Anand George's Weblogs https://docs.microsoft.com/archive/blogs/anandgeorge/feed.xml Wed, 17 Apr 2019 03:37:25 GMT en-US hourly 1 The device gets stuck when running "Surprise Removal" test with "Run Tests with I/O" option selected in a NDIS 6.2 WWAN driver for DTM. https://docs.microsoft.com/archive/blogs/anandgeorge/the-device-gets-stuck-when-running-surprise-removal-test-with-run-tests-with-io-option-selected-in-a-ndis-6-2-wwan-driver-for-dtm Mon, 12 Apr 2010 09:46:00 GMT https://blogs.msdn.microsoft.com/anandgeorge/2010/04/12/the-device-gets-stuck-when-running-surprise-removal-test-with-run-tests-with-io-option-selected-in-a-ndis-6-2-wwan-driver-for-dtm/ ·         When Run Tests with I/O option is disabled, the test passes.

·         This issue can be specific to a Win 7 NDIS 6.2 WWAN driver only.

·         Compiling the same driver as NDIS 6.0 or NDIS 5.1 does not reproduce the issue.

·         We may not see any pending IRPs or reference in the miniport.

·         We may get the UserModeOpenReferences > 0.

·         We have confirmed no User mode application is doing network communication still above symptoms shows up.

·         We may get the following callstack in the dump.

 

                   nt!KiSwapContext+0x26

                   nt!KiSwapThread+0x266

                   nt!KiCommitThreadWait+0x1df

                   nt!KeWaitForSingleObject+0x393

                   ndis!ndisPnPRemoveDeviceEx+0xe3

                   ndis!ndisPnPDispatch+0x814

                   nt!IovCallDriver+0x258

                   nt!IofCallDriver+0x1b

                   nt!ViFilterDispatchPnp+0x120

                   nt!IovCallDriver+0x258

                   nt!IofCallDriver+0x1b

                   pnpfiltr!FilterPassIrp+0x2d

                   pnpfiltr!FilterSurpriseRemove+0x69

                   pnpfiltr!FilterDispatchPnp+0xcd

                   nt!IovCallDriver+0x258

                   nt!IofCallDriver+0x1b

                   nt!IopSynchronousCall+0xc2

                   nt!IopRemoveDevice+0xd4

                   nt!PnpSurpriseRemoveLockedDeviceNode+0x101

                   nt!PnpDeleteLockedDeviceNode+0x21

                   nt!PnpDeleteLockedDeviceNodes+0x4c

                   nt!PnpProcessQueryRemoveAndEject+0x586

                   nt!PnpProcessTargetDeviceEvent+0x38

                   nt!PnpDeviceEventWorker+0x216

                   nt!ExpWorkerThread+0x10d

                   nt!PspSystemThreadStartup+0x9e

                   nt!KiThreadStartup+0x19

Potential root cause. ( not verified )

·         In ndisPnPRemoveDevice function we clean up a bunch of state (notify WMI, Close bindings, detach filters...). 

·         We call Miniport->DriverHandle->RemoveDeviceHandler if it is declared in ndisPnPRemoveDevice.

·         So if Miniport->DriverHandle->RemoveDeviceHandler is NULL this issue may happen as in that case for a SurpriseRemove, we will NOT call driver HaltHandler.

 

]]> Usage of NativeWindow.AssignHandle/ReleaseHandle when unmanaged code is involved. https://docs.microsoft.com/archive/blogs/anandgeorge/usage-of-nativewindow-assignhandlereleasehandle-when-unmanaged-code-is-involved Sat, 10 Apr 2010 20:24:00 GMT https://blogs.msdn.microsoft.com/anandgeorge/2010/04/10/usage-of-nativewindow-assignhandlereleasehandle-when-unmanaged-code-is-involved/
If an application is Subclassing from managed and unmanaged code, it should not use the NativeWindow.AssignHandle/ReleaseHandle to subclass/unsubclass due to following reasons,
 
  • In a managed application, if we call NativeWindow.AssignHandle to subclass, while that Winproc is still in the subclass chain and some native component calls SetWindowLong or SetWindowSubclass, and then when we call NativeWindow.ReleaseHandle, the call will replace the winproc with User32!DefWindowProc which is not desired in most of the cases and will cause the applicatoni crash most of the time.
  • In the above scenario after call to NativeWindow ReleaseHandle, all other WinProc are removed from the chain and User32!DefWindowProc will be in place.
 
 
The above problem cannot be potentially solved or may be very difficult to solve in .net due to following reasons.
 
1.       Subclassing creates a linked list of subclasses but Windows doesn’t provide its own mechanism for manipulating that list. We need to be able to have multiple NativeWindows subclassing in the same window and need to be able to detach them in any order.
2.       Managed code can finalize and sometimes we have no window procedure we can set back because the procedure is managed code and can also be potentially finalized.  When we cannot find a valid window procedure to set as the next window procedure we resort to user!DefWindowProc. 
 
More details on how managed code looks at native WinProc and subclassed procs.
 
Let’s consider the following example,
 
  • An original window procedure is an application’s main window procedure and has a value of 0x12345678
  • Now the nativeWindow subclasses and sets window procedure to 0x11114444 and then stores 0x12345678 as the default window procedure
  • Finally, the unmanaged code subclasses, sets window procedure to 0x11112222 and stores 0x11114444 as next in the subclass chain.
 
At this point, the subclass chain looks like this:
 
0x11112222 (via SetWindowSubclass) à 0x11114444 (via NativeWindow.AssignHandle) à 0x12345678 (Application’s wndproc)
 
Now NativeWindow unsubclasses and sees 0x11112222 as the current window procedure.
 
At this point, NativeWindow only knows that it cannot put 0x12345678 back into the window procedure because someone else has subclassed.  So what should it store in the window procedure?  It has to put something there or else it will crash.  But it doesn’t know that 0x12345678 is the original window procedure.  It could be that 0x12345678 was a subclass that was later removed.  It always has to assume the worst case which is - 0x11112222 and 0x12345678 are both subclasses that may ultimately include the native window’s window procedure of 0x11114444 in their subclass chain.  Therefore it is unsafe for NativeWindow to use either of those values.  It’s only recourse is to use a known native window procedure with User32!DefWindowProc.
 
The Best practice and a potential solution to the above mentioned problem.
 
  • P-invoke to Comctl32.dll ‘s SetWindowSubclass and RemoveWindowSubclass.
  • A working sample for the above step is attached. ( Sample is to depict what is discussed and not to be copied to production code - its far from that. )
 
Bottom Line : NativeWindow.AssignHandle/ReleaseHandle is obsolete and dont use it for any practical purposes.
 
 

Sample.zip

]]> WPF based application experiences different memory leaks. https://docs.microsoft.com/archive/blogs/anandgeorge/wpf-based-application-experiences-different-memory-leaks Wed, 31 Mar 2010 03:16:00 GMT https://blogs.msdn.microsoft.com/anandgeorge/2010/03/31/wpf-based-application-experiences-different-memory-leaks/

If you have a WPF based application which leaks memory with following symptoms, the fix is available now. This fix as on 31/ 3/ 2010 is the latest. This is fixing for about 5 different unrelated and extremely rare intermittent memory leaks in WPF. I will release the KB soon. I filled fix only for.net 3.5 SP1 and some of the issues are there in 4.0 as well. I will add the build numbers and KB number once it is public. If you happen to be running to this issue feel free to contact me via support.microsoft.com.

Memory is used in VAD and not native heap.

 

0:004> !address -summary

 

-------------------- Usage SUMMARY --------------------------

    TotSize (      KB)   Pct(Tots) Pct(Busy)   Usage

   2d087000 (  737820) : 00.01%    73.08%    : RegionUsageIsVAD

   7ffc25f6000 (8588924888) : 99.99%    00.00%    : RegionUsageFree

    7c56000 (  127320) : 00.00%    12.61%    : RegionUsageImage

     810000 (    8256) : 00.00%    00.82%    : RegionUsageStack

      12000 (      72) : 00.00%    00.01%    : RegionUsageTeb

    84f6000 (  136152) : 00.00%    13.49%    : RegionUsageHeap

          0 (       0) : 00.00%    00.00%    : RegionUsagePageHeap

       1000 (       4) : 00.00%    00.00%    : RegionUsagePeb

       2000 (       8) : 00.00%    00.00%    : RegionUsageProcessParametrs

       2000 (       8) : 00.00%    00.00%    : RegionUsageEnvironmentBlock

       Tot: 7ffffff0000 (8589934528 KB) Busy: 000000003d9fa000 (1009640 KB)

 

-------------------- Type SUMMARY --------------------------

    TotSize (      KB)   Pct(Tots)  Usage

   7ffc25f6000 (8588924888) : 99.99%   : <free>

    7c56000 (  127320) : 00.00%   : MEM_IMAGE

    1efc000 (   31728) : 00.00%   : MEM_MAPPED

   33ea8000 (  850592) : 00.01%   : MEM_PRIVATE

 

-------------------- State SUMMARY --------------------------

    TotSize (      KB)   Pct(Tots)  Usage

   16873000 (  369100) : 00.00%   : MEM_COMMIT

   7ffc25f6000 (8588924888) : 99.99%   : MEM_FREE

   27187000 (  640540) : 00.01%   : MEM_RESERVE

 

Largest free region: Base 000000007fff0000 - Size 00000641a8bf0000 (6717845440 KB)

 

 

System.WeakReference and System.Windows.Dependent[] seems very high.

 

0:004> !dumpheap -stat

total 191433 objects

Statistics:

              MT    Count    TotalSize Class Name

00000642801c8cf0        1           24 System.Collections.Generic.ObjectEqualityComparer`1[[System.Windows.DependencyObject, WindowsBase]]

00000642801c8890        1           24 System.Collections.Generic.ObjectEqualityComparer`1[[System.Windows.Threading.DispatcherTimer, WindowsBase]]

00000642801c7be8        1           24 System.Collections.Generic.GenericArraySortHelper`1[[MS.Internal.Shaping.OpenTypeLayoutCache+GlyphLookupRecord, PresentationCore]]

00000642801c70f8        1           24 System.Collections.Generic.ArraySortHelper`1[[MS.Internal.FontCache.FamilyCollection+PhysicalFace, PresentationCore]]

00000642801c7028        1           24 System.Collections.Generic.ObjectComparer`1[[MS.Internal.FontCache.FamilyCollection+PhysicalFace, PresentationCore]]

.

.

.

.

 

000006422b92a360      127        26416 System.Windows.Data.BindingExpression

000006427842dfb0      413        26432 System.EventHandler

000006422b8f0fb0      299        26760 System.Windows.ChildValueLookup[]

0000064278438880      692        27680 System.RuntimeType

000006422b8d5f78      573        32088 System.Windows.FrameworkPropertyMetadata

000006427843def8      380        33440 System.Collections.Hashtable

00000642801c11c8      860        34400 MemoryLeakTest.Entry

000006422f2e70d0      478        42064 System.Windows.DependencyProperty

000006427843e5e0      200        51200 System.Byte[]

000006427843d6c0      291        77656 System.Int32[]

000006422f2d2388      593       105032 System.Windows.EffectiveValueEntry[]

000006427843e0c0      382       237888 System.Collections.Hashtable+bucket[]

0000064278424390     1965       253016 System.Object[]

00000642784365a0     4711       313408 System.String

000006427842dab8   159901      5116832 System.WeakReference

0000000000174cd0       58     54677432      Free

000006422f2cdc90        2     66066888 System.Windows.Dependent[]

Total 191433 objects

Fragmented blocks larger than 0.5 MB:

            Addr     Size      Followed by

0000000024d81000    1.8MB 0000000024f44cd8 System.Windows.EventRoute

 

 

0:004> !dumpheap -type System.Windows.Dependent[]

         Address               MT     Size

0000000011fc8598 000006422f2cdc90   310584    

00000000151e4ef8 000006422f2cdc90 65756304    

total 2 objects

Statistics:

              MT    Count    TotalSize Class Name

000006422f2cdc90        2     66066888 System.Windows.Dependent[]

Total 2 objects

 

System.Windows.EffectiveValueEntry[] also has some role in the leak which is holding on to System.Windows.Dependent[])

 

0:004> !gcroot 00000000151e4ef8

Note: Roots found on stacks may be false positives. Run "!help gcroot" for

more info.

Scan Thread 0 OSTHread 5df4

RSP:12edd0:Root:0000000001f4c510(System.Windows.Threading.Dispatcher)->

0000000001f75048(System.Windows.Input.InputManager)->

0000000001f75d20(System.Windows.Input.StylusLogic)->

0000000001f75f18(System.Collections.Generic.Dictionary`2[[System.Object, mscorlib],[System.Windows.Input.PenContexts, PresentationCore]])->

0000000001f75f98(System.Collections.Generic.Dictionary`2+Entry[[System.Object, mscorlib],[System.Windows.Input.PenContexts, PresentationCore]][])->

0000000002042838(System.Windows.Interop.HwndSource)->

0000000001f73d78(MemoryLeakTest.Window1)->

0000000001fcea58(System.Windows.Controls.Label)->

0000000001fcaa88(System.Windows.Controls.Grid)->

0000000001fc9e88(System.Windows.Controls.Grid)->

0000000001f83d50(System.Windows.Controls.DockPanel)->

0000000001f832e8(System.Windows.Controls.DockPanel)->

0000000001f83d00(System.Windows.Controls.UIElementCollection)->

0000000001f83d28(System.Windows.Media.VisualCollection)->

0000000001fd1bf0(System.Object[])->

0000000001fcec70(System.Windows.Controls.ListBox)->

0000000001fdef00(System.Windows.EffectiveValueEntry[])->

00000000026200a0(MS.Utility.FrugalMap)->

0000000002081ca0(MS.Utility.ArrayObjectMap)->

0000000002081cc0(MS.Utility.FrugalMapBase+Entry[])->

0000000002081c88(System.Windows.DependentList)->

0000000002081d88(MS.Utility.ArrayItemList`1[[System.Windows.Dependent, WindowsBase]])->

00000000151e4ef8(System.Windows.Dependent[])

Scan Thread 2 OSTHread 575c

Scan Thread 3 OSTHread 6a5c

Scan Thread 5 OSTHread 7d18

 

Also another unrelated issue.

 

 

0:000> !dumpheap -stat

total 26378376 objects

Statistics:

      MT    Count    TotalSize Class Name

7a5ec668        1           12 System.ComponentModel.TypeConverterAttribute

7a5ec5f0        1           12 System.ComponentModel.TypeConverter

7a5ec0d8        1           12 System.ComponentModel.WeakHashtable+WeakKeyComparer

7a5eb880        1           12 System.ComponentModel.DoubleConverter

7a5eb6fc        1           12 System.ComponentModel.Int32Converter

7a5ea2a0        1           12 System.ComponentModel.StringConverter

7a5e93cc        1           12 System.Net.Cache.RequestCachePolicy

7a5e8ab0        1           12 System.Diagnostics.TraceOptions

7a5e28b4        1           12 System.Collections.Specialized.StringDictionary

7a5d61ac        1           12 System.Net.CaseInsensitiveAscii

7a5d5f10        1           12 System.Net.FileWebRequestCreator

79333ed4        1           12 System.Text.DecoderExceptionFallback

79333e90        1           12 System.Text.EncoderExceptionFallback

79331ea4        1           12 System.RuntimeTypeHandle

793316e0        1           12 System.Char

 

.

.

.

 

79332a30    35810       859440 System.Collections.ArrayList

57a0a0e0    54208       867328 System.Windows.WeakEventManager+ListenerList

57a13090    37451       898824 MS.Utility.SingleItemList`1[[System.Windows.Dependent, WindowsBase]]

55ce35ac    46274       925480 System.Windows.InstanceValueKey

55cda004     2947       943040 System.Windows.Controls.ScrollViewer

55ce975c    61024       976384 MS.Internal.Data.WeakDependencySource

55ce3290     8866      1028040 System.Windows.ContainerDependent[]

55ce90a4    35568      1138176 System.Windows.TemplateNameScope

79324338    23579      1226108 System.Collections.Generic.Dictionary`2[[System.Object, mscorlib],[System.Object, mscorlib]]

79330a00    16634      1259588 System.String

7a5ecac4    65189      1303780 System.Collections.Specialized.HybridDictionary

79324510    23575      1414500 System.Collections.Generic.Dictionary`2+Entry[[System.Object, mscorlib],[System.Object, mscorlib]][]

54f5e164    39598      1425528 MS.Utility.ThreeItemList`1[[System.Double, mscorlib]]

55cd6fa4     5897      1462456 System.Windows.Controls.Label

548178f0    16646      1464848 System.Windows.Media.GlyphRun

55cbabf4     5897      1533220 System.Windows.Controls.DockPanel

55ce7340     8855      1700220 System.Windows.PropertyValue[]

55cd1ca8     6939      1720872 System.Windows.Controls.Button

54833b6c    43199      1727960 System.Windows.Media.DoubleCollection

55ccaecc     5893      1744328 System.Windows.Controls.Primitives.ScrollBar

55cd7b4c     6959      1753668 System.Windows.Controls.ListBoxItem

57a0a12c    88932      1778640 MS.Internal.WeakEventTable+EventKey

55cc5b50     9057      1822812 MS.Utility.ItemStructMap`1+Entry[[MS.Utility.ItemStructList`1[[System.Windows.ChildValueLookup, PresentationFramework]], WindowsBase]][]

57a0fb58    77023      1848552 System.Windows.ModifiedValue

55cd7550     5896      1863136 System.Windows.Controls.ListBox

7a5ecb80    68070      1905960 System.Collections.Specialized.ListDictionary

55ce94ec    61025      1952840 MS.Internal.Data.PropertyPathWorker+SourceValueState[]

55cc8cf4    23621      2173132 System.Windows.Data.Binding

54838114    36453      2187180 System.Windows.Media.RenderData

55ce9410    61024      2196864 MS.Internal.Data.ClrBindingWorker

7a5ecc40   110449      2208980 System.Collections.Specialized.ListDictionary+DictionaryNode

55ce4ba0     9910      2695520 System.Windows.Controls.Grid

79333470    36510      2790280 System.Byte[]

79333150    13684      2800200 System.Collections.Hashtable+bucket[]

55ce9490    61025      2929200 MS.Internal.Data.PropertyPathWorker

579eff24    94488      3023616 System.Collections.Specialized.NotifyCollectionChangedEventHandler

55cb86e4    12853      3187544 System.Windows.Controls.Border

79329c6c   121018      3872576 System.EventHandler

55cc4e2c    16835      4175080 System.Windows.Controls.ContentPresenter

55cc5d2c   115754      5093528 System.Windows.ChildValueLookup[]

55cc79f4    15794      5433136 System.Windows.Controls.TextBlock

55ce35f8    61024      6590592 System.Windows.Data.BindingExpression

57a0165c   141842     18767256 System.Windows.EffectiveValueEntry[]

793041d0   378285    143217732 System.Object[]

7932a1b0 11702281    187236496 System.WeakReference

55cfed28 11193761    268650264 System.Windows.DeferredAppResourceReference

579fe0c4     2181    417178832 MS.Internal.WeakEventTable+EventKey[]

]]> Some Multi-threaded terminal server applications crashes in Win 2008 R2 https://docs.microsoft.com/archive/blogs/anandgeorge/some-multi-threaded-terminal-server-applications-crashes-in-win-2008-r2 Mon, 29 Mar 2010 09:20:00 GMT https://blogs.msdn.microsoft.com/anandgeorge/2010/03/29/some-multi-threaded-terminal-server-applications-crashes-in-win-2008-r2/ In Win2008 R2 some Multi-threaded terminal server application may crashes with access violation in the test  eax, eax cpu instruction with following symptoms. This issue is very intermittent.

1.         

2.       You may find following 2 threads,

  • Executing a test instruction and causing AV.
  • Trying to change the protection of exactly same code memory page which the first thread is causing access violation ( Not waiting ).
  • If DEP for the process is turned off application is working fine.

Following are the analysis details,

The stored exception information can be accessed via .ecxr.

(428.b50): Access violation - code c0000005 (first/second chance not available)

eax=00000000 ebx=7740f85c ecx=74e92dd9 edx=00000000 esi=00000000 edi=00000001

eip=741c17cd esp=0018a4dc ebp=0018a508 iopl=0         nv up ei pl nz na pe nc

cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206

mswsock!SockWaitForSingleObject+0x3a:

741c17cd 85c0            test    eax,eax

 

 

0:000> k100

ChildEBP RetAddr 

0018a508 741c678c mswsock!SockWaitForSingleObject+0x3a

0018a5f4 75f04a20 mswsock!WSPSelect+0x3a6

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for DvZediRimac002.dll -

0018a674 4b6f447d ws2_32!select+0x494

WARNING: Stack unwind information not available. Following frames may be wrong.

0018e598 4b6e5a80 ThirdParty!ThirdParty +0xac

0018e6ac 774bfd6e ThirdParty!ThirdParty +0x2fc

0018e698 00000000 ntdll!RtlpValidateHeap+0x20

 

0:000> !analyze -v

*******************************************************************************

*                                                                             *

*                        Exception Analysis                                   *

*                                                                             *

*******************************************************************************

 

Debugger CompCtrlDb Connection::Open failed 80004005

Debugger CompCtrlDb Connection::Open failed 80004005

Debugger CompCtrlDb Connection::Open failed 80004005

Debugger Dbgportaldb Connection::Open failed 80040e4d

Database Dbgportaldb not connected

 

FAULTING_IP:

mswsock!SockWaitForSingleObject+3a

741c17cd 85c0            test    eax,eax

 

EXCEPTION_RECORD:  ffffffff -- (.exr ffffffffffffffff)

ExceptionAddress: 741c17cd (mswsock!SockWaitForSingleObject+0x0000003a)

   ExceptionCode: c0000005 (Access violation)

  ExceptionFlags: 00000000

NumberParameters: 2

   Parameter[0]: 00000008

   Parameter[1]: 741c17cd

Attempt to execute non-executable address 741c17cd

 

PROCESS_NAME:  KAREWE.exe

 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

 

WRITE_ADDRESS:  741c17cd

 

BUGCHECK_STR:  ACCESS_VIOLATION

 

LAST_CONTROL_TRANSFER:  from 741c678c to 741c17cd

 

STACK_TEXT: 

0018a508 741c678c 0000025c 00000264 00000001 mswsock!SockWaitForSingleObject+0x3a

0018a5f4 75f04a20 00000000 0018a6a0 00000000 mswsock!WSPSelect+0x3a6

0018a674 4b6f447d 00000000 0018a6a0 00000000 ws2_32!select+0x494

WARNING: Stack unwind information not available. Following frames may be wrong.

0018e598 4b6e5a80 0018e6fc 00000200 00000001 ThirdParty!ThirdParty +0xac

0018e6ac 774bfd6e 00000000 00000044 00310150 ThirdParty!ThirdParty +0x2fc

0018e698 00000000 02c30ac8 23040027 0000000d ntdll!RtlpValidateHeap+0x20

 

 

STACK_COMMAND:  ~0s; .ecxr ; kb

 

PRIMARY_PROBLEM_CLASS:  SOFTWARE_NX_FAULT_FALSE_POSITIVE

 

DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT_FALSE_POSITIVE

 

FAULTING_THREAD:  00000b50

 

FOLLOWUP_IP:

mswsock!SockWaitForSingleObject+3a

741c17cd 85c0            test    eax,eax

 

SYMBOL_STACK_INDEX:  0

 

FOLLOWUP_NAME:  wsstress

 

MODULE_NAME:  mswsock

 

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bda77

 

SYMBOL_NAME:  mswsock!SockWaitForSingleObject+3a

 

IMAGE_NAME:  mswsock.dll

 

FAILURE_BUCKET_ID:  ACCESS_VIOLATION_mswsock!SockWaitForSingleObject+3a

 

BUCKET_ID:  ACCESS_VIOLATION_mswsock!SockWaitForSingleObject+3a

 

Followup: wsstress

---------

 

 

 

·         The application is failing at

741c17cd 85c0            test    eax,eax

 

due to access violation.

·         I checked if any dll is tampered with

0:000> !for_each_module !chkimg @#ModuleName

 

found that the dll under question(mswsock) is not tampered.

  • Above instruction (test) don't access any memory location other than where EIP points.
  • So for the above instruction to generate an AV, the EIP should point to an address in a non executable page of memory.
  • Again from !address command we can see that this a code region and it is from a mapped dll which should ideally an executable page.

0:000> !address eip

 TEB 7efdd000 in range 7efdb000 7efde000

 TEB 7efda000 in range 7efd8000 7efdb000

 ProcessParametrs 003213f0 in range 00320000 0038f000

 Environment 00320810 in range 00320000 0038f000

    741c0000 : 741c1000 - 00001000

                    Type     01000000 MEM_IMAGE

                    Protect  00000004 PAGE_READWRITE

                    State    00001000 MEM_COMMIT

                    Usage    RegionUsageImage

                    FullPath C:\Windows\System32\mswsock.dll

 

On further debugging I found the following as well, which should be true in at least some cases of execution.

 

Only two threads in the application,

Ø  Executing the test instruction and causing  AV.

Ø  Trying to change the protection of exactly same code memory page which the first thread is causing access violation.

0:000> ~

.  0  Id: 428.b50 Suspend: 1 Teb: 7efdd000 Unfrozen

   1  Id: 428.900 Suspend: 1 Teb: 7efda000 Unfrozen

0:000> ~1s

eax=00000000 ebx=80000000 ecx=00000000 edx=00000000 esi=741c1098 edi=741c0000

eip=7740ffea esp=030afacc ebp=030afb08 iopl=0         nv up ei pl nz na po nc

cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202

ntdll!NtProtectVirtualMemory+0x12:

7740ffea 83c404          add     esp,4

 

0:001> k100

ChildEBP RetAddr  

030afacc 7416aa2c ntdll!NtProtectVirtualMemory+0x12

030afb08 7416ac22 TSAPPCMP!TsRedirectRegisteredImage+0xcf

030afb58 7416af58 TSAPPCMP!TsWalkProcessDlls+0xf5

030afb8c 4b740f0c TSAPPCMP!TLoadLibraryA+0x3a

WARNING: Stack unwind information not available. Following frames may be wrong.

030afbe8 4b73f737 ThirdParty!ThirdParty +0x38a9

030afc84 774236fa ThirdParty!ThirdParty +0x20d4

030afd78 4b6b83c3 ntdll!RtlpFreeHeap+0xb7a

030afde0 774236fa ThirdParty!ThirdParty +0x9b

030afddc 50000063 ntdll!RtlpFreeHeap+0xb7a

030afec4 774236fa 0x50000063

030affd4 77429d45 ntdll!RtlpFreeHeap+0xb7a

030affec 00000000 ntdll!_RtlUserThreadStart+0x1b

 

 

Looking at that stack based on following link and trying to sleuth the parameters, ( NtProtectVirtualMemory has FPO and is written in assembly so normal methods don't work )

 

https://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Memory%20Management/Virtual%20Memory/NtProtectVirtualMemory.html

 

NTSYSAPI

NTSTATUS

NTAPI

NtProtectVirtualMemory(

 

  IN HANDLE               ProcessHandle,

  IN OUT PVOID            *BaseAddress,

  IN OUT PULONG           NumberOfBytesToProtect,

  IN ULONG                NewAccessProtection,

  OUT PULONG              OldAccessProtection );

 

Picking up the function arguments from stack

 

0:001> dds esp

030afacc  7740ffea ntdll!NtProtectVirtualMemory+0x12

030afad0  7416aa2c TSAPPCMP!TsRedirectRegisteredImage+0xcf

030afad4  ffffffff

030afad8  030afafc

030afadc  030afb00

030afae0  00000004

030afae4  030afaf8

030afae8  774f020c ntdll!PebLdr+0xc

030afaec  0038af48

030afaf0  0038be08

030afaf4  00000004

030afaf8  00000020

030afafc  741c1098 mswsock!_imp__NtOpenKey

030afb00  00000004

030afb04  741c0000 mswsock!_imp__OutputDebugStringA <PERF> (mswsock+0x0)

030afb08  030afb58

030afb0c  7416ac22 TSAPPCMP!TsWalkProcessDlls+0xf5

030afb10  741e4818 mswsock!DNSAPI_NULL_THUNK_DATA_DLB+0x8

030afb14  00000000

030afb18  00000001

030afb1c  3c144767

030afb20  00000000

030afb24  4b7a203c DvZediRimac002!CWatchedProxyObj::`vftable'+0x30280

030afb28  00000000

030afb2c  001a0018

030afb30  74162684 TSAPPCMP!`string'

030afb34  030afb54

030afb38  741c00d8 mswsock!_imp__OutputDebugStringA <PERF> (mswsock+0xd8)

030afb3c  0038be08

030afb40  030afb1c

030afb44  00000000

030afb48  030afb7c

 

 

Unassembleing the call to NtProtectVirtualMemory.

 

0:001> ub 7416aa2c L10

TSAPPCMP!TsRedirectRegisteredImage+0xaa [d:\w7rtm\termsrv\tsappcmp\register.c @ 1368]:

7416aa07 59              pop     ecx

7416aa08 59              pop     ecx

7416aa09 e9c2000000      jmp     TSAPPCMP!TsRedirectRegisteredImage+0x173 (7416aad0)

7416aa0e 6a04            push    4

7416aa10 58              pop     eax

7416aa11 8d4df0          lea     ecx,[ebp-10h]

7416aa14 51              push    ecx

7416aa15 50              push    eax

7416aa16 8945f8          mov     dword ptr [ebp-8],eax

7416aa19 8d45f8          lea     eax,[ebp-8]

7416aa1c 50              push    eax

7416aa1d 8d45f4          lea     eax,[ebp-0Ch]

7416aa20 50              push    eax

7416aa21 6aff            push    0FFFFFFFFh

7416aa23 8975f4          mov     dword ptr [ebp-0Ch],esi

7416aa26 ff151c131674    call    dword ptr [TSAPPCMP!_imp__NtProtectVirtualMemory (7416131c)]

 

What address is trying to change the protection.

 

0:001> dc 030afafc

030afafc  741c1098 00000004 741c0000 030afb58  ...t.......tX...

030afb0c  7416ac22 741e4818 00000000 00000001  "..t.H.t........

030afb1c  3c144767 00000000 4b7a203c 00000000  gG.<....< zK....

030afb2c  001a0018 74162684 030afb54 741c00d8  .....&.tT......t

030afb3c  0038be08 030afb1c 00000000 030afb7c  ..8.........|...

030afb4c  7416e80a 4b084bdf 00000000 030afb8c  ...t.K.K........

030afb5c  7416af58 3c1447b3 00000000 4b7a203c  X..t.G.<....< zK

030afb6c  00000000 611a0000 030afb60 7499fa2e  .......a`......t

 

 

Location being changed by NtProtectVirtualMemory.

 

0:001> !address 741c1098

TEB 7efdd000 in range 7efdb000 7efde000

TEB 7efda000 in range 7efd8000 7efdb000

ProcessParametrs 003213f0 in range 00320000 0038f000

Environment 00320810 in range 00320000 0038f000

    741c0000 : 741c1000 - 00001000

                    Type     01000000 MEM_IMAGE

                    Protect  00000004 PAGE_READWRITE

                    State    00001000 MEM_COMMIT

                    Usage    RegionUsageImage

                    FullPath C:\Windows\System32\mswsock.dll

 

Failing EIP in the other thread.

 

0:001> !address 741c17cd

TEB 7efdd000 in range 7efdb000 7efde000

TEB 7efda000 in range 7efd8000 7efdb000

ProcessParametrs 003213f0 in range 00320000 0038f000

Environment 00320810 in range 00320000 0038f000

    741c0000 : 741c1000 - 00001000

                    Type     01000000 MEM_IMAGE

                    Protect  00000004 PAGE_READWRITE

                    State    00001000 MEM_COMMIT

                    Usage    RegionUsageImage

                    FullPath C:\Windows\System32\mswsock.dll

 

 

Conclusion

 

This is an issue in TSAPPCMP.dll

 

Until the fix is release if you happen to run in to this issue following is the solution.

Set the following registry value:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]

to

"IAT"=dword:00000001

 

 

 

]]> C# .net application doing serial communication bug-check Window 2003. https://docs.microsoft.com/archive/blogs/anandgeorge/c-net-application-doing-serial-communication-bug-check-window-2003 Mon, 29 Mar 2010 07:38:00 GMT https://blogs.msdn.microsoft.com/anandgeorge/2010/03/29/c-net-application-doing-serial-communication-bug-check-window-2003/ Ø  An application which is doing intensive serial communication may bug-check( blue Screen) a Windows 2003 Server even with latest update until this date 29 - March - 2010.

Ø  This is potentially a issue in the speed.sys but yet have to confirm.

Ø  As far as I know this issue is extremely rare only happens when you have very high load of serial communication.

 

Following is the analysis details.

 

3: kd> k100

ChildEBP RetAddr 

b89a7a70 ba79d409 nt!KiTrap0E+0x2a7

WARNING: Stack unwind information not available. Following frames may be wrong.

b89a7b20 ba79d2b1 speed+0x2409

b89a7b38 ba79cb61 speed+0x22b1

b89a7bd8 ba79f4b6 speed+0x1b61

b89a7c04 f75785b7 speed+0x44b6

b89a7c18 f75787c6 serenum!Serenum_DispatchPassThrough+0x65

b89a7c3c 80840153 serenum!Serenum_IoCtl+0x72

b89a7c50 8092b51f nt!IofCallDriver+0x45

b89a7c64 8092b454 nt!IopSynchronousServiceTail+0x10b

b89a7d00 8092b574 nt!IopXxxControlFile+0x60f

b89a7d34 80833bef nt!NtDeviceIoControlFile+0x2a

b89a7d34 7c82860c nt!KiFastCallEntry+0xfc

03dbe8f8 00000000 0x7c82860c

 

3: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

 

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0000000c, memory referenced

Arg2: d0000005, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: ba79d409, address which referenced memory

 

Debugging Details:

------------------

 

Debugger CompCtrlDb Connection::Open failed 80004005

Debugger Dbgportaldb Connection::Open failed 80040e4d

Database Dbgportaldb not connected

 

READ_ADDRESS:  0000000c

 

CURRENT_IRQL:  5

 

FAULTING_IP:

speed+2409

ba79d409 8b480c          mov     ecx,dword ptr [eax+0Ch]

 

DEFAULT_BUCKET_ID:  DRIVER_FAULT

 

BUGCHECK_STR:  0xD1

 

PROCESS_NAME:  HYC.TMS4.Securi

 

TRAP_FRAME:  b89a7a70 -- (.trap ffffffffb89a7a70)

ErrCode = 00000000

eax=00000000 ebx=883e78f4 ecx=f7737a05 edx=00000000 esi=8830f0f8 edi=8830f354

eip=ba79d409 esp=b89a7ae4 ebp=b89a7b20 iopl=0         nv up ei pl nz na po nc

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202

speed+0x2409:

ba79d409 8b480c          mov     ecx,dword ptr [eax+0Ch] ds:0023:0000000c=????????

Resetting default scope

 

LAST_CONTROL_TRANSFER:  from ba79d409 to 80836dfd

 

STACK_TEXT: 

b89a7a70 ba79d409 badb0d00 00000000 f7737120 nt!KiTrap0E+0x2a7

WARNING: Stack unwind information not available. Following frames may be wrong.

b89a7b20 ba79d2b1 8830f0f8 86d03a60 8830f0f8 speed+0x2409

b89a7b38 ba79cb61 8830f0f8 86d03960 8830f33c speed+0x22b1

b89a7bd8 ba79f4b6 8830f040 86d03960 8830ebc8 speed+0x1b61

b89a7c04 f75785b7 8830ebc8 86d03960 86d03a60 speed+0x44b6

b89a7c18 f75787c6 8830eb10 00d03960 86d03960 serenum!Serenum_DispatchPassThrough+0x65

b89a7c3c 80840153 8830eb10 00000000 87f88c10 serenum!Serenum_IoCtl+0x72

b89a7c50 8092b51f 86d03a60 86491238 86d03960 nt!IofCallDriver+0x45

b89a7c64 8092b454 8830eb10 86d03960 86491238 nt!IopSynchronousServiceTail+0x10b

b89a7d00 8092b574 00000e1c 00000acc 00000000 nt!IopXxxControlFile+0x60f

b89a7d34 80833bef 00000e1c 00000acc 00000000 nt!NtDeviceIoControlFile+0x2a

b89a7d34 7c82860c 00000e1c 00000acc 00000000 nt!KiFastCallEntry+0xfc

03dbe8f8 00000000 00000000 00000000 00000000 0x7c82860c

 

 

STACK_COMMAND:  kb

 

FOLLOWUP_IP:

speed+2409

ba79d409 8b480c          mov     ecx,dword ptr [eax+0Ch]

 

SYMBOL_STACK_INDEX:  1

 

FOLLOWUP_NAME:  tomgreen

 

MODULE_NAME:  speed

 

DEBUG_FLR_IMAGE_TIMESTAMP:  41388d6e

 

SYMBOL_NAME:  speed+2409

 

IMAGE_NAME:  speed.sys

 

FAILURE_BUCKET_ID:  0xD1_speed+2409

 

BUCKET_ID:  0xD1_speed+2409

 

Followup: tomgreen

---------

 

3: kd> .trap ffffffffb89a7a70

ErrCode = 00000000

eax=00000000 ebx=883e78f4 ecx=f7737a05 edx=00000000 esi=8830f0f8 edi=8830f354

eip=ba79d409 esp=b89a7ae4 ebp=b89a7b20 iopl=0         nv up ei pl nz na po nc

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202

speed+0x2409:

ba79d409 8b480c          mov     ecx,dword ptr [eax+0Ch] ds:0023:0000000c=????????

 

 

 

3: kd> k100

ChildEBP RetAddr 

WARNING: Stack unwind information not available. Following frames may be wrong.

b89a7b20 ba79d2b1 speed+0x2409

b89a7b38 ba79cb61 speed+0x22b1

b89a7bd8 ba79f4b6 speed+0x1b61

b89a7c04 f75785b7 speed+0x44b6

b89a7c18 f75787c6 serenum!Serenum_DispatchPassThrough+0x65

b89a7c3c 80840153 serenum!Serenum_IoCtl+0x72

b89a7c50 8092b51f nt!IofCallDriver+0x45

b89a7c64 8092b454 nt!IopSynchronousServiceTail+0x10b

b89a7d00 8092b574 nt!IopXxxControlFile+0x60f

b89a7d34 80833bef nt!NtDeviceIoControlFile+0x2a

b89a7d34 7c82860c nt!KiFastCallEntry+0xfc

03dbe8f8 00000000 0x7c82860c

 

I would have stopped my analysis with above logs and agreed with !analyze -v if the address trying to access had not been 0000000c because

 

nt!KeSynchronizeExecution

https://msdn.microsoft.com/en-us/library/ms801652.aspx

 

 

Will raised the IRQL to Device IRQL ( 5 here ) to Mask all the interrupt to IRQL such that the function speed!SerialFinishOldWait and ISR ( Interrupt service subroutine ) of that Device are not executed asynchronously. Because ISR as well as speed!SerialFinishOldWait most probably accessing the device registers  ( reading and writing to it ). Also interrupt handle should probably be avoid when programming the device.

 

So the bottom line is when calling speed!SerialFinishOldWait Irql is 5 and no paging and scheduling is enabled. And we will get this bug check if that function try to access any paged locations in the system.

 

But I was not convinced by above points as the address which was trying to access was 0000000c due to following reason.

 

Even if the IRQL was 0 which is passive or user mode it would have caused AV - ( which is page fault in kernel mode ). So I went via the following analysis.

 

 

3: kd> ub eip

speed+0x23e7:

ba79d3e7 8b8664020000    mov     eax,dword ptr [esi+264h]

ba79d3ed 52              push    edx

ba79d3ee c7401c04000000  mov     dword ptr [eax+1Ch],4

ba79d3f5 52              push    edx

ba79d3f6 8d86e8030000    lea     eax,[esi+3E8h]

ba79d3fc 50              push    eax

ba79d3fd ff15cc507aba    call    dword ptr [speed+0xa0cc (ba7a50cc)]

ba79d403 8b865c020000    mov     eax,dword ptr [esi+25Ch]

 

3: kd> !address esi

  82b7e000 - 07c82000                          

          Usage       KernelSpaceUsageNonPagedPool

 

3: kd> !pool esi

Pool page 8830f0f8 region is Nonpaged pool

*8830f000 size:  810 previous size:    0  (Allocated) *Devi (Protected)

              Pooltag Devi : Device objects

 8830f810 size:    8 previous size:  810  (Free)       ....

 8830f818 size:   40 previous size:    8  (Allocated)  WmiR

 8830f858 size:  128 previous size:   40  (Allocated)  Dnod

 8830f980 size:  128 previous size:  128  (Allocated)  Dnod

 8830faa8 size:  128 previous size:  128  (Allocated)  Dnod

 8830fbd0 size:  128 previous size:  128  (Allocated)  Dnod

 8830fcf8 size:  128 previous size:  128  (Allocated)  Dnod

 8830fe20 size:   78 previous size:  128  (Allocated)  SPED

 8830fe98 size:   78 previous size:   78  (Allocated)  SPED

 8830ff10 size:   78 previous size:   78  (Allocated)  SPED

 8830ff88 size:   78 previous size:   78  (Allocated)  SPED

 

3: kd> dc 8830f000

8830f000  0b020000 e9766544 00000000 000000e8  ....Dev.........

8830f010  00000800 00000000 e1003268 00140014  ........h2......

8830f020  e168b388 00000001 00000006 00000000  ..h.............

8830f030  8a7f0ca0 1a200010 00000001 00000000  ...... .........

8830f040  07a00003 00000001 89db34d0 89cefd10  .........4......

8830f050  8830eb10 00000000 00000000 0000304c  ..0.........L0..

8830f060  00000000 00000000 8830f0f8 0000001b  ..........0.....

8830f070  00000004 00000000 00000000 00000000  ................

 

 

3: kd> !devobj 8830f040

Device object (8830f040) is for:

 SPEEDPort0 \Driver\SPEED DriverObject 89db34d0

Current Irp 00000000 RefCount 1 Type 0000001b Flags 0000304c

Dacl e14e9be4 DevExt 8830f0f8 DevObjExt 8830f7e0 DevNode 8830fd00

ExtensionFlags (0000000000) 

AttachedDevice (Upper) 8830eb10 \Driver\serenum

Device queue is not busy.

3: kd> r esi

Last set context:

esi=8830f0f8

 

 

0x8830f0f8 is our ESI and we are interested in offset 25C from

 

ba79d403 8b865c020000    mov     eax,dword ptr [esi+25Ch]

 

To go further we need the symbols for speed.sys which is not available externally. Following is what I found from further analysis with internals symbols for speed.sys.I did a dt on the 8830f0f8 and found the field which is going zero. The field happen to be an associate IRP which is zero and the code is not checking if it is null while accessing it.

 

Now following points worth mentioning.

 

Ø  This is not a IRQL issue.

Ø  Although the IRQL is high null reference is the root cause.

Ø  If the developer of speed.sys is checking this pointer and after that some other thread is modifying it this is a timing issue. But can be in "other thread"

Ø  Otherwise the developer of speed.sys should check the pointer for null before accessing it.

 

To see the other driver loaded at the time of crash

 

 

3: kd> lm

start    end        module name

80800000 80a7e000   nt         (pdb symbols)          F:\SymbolsPub\ntkrnlmp.pdb\36D676FC59054878A16CD63CFEDCD9772\ntkrnlmp.pdb

80a7e000 80aaa000   hal        (pdb symbols)          F:\SymbolsPub\halmacpi.pdb\F799635F9A7C45BDBF439633754B99B61\halmacpi.pdb

b8c90000 b8cbb000   RDPWD      (pdb symbols)          F:\SymbolsPub\RDPWD.pdb\854B8010B0834D189776AF0F9667C6BE1\RDPWD.pdb

b952b000 b954c480   tmcomm     (export symbols)       tmcomm.sys

b981d000 b987b000   srv        (pdb symbols)          F:\SymbolsPub\srv.pdb\36A3BEB1677845B2A1285F64E20035A12\srv.pdb

b987b000 b9898000   mqac       (pdb symbols)          F:\SymbolsPub\mqac.pdb\006191D266F74EA69CCC9A3C35D32BD81\mqac.pdb

b99b0000 b9a00000   HTTP       (pdb symbols)          F:\SymbolsPub\http.pdb\BFE8AB596A714ECFBB54FC7075F4E5EB2\http.pdb

b9a98000 b9aa3000   TDTCP      (pdb symbols)          F:\SymbolsPub\tdtcp.pdb\874BED119EF947B598E9F42A5143A3111\tdtcp.pdb

b9c30000 b9c5f000   RMCAST     (pdb symbols)          F:\SymbolsPub\rmcast.pdb\63DB75FA0168412E962E1BDE6F7C91AC1\rmcast.pdb

b9d7f000 b9d88000   kbdhid     (pdb symbols)          F:\SymbolsPub\kbdhid.pdb\46D80290361D43ABA8DA734886E6A8E31\kbdhid.pdb

b9d8f000 b9d9d000   HIDCLASS   (pdb symbols)          F:\SymbolsPub\hidclass.pdb\90EE77DAAF034BD498E8699CA92F038E1\hidclass.pdb

b9d9f000 b9da8000   hidusb     (pdb symbols)          F:\SymbolsPub\hidusb.pdb\23FA99CBB6804C65AE51E94B1315C34B1\hidusb.pdb

b9e17000 b9e33000   dump_HpCISSs2   (no symbols)          

b9e33000 b9e48000   Cdfs       (pdb symbols)          F:\SymbolsPub\cdfs.pdb\A452AB41FCA143C196ED15B34FFBC9802\cdfs.pdb

b9e48000 b9e59000   Fips       (pdb symbols)          F:\SymbolsPub\fips.pdb\03ABC31C2E494610B7D0BB23716AFD4F2\fips.pdb

b9e59000 b9ecf000   mrxsmb     (pdb symbols)          F:\SymbolsPub\mrxsmb.pdb\A3DFEE39DD064F5B8CA33222BF4AC0B52\mrxsmb.pdb

b9ef7000 b9f27000   rdbss      (pdb symbols)          F:\SymbolsPub\rdbss.pdb\FB1A2E64899146228FFC6BFECCE150742\rdbss.pdb

b9f97000 b9fa1000   Dxapi      (pdb symbols)          F:\SymbolsPub\dxapi.pdb\721396546D2043D2A9DDC6356312CA191\dxapi.pdb

b9fa7000 b9fb1000   dump_diskdump   (pdb symbols)          F:\SymbolsPub\diskdump.pdb\37F6801A2CB6409D8B08EC25EF4EB7F11\diskdump.pdb

b9fc7000 b9ff1000   afd        (pdb symbols)          F:\SymbolsPub\afd.pdb\58290F5DE8594177A0C88B7AD053A8C32\afd.pdb

b9ff1000 ba022000   netbt      (pdb symbols)          F:\SymbolsPub\netbt.pdb\455C06551A2147F5ADA64BFD6208F89B2\netbt.pdb

ba022000 ba0b6000   tcpip      (pdb symbols)          F:\SymbolsPub\tcpip.pdb\FC26191633F5414C99223CC9CD0AD4E32\tcpip.pdb

ba0b6000 ba0cf000   ipsec      (pdb symbols)          F:\SymbolsPub\ipsec.pdb\7EE640C522DD4088841B425FE48823532\ipsec.pdb

ba0ff000 ba106000   dxgthk     (pdb symbols)          F:\SymbolsPub\dxgthk.pdb\4FB4E43B8ABA4A548F650E2495D3BD201\dxgthk.pdb

ba1df000 ba1f4000   usbhub     (pdb symbols)          F:\SymbolsPub\usbhub.pdb\B3158E43948342539C03D8B84230FA921\usbhub.pdb

ba324000 ba383000   update     (pdb symbols)          F:\SymbolsPub\update.pdb\7251883337484E1E92D3F41D533749D52\update.pdb

ba3ab000 ba3e2000   rdpdr      (pdb symbols)          F:\SymbolsPub\rdpdr.pdb\848BC2B36384480CA59D94CD7CDFB0AF1\rdpdr.pdb

ba3e2000 ba438000   wlbs       (pdb symbols)          F:\SymbolsPub\wlbs.pdb\59077440992B41359712B962D79370CF2\wlbs.pdb

ba438000 ba44a000   raspptp    (pdb symbols)          F:\SymbolsPub\raspptp.pdb\4A592EBA851241449D43421574548C4E2\raspptp.pdb

ba44a000 ba463000   ndiswan    (pdb symbols)          F:\SymbolsPub\ndiswan.pdb\4160C938B1CE46B2BA662E25F575E66E2\ndiswan.pdb

ba463000 ba477000   rasl2tp    (pdb symbols)          F:\SymbolsPub\rasl2tp.pdb\48A300C372444C9397750F72BF6BC6152\rasl2tp.pdb

ba477000 ba4b0000   cpqteam    (no symbols)          

ba4b0000 ba4d7000   ks         (pdb symbols)          F:\SymbolsPub\ks.pdb\98407F7F5B8B47549ECDA3C47B16EB0B2\ks.pdb

ba4d7000 ba4eb000   redbook    (pdb symbols)          F:\SymbolsPub\redbook.pdb\458F1549775540A98F797ED48965388A1\redbook.pdb

ba4eb000 ba500000   cdrom      (pdb symbols)          F:\SymbolsPub\cdrom.pdb\6FB9D56F0A8247F1AB68A39F0EDC8FFE1\cdrom.pdb

ba500000 ba515000   serial     (pdb symbols)          F:\SymbolsPub\serial.pdb\2E4EDCACDC754270B075AA7FE795E6A21\serial.pdb

ba578000 ba585000   netbios    (pdb symbols)          F:\SymbolsPub\netbios.pdb\B833FF7890A84BF0BB7CF97E9459552C1\netbios.pdb

ba588000 ba595000   wanarp     (pdb symbols)          F:\SymbolsPub\wanarp.pdb\BD3EDDE433F742FC925ED70B71B78BC81\wanarp.pdb

ba598000 ba5a6000   msgpc      (pdb symbols)          F:\SymbolsPub\msgpc.pdb\14067A1904E94FE0B4A4B31B7FDD68021\msgpc.pdb

ba5a8000 ba5b5000   Npfs       (pdb symbols)          F:\SymbolsPub\npfs.pdb\0EB5780ED0A743A784EA2905F520FFBA1\npfs.pdb

ba5b8000 ba5c3000   Msfs       (pdb symbols)          F:\SymbolsPub\msfs.pdb\0A946EF7249C40FCBDA787C46FC201531\msfs.pdb

ba5c8000 ba5e3600   hpqilo2    (no symbols)          

ba5e4000 ba600000   VIDEOPRT   (pdb symbols)          F:\SymbolsPub\videoprt.pdb\29B14447FED6419C834515565167DDDE1\videoprt.pdb

ba600000 ba75e000   ati2mtag   (no symbols)          

ba75e000 ba788000   USBPORT    (pdb symbols)          F:\SymbolsPub\usbport.pdb\8A87CD9FE4234E4DBABFF30842FD3E761\usbport.pdb

ba788000 ba79b000   bxnd52x    (no symbols)           

ba79b000 ba7ad800   speed      (no symbols)          

ba7ae000 ba7eb000   e1e5132    (no symbols)          

bf800000 bf9d1000   win32k     (pdb symbols)          F:\SymbolsPub\win32k.pdb\73E7CBCC75964FAEB4D0AB689120F9EF2\win32k.pdb

bf9d1000 bf9e8000   dxg        (pdb symbols)          F:\SymbolsPub\dxg.pdb\8A5D0F9CC1F34C4F8D567056B62A271B1\dxg.pdb

bf9e8000 bfa28000   ati2dvag   (no symbols)          

bfa28000 bfa62000   ati2cqag   (export symbols)       ati2cqag.dll

bfa62000 bfa98000   atikvmag   (export symbols)       atikvmag.dll

bffa0000 bffea000   ATMFD    T (no symbols)          

f7109000 f7128000   Mup        (pdb symbols)          F:\SymbolsPub\mup.pdb\D1EB3084BA214384B224969400033F2B2\mup.pdb

f7128000 f7167000   NDIS       (pdb symbols)          F:\SymbolsPub\ndis.pdb\A14D4209157649C29C2B53ACB7C24C122\ndis.pdb

f7167000 f71fc000   Ntfs       (pdb symbols)          F:\SymbolsPub\ntfs.pdb\DF8CD23355324E71824D94ED509B922B2\ntfs.pdb

f71fc000 f726e000   bxvbdx     (no symbols)          

f726e000 f7294000   KSecDD     (pdb symbols)          F:\SymbolsPub\ksecdd.pdb\97DD9A8843E144AF82946CEA0D39912D1\ksecdd.pdb

f7294000 f72b9000   fltmgr     (pdb symbols)          F:\SymbolsPub\fltMgr.pdb\89680A31E23A42F8B81765B0CCF6AC7B1\fltMgr.pdb

f72b9000 f72cc000   CLASSPNP   (pdb symbols)          F:\SymbolsPub\classpnp.pdb\7A500B223916422893BA4BE476B22FE82\classpnp.pdb

f72cc000 f72ea000   storport   (pdb symbols)          F:\SymbolsPub\storport.pdb\C52B0EA7F7574A9AB0D5961C3E61C5021\storport.pdb

f72ea000 f7306000   HpCISSs2   (no symbols)          

f7306000 f7323000   atapi      (pdb symbols)          F:\SymbolsPub\atapi.pdb\D28555240C3F4860B53C1CB1F6FB6BE01\atapi.pdb

f7323000 f734d000   volsnap    (pdb symbols)          F:\SymbolsPub\volsnap.pdb\7DF5DBDD4B744321952CA20C41C092421\volsnap.pdb

f734d000 f7379000   dmio       (pdb symbols)          F:\SymbolsPub\dmio.pdb\FD474E74B14F40AEB147FB0399D67BDB1\dmio.pdb

f7379000 f73a0000   ftdisk     (pdb symbols)          F:\SymbolsPub\ftdisk.pdb\A35F2DA3D87F4FEBAD01015FB3D84FCE1\ftdisk.pdb

f73a0000 f741c000   Wdf01000   (pdb symbols)          F:\SymbolsPub\Wdf01000.pdb\0E5C347DFB5A4B1DB1606D336048C5D11\Wdf01000.pdb

f741c000 f7432000   pci        (pdb symbols)          F:\SymbolsPub\pci.pdb\19C18EEF2357412DA2D507D00DFDBD021\pci.pdb

f7432000 f7466000   ACPI       (pdb symbols)          F:\SymbolsPub\acpi.pdb\FBB7E7F76E2D4337B34F0D037397A1F91\acpi.pdb

f7487000 f7490000   WMILIB     (pdb symbols)          F:\SymbolsPub\wmilib.pdb\12857EA639DF4B4886C59A41723B52101\wmilib.pdb

f7497000 f74a6000   isapnp     (pdb symbols)          F:\SymbolsPub\isapnp.pdb\126F8C9AD41142309A3D9E6E109719CC1\isapnp.pdb

f74a7000 f74b4000   WDFLDR     (pdb symbols)          F:\SymbolsPub\wdfldr.pdb\43C2BA1CD34C49D6BA4C5DDF7582AFDE1\wdfldr.pdb

f74b7000 f74c4000   PCIIDEX    (pdb symbols)          F:\SymbolsPub\pciidex.pdb\70C5240A95584B429B1003B33A658A411\pciidex.pdb

f74c7000 f74d7000   MountMgr   (pdb symbols)          F:\SymbolsPub\mountmgr.pdb\5C581012D23247898DCE1121BB49C9591\mountmgr.pdb

f74d7000 f74e2000   PartMgr    (pdb symbols)          F:\SymbolsPub\partmgr.pdb\553D05ACC6B74F7A96205455C0FDC0612\partmgr.pdb

f74e7000 f74f7000   disk       (pdb symbols)          F:\SymbolsPub\disk.pdb\3DA44D56F4CF49678E6E538BEA9F55311\disk.pdb

f74f7000 f7503000   Dfs        (pdb symbols)          F:\SymbolsPub\dfs.pdb\E9ECFFE65B694263B16AF5284A76B7781\dfs.pdb

f7507000 f7511000   crcdisk    (pdb symbols)          F:\SymbolsPub\crcdisk.pdb\ECA72D45092A44938120B985ED028F501\crcdisk.pdb

f7547000 f7551000   mouclass   (pdb symbols)          F:\SymbolsPub\mouclass.pdb\4B24438EF11E4AA9BAAB1B922FF2BC121\mouclass.pdb

f7557000 f7566000   intelppm   (pdb symbols)          F:\SymbolsPub\intelppm.pdb\1D52238AE4AE49FCBD2A8EAC319ACED61\intelppm.pdb

f7567000 f7575000   NDProxy    (pdb symbols)          F:\SymbolsPub\ndproxy.pdb\77302E5EAF7A49A4B9F73812034D64C71\ndproxy.pdb

f7577000 f7581000   serenum    (pdb symbols)          F:\SymbolsPub\SerEnum.pdb\FE31D81794834D0E849795D9DEBA10301\SerEnum.pdb

f7587000 f7590000   raspti     (pdb symbols)          F:\SymbolsPub\raspti.pdb\C8CA04E9714C4C28B72736651219753C1\raspti.pdb

f7597000 f75a2000   ptilink    (pdb symbols)          F:\SymbolsPub\ptilink.pdb\8C99481FF12B4CE0A314836D0BFDFF541\ptilink.pdb

f75a7000 f75b6000   termdd     (pdb symbols)          F:\SymbolsPub\termdd.pdb\AD7D318B739B4975A1413478D74ADD2F1\termdd.pdb

f75b7000 f75c2000   TDI        (pdb symbols)          F:\SymbolsPub\tdi.pdb\0A6B164853FB4C3CA35A39F06BCF263B1\tdi.pdb

f7607000 f7612000   kbdclass   (pdb symbols)          F:\SymbolsPub\kbdclass.pdb\D89740D4F8B24AC994B9F73E7D52BA2A1\kbdclass.pdb

f7617000 f7623000   vga        (pdb symbols)          F:\SymbolsPub\vga.pdb\AE1F18524D5A4C4091E78CD12096C26B1\vga.pdb

f7637000 f7640000   mssmbios   (pdb symbols)          F:\SymbolsPub\mssmbios.pdb\DD4D360AB16648F8B4985A9734CFA0201\mssmbios.pdb

f7647000 f7650000   ndistapi   (pdb symbols)          F:\SymbolsPub\ndistapi.pdb\6AA8C8C3CC6F44AA95D41F674C66DAE31\ndistapi.pdb

f7667000 f7670000   watchdog   (pdb symbols)          F:\SymbolsPub\watchdog.pdb\7C54E285D9D847918F46360629BD10E11\watchdog.pdb

f76a7000 f76b2000   cpqcidrv   (no symbols)          

f76b7000 f76c6000   raspppoe   (pdb symbols)          F:\SymbolsPub\raspppoe.pdb\0D3511AF68AE4E3EAB560AAB7A5C3B841\raspppoe.pdb

f7707000 f770f000   kdcom      (pdb symbols)          F:\SymbolsPub\kdcom.pdb\D2DF9C86F6194ED680A7DD270076F7281\kdcom.pdb

f770f000 f7717000   BOOTVID    (pdb symbols)          F:\SymbolsPub\bootvid.pdb\8D00A98A20CF4EE0B3609CB593AD6B2B1\bootvid.pdb

f7717000 f771e000   pciide     (pdb symbols)          F:\SymbolsPub\pciide.pdb\432C26B572F0435A9570629D6D2DFC6A1\pciide.pdb

f771f000 f7726000   dmload     (pdb symbols)          F:\SymbolsPub\dmload.pdb\CF29F13A227D435D9215BD7E0064AAE21\dmload.pdb

f773f000 f7745300   HIDPARSE   (pdb symbols)          F:\SymbolsPub\hidparse.pdb\168DA5EBED074018AE53EFEAA44C5D131\hidparse.pdb

f775f000 f7767000   mnmdd      (pdb symbols)          F:\SymbolsPub\mnmdd.pdb\6E7B24987F6544B395CE03910BA9B1331\mnmdd.pdb

f7767000 f776f000   RDPCDD     (pdb symbols)          F:\SymbolsPub\RDPCDD.pdb\EE64C3AA62364E13BD4A32C8A16F8C201\RDPCDD.pdb

f776f000 f7777000   rasacd     (pdb symbols)          F:\SymbolsPub\rasacd.pdb\1B61FBD6F931427DBF2E82BA4D54E9471\rasacd.pdb

f77cf000 f77d6d80   usbccgp    (pdb symbols)          F:\SymbolsPub\usbccgp.pdb\91512AFAB385436892FEBAEBC8D73E161\usbccgp.pdb

f77df000 f77e4180   usbuhci    (pdb symbols)          F:\SymbolsPub\usbuhci.pdb\CA0AA1F5D3404F99BA02B344556720E61\usbuhci.pdb

f77e7000 f77edb80   usbehci    (pdb symbols)          F:\SymbolsPub\usbehci.pdb\02CCADF14C474631AF8FC8DDD63116331\usbehci.pdb

f77ef000 f77f7000   audstub    (pdb symbols)          F:\SymbolsPub\audstub.pdb\92AF0464295942BFAE368894C109C5331\audstub.pdb

f7807000 f780f000   mouhid     (pdb symbols)          F:\SymbolsPub\mouhid.pdb\F24F259F8DA548778D3EBD9BF17C2F711\mouhid.pdb

f780f000 f7817000   Fs_Rec     (pdb symbols)          F:\SymbolsPub\fs_rec.pdb\1190586148B845039CC8B5AA797BFB141\fs_rec.pdb

f7817000 f781e000   Null       (pdb symbols)          F:\SymbolsPub\null.pdb\ADB22E796C7C4B8AAAB67D2320C1A0321\null.pdb

f781f000 f7826000   Beep       (pdb symbols)          F:\SymbolsPub\beep.pdb\414379B62B904661988B3E7E7707F8C41\beep.pdb

f79a3000 f79a4280   swenum     (pdb symbols)          F:\SymbolsPub\swenum.pdb\43D2DC836ED549DDA233FF0D539B5F071\swenum.pdb

f79a5000 f79a6580   USBD       (pdb symbols)          F:\SymbolsPub\usbd.pdb\9F47B9915C294DDF913B6BB2EB77A80E1\usbd.pdb

 

Unloaded modules:

ba548000 ba556000   HIDCLASS.SYS

ba558000 ba561000   hidusb.sys

f7777000 f777f000   usbccgp.sys

ba538000 ba541000   kbdhid.sys

f777f000 f7787000   mouhid.sys

ba515000 ba528000   i8042prt.sys

ba568000 ba576000   imapi.sys

f75d7000 f75e0000   kbdhid.sys

f7807000 f780f000   Sfloppy.SYS

f7697000 f76a1000   Flpydisk.SYS

 

 

]]> Compile a Kernel mode driver in Visual Studio with full intellisense https://docs.microsoft.com/archive/blogs/anandgeorge/compile-a-kernel-mode-driver-in-visual-studio-with-full-intellisense Tue, 22 Sep 2009 11:59:00 GMT https://blogs.msdn.microsoft.com/anandgeorge/2009/09/22/compile-a-kernel-mode-driver-in-visual-studio-with-full-intellisense/ To compile a Kernel mode driver in VS 2005 or similar Visual Studio versions with intellisense, following steps can be useful. I thought this is a 'well known stuff' but I was asked recently by some of my customers a couple of times, so thought of documenting the same although obviously not supported.  

Nothing much but include the correct headers dir in the VC++ Directory. Very straight forward!

Please note the fact that this for compiling and intellisense not for Building.

Again, before steps,

My DDK is installed at

C:\WINDDK\3790_1218

Following code I complied ( never ever build it and load it into your kernel ) from air, just with the help of intellisense.

#define _X86_

#include <wdm.h>

NTSTATUS DriverEntry ( PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath )

{

PKIRQL pkirql = 0;

IoAcquireCancelSpinLock( pkirql );

}

With following warning ( we are not bothered to remove it )

------ Build started: Project: TestDirvCompile, Configuration: Debug Win32 ------

Compiling...

testdrv.c

c:\program files\microsoft visual studio 8\vc\platformsdk\include\basetsd.h(36) : warning C4005: 'POINTER_64' : macro redefinition

c:\winddk\3790_1218\inc\wxp\ntdef.h(137) : see previous definition of 'POINTER_64'

d:\myprojects\driverdev\mytest\anandtestsln\testdirvcompile\testdrv.c(11) : warning C4716: 'DriverEntry' : must return a value

Build log was saved at "file://d:\myProjects\DriverDev\mytest\anandtestsln\TestDirvCompile\Debug\BuildLog.htm"

TestDirvCompile - 0 error(s), 2 warning(s)

========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========

intellisense

Being said that following are the steps.

1. Make sure that in your Tools > options, the required DDK include directories are given as in the following screen shot ( red rectangle). Or similar. If so. You are done!

DirVCPP

2. Make a C++ console application and try to compile some driver code by adding a C file, also test if the intellisense is working.

3. Also take out all the unnecessary Preprocess definitions and pre complied headers.

image

4. If intellisense is not working, close visual studio,  delete the big .ncb files in the solutions folder and restart visual studio.

Note

Tweaking the linker is a bit more involved also I don't recommend the same or even using the obj file you got from the above explained method. Please use DDK build for building your real binaries. The method we discussed is only for development effort leverage.

If you are looking for more automation and sophistication do something like

https://www.osronline.com/article.cfm?article=43

]]>