Hi all,
Coding causing Page Fault :
DumbFunction ( “FileName”, hHandle );
KeSetEvent ( PtrWaitForDeviceIOCompletionEvent, IO_NO_INCREMENT, FALSE );
Page Fault is comming while calling KeSetEvent function.
******************************************************************************************************************************
-
I have tried by commenting DumbFunction Page fault is not comming.
-
Page fault code :
BOOLEAN DumbFunction ( IN PWCHAR pszFileName, IN HANDLE *phHandle )
{
UNICODE_STRING UnicodeFileName ;
try
{
RtlInitUnicodeString(&UnicodeFileName, pszFileName, TRUE);
if ( !UnicodeFileName.Buffer )
return ( FALSE );
return ( FALSE );
}
finally
{
}
}
Before calling this function EDI ( Register ) will contain address for KeSetEvent. After returning from this function EDI will contain 00000001. So page fault is causing.
Stack Dump :
00000001 8042C9F3
Here before returning from programm 00000001 is poping to EDI.
8042C9F3 is the address of KeSetEvet.
That mean 1 POP instruction is Missing.
-
Following function is working fine.
BOOLEAN DumbFunction ( IN PWCHAR pszFileName, IN HANDLE *phHandle )
{
UNICODE_STRING UnicodeFileName ;
try
{
}
finally
{
}
} -
Following function is working fine.
BOOLEAN DumbFunction ( IN PWCHAR pszFileName, IN HANDLE *phHandle )
{
RtlInitUnicodeString(&UnicodeFileName, pszFileName, TRUE);
if ( !UnicodeFileName.Buffer )
return ( FALSE );
return ( FALSE );
}
The Dis-Assemble part of DumbFunction ( Which is causing Page Fault ) :
PUSH EBP
MOV EBP,ESP
PUSH FF
PUSH ED259258
PUSH ntoskrnl!_except_handler3
MOV EAX, FS:[00000000]
PUSH EAX
MOV FS:[00000000],ESP
SUB ESP,10
PUSH EBX
PUSH ESI
PUSH EDI
AND DWORD PTR [EBP-04],00
PUSH 01
PUSH DWORD PTR [EBP+08]
LEA EAX,[EBP-20]
PUSH EAX
CALL [ntoskrnl!RtlinitUnicodeString]
CMP DWORD PTR [EBP-1C],00
PUSH FF
LEA EAX, [EBP-10]
PUSH EAX
CALL ntoskrnl!_local_unwind32
POP ECX
POP ECX
XOR AL,AL
MOV ECX,[EBP-10]
MOV FS:[00000000],ECX
POP EDI
POP ESI
POP EBX
LEAVE
RET 0008
Suggest me something to proceede further.
Thanks in advance,
Satish K.S
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
