Driver Verifier Confusion

NTFSD
1

Hello,

I am a bit confused what this tool does. I set it up and I get output in the
log file such as this shown at end of post. That didn’t really help me in
understanding the tool, so I tried to add somethig that I knew would crash
(a call to FltGetFileNameInformation in IRP_MJ_VOLUME_MOUNT). This blue
screened with error 8E. There seems to be no difference with or w/o
verifier. Also, I added a call to RtlEqualUnicodeString, which should be
called at PASSIVE_LEVEL, to my pre close routine (whcib can be called APC).
So would that be something that Driver Verfier could catch? And how and when
would it catch it?

Thanks, bjorn

Here’s a sample output from my verifier.exe log:
2/22/2006, 3:16:10 PM
Level: 000000DF
RaiseIrqls: 0
AcquireSpinLocks: 1903250
SynchronizeExecutions: 0
AllocationsAttempted: 154033
AllocationsSucceeded: 138458
AllocationsSucceededSpecialPool: 138458
AllocationsWithNoTag: 0
AllocationsFailed: 0
AllocationsFailedDeliberately: 10171
Trims: 1061992
UnTrackedPool: 0

Verified drivers:

Name: contbakflt.sys, loads: 2, unloads: 1
CurrentPagedPoolAllocations: 1835
CurrentNonPagedPoolAllocations: 1988
PeakPagedPoolAllocations: 1837
PeakNonPagedPoolAllocations: 1988
PagedPoolUsageInBytes: 312556
NonPagedPoolUsageInBytes: 111328
PeakPagedPoolUsageInBytes: 313168
PeakNonPagedPoolUsageInBytes: 111328

2

> So would that be something that Driver Verfier could catch? And how and when

would it catch it?

Try to call ExAcquireResourceShared without KeEnterCriticalRegion.
This will be catched for sure :slight_smile:

If you open the IFS/DDK help, and search for
DRIVER_VERIFIER_IOMANAGER_VIOLATION,
you will see the list of things that are checked by verifier.

L.

3

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
>>So would that be something that Driver Verfier could catch? And how and
>>when
>>would it catch it?

>try to call ExAcquireResourceShared without KeEnterCriticalRegion.
>his will be catched for sure :slight_smile:

Hm, thanks. Maybe I am doing something wrong, still. I checked now all
options (Level FF) and I put the following code in:

ERESOURCE eRes;
ExAcquireResourceShared(&eRes, TRUE);

I put this in various places (precreate, post setinfo, prevolumemount) - but
all I get is a crash with 0xA(IRQL_NOT_LESS_OR_EQUAL). I don’t get the 0xC9
driver verifier bug check error.

Thanks, bjorn

If you open the IFS/DDK help, and search for
DRIVER_VERIFIER_IOMANAGER_VIOLATION,
you will see the list of things that are checked by verifier.

L.

4

> ERESOURCE eRes;

ExAcquireResourceShared(&eRes, TRUE);

Do you know of ExInitializeResource ?

L.