Hi,
I have a problem with my filter driver. It occasionally crashes with BugCheck 0x0a or 0xd1. I am using the Kernel Debugger but can’t locate the bug in my code (although it obviously is caused by my driver). The MS Knowledge Base demonstrates how to find the right trap frame…but my stack trace looks a bit different from the demonstration (no “KiTrap”). Could someone give me a short hint, please? Here’s the output from the debugger:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 69445c4a, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f1de57be, address which referenced memory
kd> kv
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f89519a8 80526160 00000003 69445c4a f1de57be nt!DbgBreakPointWithStatus+0x4
f8951d74 805266db 0000000a 69445c4a 00000002 nt!KeDeregisterBugCheckReasonCallback+0x58d
f8951d94 804dce53 0000000a 69445c4a 00000002 nt!KeBugCheckEx+0x19
f8951db0 120620ff 10000108 00000000 00000014 nt!Kei386EoiHelper+0x251c
00010002 003a003d 005c003a 00410000 004c004c 0x120620ff
003a003a 00000000 00000000 00000000 00000000 0x3a003d
Thanks in advance!
See if this helps, http://www.osr.com/ntinsider/1999/kmode_except.htm.
-----Original Message-----
From: xxxxx@clever.ms [mailto:xxxxx@clever.ms]
Sent: Thursday, December 19, 2002 10:55 AM
To: File Systems Developers
Subject: [ntfsd] Getting the right trap frame (debugger question)
Hi,
I have a problem with my filter driver. It occasionally crashes with BugCheck 0x0a or 0xd1. I am using the Kernel Debugger but can’t locate the bug in my code (although it obviously is caused by my driver). The MS Knowledge Base demonstrates how to find the right trap frame…but my stack trace looks a bit different from the demonstration (no “KiTrap”). Could someone give me a short hint, please? Here’s the output from the debugger:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 69445c4a, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f1de57be, address which referenced memory
kd> kv
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f89519a8 80526160 00000003 69445c4a f1de57be nt!DbgBreakPointWithStatus+0x4
f8951d74 805266db 0000000a 69445c4a 00000002 nt!KeDeregisterBugCheckReasonCallback+0x58d
f8951d94 804dce53 0000000a 69445c4a 00000002 nt!KeBugCheckEx+0x19
f8951db0 120620ff 10000108 00000000 00000014 nt!Kei386EoiHelper+0x251c
00010002 003a003d 005c003a 00410000 004c004c 0x120620ff
003a003a 00000000 00000000 00000000 00000000 0x3a003d
Thanks in advance!
You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%
Refer to the subsection titled “Finding the Trap Frame.”
-----Original Message-----
From: Fuller, Rob
Sent: Thursday, December 19, 2002 11:18 AM
To: File Systems Developers
Subject: [ntfsd] RE: Getting the right trap frame (debugger question)
See if this helps, http://www.osr.com/ntinsider/1999/kmode_except.htm.
-----Original Message-----
From: xxxxx@clever.ms [mailto:xxxxx@clever.ms]
Sent: Thursday, December 19, 2002 10:55 AM
To: File Systems Developers
Subject: [ntfsd] Getting the right trap frame (debugger question)
Hi,
I have a problem with my filter driver. It occasionally crashes with BugCheck 0x0a or 0xd1. I am using the Kernel Debugger but can’t locate the bug in my code (although it obviously is caused by my driver). The MS Knowledge Base demonstrates how to find the right trap frame…but my stack trace looks a bit different from the demonstration (no “KiTrap”). Could someone give me a short hint, please? Here’s the output from the debugger:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 69445c4a, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f1de57be, address which referenced memory
kd> kv
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f89519a8 80526160 00000003 69445c4a f1de57be nt!DbgBreakPointWithStatus+0x4
f8951d74 805266db 0000000a 69445c4a 00000002 nt!KeDeregisterBugCheckReasonCallback+0x58d
f8951d94 804dce53 0000000a 69445c4a 00000002 nt!KeBugCheckEx+0x19
f8951db0 120620ff 10000108 00000000 00000014 nt!Kei386EoiHelper+0x251c
00010002 003a003d 005c003a 00410000 004c004c 0x120620ff
003a003a 00000000 00000000 00000000 00000000 0x3a003d
Thanks in advance!
You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%
You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%