I am trying to use Call Usage Verifier for my driver vmx86.sys.
It is build in 3790.1069 2003 free build environment with
VERIFIER_DDK_EXTENSIONS=1
and is loaded on a free XP SP1+updates x86 target system.
I get the following error in WinDbg on the first non-DriverEntry call to
ExAlocatePool():
“DDK+ Internal Error: Pool Block Already Exists”.
Do I do something wrong? Here is the relevant kernel output from WinDbg:
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Kernel Debugger connection established.
Symbol search path is:
srv*g:\symbols*http://msdl.microsoft.com/download/symbols;G:\shared
Executable search path is: G:\shared
DBGHELP: SharedUserData - virtual symbol module
DBGHELP: nt - public symbols
g:\symbols\ntoskrnl.pdb\FB1EDACE71FB4812A5D5132819D72E523\ntoskrnl.pdb
Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpsp2.030422-1633
Kernel base = 0x804d4000 PsLoadedModuleList = 0x80543530
System Uptime: not available
Symbol search path is:
srv*g:\symbols*http://msdl.microsoft.com/download/symbols;G:\shared
Physical Address: 1000 Length: 9e000
Physical Address: 100000 Length: eff000
Physical Address: 1000000 Length: 1edf7000
Total Physical Memory: 534331392 (1fd94000)
Modified-> Physical Memory Pages: 130452 (1fd94)
[deleted]
DDK+ Verifier Extensions - Library Built using build 3790 on Sep 6 2003
00:17:12
KeAcquireInStackQueuedSpinLock: 0x806AD68C
KeAcquireInStackQueuedSpinLockAtDpcLevel: 0x8052CB60
KeReleaseInStackQueuedSpinLock: 0x806AD6E0
KeAcquireInStackQueuedSpinLockFromDpcLevel: 0x8052CB74
IoSetCompletionRoutineEx: 0x804EB5AA
DDK+ Includes Pool Tracking
\Driver\vmx86 running with DDK+ enabled
DDK+ Pool tracking is engaged
DDK+ Internal Error: Pool Block Already Exists
*** Assertion failed: FALSE
*** Source File: d:\srv03spb\sdktools\ddk\ddk_ext\verifier\pooltrak.cpp,
line 314
Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread
(boipt)? b
b
Execute ‘.cxr F7A04654’ to dump context
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPoint:
8051ac90 cc int 3
kd> .cxr F7A04654
eax=f7a04654 ebx=00000000 ecx=ed9fd8fc edx=0000002f esi=8051c304 edi=ed9fd958
eip=8051c31a esp=f7a0492c ebp=f7a04940 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000282
nt!RtlAssert+0x16:
8051c31a 5d pop ebp
kd> kP
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr
f7a04940 ed9fbb98 nt!RtlAssert+0x16
f7a0497c ed9fb75e vmx86!DDKExtPoolCreateEntry(
void * Address = 0xe23fd000,
unsigned long Bytes = 0x104c)+0xc4
[d:\srv03spb\sdktools\ddk\ddk_ext\verifier\pooltrak.cpp @ 316]
f7a04990 ed9fb231 vmx86!DDK_ExAllocatePool(
_POOL_TYPE PoolType = PagedPool (1),
unsigned long NumberOfBytes = 0x104c,
void * F = 0xed9fae7a,
unsigned long L = 0x106)+0x3e
[d:\srv03spb\sdktools\ddk\ddk_ext\verifier\pool.cpp @ 76]
f7a04a18 ed9f3f63 vmx86!VMxxx(
0xe23f9000,
0x12019f)+0x239
f7a04a38 804ea221 vmx86!VMX86DispatchIRP(
struct _DEVICE_OBJECT * DeviceObject = 0x820da1c8,
struct _IRP * Irp = 0x8251cf68)+0x89
[c:\src\main\bora\build\release\ws\modules\vmmon\driver.c @ 309]
f7a04a48 8062c190 nt!IopfCallDriver+0x31
f7a04a6c 80560609 nt!IovCallDriver+0x9e
f7a04b50 8059a2c6 nt!IopParseDevice+0xa4d
f7a04bd8 80596c27 nt!ObpLookupObjectName+0x56a
f7a04c2c 80553f0d nt!ObOpenObjectByName+0xe9
f7a04ca8 80554688 nt!IopCreateFile+0x407
f7a04cf0 80556b3c nt!IoCreateFile+0x36
f7a04d30 8052d571 nt!NtCreateFile+0x2e
f7a04d30 7ffe0304 nt!KiSystemService+0xc4
0070f9ec 77f5b694 SharedUserData!SystemCallStub+0x4
0070f9f0 77e7b252 ntdll!NtCreateFile+0xc
0070fa88 77e7b4a3 kernel32!CreateFileW+0x350
0070faac 00404406 kernel32!CreateFileA+0x2e
WARNING: Stack unwind information not available. Following frames may be
wrong.
0070ff7c 00401c10 vmware_authd+0x4406
0070ffa4 77ddbd25 vmware_authd+0x1c10
kd> x vmx86!DDK*
eda08a21 vmx86!DDKExtEnabled = 0x01 ‘’
eda08a20 vmx86!DDKExtInitialized = 0x01 ‘’
eda08a3c vmx86!DDKExtLock = 0
eda086a8 vmx86!DDKUnload = 0xed9f30d6
eda08a44 vmx86!DDKPoolTrackTable = struct _RTL_AVL_TABLE
ed9fbdeb vmx86!DDKExtVCurrentIrpStack (_IRP*, char*, char*, unsigned long,
unsigned long*)
ed9fb765 vmx86!DDK_ExAllocatePoolWithTag (_POOL_TYPE, unsigned long, unsigned
long, void*, unsigned long)
ed9fb720 vmx86!DDK_ExAllocatePool (_POOL_TYPE, unsigned long, void*, unsigned
long)
ed9fbbc8 vmx86!DDKExtPoolDeleteEntry (void*)
ed9fbcbf vmx86!DDKExtPoolClearList ( void )
ed9fbad4 vmx86!DDKExtPoolCreateEntry (void* Address = e23fd000 , unsigned
long Bytes = 0x104c)
ed9fc047 vmx86!DDKExtPrompt (unsigned long*)
ed9fbf0e vmx86!DDKExtMsgInvalid (char*, unsigned long, unsigned long,
unsigned long, char*, unsigned long)
ed9fbfe1 vmx86!DDKExtMsgBadIrpStack (char*, char*, unsigned long, unsigned
long, char*, unsigned long)
ed9fb7dd vmx86!DDK_IoGetCurrentIrpStackLocation (_IRP*, void*, unsigned long)
ed9fb7c2 vmx86!DDK_ExFreePoolWithTag (void*, unsigned long, void*, unsigned
long)
ed9fb7a8 vmx86!DDK_ExFreePool (void*, void*, unsigned long)
ed9fbe64 vmx86!DDKExtMsgPtrNull (char*, unsigned long, unsigned long, char*,
unsigned long)
ed9fb8c1 vmx86!DDKPlusInitialize ( void )
ed9fba4c vmx86!DDKPlusUninitialize ( void )
ed9fb6ad vmx86!DDK_DriverUnload (_DRIVER_OBJECT*)
ed9fbdce vmx86!DDKPlusInitializePoolTracking ( void )
kd> dt _RTL_AVL_TABLE eda08a44
+0x000 BalancedRoot : _RTL_BALANCED_LINKS
+0x010 OrderedPointer : (null)
+0x014 WhichOrderedElement : 0
+0x018 NumberGenericTableElements : 6
+0x01c DepthOfTree : 3
+0x020 RestartKey : (null)
+0x024 DeleteCount : 3
+0x028 CompareRoutine : 0xed9fbd1a vmx86!PoolCompare+0
+0x02c AllocateRoutine : 0xed9fbd4d vmx86!PoolAllocate+0
+0x030 FreeRoutine : 0xed9fbd9f vmx86!PoolFree+0
+0x034 TableContext : 0x81f2db28
Thanks,
Dmitriy Budko, VMware