BugCheck 24-Weird

NTFSD
1

Hi All,
I did not get much response while i posted the same question earlier and i
am stuck with this bug
for 7 days now. I am writing a disk filter driver for enciphering and
deciphering the entire hard disk.
It works entirely fine(Boots fine 3/10 times) but many times i get this Bug
check 24 and the system refuses to boot and dumps the BSOD
Is there any site or minimum set of guidelines to be met while handling the
read and write buffers.
Has anyone come across this situation?
I can also post the source code .
Thanks and waiting for replies.
Regards
Shal.

Bug check trace is given below

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1901fd, 81bd8a80, c0000102, 0}

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt!KiBugCheckDebugBreak+19 )

Followup: MachineOwner

nt!RtlpBreakWithStatusInstruction:
8050d064 cc int 3
kd> !analyze -v
****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*
****************************************************************************
***

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001901fd
Arg2: 81bd8a80
Arg3: c0000102
Arg4: 00000000

Debugging Details:

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** ***
*************************************************************************

BUGCHECK_STR: 0x24_C0000102

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 805226a5 to 8050d064

STACK_TEXT:
f8993438 805226a5 00000003 00000000 00000024
nt!RtlpBreakWithStatusInstruction
f8993484 80522dea 00000003 00000100 81bd8a80 nt!KiBugCheckDebugBreak+0x19
f899384c 804fc1bb 00000024 001901fd 81bd8a80 nt!KeBugCheck2+0x43c
f899386c f8418568 00000024 001901fd 81bd8a80 nt!KeBugCheckEx+0x19
f8993890 f8457464 81bd8a80 c0000102 e12af560 Ntfs!NtfsRaiseStatus+0x57
f89938f8 f8429071 81bd8a80 81bd82c8 e12af560 Ntfs!NtfsReadMftRecord+0x1a3
f8993930 f84290f8 81bd8a80 81bd82c8 e12af560 Ntfs!NtfsReadFileRecord+0x78
f8993968 f8434cb0 81bd8a80 e12af558 e12af560
Ntfs!NtfsLookupInFileRecord+0x35
f8993a18 f845d8d2 81bd8a80 81b925b0 00000000
Ntfs!NtfsUpdateScbFromAttribute+0x65
f8993a48 f845b5d6 81bd8a80 81bd82f8 81bd82c8 Ntfs!NtfsOpenSystemFile+0x86
f8993cb8 f844a3c8 81bd8a80 81bd8de8 81bd8a80 Ntfs!NtfsMountVolume+0x13ed
f8993cc8 f8417fc7 81bd8a80 81bd8de8 81bd8b80
Ntfs!NtfsCommonFileSystemControl+0x37
f8993d74 804ebd08 81bd8a80 00000000 81bcb640 Ntfs!NtfsFspDispatch+0x1a0
f8993dac 80559026 81bd8a80 00000000 00000000 nt!ExpWorkerThread+0xfe
f8993ddc 8050f513 804ebc35 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:
nt!KiBugCheckDebugBreak+19
805226a5 eb59 jmp nt!KiBugCheckDebugBreak+0x74 (80522700)

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiBugCheckDebugBreak+19

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 3b7de38f

STACK_COMMAND: kb

BUCKET_ID: 0x24_C0000102_nt!KiBugCheckDebugBreak+19

Followup: MachineOwner

2

On Tue, 25 May 2004 08:36:06 -0500, Shalini wrote:

> Hi All,
> I did not get much response while i posted the same question earlier and
> i
> am stuck with this bug
> for 7 days now. I am writing a disk filter driver for enciphering and
> deciphering the entire hard disk.
> It works entirely fine(Boots fine 3/10 times) but many times i get this
> Bug
> check 24 and the system refuses to boot and dumps the BSOD
> Is there any site or minimum set of guidelines to be met while handling
> the
> read and write buffers.
> Has anyone come across this situation?
> I can also post the source code .
> Thanks and waiting for replies.
> Regards
> Shal.
>
> Bug check trace is given below
>

… long bugtrace, see previous post …

Some quick observations:

1. You have not setup WinDbg to use the standard symbol path, type
.symfix
and try again for a better trace

2. C0000102 is STATUS_FILE_CORRUPT_ERROR (according to ntstatus.h)

And the stack says this happened while reading the MFT of the NTFS volume.

My best guess: you are not decrypting the data correctly, so NTFS gets
garbage
when trying to read its own metadata from the disk.

Alternative guess:

You are decrypting the data without waiting for the read-from-disk to
complete,
causing a race condition if the disk driver returns STATUS_IO_PENDING to
indicate
that the read will complete in the background.

–
#include <disclaimer.h></disclaimer.h>

3

Thank you very much JaKob.
I shall fix the symbols also i shall check the decrypt error that u said .
Once again thanks.
Regards
Shal

“Jakob Bohm” wrote in message news:xxxxx@ntfsd…
> On Tue, 25 May 2004 08:36:06 -0500, Shalini
wrote:
>
> > Hi All,
> > I did not get much response while i posted the same question earlier and
> > i
> > am stuck with this bug
> > for 7 days now. I am writing a disk filter driver for enciphering and
> > deciphering the entire hard disk.
> > It works entirely fine(Boots fine 3/10 times) but many times i get this
> > Bug
> > check 24 and the system refuses to boot and dumps the BSOD
> > Is there any site or minimum set of guidelines to be met while handling
> > the
> > read and write buffers.
> > Has anyone come across this situation?
> > I can also post the source code .
> > Thanks and waiting for replies.
> > Regards
> > Shal.
> >
> > Bug check trace is given below
> >
>
> … long bugtrace, see previous post …
>
> Some quick observations:
>
> 1. You have not setup WinDbg to use the standard symbol path, type
> .symfix
> and try again for a better trace
>
> 2. C0000102 is STATUS_FILE_CORRUPT_ERROR (according to ntstatus.h)
>
> And the stack says this happened while reading the MFT of the NTFS volume.
>
> My best guess: you are not decrypting the data correctly, so NTFS gets
> garbage
> when trying to read its own metadata from the disk.
>
>
> Alternative guess:
>
> You are decrypting the data without waiting for the read-from-disk to
> complete,
> causing a race condition if the disk driver returns STATUS_IO_PENDING to
> indicate
> that the read will complete in the background.
>
>
>
> –
> #include <disclaimer.h>
></disclaimer.h>