Hi All,
I did not get much response while i posted the same question earlier and i
am stuck with this bug
for 7 days now. I am writing a disk filter driver for enciphering and
deciphering the entire hard disk.
It works entirely fine(Boots fine 3/10 times) but many times i get this Bug
check 24 and the system refuses to boot.
Is there any site or minimum set of guidelines to be met while handling the
read and write buffers.
Has anyone come across this situation?
I can also post the source code .
Thanks and waiting for replies.
Regards
Shal.
Bug check trace is given below
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1901fd, 81bd8a80, c0000102, 0}
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt!KiBugCheckDebugBreak+19 )
Followup: MachineOwner
nt!RtlpBreakWithStatusInstruction:
8050d064 cc int 3
kd> !analyze -v
****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*
****************************************************************************
***
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001901fd
Arg2: 81bd8a80
Arg3: c0000102
Arg4: 00000000
Debugging Details:
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** ***
*************************************************************************
BUGCHECK_STR: 0x24_C0000102
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from 805226a5 to 8050d064
STACK_TEXT:
f8993438 805226a5 00000003 00000000 00000024
nt!RtlpBreakWithStatusInstruction
f8993484 80522dea 00000003 00000100 81bd8a80 nt!KiBugCheckDebugBreak+0x19
f899384c 804fc1bb 00000024 001901fd 81bd8a80 nt!KeBugCheck2+0x43c
f899386c f8418568 00000024 001901fd 81bd8a80 nt!KeBugCheckEx+0x19
f8993890 f8457464 81bd8a80 c0000102 e12af560 Ntfs!NtfsRaiseStatus+0x57
f89938f8 f8429071 81bd8a80 81bd82c8 e12af560 Ntfs!NtfsReadMftRecord+0x1a3
f8993930 f84290f8 81bd8a80 81bd82c8 e12af560 Ntfs!NtfsReadFileRecord+0x78
f8993968 f8434cb0 81bd8a80 e12af558 e12af560
Ntfs!NtfsLookupInFileRecord+0x35
f8993a18 f845d8d2 81bd8a80 81b925b0 00000000
Ntfs!NtfsUpdateScbFromAttribute+0x65
f8993a48 f845b5d6 81bd8a80 81bd82f8 81bd82c8 Ntfs!NtfsOpenSystemFile+0x86
f8993cb8 f844a3c8 81bd8a80 81bd8de8 81bd8a80 Ntfs!NtfsMountVolume+0x13ed
f8993cc8 f8417fc7 81bd8a80 81bd8de8 81bd8b80
Ntfs!NtfsCommonFileSystemControl+0x37
f8993d74 804ebd08 81bd8a80 00000000 81bcb640 Ntfs!NtfsFspDispatch+0x1a0
f8993dac 80559026 81bd8a80 00000000 00000000 nt!ExpWorkerThread+0xfe
f8993ddc 8050f513 804ebc35 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
nt!KiBugCheckDebugBreak+19
805226a5 eb59 jmp nt!KiBugCheckDebugBreak+0x74 (80522700)
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!KiBugCheckDebugBreak+19
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3b7de38f
STACK_COMMAND: kb
BUCKET_ID: 0x24_C0000102_nt!KiBugCheckDebugBreak+19