Analyze PAGE_FAULT_IN_NONPAGED_AREA

Hello, I have ‘Debug’ and ‘Release’ build of my driver. With ‘Release’ build I get BSOD with error code PAGE_FAULT_IN_NONPAGED_AREA and have minidump, but with ‘Debug’ build I don’t get BSOD. How I can find place in source code of my driver when driver crashed? It’s possible analyze with WinDbg for ‘Release’ build or only for ‘Debug’?

xxxxx@gmail.com wrote:

Hello, I have ‘Debug’ and ‘Release’ build of my driver. With ‘Release’ build I get BSOD with error code PAGE_FAULT_IN_NONPAGED_AREA and have minidump, but with ‘Debug’ build I don’t get BSOD. How I can find place in source code of my driver when driver crashed? It’s possible analyze with WinDbg for ‘Release’ build or only for ‘Debug’?

Wouldn’t it have been quicker just to try it?

A release build still creates symbol files. However, this is one reason
I always create a linker map – so I can find addresses by hand if I
absolutely have to.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Bugs like this are notoriously hard to find. The problem is not where it
was when it crashed, but what caused it to have an invalid pointer at all
Sometimes it’s the “classic” dereference-a-NULL-pointer error, but the bug
you are seeing suggests other forms of damage that change based on a lot
of transient state. Thus the actual bug might be several tens of billions
of instructions in the past.

First thing, and most important: do !analyze -v in the debugger. This is
important, because the PTP protocol (Psychic Transfer Protocol) is not
supported on most macines, so all you have told us is “My program crashed,
what did I do wrong?” which has no answer. Wndbg works perfectly fine in
the release version, but there are fewer internal checks. Next, use
Driver Verifier with heavy-duty memory checking enabled.

But from the information you presented, the only response possible is “You
have a bug. Find it and fix it”.
joe

Hello, I have ‘Debug’ and ‘Release’ build of my driver. With ‘Release’
build I get BSOD with error code PAGE_FAULT_IN_NONPAGED_AREA and have
minidump, but with ‘Debug’ build I don’t get BSOD. How I can find place in
source code of my driver when driver crashed? It’s possible analyze with
WinDbg for ‘Release’ build or only for ‘Debug’?


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Also, an optimized release build can be very tricky to debug, because the
optimizer does really ugly things to the address-to-source-line mapping,
so you first want to try an unoptimized release build, then try an
optimized release build. Be prepared to generate the
mixed-source-and-assembly listings for the optimized version, and if you
are not proficient in reading x86/x64 asembly code, download all the
reference manuals from the Intel site.
joe

xxxxx@gmail.com wrote:
> Hello, I have ‘Debug’ and ‘Release’ build of my driver. With ‘Release’
> build I get BSOD with error code PAGE_FAULT_IN_NONPAGED_AREA and have
> minidump, but with ‘Debug’ build I don’t get BSOD. How I can find place
> in source code of my driver when driver crashed? It’s possible analyze
> with WinDbg for ‘Release’ build or only for ‘Debug’?

Wouldn’t it have been quicker just to try it?

A release build still creates symbol files. However, this is one reason
I always create a linker map – so I can find addresses by hand if I
absolutely have to.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer