Festival Shutdown : ExRaiseStatus crash when enble Driver verifier on Win8 x86 platform

NTDEV
1

Hi,

Due to Diwali Festival, SLS will be closed from Oct. 31th to Nov. 6th.
We will return on Nov. 7th to the office. For urgent matter please call on 001-408-852-0067.

For more information about Diwali:
http://en.wikipedia.org/wiki/Diwali

Regards,
Foram Modi

2

> Hi, all

I tested my driver under the Driver Verifier enabled on all Win OS. The driver
works well on all OS platforms except the Win8.

Through the analysis info, the crash point to the ExRaiseStatus function, this
function will be wrapped by the Driver Verifier, and the crash function is
ExRaiseStatus_wrapper.

But this issue not occurs on lower version. Are there anybody encounter the
same problem?

One explanation is that the Driver Verifier on Win 8 is update some function
implement.

The code like bellow:
__try{
…
if(!condition){
ExRaiseStatus(status);/* this code will produce the OS crash when running
driver on Win8 with the Driver Verifier enable*/
}
}
__except(){
…
}

Are you getting a BSoD? If so, what is the bug check code?? Is it 0xC4 (0xE5, …)?

James

3

Hi All,

Sorry to forgot attach the BSOD detail information.

I reproduce this issue again. The BSOD error status is
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

Below is the crash stack:

STACK_TEXT:
nt!RtlpBreakWithStatusInstruction
nt!KiBugCheckDebugBreak+0x1c
nt!KeBugCheck2+0x655
nt!KiBugCheck2+0xc6
nt!KeBugCheckEx+0x19
VerifierExt!SLIC_abort+0x39
VerifierExt!ExRegisterCallback_wrapper+0x3b
VerifierExt!ExRaiseStatus_wrapper+0x16
…(its my driver caller)

STACK_COMMAND: kb

FOLLOWUP_IP:
VerifierExt!SLIC_abort+39
86010301 5d pop ebp

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: VerifierExt!SLIC_abort+39

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: VerifierExt

IMAGE_NAME: VerifierExt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5010acff

FAILURE_BUCKET_ID: 0xc4_20008_VRF_VerifierExt!SLIC_abort+39

BUCKET_ID: 0xc4_20008_VRF_VerifierExt!SLIC_abort+39

Followup: MachineOwner

Best regards!
Kandom

4

What are the other codes in the BSoD?

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-545487-
xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Sunday, 3 November 2013 7:53 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] ExRaiseStatus crash when enble Driver verifier on Win8
x86 platform

Hi All,

Sorry to forgot attach the BSOD detail information.

I reproduce this issue again. The BSOD error status is
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

Below is the crash stack:

STACK_TEXT:
nt!RtlpBreakWithStatusInstruction
nt!KiBugCheckDebugBreak+0x1c
nt!KeBugCheck2+0x655
nt!KiBugCheck2+0xc6
nt!KeBugCheckEx+0x19
VerifierExt!SLIC_abort+0x39
VerifierExt!ExRegisterCallback_wrapper+0x3b
VerifierExt!ExRaiseStatus_wrapper+0x16
…(its my driver caller)

STACK_COMMAND: kb

FOLLOWUP_IP:
VerifierExt!SLIC_abort+39
86010301 5d pop ebp

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: VerifierExt!SLIC_abort+39

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: VerifierExt

IMAGE_NAME: VerifierExt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5010acff

FAILURE_BUCKET_ID: 0xc4_20008_VRF_VerifierExt!SLIC_abort+39

BUCKET_ID: 0xc4_20008_VRF_VerifierExt!SLIC_abort+39

Followup: MachineOwner

Best regards!
Kandom

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

> Hi James,

Please see the more details in BSOD.

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA
will
be among the most commonly seen crashes.
Arguments:
Arg1: 00020008, subclass of driver violation.

Right, so if you plug those numbers (0xC4, 0x20008) into google (or just the help page for bug check 0xC4) you end up on this page http://msdn.microsoft.com/en-us/library/windows/hardware/ff560187(v=vs.85).aspx, and against 0x20008 it says:

“The driver violated the DDI compliance rule IrqlExPassive. The IrqlExPassive rule specifies that the driver must call certain executive support routines only when IRQL = PASSIVE_LEVEL.”

This says that you are calling your ExRaiseStatus at an IRQL > PASSIVE_LEVEL. The docs say you can call at APC_LEVEL, but I bet you are calling at DISPATCH_LEVEL. Can you confirm if this is the case?

James

6

I would suspect the latest version of DV is catching a long-standing error
previously undiagnosed. Howver, the failure to include the !analyze -v
output suggests you are not really interested in an answer.
joe

Hi, all

I tested my driver under the Driver Verifier enabled on all Win OS. The
driver works well on all OS platforms except the Win8.

Through the analysis info, the crash point to the ExRaiseStatus function,
this function will be wrapped by the Driver Verifier, and the crash
function is ExRaiseStatus_wrapper.

But this issue not occurs on lower version. Are there anybody encounter
the same problem?

One explanation is that the Driver Verifier on Win 8 is update some
function implement.

The code like bellow:
__try{
…
if(!condition){
ExRaiseStatus(status);/* this code will produce the OS crash when running
driver on Win8 with the Driver Verifier enable*/
}
}
__except(){
…
}

Best Regards
Kandom

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

Hi All,

This issue is resloved. Thanks for the James.

The caller IRQL is equal Dispatch level, but the ExRaisStatus work <= APC level.

Best Regards!
Kandom