>start telnet session with a local network
> > machine.
> > > 3>run find / (contineously running and printing
> > data)
> > > 4>net stop filter
> > >
> > > I get an error
> > > Access violation - code c0000005 (!!! second
> > chance
> > > !!!)
> > > nt!IoBuildSynchronousFsdRequest+8b:
> > > 8041f61b ff548138 call dword ptr
> > [ecx+eax*+0x38]
> > >
> > > What can be wrong?
> > > Thanks,
> > > Jeevan
> > >
> > >
> > >
> > >
> > >
> > > Do you Yahoo!?
> > > Yahoo! Small Business $15K Web Design Giveaway
> > > http://promotions.yahoo.com/design_giveaway/
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > xxxxx@storagecraft.com
> > > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
>
>
>
> Do you Yahoo!?
> Yahoo! Small Business $15K Web Design Giveaway
> http://promotions.yahoo.com/design_giveaway/
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com