.kdfiles with ETW tracing causes STATUS_SHARING_VIOLATION

matt_sykes · January 15, 2024, 2:03pm

I assume it is because the xml registers the sys file as a provider, but even after doing a wevtutil um on the xml file, a disable/enable of the device in device manager results in a STATUS_SHARING_VIOLATION in windbg in response to the .kdfiles overwrite.

Prior to adding ETW tracing to the driver, the sys file copied over from the build machine OK.

Oh, and dont to a disable on the device and then do a wevtutil um, it results in a BSOD.

Anyway, an interesting bug, means you need to do a reboot to get the new sys file on the machine.

Scott_Noone_OSR · January 15, 2024, 5:22pm

Any chance you’re missing a call to EventUnregisterXxx in driver unload?

matt_sykes · January 24, 2024, 9:58am

Damn, you are right! It is often the obvious!

matt_sykes · January 25, 2024, 10:42am

Actually I was wrong, it is still happening:

KdPullRemoteFile(FFFFB70B3C8F3080): About to overwrite \SystemRoot\System32\drivers\xxxxxxx.sys and preallocate to 13740
KdPullRemoteFile(FFFFB70B3C8F3080): Return from ZwCreateFile with status c0000043

Doresnt matter if you do a wevtutil um on thr xml either, the sys file is STATUS_SHARING_VIOLATION

Only happens with ETW

Scott_Noone_OSR · January 30, 2024, 5:25pm

I just had this happen to me with a driver that has ETW…In my case it turned out I had Event Viewer opened and that’s what was holding the SYS file open.