Re: blue screen problem: *** STOP:0x0000006B (0xC0000020, 0x00000003, 0x00000000, 0x00000000)

NTFSD
1

How far does your code get before failing?
Use try/except around your code - it might help pinpoint this, in case you
use SoftICE (trouble debugging boot drivers).

Regards, Dejan.

Bill Deng wrote:

Hi,All,

I am writing a file filter. In my IRP_MJ_CREATE dispatch routine, I add some
codes to get the file user SID, however, when I turn on my computer I
automatically get a blue screen with the message
“Process1_initialization_failed”.

The error number is:

*** STOP:0x0000006B (0xC0000020, 0x00000003, 0x00000000, 0x00000000)

Can anyone help me with that? My codes added in IRP_MJ_CREATE dispatch
routine are attached as below, thank you in advance:

//
// Purpose of these codes is to get user SID
//

NTSTATUS status;
ULONG RetLen;
HANDLE hToken;
PTOKEN_USER tokenInfoBuffer;
PIO_STACK_LOCATION irpSp;
PACCESS_TOKEN Token;
PSID userSID;

irpSp = IoGetCurrentIrpStackLocation( Irp );
Token
=irpSp->Parameters.Create.SecurityContext->AccessState->SubjectSecurityConte
xt.ClientToken;
if( Token == NULL )
Token
=irpSp->Parameters.Create.SecurityContext->AccessState->SubjectSecurityConte
xt.PrimaryToken;

// ObOpenObjectByPointer on Token, provides hToken;
ObOpenObjectByPointer(Token, 0, NULL, TOKEN_QUERY, NULL, KernelMode,
&hToken );
ObDereferenceObject(Token);

// This returns the size of the SID.
status=ZwQueryInformationToken(hToken, TokenUser, NULL, 0, &RetLen);
if ( STATUS_SUCCESS != status )
return STATUS_UNSUCCESSFUL;

//Allocate memory for RetLen bytes, put the pointer to tokenInfoBuffer
variable.
tokenInfoBuffer=(PTOKEN_USER) ExAllocatePool( NonPagedPool, RetLen );
status=ZwQueryInformationToken(hToken, TokenUser, tokenInfoBuffer,
RetLen,&RetLen);
if ( STATUS_SUCCESS != status )
return STATUS_UNSUCCESSFUL;

userSID=tokenInfoBuffer->User.Sid;
if(RtlValidSid(userSID))
{
KdPrint((“valid userSID”));
}
else
{
KdPrint((“invalid userSID”));
}

ZwClose(hToken);

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.