Hi,
I am in the process of implementing a system that consist of two separate drivers one is a sFilter based FSFD and the other is an unloadable function driver that communicate with the FSFD. To be able to access the fixed FSFD the function driver ( through a specialized IOCTL ), discover the FSFD using ‘IoGetDeviceObjectPointer’. When running with the DriverVerifier I get the blue screen of death with IRQL_NOT_LESS_OR_EQUAL, Stop: 0x0000000A ( 0xE1A46D60, 0x00000001, 0x00000002, 0x804ECC50 ).
WinDbg with !analyze –v output:
******************************************************
MODULE_NAME: nt
FAULTING_MODULE: 804d4000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 3d6de35c
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
e1a46d60
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExAcquireResourceExclusiveLite+a0
804ecc50 0fc101 xadd [ecx],eax
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 804dce53 to 805266db
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
fa677844 804dce53 0000000a e1a46d60 00000002 nt!KeBugCheckEx+0x19
fa677860 00000000 00000060 fa6779ec 54000000 nt!Kei386EoiHelper+0x251c
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_NAME: MachineOwner
What may be wrong with my code? What may cause such a problem? Why does it happen only with the DriverVerifier?
P.S.
DriverVerifier is set to verify the following properties:
Special Pool
Pool Tracking
Force IRQL checking
I/O Verification
Enhanced I/O Verification
Deadlock detection
Any help comment or sample would be appreciated.
Naddav.
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com