Getting error in ntReadFile

NTFSD
1

I have modelled my FSD as FileMon.
But when i try to run any exe from the drive i hooked it or do some
installations, it gives excpetion in ntReadFile

as

Access violation - code c0000005 (!!! second chance !!!)
nt!NtReadFile+2f6:
804bb954 ff5608 call dword ptr [esi+0x8]

What could be the possible reason?

Thanks in advance

2

What is the value of esi register?
May be at least the output of !analyze command would help us.

-Srin.

-----Original Message-----
From: NewBie [mailto:xxxxx@yahoo.com]
Sent: Sunday, July 13, 2003 11:44 PM
To: File Systems Developers
Subject: [ntfsd] Getting error in ntReadFile

I have modelled my FSD as FileMon.
But when i try to run any exe from the drive i hooked it or do some
installations, it gives excpetion in ntReadFile

as

Access violation - code c0000005 (!!! second chance !!!)
nt!NtReadFile+2f6:
804bb954 ff5608 call dword ptr [esi+0x8]

What could be the possible reason?

Thanks in advance

You are currently subscribed to ntfsd as: xxxxx@nai.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Value of ESI register is NULL

output of -analyze is

Use !analyze -v to get detailed debugging information.

BugCheck 0, {0, 0, 0, 0}

Probably caused by : ntoskrnl.exe ( nt!NtReadFile+2f6 )

Followup: MachineOwner

Thx in advance

xxxxx@NAI.com wrote:
What is the value of esi register?
May be at least the output of !analyze command would help us.

-Srin.

-----Original Message-----
From: NewBie [mailto:xxxxx@yahoo.com]
Sent: Sunday, July 13, 2003 11:44 PM
To: File Systems Developers
Subject: [ntfsd] Getting error in ntReadFile

I have modelled my FSD as FileMon.
But when i try to run any exe from the drive i hooked it or do some
installations, it gives excpetion in ntReadFile

as

Access violation - code c0000005 (!!! second chance !!!)
nt!NtReadFile+2f6:
804bb954 ff5608 call dword ptr [esi+0x8]

What could be the possible reason?

Thanks in advance

You are currently subscribed to ntfsd as: xxxxx@nai.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@yahoo.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!

4

Actually problem occurs when i try to reas file.write file from user mode application.
The IRP comes to my device then i call lower device , after that the excption occurs!!!

Is it necessary to register my IO completion routine??
If i dont secify the IOcompletion routine then what will happen?

Regards
Shekhar

Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!