Hello all,
I m first time using windbg for debugging kernel mode keyboard class driver
for Windows NT.i have setup two m/c host and testing m/c.i have placed
executable driver image in testing m/c.
WinDbg which is running on host m/c automailcally closed as any breakpoint
hit.when i again open the WinDbg,than in source code all the break points
become clear.now i have again set option for kernel mode debugger and then
press ‘GO’.The command window showing following message ->
Unexpected Exception :code=8000003 Addrs=ffffffffffc7b1ae9
Hard Coded Breakpoint hit
how winDbg remain open after a breakpoint hit?
pls suggest me the solution.
John
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
First, what is m/c?
Second, what version of WinDBG are you running, and what OS are you running
on the host? If you don’t already have it, get the 3.0.10.0 beta from:
http://www.microsoft.com/ddk/debugging
It needs to be running on NT4 or Win2K on the host.
Last, consider sending future queries to xxxxx@osr.com, as that list is
dedicated to questions about WinDBG.
Phil
* Philip D. Barila | (503) 264-8386
* Intel Corp. | Not speaking for Intel
-----Original Message-----
From: xxxxx@yahoo.co.uk [mailto:xxxxx@yahoo.co.uk]
Sent: Monday, July 09, 2001 2:43 AM
To: NT Developers Interest List
Subject: [ntdev] WinDbg query
Hello all,
I m first time using windbg for debugging kernel mode keyboard class driver
for Windows NT.i have setup two m/c host and testing m/c.i have placed
executable driver image in testing m/c.
WinDbg which is running on host m/c automailcally closed as any breakpoint
hit.when i again open the WinDbg,than in source code all the break points
become clear.now i have again set option for kernel mode debugger and then
press ‘GO’.The command window showing following message ->
Unexpected Exception :code=8000003 Addrs=ffffffffffc7b1ae9
Hard Coded Breakpoint hit
how winDbg remain open after a breakpoint hit?
pls suggest me the solution.
John
You are currently subscribed to ntdev as: xxxxx@intel.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Hi,
I am currently writing a file system filter driver that monitors file
activities. Could some one tell me how could I get to know whether a file
is being deleted? I am trying to figure it out in the IRP_MJ_CREATE
request. Can I get that information in the IRP itself?
Regards.
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
IRP_MN_SET_INFORMATION/FileDispositionInformation/DeleteOnClose.
----- Original Message -----
From:
To: “NT Developers Interest List”
Sent: Wednesday, July 25, 2001 12:00 AM
Subject: [ntdev] Query
> Hi,
>
> I am currently writing a file system filter driver that monitors file
> activities. Could some one tell me how could I get to know whether a file
> is being deleted? I am trying to figure it out in the IRP_MJ_CREATE
> request. Can I get that information in the IRP itself?
>
> Regards.
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Hi,
Do you mean to say that at the IRP_MJ_CREATE request, I should query for
the file disposition information by generating an IRP myself? I tried the
same but the operation seems to be failing. Possibly because the OS has not
seen the fileobject. Can you please elaborate?
Regards.
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
wrote in message news:xxxxx@ntdev…
>
> Hi,
>
> Do you mean to say that at the IRP_MJ_CREATE request, I should query for
> the file disposition information by generating an IRP myself? I tried the
> same but the operation seems to be failing. Possibly because the OS has
not
> seen the fileobject. Can you please elaborate?
>
You might have better luck posting this question to NTFSD. The people on
that list LIVE for file systems, after all.
However, to get you started and elaborate on what Max said: You can’t tell a
file is going to be deleted when the file is opened. Files are deleted in
NT by setting the “delete on close” attribute. When the file is ultimately
closed, if the delete on close attribute is set, the file is deleted.
Now, obviously, you CAN check the access requested to a file when the file
is being opened. But, at least in my experience, checking to see if a file
is being opened for delete access isn’t a very good predictor of whether or
not the opener really will end up deleting the file.
I hope that helps, at least a little, in terms of getting you started. With
that info, you should be safe venturing into the waters of the NTFSD list.
Peter
OSR
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com