alloc_text(PAGE) obscure issue

NTDEV
1

Hi,

I have EvtDriverDeviceAdd receiving a DeviceInit pointer which appears corrupted. By looking at the caller, I can see the Wdf01000 wrapper passing the structure to the callback. In the wrapper frame, the DeviceInit looks fine. As an argument to EvtDDA, the low DWORD remains the same, the high DWORD is 0.
This does not happen every time. I will try to replicate it and give you the output. I moved the EvtDriverDeviceAdd into #pragma alloc_text(PAGE, EvtDriverDeviceAdd) and the problem disappeared. Driver Verifier was fine with “Enforce IRQL Checking”.
What can be the cause here?

Thank you for your time.

Calin

2

I would first suspect a memory corruptor bug in your add device routine as this hasn?t been reported before.

d

Bent from my phone

From: 30411623500n behalf of
Sent: Tuesday, July 31, 2018 2:54 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] alloc_text(PAGE) obscure issue

Hi,

I have EvtDriverDeviceAdd receiving a DeviceInit pointer which appears corrupted. By looking at the caller, I can see the Wdf01000 wrapper passing the structure to the callback. In the wrapper frame, the DeviceInit looks fine. As an argument to EvtDDA, the low DWORD remains the same, the high DWORD is 0.
This does not happen every time. I will try to replicate it and give you the output. I moved the EvtDriverDeviceAdd into #pragma alloc_text(PAGE, EvtDriverDeviceAdd) and the problem disappeared. Driver Verifier was fine with ?Enforce IRQL Checking?.
What can be the cause here?

Thank you for your time.

Calin

NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>