Driver Verifier and Norton Antivirus 2002!

NTFSD
1

Hi,
I notice that when I run Norton Antivirus 2002 in Win XP Professional, it
runs fine. When I enabled Driver Verifier for my driver, even before my
driver is loaded, Win XP crashed consistently . I didn’t enable Verifier for
any other driver. Is this due to Norton Antivirus bug? Anyone can reproduce
the problem, as I tried in two Win XP machine and both crashed. Any info is
appreciated.

Regards,
Sin-Lam

======================================================================

The error code:

Break due to KeBugCheckEx (Unhandled kernel mode exception)
Error=C4 (DRIVER_VERIFIER_DETECTED_VIOLATION) P1=90 P2=FFDFF120 P3=0 P4=0

:stack
FF49FE58 8053745B ntoskrnl!KeBugCheckEx+0001
FF49FE94 8050352D ntoskrnl!ExFreePool+031D
FF49FEC4 804EB1B9 ntoskrnl!MmAllocateContiguousMemory+012E
FF49FEE0 F7BF8F05 ntoskrnl!MmCreateSection+01F3
FF49FF4C F7C16C71 NAVAP!PAGE+0BE5
FF49FF64 F7BF884A NAVAP!PAGE+0001E951
F7CDF69C F7BFACF5 NAVAP!PAGE+052A
F7CDF6CC F7BF8903 NAVAP!PAGE+29D5
F7CDF700 F7C1685A NAVAP!PAGE+05E3
F7CDF7B0 F7E51498 NAVAP!PAGE+0001E53A
F7CDF7F0 00000001 SYMEVENT!.text+51D8

According to DDK, the error for P1=90 is

0x90 Reserved Reserved Reserved The driver switched stacks, and the
current stack is neither a thread stack nor a DPC stack
(Typically, the driver doing this should be on the stack obtained by
the KB debugger command.).

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Yes, I get this too. In addition, NAV seems to be mangling
IRP_MN_MDL/IRP_MN_COMPLETE writes before it passes them to my filter
driver (my filter fails the FastIo Mdl calls so the IRP versions may
have been an untested code path in NAV). Will research this more.

  • Nicholas Ryan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
xxxxx@lists.osr.com] On Behalf Of Tan Sin Lam
Sent: Thursday, February 21, 2002 3:19 AM
To: File Systems Developers
Subject: [ntfsd] Driver Verifier and Norton Antivirus 2002!

Hi,
I notice that when I run Norton Antivirus 2002 in Win XP
Professional,
it
runs fine. When I enabled Driver Verifier for my driver, even before
my
driver is loaded, Win XP crashed consistently . I didn’t enable
Verifier
for
any other driver. Is this due to Norton Antivirus bug? Anyone can
reproduce
the problem, as I tried in two Win XP machine and both crashed. Any
info
is
appreciated.

Regards,
Sin-Lam

======================================================================

The error code:

Break due to KeBugCheckEx (Unhandled kernel mode exception)
Error=C4 (DRIVER_VERIFIER_DETECTED_VIOLATION) P1=90 P2=FFDFF120 P3=0
P4=0

:stack
FF49FE58 8053745B ntoskrnl!KeBugCheckEx+0001
FF49FE94 8050352D ntoskrnl!ExFreePool+031D
FF49FEC4 804EB1B9 ntoskrnl!MmAllocateContiguousMemory+012E
FF49FEE0 F7BF8F05 ntoskrnl!MmCreateSection+01F3
FF49FF4C F7C16C71 NAVAP!PAGE+0BE5
FF49FF64 F7BF884A NAVAP!PAGE+0001E951
F7CDF69C F7BFACF5 NAVAP!PAGE+052A
F7CDF6CC F7BF8903 NAVAP!PAGE+29D5
F7CDF700 F7C1685A NAVAP!PAGE+05E3
F7CDF7B0 F7E51498 NAVAP!PAGE+0001E53A
F7CDF7F0 00000001 SYMEVENT!.text+51D8

According to DDK, the error for P1=90 is

0x90 Reserved Reserved Reserved The driver switched stacks, and
the
current stack is neither a thread stack nor a DPC stack
(Typically, the driver doing this should be on the stack
obtained by
the KB debugger command.).

You are currently subscribed to ntfsd as: xxxxx@secretseal.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

There is a known issue with NAV and the verifier if you have deadlock
detection enabled. Did you have this turned on? If so disable it and
see how it works.

Neal Christiansen

This posting is provided “AS IS” with no warranties, and confers no
rights.

-----Original Message-----
From: Tan Sin Lam [mailto:xxxxx@lit.org.sg]
Sent: Thursday, February 21, 2002 03:19 AM
To: File Systems Developers
Subject: [ntfsd] Driver Verifier and Norton Antivirus 2002!

Hi,
I notice that when I run Norton Antivirus 2002 in Win XP Professional,
it
runs fine. When I enabled Driver Verifier for my driver, even before my
driver is loaded, Win XP crashed consistently . I didn’t enable Verifier
for
any other driver. Is this due to Norton Antivirus bug? Anyone can
reproduce
the problem, as I tried in two Win XP machine and both crashed. Any info
is
appreciated.

Regards,
Sin-Lam

======================================================================

The error code:

Break due to KeBugCheckEx (Unhandled kernel mode exception)
Error=C4 (DRIVER_VERIFIER_DETECTED_VIOLATION) P1=90 P2=FFDFF120 P3=0
P4=0

:stack
FF49FE58 8053745B ntoskrnl!KeBugCheckEx+0001
FF49FE94 8050352D ntoskrnl!ExFreePool+031D
FF49FEC4 804EB1B9 ntoskrnl!MmAllocateContiguousMemory+012E
FF49FEE0 F7BF8F05 ntoskrnl!MmCreateSection+01F3
FF49FF4C F7C16C71 NAVAP!PAGE+0BE5
FF49FF64 F7BF884A NAVAP!PAGE+0001E951
F7CDF69C F7BFACF5 NAVAP!PAGE+052A
F7CDF6CC F7BF8903 NAVAP!PAGE+29D5
F7CDF700 F7C1685A NAVAP!PAGE+05E3
F7CDF7B0 F7E51498 NAVAP!PAGE+0001E53A
F7CDF7F0 00000001 SYMEVENT!.text+51D8

According to DDK, the error for P1=90 is

0x90 Reserved Reserved Reserved The driver switched stacks, and
the
current stack is neither a thread stack nor a DPC stack
(Typically, the driver doing this should be on the stack obtained
by
the KB debugger command.).

You are currently subscribed to ntfsd as: xxxxx@Windows.Microsoft.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com