Weird image name during image notify callback

NTFSD
1

Hi,

Sometimes during an image notify callback we are seeing and image with a “doubled” name:

…“\windows\system32\example\example.exeexample.exe”

This only occurs on Vista SP2 x64. Has anyone else seen this before?

Thanks,
-Jeff

2

Well… I have never encountered this kind of a problem.
BUT I want to take a long shot here and ask you:
What’s the length specified in the “Length” field of the UNICODE_STRING
structure that points to the image name.
And hopefully you haven’t treated it as a NULL terminated string.

Regards,
Ayush Gupta
http://www.linkedin.com/in/guptaayush

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-371918-
xxxxx@lists.osr.com] On Behalf Of Jeff Curless
Sent: Friday, July 03, 2009 1:30 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Weird image name during image notify callback

Hi,

Sometimes during an image notify callback we are seeing and image with
a “doubled” name:

…“\windows\system32\example\example.exeexample.exe”

This only occurs on Vista SP2 x64. Has anyone else seen this before?

Thanks,
-Jeff

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Nope of course not :-). The length and maximum length include the duplication.

-Jeff

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Thursday, July 02, 2009 4:08 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Weird image name during image notify callback

Well… I have never encountered this kind of a problem.
BUT I want to take a long shot here and ask you:
What’s the length specified in the “Length” field of the UNICODE_STRING
structure that points to the image name.
And hopefully you haven’t treated it as a NULL terminated string.

Regards,
Ayush Gupta
http://www.linkedin.com/in/guptaayush

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-371918-
xxxxx@lists.osr.com] On Behalf Of Jeff Curless
Sent: Friday, July 03, 2009 1:30 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Weird image name during image notify callback

Hi,

Sometimes during an image notify callback we are seeing and image with
a “doubled” name:

…“\windows\system32\example\example.exeexample.exe”

This only occurs on Vista SP2 x64. Has anyone else seen this before?

Thanks,
-Jeff

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

4

Even though I put it in the first email, it is good to note we’ve never seen this on any OS other than Vista X64 SP2.

-Jeff

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Thursday, July 02, 2009 4:08 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Weird image name during image notify callback

Well… I have never encountered this kind of a problem.
BUT I want to take a long shot here and ask you:
What’s the length specified in the “Length” field of the UNICODE_STRING
structure that points to the image name.
And hopefully you haven’t treated it as a NULL terminated string.

Regards,
Ayush Gupta
http://www.linkedin.com/in/guptaayush

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-371918-
xxxxx@lists.osr.com] On Behalf Of Jeff Curless
Sent: Friday, July 03, 2009 1:30 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Weird image name during image notify callback

Hi,

Sometimes during an image notify callback we are seeing and image with
a “doubled” name:

…“\windows\system32\example\example.exeexample.exe”

This only occurs on Vista SP2 x64. Has anyone else seen this before?

Thanks,
-Jeff

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Show your code.

//Daniel

“Jeff Curless” wrote in message news:xxxxx@ntfsd…
> Nope of course not :-). The length and maximum length include the
> duplication.
>
> -Jeff
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
> Sent: Thursday, July 02, 2009 4:08 PM
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] Weird image name during image notify callback
>
> Well… I have never encountered this kind of a problem.
> BUT I want to take a long shot here and ask you:
> What’s the length specified in the “Length” field of the UNICODE_STRING
> structure that points to the image name.
> And hopefully you haven’t treated it as a NULL terminated string.
>
> Regards,
> Ayush Gupta
> http://www.linkedin.com/in/guptaayush
>
>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com [mailto:bounce-371918-
>> xxxxx@lists.osr.com] On Behalf Of Jeff Curless
>> Sent: Friday, July 03, 2009 1:30 AM
>> To: Windows File Systems Devs Interest List
>> Subject: [ntfsd] Weird image name during image notify callback
>>
>> Hi,
>>
>> Sometimes during an image notify callback we are seeing and image with
>> a “doubled” name:
>>
>> …“\windows\system32\example\example.exeexample.exe”
>>
>> This only occurs on Vista SP2 x64. Has anyone else seen this before?
>>
>> Thanks,
>> -Jeff
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule of debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

6

Hi Jeff,

I would suggest that you put a breakpoint somewhere in the Mmxxx function
(you can easily find that out by seeing the call stack) that calls the load
image notification routine. And then try to find out if that function is
sending correct names or not. If it is sending correct names then probably
there is some memory corruption in your code and if it is not sending
correct names then it’s a bug that you should file with MS.

Regards,
Ayush Gupta

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-371935-
xxxxx@lists.osr.com] On Behalf Of Jeff Curless
Sent: Friday, July 03, 2009 2:12 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Weird image name during image notify callback

Even though I put it in the first email, it is good to note we’ve never
seen this on any OS other than Vista X64 SP2.

-Jeff

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-371919-
xxxxx@lists.osr.com] On Behalf Of Ayush Gupta
Sent: Thursday, July 02, 2009 4:08 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Weird image name during image notify callback

Well… I have never encountered this kind of a problem.
BUT I want to take a long shot here and ask you:
What’s the length specified in the “Length” field of the UNICODE_STRING
structure that points to the image name.
And hopefully you haven’t treated it as a NULL terminated string.

Regards,
Ayush Gupta
http://www.linkedin.com/in/guptaayush

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-371918-
> xxxxx@lists.osr.com] On Behalf Of Jeff Curless
> Sent: Friday, July 03, 2009 1:30 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Weird image name during image notify callback
>
> Hi,
>
> Sometimes during an image notify callback we are seeing and image
with
> a “doubled” name:
>
> …“\windows\system32\example\example.exeexample.exe”
>
> This only occurs on Vista SP2 x64. Has anyone else seen this before?
>
> Thanks,
> -Jeff
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer