pragma alloc_text(PAGE, XXX) behaves differently in Vista ?

NTFSD
1

Hi guys,

Recently I encountered a crash in Filespy legacy filter driver when testing
in Vista. It happens inside page fault handler. The IRP request is
IRP_MJ_READ,
IRP flags are 0x40060043 (so it is paging I/O read)

The crash occurs at the first instruction of NLAllocateNameControl function,
but not because the instruction touches invalid address, but because
the instruction is at crash address (paged out at the moment of crash).

The reason why the function is paged out, is this directive in the source:

#pragma alloc_text(PAGE, NLAllocateNameControl)

However, this code exists for years and apparently no one saw this problem
in pre-Vista operating systems. Does Vista behaves differently when
encounters the PAGE section ? It looks to me like the previous Windows
versions actually never paged out functions that have been marked
as PAGE, otherwise this error should have been already discovered.

Is there a bug in Filespy then ?
Could someone from FS team at Microsoft put some light on this ?

*********************** Crash info *****************************

Crash address:

FSpy!NLAllocateNameControl:
885c4da0 0302 add eax,[edx] <======== Crash address
885c4da2 0306 add eax,[esi]
885c4da4 4f dec edi
885c4da5 62446900 bound eax,[ecx+ebp*2]
885c4da9 0000 add [eax],al
885c4dab 0068f9 add [eax-0x7],ch
885c4dae e183 loope FSpy!NLGetObjectName+0xc3 (885c4d33)
885c4db0 3cb4 cmp al,0xb4
885c4db2 2200 and al,[eax]
885c4db4 0000 add [eax],al
885c4db6 008203020700 add [edx+0x70203],al
885c4dbc 43 inc ebx
885c4dbd 4d dec ebp
885c4dbe 56 push esi
885c4dbf 61 popad

Call stack:

(recursion, causes stack overflow)
819eb330 885c4da0 00000000 885c4da0 00000000 nt!KiTrap0E+0xdc
819eb3b8 885bd199 819eb3e0 885c0bc0 879ece00 FSpy!NLAllocateNameControl
819eb400 885bd6cc 8c368cc8 004e9aa0 83450e58 FSpy!SpySetName+0x129
819eb450 885bcde6 879ece00 8c368cc8 879ecfd8 FSpy!SpyLogIrp+0x22c
819eb47c 885bcf17 8c4e9aa0 879ece00 879ece00 FSpy!SpyPassThrough+0x66
819eb490 822c967f 8c4e9aa0 879ece00 881beec8 FSpy!SpyDispatch+0x77
819eb4b4 8207e288 8206fd7f 00000000 8c4e9aa0 nt!IovCallDriver+0x250
819eb4c8 8206fd7f 8307a020 881bee58 881bee6c nt!IofCallDriver+0x1b
819eb4e4 82070276 00000043 8307a020 881bee98 nt!IoPageRead+0x18e
819eb570 8204a3a4 885c4da0 00000000 00000000 nt!MiDispatchFault+0xccf
819eb5e0 82047204 00000000 885c4da0 00000000 nt!MmAccessFault+0xc7e
819eb5e0 885c4da0 00000000 885c4da0 00000000 nt!KiTrap0E+0xdc
819eb668 885bd199 819eb690 885c0bc0 8ab20e00 FSpy!NLAllocateNameControl
819eb6b0 885bd6cc 87adccc8 004e9aa0 83450e58 FSpy!SpySetName+0x129
819eb700 885bcde6 8ab20e00 87adccc8 8ab20fd8 FSpy!SpyLogIrp+0x22c
819eb72c 885bcf17 8c4e9aa0 8ab20e00 8ab20e00 FSpy!SpyPassThrough+0x66
819eb740 822c967f 8c4e9aa0 8ab20e00 83e95620 FSpy!SpyDispatch+0x77
819eb764 8207e288 8206fd7f 00000000 8c4e9aa0 nt!IovCallDriver+0x250
819eb778 8206fd7f 8307a020 83e955b0 83e955c4 nt!IofCallDriver+0x1b
819eb794 82070276 00000043 8307a020 83e955f0 nt!IoPageRead+0x18e
819eb820 8204a3a4 864ea470 00000000 00000000 nt!MiDispatchFault+0xccf
819eb890 82047204 00000000 864ea470 00000000 nt!MmAccessFault+0xc7e
819eb890 8093e7ce 00000000 864ea470 00000000 nt!KiTrap0E+0xdc
819ebb24 8093ed89 819ebc20 834500d8 00000000 Ntfs!NtfsCheckpointVolume+0xf04
819ebb78 8093ec18 819ebc20 834500d8 819ebd43
Ntfs!NtfsCheckpointAllVolumesWorker+0x3f
819ebbd8 8093ecd8 819ebc20 00000000 8093ed4e Ntfs!NtfsForEachVcb+0xdf
819ebd44 8204d881 00000000 00000000 8307a020
Ntfs!NtfsCheckpointAllVolumes+0xab
819ebd7c 8219cfea 00000000 819e0680 00000000 nt!ExpWorkerThread+0xfd
819ebdc0 8206f3c7 8204d7a0 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

2

I just found the same problem in fltmgr, with fltmgr!FltGetDeviceObject
routine. The call stack clearly proves it is stack overflow caused by
repeating
page fault at the address of fltmgr!FltGetDeviceObject. For details, look
below.

This effect has been observed in Vista build 5356 when I ran Filespy with
MSpy driver installed and performed a search for file containing a specified
string (thus, a lot of I/O and a lot of cache used).

L.

**********************************
*
*
* Bugcheck Analysis
*
*
*
**********************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it’s a trap of a kind
that the kernel isn’t allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 8012c000
Arg3: 00000000
Arg4: 00000000

*************************

fltmgr!FltGetDeviceObject:
80b59bd0 0000 add [eax],al
80b59bd2 0000 add [eax],al
80b59bd4 0000 add [eax],al
80b59bd6 0000 add [eax],al
80b59bd8 0000 add [eax],al
80b59bda 0000 add [eax],al
80b59bdc 0000 add [eax],al
80b59bde 0000 add [eax],al
80b59be0 0000 add [eax],al
80b59be2 0000 add [eax],al
80b59be4 0000 add [eax],al
80b59be6 0000 add [eax],al
80b59be8 0000 add [eax],al

*************************

kd> kb 100
ChildEBP RetAddr Args to Child
820f1bcc 820b800d 00000003 820fa75c 00000000
nt!RtlpBreakWithStatusInstruction
820f1c1c 820b8ba8 00000003 83051a80 00000000 nt!KiBugCheckDebugBreak+0x1c
820f1fdc 820461ca 0000007f 00000008 8012c000 nt!KeBugCheck2+0x648
820f1fdc 820c4493 0000007f 00000008 8012c000 nt!KiTrap08+0x75
819b9040 820a8b74 00000344 7970534d 00000040 nt!MmAllocateSpecialPool+0x22
819b9068 822cac98 00000040 00000344 7970534d
nt!ExAllocatePoolWithTagPriority+0x2f
819b9094 822ca847 00000040 00000344 7970534d
nt!VeAllocatePoolWithTagPriority+0x136
819b90b8 84b2183a 00000000 00000340 7970534d
nt!VerifierExAllocatePoolWithTag+0x59
819b90cc 84b218dc 819b90dc 89bf8838 89b3ed8c MSpy!SpyAllocateBuffer+0x5a
819b90dc 84b21707 00000019 89bf8838 00000000 MSpy!SpyNewRecord+0xc
819b90f4 80b5bf5f 89b3ed60 819b9140 819b9160
MSpy!SpyPreOperationCallback+0x17
819b9120 80b3a7cd 00000001 00000003 819b9160 fltmgr!FltvPreOperation+0x3f
819b9180 80b3cc74 819b91c8 00000000 819b91c8
fltmgr!FltpPerformPreCallbacks+0x301
819b9194 80b3d570 819b91c8 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819b91b0 80b3d933 819b9101 8d8d6e00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819b91e0 822c967f 8cf3aac8 8d8d6e00 83fe34e8 fltmgr!FltpDispatch+0xb9
819b9204 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819b9218 8206fd7f 8307d638 83fe3478 83fe348c nt!IofCallDriver+0x1b
819b9234 82070276 00000043 8307d638 83fe34b8 nt!IoPageRead+0x18e
819b92c0 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819b9334 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819b9334 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819b93bc 84b21a07 8cc90b90 819b9404 8cce58f8 fltmgr!FltGetDeviceObject
819b93f8 84b21786 8cce58f8 819b9470 00000000
MSpy!SpyLogPreOperationData+0x47
819b9424 80b5bf5f 8cce58f8 819b9470 819b9490
MSpy!SpyPreOperationCallback+0x96
819b9450 80b3a7cd 00000001 00000003 819b9490 fltmgr!FltvPreOperation+0x3f
819b94b0 80b3cc74 819b94f8 00000000 819b94f8
fltmgr!FltpPerformPreCallbacks+0x301
819b94c4 80b3d570 819b94f8 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819b94e0 80b3d933 819b9401 8cb3ee00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819b9510 822c967f 8cf3aac8 8cb3ee00 8ccfac50 fltmgr!FltpDispatch+0xb9
819b9534 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819b9548 8206fd7f 8307d638 8ccfabe0 8ccfabf4 nt!IofCallDriver+0x1b
819b9564 82070276 00000043 8307d638 8ccfac20 nt!IoPageRead+0x18e
819b95f0 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819b9664 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819b9664 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819b96ec 84b21a07 8cc90b90 819b9734 899c8cb8 fltmgr!FltGetDeviceObject
819b9728 84b21786 899c8cb8 819b97a0 00000000
MSpy!SpyLogPreOperationData+0x47
819b9754 80b5bf5f 899c8cb8 819b97a0 819b97c0
MSpy!SpyPreOperationCallback+0x96
819b9780 80b3a7cd 00000001 00000003 819b97c0 fltmgr!FltvPreOperation+0x3f
819b97e0 80b3cc74 819b9828 00000000 819b9828
fltmgr!FltpPerformPreCallbacks+0x301
819b97f4 80b3d570 819b9828 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819b9810 80b3d933 819b9801 897aee00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819b9840 822c967f 8cf3aac8 897aee00 83eab198 fltmgr!FltpDispatch+0xb9
819b9864 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819b9878 8206fd7f 8307d638 83eab128 83eab13c nt!IofCallDriver+0x1b
819b9894 82070276 00000043 8307d638 83eab168 nt!IoPageRead+0x18e
819b9920 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819b9994 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819b9994 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819b9a1c 84b21a07 8cc90b90 819b9a64 898b5068 fltmgr!FltGetDeviceObject
819b9a58 84b21786 898b5068 819b9ad0 00000000
MSpy!SpyLogPreOperationData+0x47
819b9a84 80b5bf5f 898b5068 819b9ad0 819b9af0
MSpy!SpyPreOperationCallback+0x96
819b9ab0 80b3a7cd 00000001 00000003 819b9af0 fltmgr!FltvPreOperation+0x3f
819b9b10 80b3cc74 819b9b58 00000000 819b9b58
fltmgr!FltpPerformPreCallbacks+0x301
819b9b24 80b3d570 819b9b58 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819b9b40 80b3d933 819b9b01 86260e00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819b9b70 822c967f 8cf3aac8 86260e00 89b0d358 fltmgr!FltpDispatch+0xb9
819b9b94 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819b9ba8 8206fd7f 8307d638 89b0d2e8 89b0d2fc nt!IofCallDriver+0x1b
819b9bc4 82070276 00000043 8307d638 89b0d328 nt!IoPageRead+0x18e
819b9c50 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819b9cc4 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819b9cc4 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819b9d4c 84b21a07 8cc90b90 819b9d94 898026c8 fltmgr!FltGetDeviceObject
819b9d88 84b21786 898026c8 819b9e00 00000000
MSpy!SpyLogPreOperationData+0x47
819b9db4 80b5bf5f 898026c8 819b9e00 819b9e20
MSpy!SpyPreOperationCallback+0x96
819b9de0 80b3a7cd 00000001 00000003 819b9e20 fltmgr!FltvPreOperation+0x3f
819b9e40 80b3cc74 819b9e88 00000000 819b9e88
fltmgr!FltpPerformPreCallbacks+0x301
819b9e54 80b3d570 819b9e88 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819b9e70 80b3d933 819b9e01 8d080e00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819b9ea0 822c967f 8cf3aac8 8d080e00 83ff8138 fltmgr!FltpDispatch+0xb9
819b9ec4 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819b9ed8 8206fd7f 8307d638 83ff80c8 83ff80dc nt!IofCallDriver+0x1b
819b9ef4 82070276 00000043 8307d638 83ff8108 nt!IoPageRead+0x18e
819b9f80 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819b9ff4 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819b9ff4 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819ba07c 84b21a07 8cc90b90 819ba0c4 89b3f150 fltmgr!FltGetDeviceObject
819ba0b8 84b21786 89b3f150 819ba130 00000000
MSpy!SpyLogPreOperationData+0x47
819ba0e4 80b5bf5f 89b3f150 819ba130 819ba150
MSpy!SpyPreOperationCallback+0x96
819ba110 80b3a7cd 00000001 00000003 819ba150 fltmgr!FltvPreOperation+0x3f
819ba170 80b3cc74 819ba1b8 00000000 819ba1b8
fltmgr!FltpPerformPreCallbacks+0x301
819ba184 80b3d570 819ba1b8 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819ba1a0 80b3d933 819ba101 8d3aee00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819ba1d0 822c967f 8cf3aac8 8d3aee00 83f1ec58 fltmgr!FltpDispatch+0xb9
819ba1f4 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819ba208 8206fd7f 8307d638 83f1ebe8 83f1ebfc nt!IofCallDriver+0x1b
819ba224 82070276 00000043 8307d638 83f1ec28 nt!IoPageRead+0x18e
819ba2b0 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819ba324 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819ba324 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819ba3ac 84b21a07 8cc90b90 819ba3f4 83fcc9e8 fltmgr!FltGetDeviceObject
819ba3e8 84b21786 83fcc9e8 819ba460 00000000
MSpy!SpyLogPreOperationData+0x47
819ba414 80b5bf5f 83fcc9e8 819ba460 819ba480
MSpy!SpyPreOperationCallback+0x96
819ba440 80b3a7cd 00000001 00000003 819ba480 fltmgr!FltvPreOperation+0x3f
819ba4a0 80b3cc74 819ba4e8 00000000 819ba4e8
fltmgr!FltpPerformPreCallbacks+0x301
819ba4b4 80b3d570 819ba4e8 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819ba4d0 80b3d933 819ba401 86016e00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819ba500 822c967f 8cf3aac8 86016e00 83f1efa0 fltmgr!FltpDispatch+0xb9
819ba524 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819ba538 8206fd7f 8307d638 83f1ef30 83f1ef44 nt!IofCallDriver+0x1b
819ba554 82070276 00000043 8307d638 83f1ef70 nt!IoPageRead+0x18e
819ba5e0 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819ba654 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819ba654 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819ba6dc 84b21a07 8cc90b90 819ba724 898ad128 fltmgr!FltGetDeviceObject
819ba718 84b21786 898ad128 819ba790 00000000
MSpy!SpyLogPreOperationData+0x47
819ba744 80b5bf5f 898ad128 819ba790 819ba7b0
MSpy!SpyPreOperationCallback+0x96
819ba770 80b3a7cd 00000001 00000003 819ba7b0 fltmgr!FltvPreOperation+0x3f
819ba7d0 80b3cc74 819ba818 00000000 819ba818
fltmgr!FltpPerformPreCallbacks+0x301
819ba7e4 80b3d570 819ba818 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819ba800 80b3d933 819ba801 8d2b8e00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819ba830 822c967f 8cf3aac8 8d2b8e00 83f1edb0 fltmgr!FltpDispatch+0xb9
819ba854 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819ba868 8206fd7f 8307d638 83f1ed40 83f1ed54 nt!IofCallDriver+0x1b
819ba884 82070276 00000043 8307d638 83f1ed80 nt!IoPageRead+0x18e
819ba910 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819ba984 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819ba984 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819baa0c 84b21a07 8cc90b90 819baa54 89b97700 fltmgr!FltGetDeviceObject
819baa48 84b21786 89b97700 819baac0 00000000
MSpy!SpyLogPreOperationData+0x47
819baa74 80b5bf5f 89b97700 819baac0 819baae0
MSpy!SpyPreOperationCallback+0x96
819baaa0 80b3a7cd 00000001 00000003 819baae0 fltmgr!FltvPreOperation+0x3f
819bab00 80b3cc74 819bab48 00000000 819bab48
fltmgr!FltpPerformPreCallbacks+0x301
819bab14 80b3d570 819bab48 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819bab30 80b3d933 819bab01 8a8bee00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819bab60 822c967f 8cf3aac8 8a8bee00 83ef15d8 fltmgr!FltpDispatch+0xb9
819bab84 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819bab98 8206fd7f 8307d638 83ef1568 83ef157c nt!IofCallDriver+0x1b
819babb4 82070276 00000043 8307d638 83ef15a8 nt!IoPageRead+0x18e
819bac40 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819bacb4 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819bacb4 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819bad3c 84b21a07 8cc90b90 819bad84 898ba180 fltmgr!FltGetDeviceObject
819bad78 84b21786 898ba180 819badf0 00000000
MSpy!SpyLogPreOperationData+0x47
819bada4 80b5bf5f 898ba180 819badf0 819bae10
MSpy!SpyPreOperationCallback+0x96
819badd0 80b3a7cd 00000001 00000003 819bae10 fltmgr!FltvPreOperation+0x3f
819bae30 80b3cc74 819bae78 00000000 819bae78
fltmgr!FltpPerformPreCallbacks+0x301
819bae44 80b3d570 819bae78 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819bae60 80b3d933 819bae01 8d21ce00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819bae90 822c967f 8cf3aac8 8d21ce00 83ef1438 fltmgr!FltpDispatch+0xb9
819baeb4 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819baec8 8206fd7f 8307d638 83ef13c8 83ef13dc nt!IofCallDriver+0x1b
819baee4 82070276 00000043 8307d638 83ef1408 nt!IoPageRead+0x18e
819baf70 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819bafe4 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819bafe4 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819bb06c 84b21a07 8cc90b90 819bb0b4 89b221e8 fltmgr!FltGetDeviceObject
819bb0a8 84b21786 89b221e8 819bb120 00000000
MSpy!SpyLogPreOperationData+0x47
819bb0d4 80b5bf5f 89b221e8 819bb120 819bb140
MSpy!SpyPreOperationCallback+0x96
819bb100 80b3a7cd 00000001 00000003 819bb140 fltmgr!FltvPreOperation+0x3f
819bb160 80b3cc74 819bb1a8 00000000 819bb1a8
fltmgr!FltpPerformPreCallbacks+0x301
819bb174 80b3d570 819bb1a8 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819bb190 80b3d933 819bb101 8ab84e00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819bb1c0 822c967f 8cf3aac8 8ab84e00 83ef1788 fltmgr!FltpDispatch+0xb9
819bb1e4 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819bb1f8 8206fd7f 8307d638 83ef1718 83ef172c nt!IofCallDriver+0x1b
819bb214 82070276 00000043 8307d638 83ef1758 nt!IoPageRead+0x18e
819bb2a0 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819bb314 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819bb314 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819bb39c 84b21a07 8cc90b90 819bb3e4 83d74a68 fltmgr!FltGetDeviceObject
819bb3d8 84b21786 83d74a68 819bb450 00000000
MSpy!SpyLogPreOperationData+0x47
819bb404 80b5bf5f 83d74a68 819bb450 819bb470
MSpy!SpyPreOperationCallback+0x96
819bb430 80b3a7cd 00000001 00000003 819bb470 fltmgr!FltvPreOperation+0x3f
819bb490 80b3cc74 819bb4d8 00000000 819bb4d8
fltmgr!FltpPerformPreCallbacks+0x301
819bb4a4 80b3d570 819bb4d8 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819bb4c0 80b3d933 819bb401 8ca42e00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819bb4f0 822c967f 8cf3aac8 8ca42e00 89903318 fltmgr!FltpDispatch+0xb9
819bb514 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819bb528 8206fd7f 8307d638 899032a8 899032bc nt!IofCallDriver+0x1b
819bb544 82070276 00000043 8307d638 899032e8 nt!IoPageRead+0x18e
819bb5d0 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819bb644 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819bb644 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819bb6cc 84b21a07 8cc90b90 819bb714 83f63f60 fltmgr!FltGetDeviceObject
819bb708 84b21786 83f63f60 819bb780 00000000
MSpy!SpyLogPreOperationData+0x47
819bb734 80b5bf5f 83f63f60 819bb780 819bb7a0
MSpy!SpyPreOperationCallback+0x96
819bb760 80b3a7cd 00000001 00000003 819bb7a0 fltmgr!FltvPreOperation+0x3f
819bb7c0 80b3cc74 819bb808 00000000 819bb808
fltmgr!FltpPerformPreCallbacks+0x301
819bb7d4 80b3d570 819bb808 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819bb7f0 80b3d933 819bb801 895ace00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819bb820 822c967f 8cf3aac8 895ace00 83ef1078 fltmgr!FltpDispatch+0xb9
819bb844 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819bb858 8206fd7f 8307d638 83ef1008 83ef101c nt!IofCallDriver+0x1b
819bb874 82070276 00000043 8307d638 83ef1048 nt!IoPageRead+0x18e
819bb900 8204a3a4 80b59bd0 00000000 00000000 nt!MiDispatchFault+0xccf
819bb974 82047204 00000000 80b59bd0 00000000 nt!MmAccessFault+0xc7e
819bb974 80b59bd0 00000000 80b59bd0 00000000 nt!KiTrap0E+0xdc
819bb9fc 84b21a07 8cc90b90 819bba44 89838eb0 fltmgr!FltGetDeviceObject
819bba38 84b21786 89838eb0 819bbab0 00000000
MSpy!SpyLogPreOperationData+0x47
819bba64 80b5bf5f 89838eb0 819bbab0 819bbad0
MSpy!SpyPreOperationCallback+0x96
819bba90 80b3a7cd 00000001 00000003 819bbad0 fltmgr!FltvPreOperation+0x3f
819bbaf0 80b3cc74 819bbb38 00000000 819bbb38
fltmgr!FltpPerformPreCallbacks+0x301
819bbb04 80b3d570 819bbb38 00000000 00000000
fltmgr!FltpPassThroughInternal+0x32
819bbb20 80b3d933 819bbb01 8639ae00 8cf3aac8 fltmgr!FltpPassThrough+0x1ba
819bbb50 822c967f 8cf3aac8 8639ae00 83ef11a0 fltmgr!FltpDispatch+0xb9
819bbb74 8207e288 8206fd7f 00000000 8cf3aac8 nt!IovCallDriver+0x250
819bbb88 8206fd7f 8307d638 83ef1130 83ef1144 nt!IofCallDriver+0x1b
819bbba4 82070276 00000043 8307d638 83ef1170 nt!IoPageRead+0x18e
819bbc30 8204a3a4 821bc7be 00000000 00000000 nt!MiDispatchFault+0xccf
819bbca4 82047204 00000000 821bc7be 00000000 nt!MmAccessFault+0xc7e
819bbca4 821bc7be 00000000 821bc7be 00000000 nt!KiTrap0E+0xdc
819bbd58 82074354 8307d638 00000000 82111e64 nt!MiSegmentDelete
819bbd7c 8219cfea 00000000 819b0680 00000000
nt!MiDereferenceSegmentThread+0xaa
819bbdc0 8206f3c7 820742ea 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16