May FltCreateFile(FltObjects->Filter,...) returns recursively?

[Michael_Grabelkovsky-1]

I have File Filter driver which on PreCreate callback has to open files.

Driver uses FltCreateFile() and calls it with 1st parameter FltObjects->Filter which means request has to going on filter stack down.

The problem: Sometimes request returns to driver recursively!?!

Where is possible reason for problem?

Additional information:

• The problem is reproduced on single simple configuration. I even is unable reproducing it on my test VMs.
• The fltmc on this (bad) machine reports standard filter set: luafv, FileInfo (no antiviruses etc.)

The hipotesa:
Is it possible that FltObjects->Filter sometimes is NULL?
Is it possible that one of named filters sometimes resend request to the I/O Manager?

Thanks for help,
Michael.

[OSR_Community_User]

Is it possible that FltObjects->Filter sometimes is NULL?

No. But it is possible that a lower filter might cause recursion. If you are curious about the source of this, add logic to detect this case and then set a breakpoint in your driver. Probably the simplest way to do this is to maintain a table of threads where your driver has passed a call to a lower level driver and thus permits you to detect the reentrancy.

Is it possible that one of named filters sometimes resend request to the I/O Manager?

Based upon what you’ve said it sounds like the logical conclusion. Over the years we’ve just learned to assume we have to detect this type of behavior and deal with it, so I don’t pay much attention to this issue anymore.

Tony
OSR

[Michael_Grabelkovsky-1]

The QA repeatedly gives me same BSOD, now on 32-bit system.
And I see according Stack that FltCreateFile() with NOT NULL Filter parameter goes to the up of stack!?!

This strange behavior occurs very rare and it contradicts to MSDN where is written “If it is non-NULL, the request is sent only to minifilter driver instances that are attached below the specified instance.” (http://msdn.microsoft.com/en-us/library/windows/hardware/ff541935(v=vs.85).aspx)

What reasons may be for this strange behavior?

Thanks for Help & Regards,
Michael.

[Scott_Noone_OSR]

Post the code for your call to FltCreateFile as well as the call stack from WinDbg where you see the re-entrant behavior.

-scott
OSR
@OSRDrivers

[Michael_Grabelkovsky-1]

Thanks,
Scott.
Bellow…

///////////////////////////////////

OBJECT_ATTRIBUTES ob;
IO_STATUS_BLOCK ioSt;
HANDLE hFile = NULL;
PVOID fileObject = NULL;

ob.Length = sizeof(OBJECT_ATTRIBUTES);
InitializeObjectAttributes(&ob, &StreamContext->Name, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
// Try to open the file
ntStatus = FltCreateFile(pMyFilter, // I use here pointer to static to be sure
FltObjects->Instance,
&hFile,
FILE_READ_ATTRIBUTES,
&ob,
&ioSt,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_COMPLETE_IF_OPLOCKED,
NULL,
0,
IO_IGNORE_SHARE_ACCESS_CHECK);

//////////////////////////////////

//Stack Information for Windows 7, 32-bit:
9bb12014 8bede605 9bb12038 00000000 00000000 Ntfs+0x113cb
9bb1207c 8bede87b 9bb12090 859af540 00000001 Ntfs+0xa5605
9bb121b0 82c85c1e 864aa020 859af540 859af540 Ntfs+0xa587b
9bb121c8 833a69e3 8670835c 85af50d8 8339cf00 nt!IofCallDriver+0x63
9bb121fc 833aabeb 864aa020 858e4a28 8670835c fltmgr!FltpQueryInformationFile+0xc3
9bb12230 833abcda 864aa020 85af50d8 9bb1225c fltmgr!FltpGetFileName+0x63
9bb12240 833a8f62 85af50d8 00000000 85af50d8 fltmgr!FltpGetOpenedFileName+0x18
9bb1225c 833a975d 85af50d8 00000000 85af50d8 fltmgr!FltpCallOpenedFileNameHandler+0x8a
9bb12274 83393b21 85af50d8 00000000 00000000 fltmgr!FltpCreateFileNameInformation+0x79
9bb122a4 83393fa3 859f89bc 87e69008 85acecf0 fltmgr!FltpGetFileNameInformation+0x321
9bb122cc 8bfd4952 12b37068 00000102 9bb122fc fltmgr!FltGetFileNameInformation+0x12b
9bb122e8 833a8f27 8791f958 858e4a28 85b37068 luafv+0x9952
9bb12318 833a975d 85acecf0 00000000 85acecf0 fltmgr!FltpCallOpenedFileNameHandler+0x4f
9bb12330 83393b21 85acecf0 00000000 00000000 fltmgr!FltpCreateFileNameInformation+0x79
9bb12360 83393fa3 859f89bc bd529510 bd5294f0 fltmgr!FltpGetFileNameInformation+0x321
9bb12388 9cb8b71f 12b37068 00000102 9bb123a4 fltmgr!FltGetFileNameInformation+0x12b
9bb123a8 9cb8ba23 85b37068 bd5294f0 62756666 pf_Win7_x86!PfAcquireFilename+0x45 [d:\prega\sources\dev\driver\pf\file_helper.c @ 224]
9bb123cc 9cb8afe9 85b37068 9bb12498 9bb12404 pf_Win7_x86!PfGetStreamContext+0xc9 [d:\prega\sources\dev\driver\pf\file_helper.c @ 448]
9bb12454 9cb8b4dd 85b37068 9bb12498 9bb124c4 pf_Win7_x86!PfGenericPreCallback+0x85 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
9bb12478 8338daeb 85b37068 9bb12498 9bb124c4 pf_Win7_x86!PfPreOperationCallback+0x131 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 527]
9bb124e4 833909f0 9bb12538 859d9818 859d99f0 fltmgr!FltpPerformPreCallbacks+0x34d
9bb124fc 83390f01 9bb12538 00000000 8683c218 fltmgr!FltpPassThroughInternal+0x40
9bb12520 833913ba 12b12538 8683c218 00000000 fltmgr!FltpPassThrough+0x203
9bb12550 82c85c1e 8683c218 859d9818 858e4a28 fltmgr!FltpDispatch+0xb4
9bb12568 82e81c95 9bb127b0 858e4a28 00000000 nt!IofCallDriver+0x63
9bb125a8 82e95b5b 00000000 858e4a28 00000001 nt!IopCloseFile+0x2f3
9bb12690 82e74d2e 86464e20 c762d9c8 85e6dd20 nt!IopParseDevice+0x1523
9bb1270c 82e85157 00000000 9bb12760 00000240 nt!ObpLookupObjectName+0x4fa
9bb1276c 82ee68bd 9bb12cdc 8562d9c8 85b21500 nt!ObOpenObjectByName+0x165
9bb128c8 82ee6e7f 9bb12cdc 00000080 85b21500 nt!IopFastQueryNetworkAttributes+0x127
9bb12934 82e9579f 85b21500 bdf87744 9bb12ae0 nt!IopQueryNetworkAttributes+0x40
9bb12a10 82e74d2e 86464e20 9762d9c8 85b21588 nt!IopParseDevice+0x116d
9bb12a8c 82e85157 00000000 9bb12ae0 00000240 nt!ObpLookupObjectName+0x4fa
9bb12aec 82e7bc35 9bb12cdc 8562d9c8 82d6f800 nt!ObOpenObjectByName+0x165
9bb12b68 82ebd261 9bb12cfc 00000080 9bb12cdc nt!IopCreateFile+0x673
9bb12bc4 833a6b62 9bb12cfc 00000080 9bb12cdc nt!IoCreateFileEx+0x9e
9bb12c50 833a6c84 87e01740 87e69008 9bb12cfc fltmgr!FltCreateFileEx2+0xba
9bb12c98 9cb8b827 87e01740 87e69008 9bb12cfc fltmgr!FltCreateFile+0x38
9bb12d00 9cb8ba78 85b352c8 9bb12df0 bd4fdc38 pf_Win7_x86!PfIsExist+0x7d [d:\prega\sources\dev\driver\pf\file_helper.c @ 313]
9bb12d24 9cb8afe9 85b352c8 9bb12df0 9bb12d5c pf_Win7_x86!PfGetStreamContext+0x11e [d:\prega\sources\dev\driver\pf\file_helper.c @ 465]
9bb12dac 9cb8b4dd 85b352c8 9bb12df0 9bb12e1c pf_Win7_x86!PfGenericPreCallback+0x85 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
9bb12dd0 8338daeb 85b352c8 9bb12df0 9bb12e1c pf_Win7_x86!PfPreOperationCallback+0x131 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 527]
9bb12e3c 833909f0 9bb12e90 85a54d48 85a54f20 fltmgr!FltpPerformPreCallbacks+0x34d
9bb12e54 83390f01 9bb12e90 00000000 8683c218 fltmgr!FltpPassThroughInternal+0x40
9bb12e78 833913ba 12b12e90 8683c218 00000000 fltmgr!FltpPassThrough+0x203
9bb12ea8 82c85c1e 8683c218 85a54d48 85ce49b0 fltmgr!FltpDispatch+0xb4
9bb12ec0 82e81c95 9bb13108 85ce49b0 00000000 nt!IofCallDriver+0x63
9bb12f00 82e95b5b 00000000 85ce49b0 00000001 nt!IopCloseFile+0x2f3
9bb12fe8 82e74d2e 86464e20 c762d9c8 85ce4a38 nt!IopParseDevice+0x1523
9bb12fec 86464e20 c762d9c8 85ce4a38 8683c218 nt!ObpLookupObjectName+0x4fa
9bb12ff0 c762d9c8 85ce4a38 8683c218 00000000 0x86464e20
9bb12ff4 85ce4a38 8683c218 00000000 00000000 0xc762d9c8
9bb12ff8 8683c218 00000000 00000000 00000000 0x85ce4a38
85ce4a38 00000000 00000000 00000000 00000000 0x8683c218

[Alex_Carp]

This is pretty interesting. I’m not sure why this happens, but basically it
looks like somewhere in the IopParseDevice call the system does an
IopCloseFile on something that doesn’t have proper FltMgr targeting
information so when FltMgr gets it just sends it to everyone. It would be
interesting to see what’s actually being closed by IopCloseFile… (see more
here:
http://fsfilters.blogspot.com/2011/02/filter-layering-and-io-targeting-in.html
)

Which OS is this ?

Alex.

On Mon, Oct 20, 2014 at 1:11 AM, wrote:

> Thanks,
> Scott.
> Bellow…
>
> ///////////////////////////////////
>
> OBJECT_ATTRIBUTES ob;
> IO_STATUS_BLOCK ioSt;
> HANDLE hFile = NULL;
> PVOID fileObject = NULL;
>
> ob.Length = sizeof(OBJECT_ATTRIBUTES);
> InitializeObjectAttributes(&ob, &StreamContext->Name, OBJ_KERNEL_HANDLE |
> OBJ_CASE_INSENSITIVE, NULL, NULL);
> // Try to open the file
> ntStatus = FltCreateFile(pMyFilter, // I use here pointer to
> static to be sure
> FltObjects->Instance,
> &hFile,
> FILE_READ_ATTRIBUTES,
> &ob,
> &ioSt,
> NULL,
> FILE_ATTRIBUTE_NORMAL,
> FILE_SHARE_READ,
> FILE_OPEN,
> FILE_COMPLETE_IF_OPLOCKED,
> NULL,
> 0,
> IO_IGNORE_SHARE_ACCESS_CHECK);
>
> //////////////////////////////////
>
> //Stack Information for Windows 7, 32-bit:
> 9bb12014 8bede605 9bb12038 00000000 00000000 Ntfs+0x113cb
> 9bb1207c 8bede87b 9bb12090 859af540 00000001 Ntfs+0xa5605
> 9bb121b0 82c85c1e 864aa020 859af540 859af540 Ntfs+0xa587b
> 9bb121c8 833a69e3 8670835c 85af50d8 8339cf00 nt!IofCallDriver+0x63
> 9bb121fc 833aabeb 864aa020 858e4a28 8670835c
> fltmgr!FltpQueryInformationFile+0xc3
> 9bb12230 833abcda 864aa020 85af50d8 9bb1225c fltmgr!FltpGetFileName+0x63
> 9bb12240 833a8f62 85af50d8 00000000 85af50d8
> fltmgr!FltpGetOpenedFileName+0x18
> 9bb1225c 833a975d 85af50d8 00000000 85af50d8
> fltmgr!FltpCallOpenedFileNameHandler+0x8a
> 9bb12274 83393b21 85af50d8 00000000 00000000
> fltmgr!FltpCreateFileNameInformation+0x79
> 9bb122a4 83393fa3 859f89bc 87e69008 85acecf0
> fltmgr!FltpGetFileNameInformation+0x321
> 9bb122cc 8bfd4952 12b37068 00000102 9bb122fc
> fltmgr!FltGetFileNameInformation+0x12b
> 9bb122e8 833a8f27 8791f958 858e4a28 85b37068 luafv+0x9952
> 9bb12318 833a975d 85acecf0 00000000 85acecf0
> fltmgr!FltpCallOpenedFileNameHandler+0x4f
> 9bb12330 83393b21 85acecf0 00000000 00000000
> fltmgr!FltpCreateFileNameInformation+0x79
> 9bb12360 83393fa3 859f89bc bd529510 bd5294f0
> fltmgr!FltpGetFileNameInformation+0x321
> 9bb12388 9cb8b71f 12b37068 00000102 9bb123a4
> fltmgr!FltGetFileNameInformation+0x12b
> 9bb123a8 9cb8ba23 85b37068 bd5294f0 62756666
> pf_Win7_x86!PfAcquireFilename+0x45
> [d:\prega\sources\dev\driver\pf\file_helper.c @ 224]
> 9bb123cc 9cb8afe9 85b37068 9bb12498 9bb12404
> pf_Win7_x86!PfGetStreamContext+0xc9
> [d:\prega\sources\dev\driver\pf\file_helper.c @ 448]
> 9bb12454 9cb8b4dd 85b37068 9bb12498 9bb124c4
> pf_Win7_x86!PfGenericPreCallback+0x85
> [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
> 9bb12478 8338daeb 85b37068 9bb12498 9bb124c4
> pf_Win7_x86!PfPreOperationCallback+0x131
> [d:\prega\sources\dev\driver\pf\file_filtering.c @ 527]
> 9bb124e4 833909f0 9bb12538 859d9818 859d99f0
> fltmgr!FltpPerformPreCallbacks+0x34d
> 9bb124fc 83390f01 9bb12538 00000000 8683c218
> fltmgr!FltpPassThroughInternal+0x40
> 9bb12520 833913ba 12b12538 8683c218 00000000 fltmgr!FltpPassThrough+0x203
> 9bb12550 82c85c1e 8683c218 859d9818 858e4a28 fltmgr!FltpDispatch+0xb4
> 9bb12568 82e81c95 9bb127b0 858e4a28 00000000 nt!IofCallDriver+0x63
> 9bb125a8 82e95b5b 00000000 858e4a28 00000001 nt!IopCloseFile+0x2f3
> 9bb12690 82e74d2e 86464e20 c762d9c8 85e6dd20 nt!IopParseDevice+0x1523
> 9bb1270c 82e85157 00000000 9bb12760 00000240 nt!ObpLookupObjectName+0x4fa
> 9bb1276c 82ee68bd 9bb12cdc 8562d9c8 85b21500 nt!ObOpenObjectByName+0x165
> 9bb128c8 82ee6e7f 9bb12cdc 00000080 85b21500
> nt!IopFastQueryNetworkAttributes+0x127
> 9bb12934 82e9579f 85b21500 bdf87744 9bb12ae0
> nt!IopQueryNetworkAttributes+0x40
> 9bb12a10 82e74d2e 86464e20 9762d9c8 85b21588 nt!IopParseDevice+0x116d
> 9bb12a8c 82e85157 00000000 9bb12ae0 00000240 nt!ObpLookupObjectName+0x4fa
> 9bb12aec 82e7bc35 9bb12cdc 8562d9c8 82d6f800 nt!ObOpenObjectByName+0x165
> 9bb12b68 82ebd261 9bb12cfc 00000080 9bb12cdc nt!IopCreateFile+0x673
> 9bb12bc4 833a6b62 9bb12cfc 00000080 9bb12cdc nt!IoCreateFileEx+0x9e
> 9bb12c50 833a6c84 87e01740 87e69008 9bb12cfc fltmgr!FltCreateFileEx2+0xba
> 9bb12c98 9cb8b827 87e01740 87e69008 9bb12cfc fltmgr!FltCreateFile+0x38
> 9bb12d00 9cb8ba78 85b352c8 9bb12df0 bd4fdc38 pf_Win7_x86!PfIsExist+0x7d
> [d:\prega\sources\dev\driver\pf\file_helper.c @ 313]
> 9bb12d24 9cb8afe9 85b352c8 9bb12df0 9bb12d5c
> pf_Win7_x86!PfGetStreamContext+0x11e
> [d:\prega\sources\dev\driver\pf\file_helper.c @ 465]
> 9bb12dac 9cb8b4dd 85b352c8 9bb12df0 9bb12e1c
> pf_Win7_x86!PfGenericPreCallback+0x85
> [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
> 9bb12dd0 8338daeb 85b352c8 9bb12df0 9bb12e1c
> pf_Win7_x86!PfPreOperationCallback+0x131
> [d:\prega\sources\dev\driver\pf\file_filtering.c @ 527]
> 9bb12e3c 833909f0 9bb12e90 85a54d48 85a54f20
> fltmgr!FltpPerformPreCallbacks+0x34d
> 9bb12e54 83390f01 9bb12e90 00000000 8683c218
> fltmgr!FltpPassThroughInternal+0x40
> 9bb12e78 833913ba 12b12e90 8683c218 00000000 fltmgr!FltpPassThrough+0x203
> 9bb12ea8 82c85c1e 8683c218 85a54d48 85ce49b0 fltmgr!FltpDispatch+0xb4
> 9bb12ec0 82e81c95 9bb13108 85ce49b0 00000000 nt!IofCallDriver+0x63
> 9bb12f00 82e95b5b 00000000 85ce49b0 00000001 nt!IopCloseFile+0x2f3
> 9bb12fe8 82e74d2e 86464e20 c762d9c8 85ce4a38 nt!IopParseDevice+0x1523
> 9bb12fec 86464e20 c762d9c8 85ce4a38 8683c218 nt!ObpLookupObjectName+0x4fa
> 9bb12ff0 c762d9c8 85ce4a38 8683c218 00000000 0x86464e20
> 9bb12ff4 85ce4a38 8683c218 00000000 00000000 0xc762d9c8
> 9bb12ff8 8683c218 00000000 00000000 00000000 0x85ce4a38
> 85ce4a38 00000000 00000000 00000000 00000000 0x8683c218
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

[Peter_Scott]

What is the MajorFunction you are handling in both of the calls into
your driver?

Pete

On 10/22/2014 2:26 PM, Alex Carp wrote:

This is pretty interesting. I’m not sure why this happens, but
basically it looks like somewhere in the IopParseDevice call the
system does an IopCloseFile on something that doesn’t have proper
FltMgr targeting information so when FltMgr gets it just sends it to
everyone. It would be interesting to see what’s actually being closed
by IopCloseFile… (see more here:
http://fsfilters.blogspot.com/2011/02/filter-layering-and-io-targeting-in.html)

Which OS is this ?

Alex.

On Mon, Oct 20, 2014 at 1:11 AM, > mailto:xxxxx> wrote:
>
> Thanks,
> Scott.
> Bellow…
>
> ///////////////////////////////////
>
> OBJECT_ATTRIBUTES ob;
> IO_STATUS_BLOCK ioSt;
> HANDLE hFile = NULL;
> PVOID fileObject = NULL;
>
> ob.Length = sizeof(OBJECT_ATTRIBUTES);
> InitializeObjectAttributes(&ob, &StreamContext->Name,
> OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
> // Try to open the file
> ntStatus = FltCreateFile(pMyFilter, // I use here pointer
> to static to be sure
> FltObjects->Instance,
> &hFile,
> FILE_READ_ATTRIBUTES,
> &ob,
> &ioSt,
> NULL,
> FILE_ATTRIBUTE_NORMAL,
> FILE_SHARE_READ,
> FILE_OPEN,
> FILE_COMPLETE_IF_OPLOCKED,
> NULL,
> 0,
> IO_IGNORE_SHARE_ACCESS_CHECK);
>
> //////////////////////////////////
>
> //Stack Information for Windows 7, 32-bit:
> 9bb12014 8bede605 9bb12038 00000000 00000000 Ntfs+0x113cb
> 9bb1207c 8bede87b 9bb12090 859af540 00000001 Ntfs+0xa5605
> 9bb121b0 82c85c1e 864aa020 859af540 859af540 Ntfs+0xa587b
> 9bb121c8 833a69e3 8670835c 85af50d8 8339cf00 nt!IofCallDriver+0x63
> 9bb121fc 833aabeb 864aa020 858e4a28 8670835c
> fltmgr!FltpQueryInformationFile+0xc3
> 9bb12230 833abcda 864aa020 85af50d8 9bb1225c
> fltmgr!FltpGetFileName+0x63
> 9bb12240 833a8f62 85af50d8 00000000 85af50d8
> fltmgr!FltpGetOpenedFileName+0x18
> 9bb1225c 833a975d 85af50d8 00000000 85af50d8
> fltmgr!FltpCallOpenedFileNameHandler+0x8a
> 9bb12274 83393b21 85af50d8 00000000 00000000
> fltmgr!FltpCreateFileNameInformation+0x79
> 9bb122a4 83393fa3 859f89bc 87e69008 85acecf0
> fltmgr!FltpGetFileNameInformation+0x321
> 9bb122cc 8bfd4952 12b37068 00000102 9bb122fc
> fltmgr!FltGetFileNameInformation+0x12b
> 9bb122e8 833a8f27 8791f958 858e4a28 85b37068 luafv+0x9952
> 9bb12318 833a975d 85acecf0 00000000 85acecf0
> fltmgr!FltpCallOpenedFileNameHandler+0x4f
> 9bb12330 83393b21 85acecf0 00000000 00000000
> fltmgr!FltpCreateFileNameInformation+0x79
> 9bb12360 83393fa3 859f89bc bd529510 bd5294f0
> fltmgr!FltpGetFileNameInformation+0x321
> 9bb12388 9cb8b71f 12b37068 00000102 9bb123a4
> fltmgr!FltGetFileNameInformation+0x12b
> 9bb123a8 9cb8ba23 85b37068 bd5294f0 62756666
> pf_Win7_x86!PfAcquireFilename+0x45
> [d:\prega\sources\dev\driver\pf\file_helper.c @ 224]
> 9bb123cc 9cb8afe9 85b37068 9bb12498 9bb12404
> pf_Win7_x86!PfGetStreamContext+0xc9
> [d:\prega\sources\dev\driver\pf\file_helper.c @ 448]
> 9bb12454 9cb8b4dd 85b37068 9bb12498 9bb124c4
> pf_Win7_x86!PfGenericPreCallback+0x85
> [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
> 9bb12478 8338daeb 85b37068 9bb12498 9bb124c4
> pf_Win7_x86!PfPreOperationCallback+0x131
> [d:\prega\sources\dev\driver\pf\file_filtering.c @ 527]
> 9bb124e4 833909f0 9bb12538 859d9818 859d99f0
> fltmgr!FltpPerformPreCallbacks+0x34d
> 9bb124fc 83390f01 9bb12538 00000000 8683c218
> fltmgr!FltpPassThroughInternal+0x40
> 9bb12520 833913ba 12b12538 8683c218 00000000
> fltmgr!FltpPassThrough+0x203
> 9bb12550 82c85c1e 8683c218 859d9818 858e4a28 fltmgr!FltpDispatch+0xb4
> 9bb12568 82e81c95 9bb127b0 858e4a28 00000000 nt!IofCallDriver+0x63
> 9bb125a8 82e95b5b 00000000 858e4a28 00000001 nt!IopCloseFile+0x2f3
> 9bb12690 82e74d2e 86464e20 c762d9c8 85e6dd20 nt!IopParseDevice+0x1523
> 9bb1270c 82e85157 00000000 9bb12760 00000240
> nt!ObpLookupObjectName+0x4fa
> 9bb1276c 82ee68bd 9bb12cdc 8562d9c8 85b21500
> nt!ObOpenObjectByName+0x165
> 9bb128c8 82ee6e7f 9bb12cdc 00000080 85b21500
> nt!IopFastQueryNetworkAttributes+0x127
> 9bb12934 82e9579f 85b21500 bdf87744 9bb12ae0
> nt!IopQueryNetworkAttributes+0x40
> 9bb12a10 82e74d2e 86464e20 9762d9c8 85b21588 nt!IopParseDevice+0x116d
> 9bb12a8c 82e85157 00000000 9bb12ae0 00000240
> nt!ObpLookupObjectName+0x4fa
> 9bb12aec 82e7bc35 9bb12cdc 8562d9c8 82d6f800
> nt!ObOpenObjectByName+0x165
> 9bb12b68 82ebd261 9bb12cfc 00000080 9bb12cdc nt!IopCreateFile+0x673
> 9bb12bc4 833a6b62 9bb12cfc 00000080 9bb12cdc nt!IoCreateFileEx+0x9e
> 9bb12c50 833a6c84 87e01740 87e69008 9bb12cfc
> fltmgr!FltCreateFileEx2+0xba
> 9bb12c98 9cb8b827 87e01740 87e69008 9bb12cfc fltmgr!FltCreateFile+0x38
> 9bb12d00 9cb8ba78 85b352c8 9bb12df0 bd4fdc38
> pf_Win7_x86!PfIsExist+0x7d
> [d:\prega\sources\dev\driver\pf\file_helper.c @ 313]
> 9bb12d24 9cb8afe9 85b352c8 9bb12df0 9bb12d5c
> pf_Win7_x86!PfGetStreamContext+0x11e
> [d:\prega\sources\dev\driver\pf\file_helper.c @ 465]
> 9bb12dac 9cb8b4dd 85b352c8 9bb12df0 9bb12e1c
> pf_Win7_x86!PfGenericPreCallback+0x85
> [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
> 9bb12dd0 8338daeb 85b352c8 9bb12df0 9bb12e1c
> pf_Win7_x86!PfPreOperationCallback+0x131
> [d:\prega\sources\dev\driver\pf\file_filtering.c @ 527]
> 9bb12e3c 833909f0 9bb12e90 85a54d48 85a54f20
> fltmgr!FltpPerformPreCallbacks+0x34d
> 9bb12e54 83390f01 9bb12e90 00000000 8683c218
> fltmgr!FltpPassThroughInternal+0x40
> 9bb12e78 833913ba 12b12e90 8683c218 00000000
> fltmgr!FltpPassThrough+0x203
> 9bb12ea8 82c85c1e 8683c218 85a54d48 85ce49b0 fltmgr!FltpDispatch+0xb4
> 9bb12ec0 82e81c95 9bb13108 85ce49b0 00000000 nt!IofCallDriver+0x63
> 9bb12f00 82e95b5b 00000000 85ce49b0 00000001 nt!IopCloseFile+0x2f3
> 9bb12fe8 82e74d2e 86464e20 c762d9c8 85ce4a38 nt!IopParseDevice+0x1523
> 9bb12fec 86464e20 c762d9c8 85ce4a38 8683c218
> nt!ObpLookupObjectName+0x4fa
> 9bb12ff0 c762d9c8 85ce4a38 8683c218 00000000 0x86464e20
> 9bb12ff4 85ce4a38 8683c218 00000000 00000000 0xc762d9c8
> 9bb12ff8 8683c218 00000000 00000000 00000000 0x85ce4a38
> 85ce4a38 00000000 00000000 00000000 00000000 0x8683c218
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> — NTFSD is sponsored by OSR OSR is hiring!! Info at
> http://www.osr.com/careers For our schedule of debugging and file
> system seminars visit: http://www.osr.com/seminars To unsubscribe,
> visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295</mailto:xxxxx>

[Michael_Grabelkovsky-1]

>>What is the MajorFunction you are handling in both of the calls into
your driver?

Unfortunately, it’s not easy to understand, it’s release version and some data are not seen (for example Data->Iopb is NULL :(). But drivers goes to this sequence from IRP_MJ_WRITE

I add bellow the same dump for 64-bit.
As I told it’s not easy to come to this problem - Crash Dump the result of night test.

Alex, Peter,
I like to give more information or build experiment version for checking, if you would recomend something.

Regards,
Michael.

///////////////////// Stack fr 64-bit crash //////////////////////////////////////////////
2: kd> kb 256
RetAddr : Args to Child : Call Site
fffff80003276169 : 000000000000007f 0000000000000008 0000000080050033 00000000000406f8 : nt!KeBugCheckEx fffff80003274632 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiBugCheckDispatch+0x69
fffff80003548f63 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiDoubleFaultAbort+0xb2 fffff800035492f3 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!PsOpenProcess+0x23
fffff80003275e53 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!NtOpenProcess+0x23 fffff80003272410 : fffff88008cc7727 0000000000000000 0000000000000000 fffff8800c39a460 : nt!KiSystemServiceCopyEnd+0x13
fffff88008cc7727 : 0000000000000000 0000000000000000 fffff8800c39a460 0000000050475043 : nt!KiServiceLinkage fffff88008cc7c1c : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!UtlGetProcessHandleById+0x5f [d:\prega\sources\dev\driver\libs\utils\bpmutils.c @ 423]
fffff88008cc062b : 0000000000000000 0000000000000000 0000000000000000 fffff8a0003de570 : pf_Win7_amd64!UtlGetProcessImageName+0x90 [d:\prega\sources\dev\driver\libs\utils\bpmutils.c @ 790] fffff88008cc26d6 : fffff8800c39a460 00000000000008f0 fffffa8006fc2160 0000000050475043 : pf_Win7_amd64!EventInit+0x14f [d:\prega\sources\dev\driver\pf\pf.c @ 433]
fffff88008cc2b8e : 0000000000000000 0000000000000000 fffffa8006fc2160 0000000000000000 : pf_Win7_amd64!PfGenericPreCallback+0x7a [d:\prega\sources\dev\driver\pf\file_filtering.c @ 296] fffff88001172067 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515]
fffff8800117482d : fffff88001192900 fffffa80074571f2 fffffa8006f3b400 fffff8800c39ad00 : fltmgr!FltpPerformPreCallbacks+0x2f7 fffff88001192a9f : fffffa8007376de0 0000000000000000 fffffa8006f3b480 fffffa8006f3b7d8 : fltmgr!FltpPassThroughFastIo+0x4d
fffff80003576c72 : 0000000000000047 fffff8800c39ab80 fffffa8006fbc1c8 00000000000007ff : fltmgr!FltpFastIoQueryOpen+0x10f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006fbc010 0000000000000000 : nt!IopParseDevice+0x1249
fffff80003573a96 : 0000000000000000 fffffa8006fbc010 0000000000000000 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39ad20 fffff8800c39ad20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a006dcf400 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006fc41c8 0000000000000104 fffffa8006fc6010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006fc4010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006fc4010 0000000000000000 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800000029b 0000000000000000 fffffa8006913000 00000000000007ff : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39b440 fffffa8000000080 fffff8800c39b3f0 fffff8800c39b3e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39b618 fffff8800c39b440 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39b618 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a0068231d0 fffff8a00271db90 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006e705a0 fffff8800c39b588 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39b598 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39b700 fffff88001192e12 fffffa8006e70000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006e70010 fffffa8007376de0 fffffa800724ca80 fffffa8006ab89f0 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006e70010 0000000000000000 0000000000000000 fffffa8006ab89f0 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006e5c1c8 0000000000000000 fffff8800c39bb90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006e5c010 00fcfcfc00000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006e5c010 0000000000fcfc00 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39be20 fffff8800c39be20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a0065638a0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006e741c8 0000000000000104 fffffa8007043010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006e74010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006e74010 0000000000000000 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800000029b 0000000000000000 fffffa8006913000 00000000000007ff : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39c540 fffffa8000000080 fffff8800c39c4f0 fffff8800c39c4e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39c718 fffff8800c39c540 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39c718 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00f3fd450 fffff8a005e4a490 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa800704b590 fffff8800c39c688 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39c698 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39c800 fffff88001192e12 fffffa800704b000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa800704b010 fffffa8007376de0 fffffa800724ca80 fffffa8006fde070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa800704b010 0000000000000000 0000000000000000 fffffa8006fde070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa80070451c8 0000000000000000 fffff8800c39cc90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007045010 fffff98000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8007045010 000000000724ec00 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39cf20 fffff8800c39cf20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00680b400 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa80070561c8 0000000000000104 fffffa8007058010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007056010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007056010 fffff8800c39d180 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c39d600 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39d640 fffffa8000000080 fffff8800c39d5f0 fffff8800c39d5e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39d818 fffff8800c39d640 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39d818 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00680b010 fffff8a00f03dae0 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007027590 fffff8800c39d788 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39d798 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39d900 fffff88001192e12 fffffa8007027000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8007027010 fffffa8007376de0 fffffa800724ca80 fffffa8006e38070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8007027010 0000000000000000 0000000000000000 fffffa8006e38070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa800705b1c8 0000000000000000 fffff8800c39dd90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800705b010 fffff98000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa800705b010 000000000724ec00 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39e020 fffff8800c39e020 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a0065281a0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa80070281c8 0000000000000104 fffffa8007029010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007028010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007028010 fffff8800c39e280 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c39e700 0000000000000000 fffffa8006913000 fffff8a005eceb00 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39e740 fffffa8000000080 fffff8800c39e6f0 fffff8800c39e6e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39e918 fffff8800c39e740 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39e918 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a005e906d0 fffff8a00564b580 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007039590 fffff8800c39e888 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39e898 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39ea00 fffff88001192e12 fffffa8007039000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8007039010 fffffa8007376de0 fffffa800724ca80 fffffa800701a070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8007039010 0000000000000000 0000000000000000 fffffa800701a070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa800702f1c8 0000000000000000 fffff8800c39ee90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800702f010 fffff98000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa800702f010 000000000724ec00 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39f120 fffff8800c39f120 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a006806bf0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa800703c1c8 0000000000000104 fffffa8006ffe010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800703c010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa800703c010 fffff8800c39f380 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c39f800 0000000000000000 fffffa8006913000 fffff8a005eceb00 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39f840 fffffa8000000080 fffff8800c39f7f0 fffff8800c39f7e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39fa18 fffff8800c39f840 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39fa18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a0069016d0 fffff8a005e5ffd0 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007007590 fffff8800c39f988 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39f998 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39fb00 fffff88001192e12 fffffa8007007000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8007007010 fffffa8007376de0 fffffa800724ca80 fffffa8006f9e070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8007007010 0000000000000000 0000000000000000 fffffa8006f9e070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa80070061c8 0000000000000000 fffff8800c39ff90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007006010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8007006010 0000000000000000 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a0220 fffff8800c3a0220 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a0066af200 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa80070091c8 0000000000000104 fffffa800700a010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007009010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007009010 fffff8800c3a0480 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a0900 0000000000000000 fffffa8006913000 fffff8a005eceb00 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a0940 fffffa8000000080 fffff8800c3a08f0 fffff8800c3a08e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a0b18 fffff8800c3a0940 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a0b18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a0063b65c0 fffff8a006352290 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa800700d590 fffff8800c3a0a88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a0a98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a0c00 fffff88001192e12 fffffa800700d000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa800700d010 fffffa8007376de0 fffffa800724ca80 fffffa8006cdd6b0 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa800700d010 0000000000000000 0000000000000000 fffffa8006cdd6b0 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa800700b1c8 0000000000000000 fffff8800c3a1090 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800700b010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa800700b010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a1320 fffff8800c3a1320 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00e844300 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa800700e1c8 0000000000000104 fffffa800700f010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800700e010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa800700e010 fffff8800c3a1580 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a1a00 0000000000000000 fffffa8006913000 fffff8a00633ac40 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a1a40 fffffa8000000080 fffff8800c3a19f0 fffff8800c3a19e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a1c18 fffff8800c3a1a40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a1c18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a005646d90 fffff8a006e15070 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006fec590 fffff8800c3a1b88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a1b98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a1d00 fffff88001192e12 fffffa8006ff8400 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006ff8470 fffffa8007376de0 fffffa800724ca80 fffffa8006de6a10 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006ff8470 0000000000000000 0000000000000000 fffffa8006de6a10 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa80070101c8 0000000000000000 fffff8800c3a2190 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007010010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8007010010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a2420 fffff8800c3a2420 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a0066534e0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa80070131c8 0000000000000104 fffffa8006fd0010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007013010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007013010 fffff8800c3a2680 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a2b00 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a2b40 fffffa8000000080 fffff8800c3a2af0 fffff8800c3a2ae0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a2d18 fffff8800c3a2b40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a2d18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00db695c0 fffff8a0059f6530 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006fec160 fffff8800c3a2c88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a2c98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a2e00 fffff88001192e12 fffffa800700c800 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa800700c820 fffffa8007376de0 fffffa800724ca80 fffffa8006d09630 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa800700c820 0000000000000000 0000000000000000 fffffa8006d09630 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006fe81c8 0000000000000000 fffff8800c3a3290 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006fe8010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006fe8010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a3520 fffff8800c3a3520 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a005ecd9a0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006fef1c8 0000000000000104 fffffa8006ff0010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006fef010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006fef010 fffff8800c3a3780 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a3c00 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a3c40 fffffa8000000080 fffff8800c3a3bf0 fffff8800c3a3be0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a3e18 fffff8800c3a3c40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a3e18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a006806d90 fffff8a005297370 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007012590 fffff8800c3a3d88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a3d98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a3f00 fffff88001192e12 fffffa8006fe3900 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006fe3930 fffffa8007376de0 fffffa800724ca80 fffffa8006c6bf20 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006fe3930 0000000000000000 0000000000000000 fffffa8006c6bf20 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006ff31c8 0000000000000000 fffff8800c3a4390 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006ff3010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006ff3010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a4620 fffff8800c3a4620 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00561edd0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006ff71c8 0000000000000104 fffffa8006ff9010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006ff7010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006ff7010 fffff8800c3a4880 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a4d00 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a4d40 fffffa8000000080 fffff8800c3a4cf0 fffff8800c3a4ce0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a4f18 fffff8800c3a4d40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a4f18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a005ecdaa0 fffff8a00cdc5e60 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007012160 fffff8800c3a4e88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a4e98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a5000 fffff88001192e12 fffffa8006ff8800 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006ff8820 fffffa8007376de0 fffffa800724ca80 fffffa8006dbb070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006ff8820 0000000000000000 0000000000000000 fffffa8006dbb070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006ffc1c8 0000000000000000 fffff8800c3a5490 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006ffc010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006ffc010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a5720 fffff8800c3a5720 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00e2072c0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa800700c1c8 0000000000000104 fffffa8006e8b010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800700c010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa800700c010 fffff8800c3a5980 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a5e00 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a5e40 fffffa8000000080 fffff8800c3a5df0 fffff8800c3a5de0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a6018 fffff8800c3a5e40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a6018 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00561ee50 fffff8a0063afc80 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006f53160 fffff8800c3a5f88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a5f98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a6100 fffff88001192e12 fffffa8008cbc600 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8008cbc600 fffffa8007376de0 fffffa800724ca80 fffffa8006fe2520 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8008cbc600 0000000000000000 0000000000000000 fffffa8006fe2520 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006b6a1c8 0000000000000000 fffff8800c3a6590 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006b6a010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006b6a010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a6820 fffff8800c3a6820 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00561ebf0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006f90cc8 0000000000000104 fffffa8007045b10 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006f90b10 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006f90b10 fffff8800c3a6a80 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a6f00 0000000000000000 fffffa8006913000 fffff8a00633ac40 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a6f40 fffffa8000000080 fffff8800c3a6ef0 fffff8800c3a6ee0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a7118 fffff8800c3a6f40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a7118 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00561ec20 fffff8a00d64bf20 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007047d80 fffff8800c3a7088 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a7098 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a7200 fffff88001192e12 fffffa8006b51800 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006b51880 fffffa8007376de0 fffffa800724ca80 fffffa8006fdf310 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006b51880 0000000000000000 0000000000000000 fffffa8006fdf310 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006ba5b68 0000000000000000 fffff8800c3a7690 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006ba59b0 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006ba59b0 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a7920 fffff8800c3a7920 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00627cc90 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006f66cc8 0000000000000104 fffffa8006e17010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006f66b10 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006f66b10 fffff8800c3a7b80 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a8000 0000000000000000 fffffa8006913000 fffff8a00633ac40 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a8040 fffffa8000000080 fffff8800c3a7ff0 fffff8800c3a7fe0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a8218 fffff8800c3a8040 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a8218 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00673f2f0 fffff8a0062604a0 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006fbdc40 fffff8800c3a8188 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a8198 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a8300 fffff88001192e12 fffffa8006e4a700 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006e4a760 fffffa8007376de0 fffffa800724ca80 fffffa8006918070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006e4a760 0000000000000000 0000000000000000 fffffa8006918070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006b6bcc8 0000000000000000 fffff8800c3a8790 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006b6bb10 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006b6bb10 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a8a20 fffff8800c3a8a20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a003fdc950 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8007004cc8 0000000000000104 fffffa8006f66610 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007004b10 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007004b10 fffff8800c3a8c80 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a9100 0000000000000000 fffffa8006913000 fffff8a00633ac40 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a9140 fffffa8000000080 fffff8800c3a90f0 fffff8800c3a90e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a9318 fffff8800c3a9140 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a9318 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00673f010 fffff8a005f0cae0 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006b5ed80 fffff8800c3a9288 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a9298 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a9400 fffff88001192e12 fffffa8006d01700 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006d017d0 fffffa8007376de0 fffffa800724ca80 fffffa8006e44070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006d017d0 0000000000000000 0000000000000000 fffffa8006e44070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa800703ccc8 0000000000000000 fffff8800c3a9890 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800703cb10 fffff8a000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa800703cb10 000000000724ec01 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a9b20 fffff8800c3a9b20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a005fd26c0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006d5c1c8 0000000000000104 fffffa8006fe8b10 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006d5c010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006d5c010 fffff88000000009 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : 000000000c3aa200 0000000000000000 0000000000000000 fffffa80068ad3c0 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3aa240 fffffa8000000080 fffff8800c3aa1f0 fffff8800c3aa1e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3aa418 fffff8800c3aa240 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3aa418 0000000000000000 fffff8800c3aa2c8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00cffd2e0 fffff8a00ce89c10 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007033d80 fffff8800c3aa388 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3aa398 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3aa500 fffff88001192e12 fffffa8007013800 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8007013820 fffffa8007376de0 fffffa800724ca80 fffffa8006bb1860 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8007013820 0000000000000000 0000000000000000 fffffa8006bb1860 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006dadcc8 0000000000000000 fffff8800c3aa990 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006dadb10 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006dadb10 000000000d11b501 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3aac20 fffff8800c3aac20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a005e7c5c0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006f61c08 0000000000000104 fffffa8007043b10 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006f61a50 fffff80000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006f61a50 fffffa8006737e80 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : 0000000000000000 0000000000000000 0000000000000000 fffff88000000001 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3ab2e0 fffffa8000000080 fffff8800c3ab2f8 fffff8800c3ab2e8 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : fffff8800c3ab4b8 fffffa8006f860c0 fffff8800c3ab2e0 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc32fa : fffff8a0062b2830 0000000000000000 fffff8800c3ab2f0 0000000000000000 : fltmgr!FltCreateFile+0x8d fffff88008cc22e7 : fffff8a0062b27b0 fffff8a0062b27b0 fffff8800c3ab400 0000000000000000 : pf_Win7_amd64!PfIsDirectory+0x106 [d:\prega\sources\dev\driver\pf\file_helper.c @ 352]
fffff88008cc2c66 : 0000000000000001 fffff8a00f200e10 00000000ffffffff fffffa8006f86160 : pf_Win7_amd64!PfPreCreateCallback+0x197 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 73] fffff88001172067 : fffff8a00f200dd8 fffff80000000000 0000000000001700 0000000000000801 : pf_Win7_amd64!PfPreOperationCallback+0x14a [d:\prega\sources\dev\driver\pf\file_filtering.c @ 501]
fffff880011749aa : fffffa8006bfa700 fffffa8006ac4700 fffffa8007376d00 fffffa8007903000 : fltmgr!FltpPerformPreCallbacks+0x2f7 fffff880011922a3 : fffffa8006bfa760 fffffa8006bfa760 fffffa8006bfa760 6d4e6f4906ac47f0 : fltmgr!FltpPassThroughInternal+0x4a
fffff80003576efc : 0000000000000005 fffffa80098a4a28 fffffa8006ac47f0 0000000000000000 : fltmgr!FltpCreate+0x293 fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa80098a4870 0000000000000001 : nt!IopParseDevice+0x14d3
fffff80003573a96 : 0000000000000000 fffffa80098a4870 fffff680003bd900 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff8000357539c : 0000000000000110 0000000000000000 fffffa8006fbcb01 ffffffffffffffff : nt!ObOpenObjectByName+0x306
fffff8000355fdd8 : 000000000788c3e0 fffff8a000100080 000000000788c3f0 000000000788c430 : nt!IopCreateFile+0x2bc fffff80003275e53 : ffffffffffffffff 0000007fffffffff 000000000788c4c0 0000098000000000 : nt!NtOpenFile+0x58
0000000077c215ea : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x77c215ea

[Peter_Scott]

The reason why I ask is that it appears your code performs the call to
pf_Win7_amd64!PfIsExist() for every MajorFunction in your precallback
handler.

If so, possibly only do this during the precreate processing. At which
point you would allocate a stream context which will hold the current
state and only retrieve the stream context for all subsequent function
precallback handlers. You’ll need to maintain a state transition lock
for the stream context since the state could change, meaning the file
could be created and you will need to update the ‘open’ contexts
accordingly. I talk about this need for a lock on the context while
transitioning the state of the file in my blog entry
http://www.kerneldrivers.com/?p=185

Pete

On 10/23/2014 4:00 AM, xxxxx@saferpoint.com wrote:

>> What is the MajorFunction you are handling in both of the calls into
your driver?

Unfortunately, it’s not easy to understand, it’s release version and some data are not seen (for example Data->Iopb is NULL :(). But drivers goes to this sequence from IRP_MJ_WRITE

I add bellow the same dump for 64-bit.
As I told it’s not easy to come to this problem - Crash Dump the result of night test.

Alex, Peter,
I like to give more information or build experiment version for checking, if you would recomend something.

Regards,
Michael.

///////////////////// Stack fr 64-bit crash //////////////////////////////////////////////
2: kd> kb 256
RetAddr : Args to Child : Call Site
fffff80003276169 : 000000000000007f 0000000000000008 0000000080050033 00000000000406f8 : nt!KeBugCheckEx fffff80003274632 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiBugCheckDispatch+0x69
fffff80003548f63 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiDoubleFaultAbort+0xb2 fffff800035492f3 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!PsOpenProcess+0x23
fffff80003275e53 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!NtOpenProcess+0x23 fffff80003272410 : fffff88008cc7727 0000000000000000 0000000000000000 fffff8800c39a460 : nt!KiSystemServiceCopyEnd+0x13
fffff88008cc7727 : 0000000000000000 0000000000000000 fffff8800c39a460 0000000050475043 : nt!KiServiceLinkage fffff88008cc7c1c : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!UtlGetProcessHandleById+0x5f [d:\prega\sources\dev\driver\libs\utils\bpmutils.c @ 423]
fffff88008cc062b : 0000000000000000 0000000000000000 0000000000000000 fffff8a0003de570 : pf_Win7_amd64!UtlGetProcessImageName+0x90 [d:\prega\sources\dev\driver\libs\utils\bpmutils.c @ 790] fffff88008cc26d6 : fffff8800c39a460 00000000000008f0 fffffa8006fc2160 0000000050475043 : pf_Win7_amd64!EventInit+0x14f [d:\prega\sources\dev\driver\pf\pf.c @ 433]
fffff88008cc2b8e : 0000000000000000 0000000000000000 fffffa8006fc2160 0000000000000000 : pf_Win7_amd64!PfGenericPreCallback+0x7a [d:\prega\sources\dev\driver\pf\file_filtering.c @ 296] fffff88001172067 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515]
fffff8800117482d : fffff88001192900 fffffa80074571f2 fffffa8006f3b400 fffff8800c39ad00 : fltmgr!FltpPerformPreCallbacks+0x2f7 fffff88001192a9f : fffffa8007376de0 0000000000000000 fffffa8006f3b480 fffffa8006f3b7d8 : fltmgr!FltpPassThroughFastIo+0x4d
fffff80003576c72 : 0000000000000047 fffff8800c39ab80 fffffa8006fbc1c8 00000000000007ff : fltmgr!FltpFastIoQueryOpen+0x10f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006fbc010 0000000000000000 : nt!IopParseDevice+0x1249
fffff80003573a96 : 0000000000000000 fffffa8006fbc010 0000000000000000 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39ad20 fffff8800c39ad20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a006dcf400 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006fc41c8 0000000000000104 fffffa8006fc6010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006fc4010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006fc4010 0000000000000000 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800000029b 0000000000000000 fffffa8006913000 00000000000007ff : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39b440 fffffa8000000080 fffff8800c39b3f0 fffff8800c39b3e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39b618 fffff8800c39b440 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39b618 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a0068231d0 fffff8a00271db90 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006e705a0 fffff8800c39b588 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39b598 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39b700 fffff88001192e12 fffffa8006e70000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006e70010 fffffa8007376de0 fffffa800724ca80 fffffa8006ab89f0 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006e70010 0000000000000000 0000000000000000 fffffa8006ab89f0 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006e5c1c8 0000000000000000 fffff8800c39bb90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006e5c010 00fcfcfc00000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006e5c010 0000000000fcfc00 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39be20 fffff8800c39be20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a0065638a0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006e741c8 0000000000000104 fffffa8007043010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006e74010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006e74010 0000000000000000 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800000029b 0000000000000000 fffffa8006913000 00000000000007ff : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39c540 fffffa8000000080 fffff8800c39c4f0 fffff8800c39c4e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39c718 fffff8800c39c540 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39c718 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00f3fd450 fffff8a005e4a490 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa800704b590 fffff8800c39c688 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39c698 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39c800 fffff88001192e12 fffffa800704b000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa800704b010 fffffa8007376de0 fffffa800724ca80 fffffa8006fde070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa800704b010 0000000000000000 0000000000000000 fffffa8006fde070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa80070451c8 0000000000000000 fffff8800c39cc90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007045010 fffff98000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8007045010 000000000724ec00 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39cf20 fffff8800c39cf20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00680b400 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa80070561c8 0000000000000104 fffffa8007058010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007056010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007056010 fffff8800c39d180 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c39d600 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39d640 fffffa8000000080 fffff8800c39d5f0 fffff8800c39d5e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39d818 fffff8800c39d640 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39d818 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00680b010 fffff8a00f03dae0 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007027590 fffff8800c39d788 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39d798 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39d900 fffff88001192e12 fffffa8007027000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8007027010 fffffa8007376de0 fffffa800724ca80 fffffa8006e38070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8007027010 0000000000000000 0000000000000000 fffffa8006e38070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa800705b1c8 0000000000000000 fffff8800c39dd90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800705b010 fffff98000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa800705b010 000000000724ec00 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39e020 fffff8800c39e020 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a0065281a0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa80070281c8 0000000000000104 fffffa8007029010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007028010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007028010 fffff8800c39e280 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c39e700 0000000000000000 fffffa8006913000 fffff8a005eceb00 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39e740 fffffa8000000080 fffff8800c39e6f0 fffff8800c39e6e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39e918 fffff8800c39e740 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39e918 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a005e906d0 fffff8a00564b580 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007039590 fffff8800c39e888 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39e898 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39ea00 fffff88001192e12 fffffa8007039000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8007039010 fffffa8007376de0 fffffa800724ca80 fffffa800701a070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8007039010 0000000000000000 0000000000000000 fffffa800701a070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa800702f1c8 0000000000000000 fffff8800c39ee90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800702f010 fffff98000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa800702f010 000000000724ec00 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c39f120 fffff8800c39f120 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a006806bf0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa800703c1c8 0000000000000104 fffffa8006ffe010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800703c010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa800703c010 fffff8800c39f380 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c39f800 0000000000000000 fffffa8006913000 fffff8a005eceb00 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c39f840 fffffa8000000080 fffff8800c39f7f0 fffff8800c39f7e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c39fa18 fffff8800c39f840 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c39fa18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a0069016d0 fffff8a005e5ffd0 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007007590 fffff8800c39f988 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c39f998 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c39fb00 fffff88001192e12 fffffa8007007000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8007007010 fffffa8007376de0 fffffa800724ca80 fffffa8006f9e070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8007007010 0000000000000000 0000000000000000 fffffa8006f9e070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa80070061c8 0000000000000000 fffff8800c39ff90 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007006010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8007006010 0000000000000000 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a0220 fffff8800c3a0220 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a0066af200 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa80070091c8 0000000000000104 fffffa800700a010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007009010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007009010 fffff8800c3a0480 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a0900 0000000000000000 fffffa8006913000 fffff8a005eceb00 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a0940 fffffa8000000080 fffff8800c3a08f0 fffff8800c3a08e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a0b18 fffff8800c3a0940 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a0b18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a0063b65c0 fffff8a006352290 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa800700d590 fffff8800c3a0a88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a0a98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a0c00 fffff88001192e12 fffffa800700d000 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa800700d010 fffffa8007376de0 fffffa800724ca80 fffffa8006cdd6b0 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa800700d010 0000000000000000 0000000000000000 fffffa8006cdd6b0 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa800700b1c8 0000000000000000 fffff8800c3a1090 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800700b010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa800700b010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a1320 fffff8800c3a1320 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00e844300 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa800700e1c8 0000000000000104 fffffa800700f010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800700e010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa800700e010 fffff8800c3a1580 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a1a00 0000000000000000 fffffa8006913000 fffff8a00633ac40 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a1a40 fffffa8000000080 fffff8800c3a19f0 fffff8800c3a19e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a1c18 fffff8800c3a1a40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a1c18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a005646d90 fffff8a006e15070 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006fec590 fffff8800c3a1b88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a1b98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a1d00 fffff88001192e12 fffffa8006ff8400 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006ff8470 fffffa8007376de0 fffffa800724ca80 fffffa8006de6a10 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006ff8470 0000000000000000 0000000000000000 fffffa8006de6a10 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa80070101c8 0000000000000000 fffff8800c3a2190 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007010010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8007010010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a2420 fffff8800c3a2420 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a0066534e0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa80070131c8 0000000000000104 fffffa8006fd0010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007013010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007013010 fffff8800c3a2680 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a2b00 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a2b40 fffffa8000000080 fffff8800c3a2af0 fffff8800c3a2ae0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a2d18 fffff8800c3a2b40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a2d18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00db695c0 fffff8a0059f6530 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006fec160 fffff8800c3a2c88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a2c98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a2e00 fffff88001192e12 fffffa800700c800 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa800700c820 fffffa8007376de0 fffffa800724ca80 fffffa8006d09630 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa800700c820 0000000000000000 0000000000000000 fffffa8006d09630 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006fe81c8 0000000000000000 fffff8800c3a3290 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006fe8010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006fe8010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a3520 fffff8800c3a3520 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a005ecd9a0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006fef1c8 0000000000000104 fffffa8006ff0010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006fef010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006fef010 fffff8800c3a3780 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a3c00 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a3c40 fffffa8000000080 fffff8800c3a3bf0 fffff8800c3a3be0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a3e18 fffff8800c3a3c40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a3e18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a006806d90 fffff8a005297370 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007012590 fffff8800c3a3d88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a3d98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a3f00 fffff88001192e12 fffffa8006fe3900 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006fe3930 fffffa8007376de0 fffffa800724ca80 fffffa8006c6bf20 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006fe3930 0000000000000000 0000000000000000 fffffa8006c6bf20 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006ff31c8 0000000000000000 fffff8800c3a4390 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006ff3010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006ff3010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a4620 fffff8800c3a4620 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00561edd0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006ff71c8 0000000000000104 fffffa8006ff9010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006ff7010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006ff7010 fffff8800c3a4880 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a4d00 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a4d40 fffffa8000000080 fffff8800c3a4cf0 fffff8800c3a4ce0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a4f18 fffff8800c3a4d40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a4f18 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a005ecdaa0 fffff8a00cdc5e60 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007012160 fffff8800c3a4e88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a4e98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a5000 fffff88001192e12 fffffa8006ff8800 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006ff8820 fffffa8007376de0 fffffa800724ca80 fffffa8006dbb070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006ff8820 0000000000000000 0000000000000000 fffffa8006dbb070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006ffc1c8 0000000000000000 fffff8800c3a5490 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006ffc010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006ffc010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a5720 fffff8800c3a5720 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00e2072c0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa800700c1c8 0000000000000104 fffffa8006e8b010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800700c010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa800700c010 fffff8800c3a5980 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a5e00 0000000000000000 fffffa8006913000 fffff8a00633a570 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a5e40 fffffa8000000080 fffff8800c3a5df0 fffff8800c3a5de0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a6018 fffff8800c3a5e40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a6018 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00561ee50 fffff8a0063afc80 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006f53160 fffff8800c3a5f88 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a5f98 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a6100 fffff88001192e12 fffffa8008cbc600 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8008cbc600 fffffa8007376de0 fffffa800724ca80 fffffa8006fe2520 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8008cbc600 0000000000000000 0000000000000000 fffffa8006fe2520 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006b6a1c8 0000000000000000 fffff8800c3a6590 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006b6a010 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006b6a010 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a6820 fffff8800c3a6820 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00561ebf0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006f90cc8 0000000000000104 fffffa8007045b10 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006f90b10 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006f90b10 fffff8800c3a6a80 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a6f00 0000000000000000 fffffa8006913000 fffff8a00633ac40 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a6f40 fffffa8000000080 fffff8800c3a6ef0 fffff8800c3a6ee0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a7118 fffff8800c3a6f40 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a7118 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00561ec20 fffff8a00d64bf20 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007047d80 fffff8800c3a7088 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a7098 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a7200 fffff88001192e12 fffffa8006b51800 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006b51880 fffffa8007376de0 fffffa800724ca80 fffffa8006fdf310 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006b51880 0000000000000000 0000000000000000 fffffa8006fdf310 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006ba5b68 0000000000000000 fffff8800c3a7690 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006ba59b0 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006ba59b0 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a7920 fffff8800c3a7920 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a00627cc90 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006f66cc8 0000000000000104 fffffa8006e17010 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006f66b10 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006f66b10 fffff8800c3a7b80 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a8000 0000000000000000 fffffa8006913000 fffff8a00633ac40 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a8040 fffffa8000000080 fffff8800c3a7ff0 fffff8800c3a7fe0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a8218 fffff8800c3a8040 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a8218 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00673f2f0 fffff8a0062604a0 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006fbdc40 fffff8800c3a8188 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a8198 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a8300 fffff88001192e12 fffffa8006e4a700 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006e4a760 fffffa8007376de0 fffffa800724ca80 fffffa8006918070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006e4a760 0000000000000000 0000000000000000 fffffa8006918070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006b6bcc8 0000000000000000 fffff8800c3a8790 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006b6bb10 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006b6bb10 0000000000000001 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a8a20 fffff8800c3a8a20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a003fdc950 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8007004cc8 0000000000000104 fffffa8006f66610 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8007004b10 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8007004b10 fffff8800c3a8c80 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : fffff8800c3a9100 0000000000000000 fffffa8006913000 fffff8a00633ac40 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3a9140 fffffa8000000080 fffff8800c3a90f0 fffff8800c3a90e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3a9318 fffff8800c3a9140 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3a9318 fffffa8008fe0010 fffff8a00e12a5a8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00673f010 fffff8a005f0cae0 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8006b5ed80 fffff8800c3a9288 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3a9298 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3a9400 fffff88001192e12 fffffa8006d01700 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8006d017d0 fffffa8007376de0 fffffa800724ca80 fffffa8006e44070 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8006d017d0 0000000000000000 0000000000000000 fffffa8006e44070 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa800703ccc8 0000000000000000 fffff8800c3a9890 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa800703cb10 fffff8a000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa800703cb10 000000000724ec01 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3a9b20 fffff8800c3a9b20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a005fd26c0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006d5c1c8 0000000000000104 fffffa8006fe8b10 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006d5c010 fffffa8000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006d5c010 fffff88000000009 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : 000000000c3aa200 0000000000000000 0000000000000000 fffffa80068ad3c0 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3aa240 fffffa8000000080 fffff8800c3aa1f0 fffff8800c3aa1e0 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : 0000000000000000 fffff8800c3aa418 fffff8800c3aa240 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc31ba : 0000000000000000 fffff8800c3aa418 0000000000000000 fffff8800c3aa2c8 : fltmgr!FltCreateFile+0x8d fffff88008cc3539 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfIsExist+0xba [d:\prega\sources\dev\driver\pf\file_helper.c @ 303]
fffff88008cc2716 : fffff8a00cffd2e0 fffff8a00ce89c10 0000000000000000 0000000050475043 : pf_Win7_amd64!PfGetStreamContext+0x195 [d:\prega\sources\dev\driver\pf\file_helper.c @ 454] fffff88008cc2b8e : fffffa8007cbb180 0000000000000000 fffffa8007033d80 fffff8800c3aa388 : pf_Win7_amd64!PfGenericPreCallback+0xba [d:\prega\sources\dev\driver\pf\file_filtering.c @ 301]
fffff88001172067 : fffff8800c3aa398 0000000000000000 0000000000000000 0000000000000000 : pf_Win7_amd64!PfPreOperationCallback+0x72 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 515] fffff88001173329 : fffff8800c3aa500 fffff88001192e12 fffffa8007013800 0000000000000000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880011716c7 : fffffa8007013820 fffffa8007376de0 fffffa800724ca80 fffffa8006bb1860 : fltmgr!FltpPassThrough+0x2d9 fffff8000358042f : fffffa8007013820 0000000000000000 0000000000000000 fffffa8006bb1860 : fltmgr!FltpDispatch+0xb7
fffff8000357780a : 0000000000000000 fffffa8006dadcc8 0000000000000000 fffff8800c3aa990 : nt!IopCloseFile+0x11f fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006dadb10 0000000000000000 : nt!IopParseDevice+0x1de1
fffff80003573a96 : 0000000000000000 fffffa8006dadb10 000000000d11b501 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff800036441e5 : fffff8800c3aac20 fffff8800c3aac20 fffffa8006b02900 0000000000000001 : nt!ObOpenObjectByName+0x306
fffff8000364430e : 0000000000000000 fffff8a005e7c5c0 0000000000000000 0000000000000000 : nt!IopFastQueryNetworkAttributes+0x185 fffff8000357725b : 0000000000000104 fffffa8006f61c08 0000000000000104 fffffa8007043b10 : nt!IopQueryNetworkAttributes+0x5e
fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa8006f61a50 fffff80000000000 : nt!IopParseDevice+0x1832 fffff80003573a96 : 0000000000000000 fffffa8006f61a50 fffffa8006737e80 fffffa80067b2400 : nt!ObpLookupObjectName+0x588
fffff8000357539c : 0000000000000000 0000000000000000 0000000000000000 fffff88000000001 : nt!ObOpenObjectByName+0x306 fffff8000351c0fb : fffff8800c3ab2e0 fffffa8000000080 fffff8800c3ab2f8 fffff8800c3ab2e8 : nt!IopCreateFile+0x2bc
fffff8800119449c : 0000000000000000 0000000000000000 0000000000000000 0000000000000080 : nt!IoCreateFileEx+0xfb fffff880011a3abd : fffff8800c3ab4b8 fffffa8006f860c0 fffff8800c3ab2e0 0000000000000000 : fltmgr!FltCreateFileEx2+0x18c
fffff88008cc32fa : fffff8a0062b2830 0000000000000000 fffff8800c3ab2f0 0000000000000000 : fltmgr!FltCreateFile+0x8d fffff88008cc22e7 : fffff8a0062b27b0 fffff8a0062b27b0 fffff8800c3ab400 0000000000000000 : pf_Win7_amd64!PfIsDirectory+0x106 [d:\prega\sources\dev\driver\pf\file_helper.c @ 352]
fffff88008cc2c66 : 0000000000000001 fffff8a00f200e10 00000000ffffffff fffffa8006f86160 : pf_Win7_amd64!PfPreCreateCallback+0x197 [d:\prega\sources\dev\driver\pf\file_filtering.c @ 73] fffff88001172067 : fffff8a00f200dd8 fffff80000000000 0000000000001700 0000000000000801 : pf_Win7_amd64!PfPreOperationCallback+0x14a [d:\prega\sources\dev\driver\pf\file_filtering.c @ 501]
fffff880011749aa : fffffa8006bfa700 fffffa8006ac4700 fffffa8007376d00 fffffa8007903000 : fltmgr!FltpPerformPreCallbacks+0x2f7 fffff880011922a3 : fffffa8006bfa760 fffffa8006bfa760 fffffa8006bfa760 6d4e6f4906ac47f0 : fltmgr!FltpPassThroughInternal+0x4a
fffff80003576efc : 0000000000000005 fffffa80098a4a28 fffffa8006ac47f0 0000000000000000 : fltmgr!FltpCreate+0x293 fffff80003572878 : fffffa8007353cd0 fffff80000000000 fffffa80098a4870 0000000000000001 : nt!IopParseDevice+0x14d3
fffff80003573a96 : 0000000000000000 fffffa80098a4870 fffff680003bd900 fffffa80067b2400 : nt!ObpLookupObjectName+0x588 fffff8000357539c : 0000000000000110 0000000000000000 fffffa8006fbcb01 ffffffffffffffff : nt!ObOpenObjectByName+0x306
fffff8000355fdd8 : 000000000788c3e0 fffff8a000100080 000000000788c3f0 000000000788c430 : nt!IopCreateFile+0x2bc fffff80003275e53 : ffffffffffffffff 0000007fffffffff 000000000788c4c0 0000098000000000 : nt!NtOpenFile+0x58
0000000077c215ea : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x77c215ea

---

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

[Michael_Grabelkovsky-1]

>The reason why I ask is that it appears your code performs the call to

pf_Win7_amd64!PfIsExist() for every MajorFunction in your precallback
handler.

If so, possibly only do this during the precreate processing. At which
point you would allocate a stream context which will hold the current
state and only retrieve the stream context for all subsequent function
precallback handlers. You’ll need to maintain a state transition lock
for the stream context since the state could change, meaning the file
could be created and you will need to update the ‘open’ contexts
accordingly. I talk about this need for a lock on the context while
transitioning the state of the file in my blog entry
http://www.kerneldrivers.com/?p=185

Peter

Peter, it is not my algorithm, but I’ve checked it carefully.
It tries FltAllocateContext() and only if not success, it calls FltAllocateContext(), FltGetFileNameInformation() and PfIsExist() after.

Regards,
Michael.

[Peter_Scott]

Right, my point is that you should perform the check PfIsExist() only
during pre-create processing OR eliminate if from other pre-operation
callbacks that could lead to this recursive loop such as cleanup and
close. Looking at the stack trace, it appears that you are doing this
check in the preclose processing which you should skip. Just because you
specify a non-NULL instance in your call to FltCreateFile() call does
not mean all operations which come in before that call returns will be
passed to the filters below you, only the pre-create (IRP_MJ_CREATE)
request associated to the open you initiated will be passed to filters
below you.

Also, I assume in

“It tries FltAllocateContext() and only if not success, it calls
FltAllocateContext(), FltGetFileNameInformation() and PfIsExist() after.”

you actually meant “It tries ‘FltGetStreamHandleContext’ and only if not
success, …”

As it quick check, you could skip the processing in pre-close if you do
not locate a context, the file object is being removed so there won’t be
any additional requests sent on it anyway.

Pete

On 10/23/2014 8:51 AM, xxxxx@saferpoint.com wrote:

> The reason why I ask is that it appears your code performs the call to
> pf_Win7_amd64!PfIsExist() for every MajorFunction in your precallback
> handler.
>
> If so, possibly only do this during the precreate processing. At which
> point you would allocate a stream context which will hold the current
> state and only retrieve the stream context for all subsequent function
> precallback handlers. You’ll need to maintain a state transition lock
> for the stream context since the state could change, meaning the file
> could be created and you will need to update the ‘open’ contexts
> accordingly. I talk about this need for a lock on the context while
> transitioning the state of the file in my blog entry
> http://www.kerneldrivers.com/?p=185
>
> Peter
Peter, it is not my algorithm, but I’ve checked it carefully.
It tries FltAllocateContext() and only if not success, it calls FltAllocateContext(), FltGetFileNameInformation() and PfIsExist() after.

Regards,
Michael.

---

NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

[Michael_Grabelkovsky-1]

Peter,
thank You for help!

I try to close the problem by two solutions:

1. I revised the code to guarantee that PfIsExist() is called only on PreCreate
2. I developed new module that checks and limits (currently to 4) recursive re-entry. I dream this solution will help us t close some antivirus compatibility problems too.

I’m waiting for result from QA. They receive the problem only sometimes on night test.

Thanks & Regards,
Michael.

[Michael_Grabelkovsky-1]

It’s seen such as my improvements help - there is no new reports from QA with same Crash Dumps.

It’s sadly but I don’t know which solution 1) or 2) helps. But practically it less important.

Repeatedly thanks a lot to Tony , Peter and Alex for advises!

Regards,
Michael.

PS. Some additional technical information

My module which blocks recursive reentry has extension for searching which deep of reentry is possible.
I done some tests and maximum recursive deep which I have seen was 2.
It was reason to setup my limit to 4. But I don’t know, probably exist the driver(s) which may generate more.