Hi,
Does anyone know of a way to increase the kernel stack size of a
process?
We are running Windows 2003 servers with SP3 with an Anti-virus product and
a Filesystem filter driver product that performs encryption.
When we log in to the servers using Terminal Services, we get a
BSOD because
NTFS was throwing an exception with a value of 0xC00000D8 and while
trying to
process the exception, the exception handling code walked off the end of
the kernel stack.
Thanks for any help you can give us…
Duane
The trace is:
kd> !thread
THREAD 82507b80 Cid 678.66c Teb: 7ffdd000 Win32Thread: a2016938 RUNNING
IRP List:
82672de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
82624de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
Not impersonating
Owning Process 81028ce0
Wait Start TickCount 10070 Elapsed Ticks: 0
Context Switch Count 18 LargeStack
UserTime 0:00:00.0000
KernelTime 0:00:00.0010
Start Address winsrv!TerminalServerRequestThread (0x5ffc001f)
Stack Init f6106000 Current f6103bdc Base f6106000 Limit f6103000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr Args to Child
00000000 8042cd69 00000000 00000000 00000000 nt!KiTrap08+0x3e
f610301c 80430386 f6103000 00000000 f6103124 nt!KiEspToTrapFrame+0x1
f6103074 80466b2d f6103124 00000000 f6103098 nt!KiContinue+0x86
f6103088 80462f14 f6103124 00000000 8045d70c nt!NtContinue+0x21
f6103088 8045d704 f6103124 00000000 8045d70c nt!KiSystemService+0xc4
f61034c4 8045dc0f f6103c70 f61034e8 f6103c78 nt!_global_unwind2+0x18
f61034e8 80467ee2 f61035a4 f6103c70 f61035f4 nt!_except_handler3+0x5f
f610350c 804598c8 f61035a4 f6103c70 f61035f4 nt!ExecuteHandler+0x26
f6103594 80467e91 f61035a4 f61035f4 c00000d8 nt!RtlDispatchException+0x76
f61038c8 fcc3893a c00000d8 81050c28 82672f9c nt!ExRaiseStatus+0xb5
f61038d8 fcc838f0 81050c28 c00000d8 00000000 Ntfs!NtfsRaiseStatus+0x65
f6103be0 fcc56a46 81050c28 82672de8 f6103c40 Ntfs!NtfsCommonCreate+0x489
f6103c80 8041cc8b 813b36e0 82672de8 00000000 Ntfs!NtfsFsdCreate+0x157
f6103c94 f5ced2b3 f6103ce4 f6043c00 00000000 nt!IopfCallDriver+0x35
f6103d70 f70b4776 82672de8 8491ae40 00000002 SYMEVENT+0x62b3
f6103da4 f70b4a3b 82672de8 82672fc0 879afed8 filecheck_2k!FinishIrp+0x13e
f6103de4 8041cc8b 879afe20 879afed8 82672df8 filecheck_2k!handleIrp+0x183
f6103df8 804bd526 f61040f8 804bcb22 f61040ec nt!IopfCallDriver+0x35
f6103f80 8044ea07 813e97b0 00000000 f6104030 nt!IopParseDevice+0xa04
f6103ff0 804d303b 00000000 81430000 00000040 nt!ObpLookupObjectName+0x4db
f6104100 8049dc04 00000000 00000000 80469400 nt!ObOpenObjectByName+0xc5
f61041d4 804a6317 f6104328 00000180 f61042f8 nt!IoCreateFile+0x3ec
f6104214 80462f14 f6104328 00000180 f61042f8 nt!NtOpenFile+0x25
f6104214 8042e71f f6104328 00000180 f61042f8 nt!KiSystemService+0xc4
f61042a4 f5caec38 f6104328 00000180 f61042f8 nt!ZwOpenFile+0xb
f6104320 f5caeea3 e237fc10 e1eda200 00000000 NAVAP+0x2cc38
ff487f30 f5cb2acd e237fc10 f61044c2 f6104348 NAVAP+0x2cea3
ff487f40 f5c8cc11 e237fc10 f6104438 f5c8c615 NAVAP+0x30acd
f6104348 f5c88106 ff487f88 f5c88050 f61043b8 NAVAP+0xac11
f610439c f5c8834f ff487f88 00003f80 f5c88050 NAVAP+0x6106
e1ef06a8 e1ef14a8 f5ce73f0 e12e8948 f5ce73f4 NAVAP+0x634f
f5ce7784 f5ceafd0 f5ceb070 f5ced9b0 f5ceb0c0 +0xe1ef14a8
f5cec3f0 ffffeb58 082444f6 56097401 0027bbe8 SYMEVENT+0x3fd0
e8f18b56 00000000 00000000 00000000 00000000 +0xffffeb58
Short of allocating your own stack for the thread and switching to it,
which some people on this list may support, simply queue the request to
a worker thread when the stack space is getting low.
Pete
Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Duane Souder
Sent: Friday, May 30, 2003 9:28 AM
To: File Systems Developers
Subject: [ntfsd] Kernel Stack limts
Hi,
Does anyone know of a way to increase the kernel stack size of a
process?
We are running Windows 2003 servers with SP3 with an Anti-virus product
and
a Filesystem filter driver product that performs encryption.
When we log in to the servers using Terminal Services, we get a
BSOD because
NTFS was throwing an exception with a value of 0xC00000D8 and while
trying to
process the exception, the exception handling code walked off the end of
the kernel stack.
Thanks for any help you can give us…
Duane
The trace is:
kd> !thread
THREAD 82507b80 Cid 678.66c Teb: 7ffdd000 Win32Thread: a2016938
RUNNING
IRP List:
82672de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
82624de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
Not impersonating
Owning Process 81028ce0
Wait Start TickCount 10070 Elapsed Ticks: 0
Context Switch Count 18 LargeStack
UserTime 0:00:00.0000
KernelTime 0:00:00.0010
Start Address winsrv!TerminalServerRequestThread (0x5ffc001f)
Stack Init f6106000 Current f6103bdc Base f6106000 Limit f6103000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr Args to Child
00000000 8042cd69 00000000 00000000 00000000 nt!KiTrap08+0x3e
f610301c 80430386 f6103000 00000000 f6103124 nt!KiEspToTrapFrame+0x1
f6103074 80466b2d f6103124 00000000 f6103098 nt!KiContinue+0x86
f6103088 80462f14 f6103124 00000000 8045d70c nt!NtContinue+0x21
f6103088 8045d704 f6103124 00000000 8045d70c nt!KiSystemService+0xc4
f61034c4 8045dc0f f6103c70 f61034e8 f6103c78 nt!_global_unwind2+0x18
f61034e8 80467ee2 f61035a4 f6103c70 f61035f4 nt!_except_handler3+0x5f
f610350c 804598c8 f61035a4 f6103c70 f61035f4 nt!ExecuteHandler+0x26
f6103594 80467e91 f61035a4 f61035f4 c00000d8
nt!RtlDispatchException+0x76
f61038c8 fcc3893a c00000d8 81050c28 82672f9c nt!ExRaiseStatus+0xb5
f61038d8 fcc838f0 81050c28 c00000d8 00000000 Ntfs!NtfsRaiseStatus+0x65
f6103be0 fcc56a46 81050c28 82672de8 f6103c40 Ntfs!NtfsCommonCreate+0x489
f6103c80 8041cc8b 813b36e0 82672de8 00000000 Ntfs!NtfsFsdCreate+0x157
f6103c94 f5ced2b3 f6103ce4 f6043c00 00000000 nt!IopfCallDriver+0x35
f6103d70 f70b4776 82672de8 8491ae40 00000002 SYMEVENT+0x62b3
f6103da4 f70b4a3b 82672de8 82672fc0 879afed8
filecheck_2k!FinishIrp+0x13e
f6103de4 8041cc8b 879afe20 879afed8 82672df8
filecheck_2k!handleIrp+0x183
f6103df8 804bd526 f61040f8 804bcb22 f61040ec nt!IopfCallDriver+0x35
f6103f80 8044ea07 813e97b0 00000000 f6104030 nt!IopParseDevice+0xa04
f6103ff0 804d303b 00000000 81430000 00000040
nt!ObpLookupObjectName+0x4db
f6104100 8049dc04 00000000 00000000 80469400 nt!ObOpenObjectByName+0xc5
f61041d4 804a6317 f6104328 00000180 f61042f8 nt!IoCreateFile+0x3ec
f6104214 80462f14 f6104328 00000180 f61042f8 nt!NtOpenFile+0x25
f6104214 8042e71f f6104328 00000180 f61042f8 nt!KiSystemService+0xc4
f61042a4 f5caec38 f6104328 00000180 f61042f8 nt!ZwOpenFile+0xb
f6104320 f5caeea3 e237fc10 e1eda200 00000000 NAVAP+0x2cc38
ff487f30 f5cb2acd e237fc10 f61044c2 f6104348 NAVAP+0x2cea3
ff487f40 f5c8cc11 e237fc10 f6104438 f5c8c615 NAVAP+0x30acd
f6104348 f5c88106 ff487f88 f5c88050 f61043b8 NAVAP+0xac11
f610439c f5c8834f ff487f88 00003f80 f5c88050 NAVAP+0x6106
e1ef06a8 e1ef14a8 f5ce73f0 e12e8948 f5ce73f4 NAVAP+0x634f
f5ce7784 f5ceafd0 f5ceb070 f5ced9b0 f5ceb0c0 +0xe1ef14a8
f5cec3f0 ffffeb58 082444f6 56097401 0027bbe8 SYMEVENT+0x3fd0
e8f18b56 00000000 00000000 00000000 00000000 +0xffffeb58
You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
How much stack Kernel Stack Space should I assume that NTFS needs ?
Note the stack trace was at f6103da4 for the encryption filter
with a limit of f6103000 meaning there was still da0 left.
Peter Scott wrote:
Short of allocating your own stack for the thread and switching to it,
which some people on this list may support, simply queue the request to
a worker thread when the stack space is getting low.
Pete
Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Duane Souder
Sent: Friday, May 30, 2003 9:28 AM
To: File Systems Developers
Subject: [ntfsd] Kernel Stack limts
Hi,
Does anyone know of a way to increase the kernel stack size of a
process?
We are running Windows 2003 servers with SP3 with an Anti-virus product
and
a Filesystem filter driver product that performs encryption.
When we log in to the servers using Terminal Services, we get a
BSOD because
NTFS was throwing an exception with a value of 0xC00000D8 and while
trying to
process the exception, the exception handling code walked off the end of
the kernel stack.
Thanks for any help you can give us…
Duane
The trace is:
kd> !thread
THREAD 82507b80 Cid 678.66c Teb: 7ffdd000 Win32Thread: a2016938
RUNNING
IRP List:
82672de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
82624de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
Not impersonating
Owning Process 81028ce0
Wait Start TickCount 10070 Elapsed Ticks: 0
Context Switch Count 18 LargeStack
UserTime 0:00:00.0000
KernelTime 0:00:00.0010
Start Address winsrv!TerminalServerRequestThread (0x5ffc001f)
Stack Init f6106000 Current f6103bdc Base f6106000 Limit f6103000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr Args to Child
00000000 8042cd69 00000000 00000000 00000000 nt!KiTrap08+0x3e
f610301c 80430386 f6103000 00000000 f6103124 nt!KiEspToTrapFrame+0x1
f6103074 80466b2d f6103124 00000000 f6103098 nt!KiContinue+0x86
f6103088 80462f14 f6103124 00000000 8045d70c nt!NtContinue+0x21
f6103088 8045d704 f6103124 00000000 8045d70c nt!KiSystemService+0xc4
f61034c4 8045dc0f f6103c70 f61034e8 f6103c78 nt!_global_unwind2+0x18
f61034e8 80467ee2 f61035a4 f6103c70 f61035f4 nt!_except_handler3+0x5f
f610350c 804598c8 f61035a4 f6103c70 f61035f4 nt!ExecuteHandler+0x26
f6103594 80467e91 f61035a4 f61035f4 c00000d8
nt!RtlDispatchException+0x76
f61038c8 fcc3893a c00000d8 81050c28 82672f9c nt!ExRaiseStatus+0xb5
f61038d8 fcc838f0 81050c28 c00000d8 00000000 Ntfs!NtfsRaiseStatus+0x65
f6103be0 fcc56a46 81050c28 82672de8 f6103c40 Ntfs!NtfsCommonCreate+0x489
f6103c80 8041cc8b 813b36e0 82672de8 00000000 Ntfs!NtfsFsdCreate+0x157
f6103c94 f5ced2b3 f6103ce4 f6043c00 00000000 nt!IopfCallDriver+0x35
f6103d70 f70b4776 82672de8 8491ae40 00000002 SYMEVENT+0x62b3
f6103da4 f70b4a3b 82672de8 82672fc0 879afed8
filecheck_2k!FinishIrp+0x13e
f6103de4 8041cc8b 879afe20 879afed8 82672df8
filecheck_2k!handleIrp+0x183
f6103df8 804bd526 f61040f8 804bcb22 f61040ec nt!IopfCallDriver+0x35
f6103f80 8044ea07 813e97b0 00000000 f6104030 nt!IopParseDevice+0xa04
f6103ff0 804d303b 00000000 81430000 00000040
nt!ObpLookupObjectName+0x4db
f6104100 8049dc04 00000000 00000000 80469400 nt!ObOpenObjectByName+0xc5
f61041d4 804a6317 f6104328 00000180 f61042f8 nt!IoCreateFile+0x3ec
f6104214 80462f14 f6104328 00000180 f61042f8 nt!NtOpenFile+0x25
f6104214 8042e71f f6104328 00000180 f61042f8 nt!KiSystemService+0xc4
f61042a4 f5caec38 f6104328 00000180 f61042f8 nt!ZwOpenFile+0xb
f6104320 f5caeea3 e237fc10 e1eda200 00000000 NAVAP+0x2cc38
ff487f30 f5cb2acd e237fc10 f61044c2 f6104348 NAVAP+0x2cea3
ff487f40 f5c8cc11 e237fc10 f6104438 f5c8c615 NAVAP+0x30acd
f6104348 f5c88106 ff487f88 f5c88050 f61043b8 NAVAP+0xac11
f610439c f5c8834f ff487f88 00003f80 f5c88050 NAVAP+0x6106
e1ef06a8 e1ef14a8 f5ce73f0 e12e8948 f5ce73f4 NAVAP+0x634f
f5ce7784 f5ceafd0 f5ceb070 f5ced9b0 f5ceb0c0 +0xe1ef14a8
f5cec3f0 ffffeb58 082444f6 56097401 0027bbe8 SYMEVENT+0x3fd0
e8f18b56 00000000 00000000 00000000 00000000 +0xffffeb58
You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
You are currently subscribed to ntfsd as: xxxxx@okena.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Well, kernel stacks are 12K, fixed in size. So pick a lower limit and if
you have the request and the current stack size is below this limit then
queue it up to a worker thread.
Pete
Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Duane Souder
Sent: Friday, May 30, 2003 10:19 AM
To: File Systems Developers
Subject: [ntfsd] RE: Kernel Stack limts
How much stack Kernel Stack Space should I assume that NTFS needs ?
Note the stack trace was at f6103da4 for the encryption filter
with a limit of f6103000 meaning there was still da0 left.
Peter Scott wrote:
Short of allocating your own stack for the thread and switching to it,
which some people on this list may support, simply queue the request to
a worker thread when the stack space is getting low.
Pete
Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Duane Souder
Sent: Friday, May 30, 2003 9:28 AM
To: File Systems Developers
Subject: [ntfsd] Kernel Stack limts
Hi,
Does anyone know of a way to increase the kernel stack size of a
process?
We are running Windows 2003 servers with SP3 with an Anti-virus product
and
a Filesystem filter driver product that performs encryption.
When we log in to the servers using Terminal Services, we get a
BSOD because
NTFS was throwing an exception with a value of 0xC00000D8 and while
trying to
process the exception, the exception handling code walked off the end
of
the kernel stack.
Thanks for any help you can give us…
Duane
The trace is:
kd> !thread
THREAD 82507b80 Cid 678.66c Teb: 7ffdd000 Win32Thread: a2016938
RUNNING
IRP List:
82672de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
82624de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
Not impersonating
Owning Process 81028ce0
Wait Start TickCount 10070 Elapsed Ticks: 0
Context Switch Count 18 LargeStack
UserTime 0:00:00.0000
KernelTime 0:00:00.0010
Start Address winsrv!TerminalServerRequestThread (0x5ffc001f)
Stack Init f6106000 Current f6103bdc Base f6106000 Limit f6103000 Call
0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr Args to Child
00000000 8042cd69 00000000 00000000 00000000 nt!KiTrap08+0x3e
f610301c 80430386 f6103000 00000000 f6103124 nt!KiEspToTrapFrame+0x1
f6103074 80466b2d f6103124 00000000 f6103098 nt!KiContinue+0x86
f6103088 80462f14 f6103124 00000000 8045d70c nt!NtContinue+0x21
f6103088 8045d704 f6103124 00000000 8045d70c nt!KiSystemService+0xc4
f61034c4 8045dc0f f6103c70 f61034e8 f6103c78 nt!_global_unwind2+0x18
f61034e8 80467ee2 f61035a4 f6103c70 f61035f4 nt!_except_handler3+0x5f
f610350c 804598c8 f61035a4 f6103c70 f61035f4 nt!ExecuteHandler+0x26
f6103594 80467e91 f61035a4 f61035f4 c00000d8
nt!RtlDispatchException+0x76
f61038c8 fcc3893a c00000d8 81050c28 82672f9c nt!ExRaiseStatus+0xb5
f61038d8 fcc838f0 81050c28 c00000d8 00000000 Ntfs!NtfsRaiseStatus+0x65
f6103be0 fcc56a46 81050c28 82672de8 f6103c40
Ntfs!NtfsCommonCreate+0x489
f6103c80 8041cc8b 813b36e0 82672de8 00000000 Ntfs!NtfsFsdCreate+0x157
f6103c94 f5ced2b3 f6103ce4 f6043c00 00000000 nt!IopfCallDriver+0x35
f6103d70 f70b4776 82672de8 8491ae40 00000002 SYMEVENT+0x62b3
f6103da4 f70b4a3b 82672de8 82672fc0 879afed8
filecheck_2k!FinishIrp+0x13e
f6103de4 8041cc8b 879afe20 879afed8 82672df8
filecheck_2k!handleIrp+0x183
f6103df8 804bd526 f61040f8 804bcb22 f61040ec nt!IopfCallDriver+0x35
f6103f80 8044ea07 813e97b0 00000000 f6104030 nt!IopParseDevice+0xa04
f6103ff0 804d303b 00000000 81430000 00000040
nt!ObpLookupObjectName+0x4db
f6104100 8049dc04 00000000 00000000 80469400 nt!ObOpenObjectByName+0xc5
f61041d4 804a6317 f6104328 00000180 f61042f8 nt!IoCreateFile+0x3ec
f6104214 80462f14 f6104328 00000180 f61042f8 nt!NtOpenFile+0x25
f6104214 8042e71f f6104328 00000180 f61042f8 nt!KiSystemService+0xc4
f61042a4 f5caec38 f6104328 00000180 f61042f8 nt!ZwOpenFile+0xb
f6104320 f5caeea3 e237fc10 e1eda200 00000000 NAVAP+0x2cc38
ff487f30 f5cb2acd e237fc10 f61044c2 f6104348 NAVAP+0x2cea3
ff487f40 f5c8cc11 e237fc10 f6104438 f5c8c615 NAVAP+0x30acd
f6104348 f5c88106 ff487f88 f5c88050 f61043b8 NAVAP+0xac11
f610439c f5c8834f ff487f88 00003f80 f5c88050 NAVAP+0x6106
e1ef06a8 e1ef14a8 f5ce73f0 e12e8948 f5ce73f4 NAVAP+0x634f
f5ce7784 f5ceafd0 f5ceb070 f5ced9b0 f5ceb0c0 +0xe1ef14a8
f5cec3f0 ffffeb58 082444f6 56097401 0027bbe8 SYMEVENT+0x3fd0
e8f18b56 00000000 00000000 00000000 00000000 +0xffffeb58
You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
You are currently subscribed to ntfsd as: xxxxx@okena.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
ExQueueWorkItem is the simplest way. Watch IoGetRemainingStackSize,
and, if it is too low, queue a work item.
----- Original Message -----
From: “Duane Souder”
To: “File Systems Developers”
Sent: Friday, May 30, 2003 7:28 PM
Subject: [ntfsd] Kernel Stack limts
> Hi,
> Does anyone know of a way to increase the kernel stack size of a
> process?
> We are running Windows 2003 servers with SP3 with an Anti-virus
product and
> a Filesystem filter driver product that performs encryption.
> When we log in to the servers using Terminal Services, we get a
> BSOD because
> NTFS was throwing an exception with a value of 0xC00000D8 and while
> trying to
> process the exception, the exception handling code walked off the
end of
> the kernel stack.
> Thanks for any help you can give us…
> Duane
> ----------------------------
> The trace is:
> kd> !thread
> THREAD 82507b80 Cid 678.66c Teb: 7ffdd000 Win32Thread: a2016938
RUNNING
> IRP List:
> 82672de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
> 82624de8: (0006,01fc) Flags: 00000884 Mdl: 00000000
> Not impersonating
> Owning Process 81028ce0
> Wait Start TickCount 10070 Elapsed Ticks: 0
> Context Switch Count 18 LargeStack
> UserTime 0:00:00.0000
> KernelTime 0:00:00.0010
> Start Address winsrv!TerminalServerRequestThread (0x5ffc001f)
> Stack Init f6106000 Current f6103bdc Base f6106000 Limit f6103000
Call 0
> Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0
>
> ChildEBP RetAddr Args to Child
> 00000000 8042cd69 00000000 00000000 00000000 nt!KiTrap08+0x3e
> f610301c 80430386 f6103000 00000000 f6103124 nt!KiEspToTrapFrame+0x1
> f6103074 80466b2d f6103124 00000000 f6103098 nt!KiContinue+0x86
> f6103088 80462f14 f6103124 00000000 8045d70c nt!NtContinue+0x21
> f6103088 8045d704 f6103124 00000000 8045d70c nt!KiSystemService+0xc4
> f61034c4 8045dc0f f6103c70 f61034e8 f6103c78 nt!_global_unwind2+0x18
> f61034e8 80467ee2 f61035a4 f6103c70 f61035f4
nt!_except_handler3+0x5f
> f610350c 804598c8 f61035a4 f6103c70 f61035f4 nt!ExecuteHandler+0x26
> f6103594 80467e91 f61035a4 f61035f4 c00000d8
nt!RtlDispatchException+0x76
> f61038c8 fcc3893a c00000d8 81050c28 82672f9c nt!ExRaiseStatus+0xb5
> f61038d8 fcc838f0 81050c28 c00000d8 00000000
Ntfs!NtfsRaiseStatus+0x65
> f6103be0 fcc56a46 81050c28 82672de8 f6103c40
Ntfs!NtfsCommonCreate+0x489
> f6103c80 8041cc8b 813b36e0 82672de8 00000000
Ntfs!NtfsFsdCreate+0x157
> f6103c94 f5ced2b3 f6103ce4 f6043c00 00000000 nt!IopfCallDriver+0x35
> f6103d70 f70b4776 82672de8 8491ae40 00000002 SYMEVENT+0x62b3
> f6103da4 f70b4a3b 82672de8 82672fc0 879afed8
filecheck_2k!FinishIrp+0x13e
> f6103de4 8041cc8b 879afe20 879afed8 82672df8
filecheck_2k!handleIrp+0x183
> f6103df8 804bd526 f61040f8 804bcb22 f61040ec nt!IopfCallDriver+0x35
> f6103f80 8044ea07 813e97b0 00000000 f6104030 nt!IopParseDevice+0xa04
> f6103ff0 804d303b 00000000 81430000 00000040
nt!ObpLookupObjectName+0x4db
> f6104100 8049dc04 00000000 00000000 80469400
nt!ObOpenObjectByName+0xc5
> f61041d4 804a6317 f6104328 00000180 f61042f8 nt!IoCreateFile+0x3ec
> f6104214 80462f14 f6104328 00000180 f61042f8 nt!NtOpenFile+0x25
> f6104214 8042e71f f6104328 00000180 f61042f8 nt!KiSystemService+0xc4
> f61042a4 f5caec38 f6104328 00000180 f61042f8 nt!ZwOpenFile+0xb
> f6104320 f5caeea3 e237fc10 e1eda200 00000000 NAVAP+0x2cc38
> ff487f30 f5cb2acd e237fc10 f61044c2 f6104348 NAVAP+0x2cea3
> ff487f40 f5c8cc11 e237fc10 f6104438 f5c8c615 NAVAP+0x30acd
> f6104348 f5c88106 ff487f88 f5c88050 f61043b8 NAVAP+0xac11
> f610439c f5c8834f ff487f88 00003f80 f5c88050 NAVAP+0x6106
> e1ef06a8 e1ef14a8 f5ce73f0 e12e8948 f5ce73f4 NAVAP+0x634f
> f5ce7784 f5ceafd0 f5ceb070 f5ced9b0 f5ceb0c0 +0xe1ef14a8
> f5cec3f0 ffffeb58 082444f6 56097401 0027bbe8 SYMEVENT+0x3fd0
> e8f18b56 00000000 00000000 00000000 00000000 +0xffffeb58
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com