Generally, one should post the output of the command !analyze -v from
windbg, after current contexts are set in debugger, it is many times much
more usefull then blindly only the error code. Also, that stack trace you
got in Softice is
hardly usefull because I beleive you dont have any symbols loaded, or
whatsoever.
Be sure you get correct symbols loaded in whatever debugger you use, and
preferably use Windbg to analyze crash reasons. Is better suited for this
than any other package. Also, Ntice hooks on interrupts in kernel MAY result
in a slightly trashed crash dump, easy to recover from anyway , since the
debugger wont find any apropiate symbols for module ntice.sys .
Dan
----- Original Message -----
From: “Croci, MaryBeth”
To: “Windows System Software Developers Interest List”
Sent: Thursday, July 31, 2003 4:13 PM
Subject: [ntdev] RE: Double fault when ZoneLab’s vsdatant.sys is active
> I have no personal experience with this, but I typed “vsdatant BSOD” into
> google search, and found several articles reporting crashes with this
> driver. It seems to be buggy. In one case, they mentioned that version 2
> seemed OK, but version 3 has problems.
>
> -----Original Message-----
> From: Jicun Zhong [mailto:xxxxx@vallcom.com]
> Sent: Thursday, July 31, 2003 2:39 AM
> To: Windows System Software Developers Interest List
> Subject: [ntdev] Double fault when ZoneLab’s vsdatant.sys is active
>
>
> Hi All,
> I noticed that when ZoneLab’s vsdatant.sys firewall driver is active I
> can occassionally get a double fault bugcheck :
> Error=7F, P1=8, P2=80042000, P3=0, P4=0
> The SI call stack looks like :
> 805367e0 8052f283 ntoskrnl!@CcWriteBehind+00A3
> 00000000 00000000 ntoskrnl!@RtlIpv6StringToAddressW+0115
> I know that vsdatant.sys registers a fake protocol and walks thru the
> protocol list and corresponding miniports to hook thing up. This problem
> happens only when I am using an NDIS hook driver which patches NDIS export
> table on certain functions like NdisRegisterProtocol etc… In order to
> ensure that kernel stack is not tight, I put a stack check
> (remainingsize<1024) on all the hooking functions in the Ndis hook driver.
> However when the bugcheck happens, none of the stack check has indicated
the
> stack remainingsize<1024. Has any one seen similar problems? Any ideas on
> the cause and how to debug this?
>
> Jicun
>
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@stratus.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>