Hello Don and Mark
Whenever i return either STATUS_UNSUCCESSFUL or STATUS_CUSTOMERROR (where
its #defined to 0xE2222222)
i get the Bugcheck 0x000000CE. Attached is the thing that i obtained from
the debugger…
Also my DriverEntry() function looks like
DriverEntry()
{
ULONG ulIndex;
PDRIVER_DISPATCH * dispatch;
if(!Condition())
return(STATUS_CUSTOM_VALUE);
//Other info here…
}
*** Fatal System Error: 0x000000ce
(0xBFD97000,0x00000000,0x80458399,0x00000000)
The mydriver.sys driver may be at fault.
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
Connected to Windows 2000 2195 x86 compatible target, ptr64 FALSE
Loading Kernel Symbols
…
Loading unloaded module list
No unloaded module list present
Loading User Symbols
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck CE, {bfd97000, 0, 80458399, 0}
Probably caused by : ntoskrnl.exe ( nt!RtlImageNtHeader+f )
Followup: MachineOwner
nt!RtlpBreakWithStatusInstruction:
80452e70 cc int 3
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver’s name is displayed on the screen.
Arguments:
Arg1: bfd97000, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: 80458399, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, Mm internal code.
Debugging Details:
READ_ADDRESS: bfd97000 Nonpaged pool
FAULTING_IP:
nt!RtlImageNtHeader+f
80458399 6681394d5a cmp word ptr [ecx],0x5a4d
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xCE
LAST_CONTROL_TRANSFER: from 8054dd2a to 80458399
TRAP_FRAME: eb41b7a0 – (.trap ffffffffeb41b7a0)
ErrCode = 00000000
eax=00000000 ebx=eb41b88c ecx=bfd97000 edx=00000001 esi=8007ceb8
edi=bfd97000
eip=80458399 esp=eb41b814 ebp=eb41b854 iopl=0 nv up ei ng nz ac pe
cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010293
nt!RtlImageNtHeader+0xf:
80458399 6681394d5a cmp word ptr [ecx],0x5a4d
Resetting default scope
STACK_TEXT:
eb41b810 8054dd2a bfd97000 8007ceb8 e13793e8 nt!RtlImageNtHeader+0xf
eb41b854 8054daff 84dd06b0 8007a770 bfd97300
nt!IopInitializeBuiltinDriver+0xed
eb41b8b8 8054c574 80087000 eb41ba00 00000000
nt!IopInitializeBootDrivers+0x2d0
eb41ba58 8054b35a 80087000 00000000 00000000 nt!IoInitSystem+0x5ef
eb41bda8 804524f6 80087000 00000000 00000000 nt!Phase1Initialization+0x71b
eb41bddc 80465b62 8054aca6 80087000 00000000 nt!PspSystemThreadStartup+0x69
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
nt!RtlImageNtHeader+f
80458399 6681394d5a cmp word ptr [ecx],0x5a4d
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!RtlImageNtHeader+f
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 384d9b17
STACK_COMMAND: .trap ffffffffeb41b7a0 ; kb
BUCKET_ID: 0xCE_nt!RtlImageNtHeader+f
Followup: MachineOwner
“Don Burn” wrote in message news:xxxxx@ntdev…
> Your STATUS_CUSTOMERROR is a warning code, this will allow things to be
> loaded. Try STATUS_UNSUCCESSFUL. You custom status value should be of
> the
> form 0xEhhhhhhh where h are hex digits.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
> “Shalini” wrote in message news:xxxxx@ntdev…
>> Hi Don
>> thanks for the reply…
>> Based on that what i did was
>>
>> I set the ErrorControl setting to 0 which means SERVICE_ERROR_IGNORE…
>> then i created a #define STATUS_CUSTOMERROR 2453
>>
>> Then in my DriverEntry i did as
>>
>> DriverEntry(…)
>> {
>> if(!cond())
>> return STATUS_CUSTOMERROR;
>>
>> }
>>
>> Though my IRP_MJ_READ/WRITE and others were not mapped but still my
>> driver
>> verifier says that my driver is loaded?
>> Is it a normal practice or am i doing something wrong?
>>
>> Thanks…
>> Regards
>> Shal.
>>
>>
>>
>> “Don Burn” wrote in message news:xxxxx@ntdev…
>> > If you can determine at DriverEntry that your condition is true, then
>> > return
>> > an error status (making sure your driver’s ErrorControl setting is
>> > SERVICE_ERROR_IGNORE). You may want the error status to be a custom
> value
>> > so you can indicate that this is an expected action.
>> >
>> >
>> > –
>> > Don Burn (MVP, Windows DDK)
>> > Windows 2k/XP/2k3 Filesystem and Driver Consulting
>> > Remove StopSpam from the email to reply
>> >
>> >
>> > “Shalini” wrote in message news:xxxxx@ntdev…
>> >> Hello All.
>> >> IS it possible to unload a Upper class filter driver to unload
>> > automatically
>> >> during boot up itself or not to allow it to load at all…
>> >> In the sense that i have to add some conditions based on which the
> Upper
>> >> class filter driver is to load or not.
>> >>
>> >> I found a good example in Windows Device driver book saying that we
>> >> can
>> > just
>> >> return STATUS_SUCCESS from the AddDevice routine so that it
>> >> does not attach toe the device stack.
>> >> But even if do that i can see that my Driver Verifier says that the
>> >> filter
>> >> driver is loaded.
>> >>
>> >> What i have to do is say in DriverEntry i have to add a condition like
>> >> say…
>> >>
>> >>
>> >> int cond()
>> >> {
>> >> if((1+1)==2)
>> >> return 1;
>> >> else
>> >> return 0;
>> >> }
>> >>
>> >>
>> >> DriverEntry(…)
>> >> {
>> >>
>> >> if(cond())
>> >> proceed nicely;
>> >> else
>> >> unloadmenow();
>> >> }
>> >>
>> >> Thanks very much
>> >> Regards
>> >> Shal
>> >>
>> >>
>> >>
>> >
>> >
>> >
>>
>>
>>
>
>
>
