system error 127

Dejan,
Thank you for your reply. I do not use the function which you specified. I
might use the function that do not work on Windows 2000. How do you find
that out? I set break point at DriverEntry but it will not stop. Look like
system check it before running. Please share your way to us. Thak you again
for your help.

FC

‘depends’ apparently works for drivers. Red marks will show you missing
exports.

Andrey.

“fc” wrote in message news:xxxxx@ntfsd…
> Dejan,
> Thank you for your reply. I do not use the function which you specified. I
> might use the function that do not work on Windows 2000. How do you find
> that out? I set break point at DriverEntry but it will not stop. Look like
> system check it before running. Please share your way to us. Thak you
> again for your help.
>
> FC
>
>

Andrey,
Thank you for help. Can you tell me what “Red Marks” mean? Following is
import symbols. Can you point to me where is the problem?

Section contains the following imports:

ntoskrnl.exe
18020 Import Address Table
24234 Import Name Table
0 time date stamp
0 Index of first forwarder reference

154 IoCreateSymbolicLink
31 DbgPrint
14B IoCreateDevice
43B RtlInitUnicodeString
3CF RtlAssert
2D DbgBreakPoint
46 ExDeleteNPagedLookasideList
34C ObfDereferenceObject
20C KeDelayExecutionThread
161 IoDetachDevice
1D4 IoUnregisterFsRegistrationChange
1F1 IofCompleteRequest
24B KeReadStateEvent
286 KeWaitForSingleObject
1F0 IofCallDriver
26D KeSetEvent
22E KeInitializeSemaphore
71 ExQueueWorkItem
1AF IoReleaseCancelSpinLock
129 IoAcquireCancelSpinLock
177 IoGetCurrentProcess
259 KeReleaseSemaphore
5AB _except_handler3
127 InterlockedPopEntrySList
52B ZwClose
576 ZwQueryValueKey
555 ZwOpenKey
2BC MmGetSystemRoutineAddress
160 IoDeleteSymbolicLink
372 PsGetCurrentThreadId
36F PsGetCurrentProcessId
247 KeQuerySystemTime
138 IoAttachDeviceToDeviceStack
3C9 RtlAppendUnicodeStringToString
5EC wcslen
5DF swprintf
18A IoGetTopLevelIrp
3CA RtlAppendUnicodeToString
3E4 RtlCopyUnicodeString
16F IoFreeIrp
219 KeGetCurrentThread
131 IoAllocateIrp
34D ObfReferenceObject
174 IoGetBaseFileSystemDeviceObject
344 ObReferenceObjectByHandle
16A IoFileObjectType
530 ZwCreateFile
3DA RtlCompareUnicodeString
128 InterlockedPushEntrySList
342 ObQueryNameString
5BE _wcsnicmp
409 RtlEqualUnicodeString
24F KeReadStateSemaphore
287 KefAcquireSpinLockAtDpcLevel
27F KeTickCount
207 KeBugCheckEx
15E IoDeleteDevice
42 ExAllocatePoolWithTag
4F ExFreePoolWithTag
229 KeInitializeEvent
56 ExInitializeNPagedLookasideList
1AB IoRegisterFsRegistrationChange
392 PsGetVersion
5D2 sprintf

HAL.dll
18000 Import Address Table
24214 Import Name Table
0 time date stamp
0 Index of first forwarder reference

4E KfRaiseIrql
4C KfAcquireSpinLock
4F KfReleaseSpinLock
0 ExAcquireFastMutex
1 ExReleaseFastMutex
40 KeGetCurrentIrql
4D KfLowerIrql

Thanks,
FC

“Andrey Shedel” wrote in message news:xxxxx@ntfsd…
> ‘depends’ apparently works for drivers. Red marks will show you missing
> exports.
>
> Andrey.
>
> “fc” wrote in message news:xxxxx@ntfsd…
>> Dejan,
>> Thank you for your reply. I do not use the function which you specified.
>> I might use the function that do not work on Windows 2000. How do you
>> find that out? I set break point at DriverEntry but it will not stop.
>> Look like system check it before running. Please share your way to us.
>> Thak you again for your help.
>>
>> FC
>>
>>
>
>
>

The easiest way is probably to set the start for the driver to Manual, and start
your driver with “net start MyDriver” (MyDriver is the SCM entry you made). A message
will pop up to say what function cannot be found.

Regards, Dejan.

fc wrote:

Dejan,
Thank you for your reply. I do not use the function which you specified. I
might use the function that do not work on Windows 2000. How do you find
that out? I set break point at DriverEntry but it will not stop. Look like
system check it before running. Please share your way to us. Thak you again
for your help.

FC


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Kind regards, Dejan M.
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.

This problem has fixed. I compared the imports list from good one with bad
one and found the problem. The probblem is InterlockedPopEntrySList and
InterlockedPushEntrySList different between Window 2000 and WNET. It needs
to compile with _WIN2K_COMPAT_SLIST_USAGE and X86 switch in order to make
it recognize at Window 2000. By the way the WINVER also needs to define as
0x0500.
Thank you for all help.

FC
“Andrey Shedel” wrote in message news:xxxxx@ntfsd…
> ‘depends’ apparently works for drivers. Red marks will show you missing
> exports.
>
> Andrey.
>
> “fc” wrote in message news:xxxxx@ntfsd…
>> Dejan,
>> Thank you for your reply. I do not use the function which you specified.
>> I might use the function that do not work on Windows 2000. How do you
>> find that out? I set break point at DriverEntry but it will not stop.
>> Look like system check it before running. Please share your way to us.
>> Thak you again for your help.
>>
>> FC
>>
>>
>
>
>

> Thank you for help. Can you tell me what “Red Marks” mean?

Right question is probably ‘what “depends” mean?’ :slight_smile: Sorry for not been
clear enough.
You should have depends.exe installed as part of Visual Studio. Really
helpful tool in situations like this one.

Andrey.