FsRtlFullReportChange

NTFSD
1

Hi All,

I am writing a FILE SYSTEM DRIVER, I am catching an exception while trying to do FsRtlFullReportChange.
Here’s the output of “!analyze -v”.
What could be wrong. I have initialized both NotifySync and NotifyList at the mountvolume.

Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:

“kernel32.dll” was not found in the image list.
Debugger will attempt to load “kernel32.dll” at given base 00000000`00000000.

Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=,.
Unable to add module at 0000000000000000<br><br>PROCESS_NAME: WINWORD.EXE<br><br>FAULTING_IP: <br>nt!memcmp+32<br>fffff80002869942 3a040a cmp al,byte ptr [rdx+rcx]

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid
EXCEPTION_PARAMETER1: 0000000000000000
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff880038d1558 – (.exr 0xfffff880038d1558)
ExceptionAddress: fffff80002869942 (nt!memcmp+0x0000000000000032)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

FOLLOWUP_IP:
Driver!DriverExceptionFilter+2e [c:\users\adnan\documents\driver\except.c @ 23]
fffff8800212be0e cc int 3<br><br>BUGCHECK_STR: ACCESS_VIOLATION<br><br>TRAP_FRAME: fffff880038d1600 -- (.trap 0xfffff880038d1600)<br>NOTE: The trap frame does not contain all registers.<br>Some register values may be zeroed or incorrect.<br>rax=fffff8a001752e5c rbx=0000000000000000 rcx=fffff8a000dead00<br>rdx=006907c5ff415374 rsi=0000000000000000 rdi=0000000000000000<br>rip=fffff80002869942 rsp=fffff880038d1798 rbp=fffffa8001b67840<br> r8=0000000000000002 r9=fffff8a00198df40 r10=fffff800029ee480<br>r11=0000000000000010 r12=0000000000000000 r13=0000000000000000<br>r14=0000000000000000 r15=0000000000000000<br>iopl=0 nv up ei pl nz na pe nc<br>nt!memcmp+0x32:<br>fffff80002869942 3a040a cmp al,byte ptr [rdx+rcx] ds:0069006600200074=??<br>Resetting default scope<br><br>LAST_CONTROL_TRANSFER: from fffff880021470b3 to fffff8800212be0e<br><br>STACK_TEXT: <br>fffff880038d0580 fffff880021470b3 : fffffa8002c09d90 fffff880038d0640 fffff880038d06b8 fffff880038d06b8 : Driver!DriverExceptionFilter+0x2e [c:\users\adnan\documents\driver\except.c @ 23]<br>fffff880038d05e0 fffff800028a08ac : fffff880038d0640 fffff880038d1d50 0000000000000000 fffffa8001c71680 : Driver!IRPDispatcher$filt$0+0x23 [c:\users\adnan\documents\driver\irp.c @ 1639]<br>fffff880038d0610 fffff80002897fad : fffff8800214dbcc fffff880038d1d50 0000000000000000 fffff8800211b000 : nt!_C_specific_handler+0x8c<br>fffff880038d0680 fffff8000289f620 : fffff8800214dbcc fffff880038d06f8 fffff880038d1558 fffff8800211b000 : nt!RtlpExecuteHandlerForException+0xd<br>fffff880038d06b0 fffff800028ac6cf : fffff880038d1558 fffff880038d0dc0 fffff88000000000 0000000000000000 : nt!RtlDispatchException+0x410<br>fffff880038d0d90 fffff80002871ec2 : fffff880038d1558 fffffa8001a08601 fffff880038d1600 fffff8a002f7d400 : nt!KiDispatchException+0x16f<br>fffff880038d1420 fffff800028707ca : 0000000000000f88 0000000000000000 0000000000000000 0000000000000000 : nt!KiExceptionDispatch+0xc2<br>fffff880038d1600 fffff80002869942 : fffff80002b82520 00000000000ed100 fffffa80039aa060 0000000000000000 : nt!KiGeneralProtectionFault+0x10a<br>fffff880038d1798 fffff80002b82520 : 00000000000ed100 fffffa80039aa060 0000000000000000 fffffa8001b67840 : nt!memcmp+0x32<br>fffff880038d17a0 fffff80002cc9e7b : fffffa8003970e50 fffffa80039aa722 fffff8a00198df40 ffff000049000002 : nt!FsRtlNotifyFilterReportChange+0x210<br>fffff880038d18e0 fffff880021404df : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!FsRtlNotifyFullReportChange+0x4b<br>fffff880038d1940 fffff880021379c3 : fffff8a00198df40 fffff8a0015f0002 fffffa80039aa1b0 fffff8a000000001 : Driver!DriverNotifyChange+0x7f [c:\users\adnan\documents\driver\user.c @ 77]<br>fffff880038d19a0 fffff88002124861 : fffffa80039aa1b0 fffff8a002dfb350 fffff8a002f88a30 0000000000000801 : Driver!DriverDeleteFile+0x3a3 [c:\users\adnan\documents\driver\irp.c @ 743]<br>fffff880038d1c40 fffff88002138de6 : fffffa8002c09d90 00000000000007ff fffffa8001b7e510 fffffa8002c09d90 : Driver!DriverCleanup+0x671 [c:\users\adnan\documents\driver\cleanup.c @ 173]<br>fffff880038d1d10 fffff880021390dd : fffffa8002c09d90 fffffa80039aa060 0000000000000000 fffffa8002889a20 : Driver!DriverDispatchRequest+0x166 [c:\users\adnan\documents\driver\irp.c @ 1496]<br>fffff880038d1d50 fffff80002b84d8f : fffffa80039aa060 fffffa8001b7e170 0000000000000000 fffffa8002889a20 : Driver!IRPDispatcher+0x11d [c:\users\adnan\documents\driver\irp.c @ 1636]<br>fffff880038d1db0 fffff80002b69024 : 0000000000000000 fffffa8001b67840 fffffa8001a20100 fffffa8002889a20 : nt!IopCloseFile+0x11f<br>fffff880038d1e40 fffff80002b84881 : fffffa8001b67840 fffffa8000000001 fffff8a002c78330 0000000000000000 : nt!ObpDecrementHandleCount+0xb4<br>fffff880038d1ec0 fffff80002b84794 : 0000000000000430 fffffa8001b67840 fffff8a002c78330 0000000000000430 : nt!ObpCloseHandleTableEntry+0xb1<br>fffff880038d1f50 fffff80002871ad3 : fffffa8001a086d0 fffff880038d2020 000000007efdb000 0001000000008000 : nt!ObpCloseHandle+0x94<br>fffff880038d1fa0 00000000770df7aa : 00000000739ff2cd 0000000073982450 00000000000ed1a0 00000000000efd20 : nt!KiSystemServiceCopyEnd+0x13<br>00000000000ec838 00000000739ff2cd : 0000000073982450 00000000000ed1a0 00000000000efd20 0000000073a0524c : ntdll!NtClose+0xa<br>00000000000ec840 00000000739fcf87 : 00000000000ec818 00000000003d8930 000000007efdb000 0000000000400060 : wow64!whNtClose+0x11<br>00000000000ec870 000000007398276d : 0000000077290fba 0073006f00720023 0000000000000000 00000000003d8f48 : wow64!Wow64SystemServiceEx+0xd7<br>00000000000ed130 00000000739fd07e : 000000007684723b 0000000073981904 0000000073ae0fdb 00000000003df304 : wow64cpu!ServiceNoTurbo+0x24<br>00000000000ed1f0 00000000739f8a40 : 00000000000272a5 00000000003df530 000000000000002b 00000000000edfb0 : wow64!RunCpuSimulation+0xa<br>00000000000ed240 00000000739c2c4e : 00000000000ed5c0 0000000000000002 00000000000edf20 0000000000000020 : wow64!Wow64KiUserCallbackDispatcher+0x204<br>00000000000ed590 00000000770df5e5 : 3f3a500001000000 0000000000000000 0000000000000000 772e70d5003ddf28 : wow64win!whcbfnDWORD+0xe2<br>00000000000edf80 00000000739cfe4a : 00000000739aaefe 0000000000000000 00000000770df5e5 0000000000a9c910 : ntdll!KiUserCallbackDispatcherContinue<br>00000000000ee008 00000000739aaefe : 0000000000000000 00000000770df5e5 0000000000a9c910 000000000000000f : wow64win!ZwUserMessageCall+0xa<br>00000000000ee010 00000000739c281b : 0000000000000000 00000000739a54b0 00000000739a48e8 0000000000000112 : wow64win!whNT32NtUserMessageCallCB+0x32<br>00000000000ee060 00000000739ab03a : 000000000000029e 00000000003dcfb4 0000000000000112 0000000000000000 : wow64win!Wow64DoMessageThunk+0x8b<br>00000000000ee0a0 00000000739fcf87 : 00000000003dcf30 000000007efdb000 000000007efdd000 00000000739aaf0c : wow64win!whNtUserMessageCall+0x12e<br>00000000000ee140 000000007398276d : 000000007684ce75 00000000739f0023 0000000000000007 00000000003df75c : wow64!Wow64SystemServiceEx+0xd7<br>00000000000eea00 00000000739fd07e : 0000000000000000 0000000073981920 00000000771a8288 00000000770c34f1 : wow64cpu!ServiceNoTurbo+0x24<br>00000000000eeac0 00000000739fc549 : 0000000000000000 0000000000000000 00000000739f4ac8 000000007ffe0030 : wow64!RunCpuSimulation+0xa<br>00000000000eeb10 00000000770dae27 : 0000000000172e00 0000000000000000 00000000771aa1e0 000000007efdf000 : wow64!Wow64LdrpInitialize+0x429<br>00000000000ef060 00000000770d7168 : 0000000000000000 00000000770d8641 00000000770e84f0 0000000000000000 : ntdll!LdrpInitializeProcess+0x1780<br>00000000000ef560 00000000770c2aae : 00000000000ef620 0000000000000000 000000007efdf000 0000000000000000 : ntdll! ?? ::FNODOBFM::string’+0x2af20
00000000000ef5d0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!LdrInitializeThunk+0xe

STACK_COMMAND: kb

FAULTING_SOURCE_LINE: c:\users\adnan\documents\driver\except.c

FAULTING_SOURCE_FILE: c:\users\adnan\documents\driver\except.c

FAULTING_SOURCE_LINE_NUMBER: 23

FAULTING_SOURCE_CODE:
21:
22: #ifdef DBG
> 23: DbgBreakPoint();
24: #endif // DBG
25:

SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Driver!DriverExceptionFilter+2e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Driver
IMAGE_NAME: Driver.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52527291
FAILURE_BUCKET_ID: X64_ACCESS_VIOLATION_Driver!DriverExceptionFilter+2e
BUCKET_ID: X64_ACCESS_VIOLATION_Driver!DriverExceptionFilter+2e

Followup: MachineOwner
---------</image.ext>

2

I’ve seen this in cases where the name passed into a routine to build
the notify structure, such as FsRtlNotifyFullChangeDirectory, has been
deallocated or is no longer available. Look at the parameters in the
memcmp call and see what is being accessed to cause the exception.

Pete

On 10/7/2013 2:58 AM, xxxxx@gmail.com wrote:

Hi All,

I am writing a FILE SYSTEM DRIVER, I am catching an exception while trying to do FsRtlFullReportChange.
Here’s the output of “!analyze -v”.
What could be wrong. I have initialized both NotifySync and NotifyList at the mountvolume.

Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:

“kernel32.dll” was not found in the image list.
Debugger will attempt to load “kernel32.dll” at given base 00000000`00000000.

Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=,.
> Unable to add module at 0000000000000000<br>&gt;<br>&gt; PROCESS_NAME: WINWORD.EXE<br>&gt;<br>&gt; FAULTING_IP:<br>&gt; nt!memcmp+32<br>&gt; fffff80002869942 3a040a cmp al,byte ptr [rdx+rcx]
>
> ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.
> EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid
> EXCEPTION_PARAMETER1: 0000000000000000
> DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
> CURRENT_IRQL: 0
> EXCEPTION_RECORD: fffff880038d1558 – (.exr 0xfffff880038d1558)
> ExceptionAddress: fffff80002869942 (nt!memcmp+0x0000000000000032)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 0000000000000000
> Parameter[1]: ffffffffffffffff
> Attempt to read from address ffffffffffffffff
>
> READ_ADDRESS: ffffffffffffffff
>
> FOLLOWUP_IP:
> Driver!DriverExceptionFilter+2e [c:\users\adnan\documents\driver\except.c @ 23]
> fffff8800212be0e cc int 3<br>&gt;<br>&gt; BUGCHECK_STR: ACCESS_VIOLATION<br>&gt;<br>&gt; TRAP_FRAME: fffff880038d1600 -- (.trap 0xfffff880038d1600)<br>&gt; NOTE: The trap frame does not contain all registers.<br>&gt; Some register values may be zeroed or incorrect.<br>&gt; rax=fffff8a001752e5c rbx=0000000000000000 rcx=fffff8a000dead00<br>&gt; rdx=006907c5ff415374 rsi=0000000000000000 rdi=0000000000000000<br>&gt; rip=fffff80002869942 rsp=fffff880038d1798 rbp=fffffa8001b67840<br>&gt; r8=0000000000000002 r9=fffff8a00198df40 r10=fffff800029ee480<br>&gt; r11=0000000000000010 r12=0000000000000000 r13=0000000000000000<br>&gt; r14=0000000000000000 r15=0000000000000000<br>&gt; iopl=0 nv up ei pl nz na pe nc<br>&gt; nt!memcmp+0x32:<br>&gt; fffff80002869942 3a040a cmp al,byte ptr [rdx+rcx] ds:0069006600200074=??<br>&gt; Resetting default scope<br>&gt;<br>&gt; LAST_CONTROL_TRANSFER: from fffff880021470b3 to fffff8800212be0e<br>&gt;<br>&gt; STACK_TEXT:<br>&gt; fffff880038d0580 fffff880021470b3 : fffffa8002c09d90 fffff880038d0640 fffff880038d06b8 fffff880038d06b8 : Driver!DriverExceptionFilter+0x2e [c:\users\adnan\documents\driver\except.c @ 23]<br>&gt; fffff880038d05e0 fffff800028a08ac : fffff880038d0640 fffff880038d1d50 0000000000000000 fffffa8001c71680 : Driver!IRPDispatcher$filt$0+0x23 [c:\users\adnan\documents\driver\irp.c @ 1639]<br>&gt; fffff880038d0610 fffff80002897fad : fffff8800214dbcc fffff880038d1d50 0000000000000000 fffff8800211b000 : nt!_C_specific_handler+0x8c<br>&gt; fffff880038d0680 fffff8000289f620 : fffff8800214dbcc fffff880038d06f8 fffff880038d1558 fffff8800211b000 : nt!RtlpExecuteHandlerForException+0xd<br>&gt; fffff880038d06b0 fffff800028ac6cf : fffff880038d1558 fffff880038d0dc0 fffff88000000000 0000000000000000 : nt!RtlDispatchException+0x410<br>&gt; fffff880038d0d90 fffff80002871ec2 : fffff880038d1558 fffffa8001a08601 fffff880038d1600 fffff8a002f7d400 : nt!KiDispatchException+0x16f<br>&gt; fffff880038d1420 fffff800028707ca : 0000000000000f88 0000000000000000 0000000000000000 0000000000000000 : nt!KiExceptionDispatch+0xc2<br>&gt; fffff880038d1600 fffff80002869942 : fffff80002b82520 00000000000ed100 fffffa80039aa060 0000000000000000 : nt!KiGeneralProtectionFault+0x10a<br>&gt; fffff880038d1798 fffff80002b82520 : 00000000000ed100 fffffa80039aa060 0000000000000000 fffffa8001b67840 : nt!memcmp+0x32<br>&gt; fffff880038d17a0 fffff80002cc9e7b : fffffa8003970e50 fffffa80039aa722 fffff8a00198df40 ffff000049000002 : nt!FsRtlNotifyFilterReportChange+0x210<br>&gt; fffff880038d18e0 fffff880021404df : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!FsRtlNotifyFullReportChange+0x4b<br>&gt; fffff880038d1940 fffff880021379c3 : fffff8a00198df40 fffff8a0015f0002 fffffa80039aa1b0 fffff8a000000001 : Driver!DriverNotifyChange+0x7f [c:\users\adnan\documents\driver\user.c @ 77]<br>&gt; fffff880038d19a0 fffff88002124861 : fffffa80039aa1b0 fffff8a002dfb350 fffff8a002f88a30 0000000000000801 : Driver!DriverDeleteFile+0x3a3 [c:\users\adnan\documents\driver\irp.c @ 743]<br>&gt; fffff880038d1c40 fffff88002138de6 : fffffa8002c09d90 00000000000007ff fffffa8001b7e510 fffffa8002c09d90 : Driver!DriverCleanup+0x671 [c:\users\adnan\documents\driver\cleanup.c @ 173]<br>&gt; fffff880038d1d10 fffff880021390dd : fffffa8002c09d90 fffffa80039aa060 0000000000000000 fffffa8002889a20 : Driver!DriverDispatchRequest+0x166 [c:\users\adnan\documents\driver\irp.c @ 1496]<br>&gt; fffff880038d1d50 fffff80002b84d8f : fffffa80039aa060 fffffa8001b7e170 0000000000000000 fffffa8002889a20 : Driver!IRPDispatcher+0x11d [c:\users\adnan\documents\driver\irp.c @ 1636]<br>&gt; fffff880038d1db0 fffff80002b69024 : 0000000000000000 fffffa8001b67840 fffffa8001a20100 fffffa8002889a20 : nt!IopCloseFile+0x11f<br>&gt; fffff880038d1e40 fffff80002b84881 : fffffa8001b67840 fffffa8000000001 fffff8a002c78330 0000000000000000 : nt!ObpDecrementHandleCount+0xb4<br>&gt; fffff880038d1ec0 fffff80002b84794 : 0000000000000430 fffffa8001b67840 fffff8a002c78330 0000000000000430 : nt!ObpCloseHandleTableEntry+0xb1<br>&gt; fffff880038d1f50 fffff80002871ad3 : fffffa8001a086d0 fffff880038d2020 000000007efdb000 0001000000008000 : nt!ObpCloseHandle+0x94<br>&gt; fffff880038d1fa0 00000000770df7aa : 00000000739ff2cd 0000000073982450 00000000000ed1a0 00000000000efd20 : nt!KiSystemServiceCopyEnd+0x13<br>&gt; 00000000000ec838 00000000739ff2cd : 0000000073982450 00000000000ed1a0 00000000000efd20 0000000073a0524c : ntdll!NtClose+0xa<br>&gt; 00000000000ec840 00000000739fcf87 : 00000000000ec818 00000000003d8930 000000007efdb000 0000000000400060 : wow64!whNtClose+0x11<br>&gt; 00000000000ec870 000000007398276d : 0000000077290fba 0073006f00720023 0000000000000000 00000000003d8f48 : wow64!Wow64SystemServiceEx+0xd7<br>&gt; 00000000000ed130 00000000739fd07e : 000000007684723b 0000000073981904 0000000073ae0fdb 00000000003df304 : wow64cpu!ServiceNoTurbo+0x24<br>&gt; 00000000000ed1f0 00000000739f8a40 : 00000000000272a5 00000000003df530 000000000000002b 00000000000edfb0 : wow64!RunCpuSimulation+0xa<br>&gt; 00000000000ed240 00000000739c2c4e : 00000000000ed5c0 0000000000000002 00000000000edf20 0000000000000020 : wow64!Wow64KiUserCallbackDispatcher+0x204<br>&gt; 00000000000ed590 00000000770df5e5 : 3f3a500001000000 0000000000000000 0000000000000000 772e70d5003ddf28 : wow64win!whcbfnDWORD+0xe2<br>&gt; 00000000000edf80 00000000739cfe4a : 00000000739aaefe 0000000000000000 00000000770df5e5 0000000000a9c910 : ntdll!KiUserCallbackDispatcherContinue<br>&gt; 00000000000ee008 00000000739aaefe : 0000000000000000 00000000770df5e5 0000000000a9c910 000000000000000f : wow64win!ZwUserMessageCall+0xa<br>&gt; 00000000000ee010 00000000739c281b : 0000000000000000 00000000739a54b0 00000000739a48e8 0000000000000112 : wow64win!whNT32NtUserMessageCallCB+0x32<br>&gt; 00000000000ee060 00000000739ab03a : 000000000000029e 00000000003dcfb4 0000000000000112 0000000000000000 : wow64win!Wow64DoMessageThunk+0x8b<br>&gt; 00000000000ee0a0 00000000739fcf87 : 00000000003dcf30 000000007efdb000 000000007efdd000 00000000739aaf0c : wow64win!whNtUserMessageCall+0x12e<br>&gt; 00000000000ee140 000000007398276d : 000000007684ce75 00000000739f0023 0000000000000007 00000000003df75c : wow64!Wow64SystemServiceEx+0xd7<br>&gt; 00000000000eea00 00000000739fd07e : 0000000000000000 0000000073981920 00000000771a8288 00000000770c34f1 : wow64cpu!ServiceNoTurbo+0x24<br>&gt; 00000000000eeac0 00000000739fc549 : 0000000000000000 0000000000000000 00000000739f4ac8 000000007ffe0030 : wow64!RunCpuSimulation+0xa<br>&gt; 00000000000eeb10 00000000770dae27 : 0000000000172e00 0000000000000000 00000000771aa1e0 000000007efdf000 : wow64!Wow64LdrpInitialize+0x429<br>&gt; 00000000000ef060 00000000770d7168 : 0000000000000000 00000000770d8641 00000000770e84f0 0000000000000000 : ntdll!LdrpInitializeProcess+0x1780<br>&gt; 00000000000ef560 00000000770c2aae : 00000000000ef620 0000000000000000 000000007efdf000 0000000000000000 : ntdll! ?? ::FNODOBFM::string’+0x2af20
> 00000000000ef5d0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!LdrInitializeThunk+0xe
>
>
> STACK_COMMAND: kb
>
> FAULTING_SOURCE_LINE: c:\users\adnan\documents\driver\except.c
>
> FAULTING_SOURCE_FILE: c:\users\adnan\documents\driver\except.c
>
> FAULTING_SOURCE_LINE_NUMBER: 23
>
> FAULTING_SOURCE_CODE:
> 21:
> 22: #ifdef DBG
>> 23: DbgBreakPoint();
> 24: #endif // DBG
> 25:
>
>
>
> SYMBOL_STACK_INDEX: 0
> SYMBOL_NAME: Driver!DriverExceptionFilter+2e
> FOLLOWUP_NAME: MachineOwner
> MODULE_NAME: Driver
> IMAGE_NAME: Driver.sys
> DEBUG_FLR_IMAGE_TIMESTAMP: 52527291
> FAILURE_BUCKET_ID: X64_ACCESS_VIOLATION_Driver!DriverExceptionFilter+2e
> BUCKET_ID: X64_ACCESS_VIOLATION_Driver!DriverExceptionFilter+2e
>
> Followup: MachineOwner
> ---------
>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295</image.ext>

3

Thanks Peter, I managed to figure out the problem with your help.