Debugging kernel mode driver on remote machine

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Drivers
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - SCSI Miniport HwScsiStartIo While reading about StorPort, I found this: In the SCSI Port-miniport driver I/O model, the miniport driver's StartIo routine, HwScsiStartIo, should transmit SCSI request blocks (SRBs) to the hardware as quickly as possible. This is essential, because work done in the miniport driver's StartIo routine is accomplished while interrupts are disabled and at IRQL = DISPATCH_LEVEL. I was not aware that interrupts are disabled in HwScsiStartIo. Is this true? If so, is it documented anywhere? Tag: Debugging kernel mode driver on remote machine Tag: 88389
  - 2
    - Installing signed drivers on Vista I'm trying to install signed drivers on Vista (RC2). I'm using InstallShield 12, but I can't get the DIFxApp (2.01), provided by the Device Wizard in InstallShield or the merge module with DIFx tools, to cleanly install my drivers. In the install log I always get the following error: DIFXAPP: ERROR: DriverPackageGetPath is not yet supported for PnP drivers on LH. This only causes my installation to fail if I attempt to remove the Connect Device to Computer dialog (bit flag = 2). I've also tried calling SetupCopyOemInfA(...) with no success Any help would be greatly appreciated. Thanks, James Tag: Debugging kernel mode driver on remote machine Tag: 88384
  - 3
    - handles owned by a process hi there, I tried to make an aplication that monitors the handle of a process. I used ZwQuerySystemInformation with the SytemHandleInformation class, this returns a vector of Objects in the system associated with a process ID of the process that holds the object. I managed to get the object types easily, object names as well. I just had an issue, how do I get the handles associated with each object(for example u have the object for the current process PEPROCESS cProcess, and you can call ObOpebObjectByPointer() and make a lot of handles associated with that object with different security and different access masks ). I managed to get object handle count, for each object. Or how can I get the handle_table associated with a process, I know there is a function called ObReferenceProcessHandleTable but it is not documented and I cannot import it from ntoskrnl.exe. or NTKERNELAPI PHANDLE_TABLE ExCreateHandleTable ( __in_opt struct _EPROCESS *Process ); but the same problem not documented, nowhere to get it from. If u know other places I can get these function pointers from except ntoskrnl.exe or ntdll.dll please help, or i u have any solutions to this issue; thank you in advance Tag: Debugging kernel mode driver on remote machine Tag: 88370
  - 4
    - How to notify user mode applications from kernel mode drivers Hi, I am trying to create a file system driver with support for live notifications. That is, when ever an application changes any portion of the data in an open file, all other processes that has opened the same file should get notified about the changes. (Similar to directory change notifications, but at a more granular level of files.) It seems all that i need to do is raise a notification in the IOWrite event of my driver. But I could not get how the kernel driver can inform the user mode applications about the changes. Should I have a user mode function that regularily polls the kernel driver for the changes? Or is there any way the user mode applications can "register" for some callback and the kernel driver can invoke the callbacks right from the IOWrite call ? Which way is good/easy to implement? Any guidance is greatly appreciated. Yours, P.Gopalakrishna. Tag: Debugging kernel mode driver on remote machine Tag: 88369
  - 5
    - How to register a custom parse method of my device object ? Hi, I am trying to modify the RamDisk.sys KMDF sample to provide some custom path features for the files. (For example, I should be able to address the second character in the "Hello.txt" file on the RamDisk when I speciffy Z:\Hello.txt\2) I came to know that Object manager takes care of parsing the paths and dispatching the portions to associated devices. But I am not sure how I receive this in my RamDisk code. It seems Object manager would parse upto "z:\" and then would pass the "hello.txt\2" to my RamDisk driver for parsing. Is that right? And which function/event (or IOCTL) is responsible for this? Please provide some information (or sources/links) in this regard. Thanking you, Yours, P.Gopalakrishna. Tag: Debugging kernel mode driver on remote machine Tag: 88365
  - 6
    - When does IRP cancel routines get called? Will not EvtDeviceReleaseHardware() get called if one of the IRPs is not completed? Hi, When I disable my driver, my event callback routines registered with KMDF get invoked. The driver receives IRP_MN_QUERY_REMOVE and once the callback routine processes this IRP and returns (is completed), the cancel routine that my driver registered for IRPs that were received by driver earlier get called for a no. of times. Question: 1. Who calls this cancel routine? Is it some application shipped along with my driver package or the PnP/IO manager takes care of calling cancellation routines for all my IRPs that my driver had not completed earlier? Does PnP/IO manager know that my driver is getting disabled(removed) and hence invokes cancel routines for all the IRPs that was not completed earlier by the driver? Does OS keep track of all these IRPs not completed? Or is the framework? 2. Once these cancel routines are executed, I dont see EvtDeviceReleaseHardware() getting executed. Is my driver EvtDeviceReleaseHardware() not getting executed because the driver did not complete all the IRPs when the cancel routine got called? Is this the reason why disable of driver did not go through throwing out a message: "Hardware settings have changed. System needs to be restarted". Regards, -Praveen Tag: Debugging kernel mode driver on remote machine Tag: 88364
  - 7
    - signability.exe - supress the warning file? Is there a way of stopping signability from opening the results file after successfully running? Ideally it would suppress the results file even when warnings are found, but not when errors are found. I have added signability to an automated build procedure, which checks the inf files for all our products with drivers (about 70 inf files). Each time it runs, it opens a notepad to tell me that the inf file passed with warnings (file ... is not represented by a signed cat file - I haven't signed them yet). Its just a pain to close all these files after the build. -- Using Opera's revolutionary e-mail client: http://www.opera.com/mail/ Tag: Debugging kernel mode driver on remote machine Tag: 88362
  - 8
    - RamDisk depends on FastFat ?? I am working on the RamDisk sample from the latest WDK (KMDF). I was trying to create a file in the ram drive and see the flow of functions therein. I was expecting RamDisk sample to parse the file path and take care of the file creating etc.. However, in reality it turns out that another driver (FastFat.sys) is taking control of the file creation and etc.. functionality, and RamDisk is receiving the calls in asynchronous mode after the FastFat. How is this connection established? I see no code dependency in RamDisk for FastFat. Does this mean all FAT drivers eventaully depend on FastFat.Sys driver?? Or is FastFat.sys a filter driver?? Yours, P.Gopalakrishna. Tag: Debugging kernel mode driver on remote machine Tag: 88361
  - 9
    - A question regarding MTU: how it can effect TCP performance + other queries Hello all, I have created a VPN application, which installs a Virtual NIC (an NDIS miniport driver) in the system. Thus when you connects with the VPN then a virtual NIC appears in the system and all the IP packets (for the VPN network) are then transferred to the Virtual NIC. From my virtual NIC i am transferring the IP packets back to a user lever application (via file interface CrateFile(), ReadFile(), WriteFile()) which then sends all those IP packets to the remote machine (a computer having similar VPN application and VNIC driver running) using a socket connection. I need to do following: 1. I would like to know how changing (increasing and/or decreasing) the MTU of the Virtual NIC could effect the performance of the system. Please feel free to give your thoughts/comments on it. 2. I also like to calculate time to transfer IP packet from my VNIC driver to the user level application. I just like to ask what APIs can I use in the driver to calculate time and then in the user application also to calculate time. I actually am thinking about getting system time using some API in the driver and put that time information in a packet and send that packet to user application. Then user application uses some other API to calculate time when it recieves the packet and then to calculate time difference by subtracting time calculated by the driver from that of user application. But I dont know which specific API should I use in user level application which gives me time in the same format as calculated by some other API in the driver. Please reply, Thanks, Arsalan Tag: Debugging kernel mode driver on remote machine Tag: 88356
  - 10
    - Print monitor and error code 182 (invalid ordinal) Hi, I am writing a printer port monitor in C/C++ and when i want to "register" it with the AddMonitor API function on an english OS, here is the error code i get: Error code 182. The very strange thing is that i can register it on a french OS . I really don't understand why it works fine on a french OS not properly on an english OS. Maybe someone can give me a help. Thanks. Fabrice. Tag: Debugging kernel mode driver on remote machine Tag: 88354
  - 11
    - FYI: TechNet Webcast: Windows Hang and Crash Dump Analysis "TechNet Webcast: Windows Hang and Crash Dump Analysis" by Mark Russinovich http://www.microsoft.com/events/EventDetails.aspx?CMTYSvcSource=MSCOMMedia&Params=~CMTYDataSvcParams^~arg+Name="ID"+Value="1032298076"/^~arg+Name="ProviderID"+Value="A6B43178-497C-4225-BA42-DF595171F04C"/^~arg+Name="lang"+Value="en"/^~arg+Name="cr"+Value="US"/^~sParams^~/sParams^~/CMTYDataSvcParams^ [sorry for the longish link...] Stephan Tag: Debugging kernel mode driver on remote machine Tag: 88353
  - 12
    - Difference of FS filter and mini-filter driver Hi, I am a newbie in this area. Would someone tell me what is the difference between FS filter and mini-filter driver? Thanks. Tag: Debugging kernel mode driver on remote machine Tag: 88344
  - 13
    - enumerate handles hi there, I tried to make an aplication that monitors the handle of a process. I used ZwQuerySystemInformation with the SytemHandleInformation class, this returns a vector of Objects in the system associated with a process ID of the process that holds the object. I managed to get the object types easily, object names as well. I just had an issue, how do I get the handles associated with each object(for example u have the object for the current process PEPROCESS cProcess, and you can call ObOpebObjectByPointer() and make a lot of handles associated with that object with different security and different access masks ). I managed to get object handle count, for each object. Or how can I get the handle_table associated with a process, I know there is a function called ObReferenceProcessHandleTable but it is not documented and I cannot import it from ntoskrnl.exe. or NTKERNELAPI PHANDLE_TABLE ExCreateHandleTable ( __in_opt struct _EPROCESS *Process ); but the same problem not documented, nowhere to get it from. If u know other places I can get these function pointers from except ntoskrnl.exe or ntdll.dll please help, or i u have any solutions to this issue; thank you in advance Tag: Debugging kernel mode driver on remote machine Tag: 88328
  - 14
    - enumerate handles hi there, I tried to make an aplication that monitors the handle of a process. I used ZwQuerySystemInformation with the SytemHandleInformation class, this returns a vector of Objects in the system associated with a process ID of the process that holds the object. I managed to get the object types easily, object names as well. I just had an issue, how do I get the handles associated with each object(for example u have the object for the current process PEPROCESS cProcess, and you can call ObOpebObjectByPointer() and make a lot of handles associated with that object with different security and different access masks ). I managed to get object handle count, for each object. Or how can I get the handle_table associated with a process, I know there is a function called ObReferenceProcessHandleTable but it is not documented and I cannot import it from ntoskrnl.exe. or NTKERNELAPI PHANDLE_TABLE ExCreateHandleTable ( __in_opt struct _EPROCESS *Process ); but the same problem not documented, nowhere to get it from. If u know other places I can get these function pointers from except ntoskrnl.exe or ntdll.dll please help, or i u have any solutions to this issue; thank you in advance Tag: Debugging kernel mode driver on remote machine Tag: 88327
  - 15
    - finding hidden devices i'm trying to figure out how i can programatically determine if a network adapter is hidden. i've tried finding a wmi property and using SPDRP_CHARACTERISTICS with no luck. any other suggestions? thanks Tag: Debugging kernel mode driver on remote machine Tag: 88326
  - 16
    - Can File Ssystem filter driver be implemented using UMDF? Hi, I am a newbee in this this area. I found the release of User Mode Driver Framework seem interesting for driver development. I wonder if it is possible to develop a filter driver for File System using the user mode framework. Thanks in advance. Tag: Debugging kernel mode driver on remote machine Tag: 88315
  - 17
    - Installing driver without hardware Hi, As part of a larger installation, I would like to install driver software for PCMCIA hardware that will be attached at a later time. When the hardware is attached, the user should see no wizard of any type. That is, the sorftware to operate the device should be either fully installed during the initial installation, or any additional steps should be invisible to the person using the device. Suggestions on the best way to do this would be greatly appreciated! Jim Tag: Debugging kernel mode driver on remote machine Tag: 88310
  - 18
    - Problems with installation of NDISUIO-based protocol driver Hello, We've succesfully developed a protocol driver based on MS DDK sample NDISUIO and are installing it using the Service Manager API on Win2K/XP. Most of the time everything goes fine, but occasionally, on machines were previous installations went OK, we observe the following: installation seem to complete correctly, but the TCP/IP stack somehow looks unbound from some lower level layer, probably tcpip --for instance DCHP is not able to resolve an IP address and the IP interfaces show a no or limited connectivity status message. When this happens, uninstallaing, doing the installation again and rebooting usually get things straight again. Does this ring a bell to anybody? I can provide more info on demand. Thanks for any information/help. Best regards, Tag: Debugging kernel mode driver on remote machine Tag: 88309
  - 19
    - WIA Scanner Minidriver - Preview Not Working I've written a WIA minidriver and I cannot get the preview button to work. When I click the preview button (on the standard UI) I get a message that start, "An error occurred during preview. If the scanner is being used..." I'm not currently using the scanner and I believe I've defined WIA_DPS_PREVIEW correctly, but in my logs I don't see the driver trying to scan at all when I click preview. Does anyone have any idea why this might be? Thanks in advance, Mike Tag: Debugging kernel mode driver on remote machine Tag: 88307
  - 20
    - Problem with compilation I am using the fpfilter ddk sample. I want to compile this sample. When I type build all works fine. Then, if I type build a 2nd time I have warning messages. I don't understand why the warnings don't appear on the 1st compilation as I have not changed anything in the project files. Here is the output from the build command: C:\NTDDK>cd .. C:\>cd fpfilter C:\fpfilter>build BUILD: Object root set to: ==> objchk BUILD: /i switch ignored BUILD: Compile and Link for i386 BUILD: Loading c:\NTDDK\build.dat... BUILD: Computing Include file dependencies: BUILD: Examining c:\fpfilter directory for files to compile. c:\fpfilter - 2 source files (1,122 lines) BUILD: Saving c:\NTDDK\build.dat... BUILD: Compiling c:\fpfilter directory Compiling - fpfilter.rc for i386 Compiling - fpfilter.c for i386 BUILD: Linking c:\fpfilter directory Linking Executable - objchk\i386\fpfilter.sys for i386 BUILD: Done 2 files compiled 1 executable built C:\fpfilter>build BUILD: Object root set to: ==> objchk BUILD: /i switch ignored BUILD: Compile and Link for i386 BUILD: Loading c:\NTDDK\build.dat... BUILD: Computing Include file dependencies: BUILD: Examining c:\fpfilter directory for files to compile. BUILD: c:\fpfilter\fpfilter.rc: c:\ntddk\inc\winbase.h: cannot find include file <macwin32.h> BUILD: c:\fpfilter\fpfilter.rc: c:\ntddk\inc\wingdi.h: cannot find include file <macwin32.h> BUILD: c:\fpfilter\fpfilter.rc: c:\ntddk\inc\winuser.h: cannot find include file <macwin32.h> BUILD: c:\fpfilter\fpfilter.rc: c:\ntddk\inc\winnls.h: cannot find include file <macwin32.h> BUILD: c:\fpfilter\fpfilter.rc: c:\ntddk\inc\winreg.h: cannot find include file <macwin32.h> BUILD: c:\fpfilter\fpfilter.rc: c:\ntddk\inc\mmsystem.h: cannot find include fil e <macwin32.h> BUILD: Linking c:\fpfilter directory BUILD: Done Tag: Debugging kernel mode driver on remote machine Tag: 88303
  - 21
    - DIFx: DriverPackageInstall for non-PnP devices? Hi, is it possible to install a non-PnP device with the DriverPackageInstall function or with DPInst.exe? I have a W2k driver for a non-PnP device that must be installed with the Add New Hardware Wizard (until now) and I like to automate the installation with a setup.exe or DPInst.exe. DriverPackageInstall / DPInst.exe installs my driver files in the DRVSTORE but the device will not be installed. Below, you will find the begin of my inf file and the DPINST.LOG output. Any idea? Thanks in advance! :)Dieter pci_f14_mon.inf ------------------ [Version] Signature="$Windows NT$" Class="BBIS boards" ClassGUID={A729BECD-2979-48f3-AA9F-7E0B96A0A98C} Provider=%MEN% DriverVer = 11/02/2006,1.4.0.0 [SourceDisksNames.x86] 1=MEN 13m00006 - MDIS System Package for Windows,"",, [SourceDisksFiles.x86] men_qt-mt.dll=1 men_mdis_clinst.dll=1 men_evlg.dll=1 men_pci.sys=1 [DestinationDirs] DefaultDestDir=12 ClassInst_Files=11 ;; ;; Class installation section ;; [ClassInstall32.ntx86] AddReg=AddClassReg CopyFiles=ClassInst_Files [AddClassReg] HKR,,,,"BBIS boards" HKR,,Icon,,101 HKR,,Installer32,,"men_mdis_clinst.dll,BbisClassInstaller" [ClassInst_Files] men_qt-mt.dll,,,%COPYFLG% men_mdis_clinst.dll,,,%COPYFLG% men_evlg.dll,,,%COPYFLG% ;; ;; Device list ;; [Manufacturer] %MEN%=MEN [MEN] "PCI - ICH6/7 LPC on MEN F14/F15/F17/D601 CPU (required for F14_MON)"=*PCI*,root\men_pci ;; ;; *PCI* sections ;; [*PCI*] ... DPINST.LOG -------------- INFO: **************************************** INFO: Current working directory: 'V:\TEST\DPInst\PCI_F14_MON' INFO: Running on path 'V:\TEST\DPInst\PCI_F14_MON' INFO: DPInst.xml does not list the current UI language. INFO: User UI Language is 0x409. INFO: Install option set: legacy mode on. INFO: Found driver package: 'V:\TEST\DPInst\PCI_F14_MON\pci_f14_mon.inf'. INFO: Preinstalling 'v:\test\dpinst\pci_f14_mon\pci_f14_mon.inf' ... INFO: ENTER: DriverPackagePreinstallW SUCCESS:v:\test\dpinst\pci_f14_mon\pci_f14_mon.inf is preinstalled. INFO: RETURN: DriverPackagePreinstallW (0xB7) INFO: ENTER: DriverPackageGetPathW SUCCESS:Found driver store entry. INFO: RETURN: DriverPackageGetPathW (0x0) INFO: ENTER: DriverPackageInstallW INFO: Installing INF file "D:\WINDOWS\system32\DRVSTORE\pci_f14_mo_7EC8FD667D6017CA2525C7A69712478741E71D7B\pci_f14_mon.inf" of Type 6. INFO: Looking for Model Section [MEN]... INFO: No matching devices found in INF "D:\WINDOWS\system32\DRVSTORE\pci_f14_mo_7EC8FD667D6017CA2525C7A69712478741E71D7B\pci_f14_mon.inf" on the Machine. INFO: No drivers installed. No devices found that match driver(s) contained in 'D:\WINDOWS\system32\DRVSTORE\pci_f14_mo_7EC8FD667D6017CA2525C7A69712478741E71D7B\pci_f14_mon.inf'. SUCCESS:Installation completed with code 0xE000020B. INFO: RETURN: DriverPackageInstallW (0xE000020B) INFO: No matching device was found for 'v:\test\dpinst\pci_f14_mon\pci_f14_mon.inf'. Driver will be installed when plugged in. INFO: Returning with code 0x100 INFO: 10/01/2006 01:37:34 ------------------- Tag: Debugging kernel mode driver on remote machine Tag: 88296
  - 22
    - Problem With - KSPROPERTY_DROPPEDFRAMES_CURRENT!!! & AmCap Hello, I have developed Avstream minidriver for camera device having a video capture pin. I have implemented PROPSETID_VIDCAP_DROPPEDFRAMES property for pin and in the handler i am returning all values properly. But i have some issues regarding it, 1) when tried driver with amcap application it dint show any kind of status of captured and dropped frame. 2) When i tried debugging , though it got IID_IAMDroppedFrames interface its failing at hr = gcap.pDF->GetNumDropped(&lDropped); 3) When i checked Driver log my handler is called too. but still amcap is not able to display the capture and drop information returned to it. 4) Captured file is playing properly, but when amcap is capturing , preview window goes blank no video is being previewed during capturing to file. Please help me . Thanks & Rgds, Darshan Tag: Debugging kernel mode driver on remote machine Tag: 88295
  - 23
    - How to set MTU for a virtual ethernet NIC driver Hi all, I have a miniport adapter (Virtual NIC) driver. Can anyone tell me how can I change its MTU? Thanks, Arsalan Tag: Debugging kernel mode driver on remote machine Tag: 88294
  - 24
    - Hyperthread issue Hi , I have developed a virutal ethernet driver which runs on a pci card. This works fine on a single cpu machine(celeron) with windows XPE. when i want the same to work on the hyperthread machine (p4) with windows XPE, i am facing a problem. Send handler running in the Dispatch level, is called for the second time by the same cpu(say cpu 1), even before the first call gets completed. The send handler holds a spinlock within that is sends the acknowledgements to the application. During the 2nd call, when the cpu tries to acquire the spinlock, the system hangs. Please let me know whether the above phenomenon is proper and how to avoid this race condition. Regards, Kans. Tag: Debugging kernel mode driver on remote machine Tag: 88293
  - 25
    - Using DIFxApp with Visual Studio 2005 Can you use DIFxApp merge modules with Visual Studio 2005? I added DIFxApp.msm to my existing setup project. What I would like to do now is add a driver package to the setup project. But I can't figure out what to do to achieve this. The msm has mininal properties and I can't find any GUI for adding a driver package. I see a lot of references to database tables and orca but they don't seem to have a parallel in VS2005. Any help appreciated. Tag: Debugging kernel mode driver on remote machine Tag: 88291
- Next
  - 1
    - NDIS mini-port and an application power management cooperation Hi All, The issue has been already discussed in a few forums. However, I would like to raise another aspect - can a "friendly" application be used in cooperation with NDIS mini-port driver to detect and to initiate the device low power setting. We have encountered the same problem with NDIS mini-port limitations - low power setting while a device idle (no activity). But in our situation we provide both an application and NDIS mini-port driver SW packages. Thus, my question is: Can we involve our application SW in order to initiate the NDIS mini-port driver low power setting? For example, Vista allows DeviceControl (even proprietary ones) IOCTLs communication between an application and device driver. Can such mechanism be used in order to initiate a device low power transition (e.g USB selective suspend) while the device detects idle conditions? Thanks in advance, Avi Tag: Debugging kernel mode driver on remote machine Tag: 88285
  - 2
    - Calling ReadRegistryParams() and NdisOpenConfiguration() from MiniportInitialise() causes system instability. I have seen various BSODs unrelated to my driver that I have tracked down to a combination of these function calls at initialise time. Are there any known issues regarding this? Thanks in advance. Tag: Debugging kernel mode driver on remote machine Tag: 88282
  - 3
    - use toaster sample to simulate USB device enumeration I am studying the toaster on bus behavior. Now I want to know can I use this sample to simulate USB device plugin/unplug. 1. can I use 'enum' console application to send the IOCTL to tell the busenum driver that a new USB device is plugged in? Do I need to modify the code of it? 2. what do I need to modify the busenum driver code to tell PnP manager that a USB device is attached? Any comment is appreaciated. Tag: Debugging kernel mode driver on remote machine Tag: 88281
  - 4
    - (null) For the past 30 years or so, when seeing the word "(null)" (without the quotes but with the parentheses) output in the middle of an otherwise sensible output string, it has commonly been due to passing a null pointer to printf or similar API. My understanding is that this started with BSD Unix, maybe when someone decided that some abuses of null pointers were less important than others so they made printf display (null) instead of segfaulting, or maybe a coder of printf internals forgot that segfaulting would be a good thing to do, at least during debugging stages. Does a Windows XP API (maybe a native API) do the same thing? Or is it just coincidence? Does the boot-time version of the CHKDSK command pass a null pointer to an API where a non-null pointer is required? Or is it just a coincidence? Maybe the boot-time version of the CHKDSK command intentionally outputs the word (null) to give geeks a scare but maybe it's mostly harmless? It was really really comforting to see Windows XP boot after displaying the following on a blue background: Windows replaced bad clusters in file \pagefile.sys of name (null). Windows replaced bad clusters in file \WINDOWS\MEMORY.DMP of name (null). It was really really comforting to see Windows boot after that, and operate without any apparent ill effects. It was really really comforting to see Windows XP robustly survive some strongly suspicious evidence that low-level internals are passing null pointers around where non-null pointers are required. But maybe it was just a coincidence? Or by design? Windows XP internals don't really pass null pointers around where non-null pointers are required, right? They surely wouldn't pass such things to printf, they surely wouldn't pass such things to memcpy, they surely wouldn't write such things into memory descriptors in RAM or file descriptors on disk or anything else like that, right? They've all been verified, right? Tag: Debugging kernel mode driver on remote machine Tag: 88271
  - 5
    - Please example of RtlStringCbVPrintfA...! Hi. I try to use RtlStringCbVPrintfA funciton. my code: RtlStringCbVPrintfA(pszBUFF, nPathSize, "%s\\%s", szVolume, szFolder); But the code is 'too many parameter'. So I made next code: void printfA(PCHAR szDest, int nDestSize, PCHAR Format, ...) { va_list va; NTSTATUS status; va_start(va, Format); status = RtlStringCbVPrintfA(szDest, nDestSize, Format, va); va_end(va); } But the code doesn't work also. How do I use the function? Tag: Debugging kernel mode driver on remote machine Tag: 88269
  - 6
    - Please example of RtlStringCbVPrintfA...! Hi. I try to use RtlStringCbVPrintfA funciton. my code: RtlStringCbVPrintfA(pszBUFF, nPathSize, "%s\\%s", szVolume, szFolder); But the code is 'too many parameter'. So I made next code: void printfA(PCHAR szDest, int nDestSize, PCHAR Format, ...) { va_list va; NTSTATUS status; va_start(va, Format); status = RtlStringCbVPrintfA(szDest, nDestSize, Format, va); va_end(va); } But the code doesn't work also. How do I use the function? Tag: Debugging kernel mode driver on remote machine Tag: 88268
  - 7
    - Please example of RtlStringCbVPrintfA...! Hi. I try to use RtlStringCbVPrintfA funciton. my code: RtlStringCbVPrintfA(pszBUFF, nPathSize, "%s\\%s", szVolume, szFolder); But the code is 'too many parameter'. So I made next code: void printfA(PCHAR szDest, int nDestSize, PCHAR Format, ...) { va_list va; NTSTATUS status; va_start(va, Format); status = RtlStringCbVPrintfA(szDest, nDestSize, Format, va); va_end(va); } But the code doesn't work also. How do I use the function? Tag: Debugging kernel mode driver on remote machine Tag: 88267
  - 8
    - Vista 5840 and Int 2C Hi! The OS is triggering this assert while my driver is executing its interrupt handler. I suspect that the OS is hitting the assert because we may be within DPC for too long. However, how can I find out the root cause for this assert? Thanks! Tag: Debugging kernel mode driver on remote machine Tag: 88264
  - 9
    - Does WDK include IFS? cannot find ntifs.h Hi. I have to port a Filter Driver to Vista. The Driver is working well in 2k, XP, 2k3 and i've used IFS for developing it. I read some articles that indicates WDK insludes IFS KIT, then I'd downloaded WDK beta.(WDK RTM build 6000.16386) But I can't find 'ntifs.h' in WDK (or WinDDK directory). I used #include ntifs.h in old source, i'm facing a huge wall. Should i 'modify all' my source to work well without ntifs.h? or Use IFS Kit for Windows Server 2003 SP1 with WDK? Please help. Regards Atdda Tag: Debugging kernel mode driver on remote machine Tag: 88263
  - 10
    - filtering ipnat.sys Has anyone tried to filter ipnat.sys? I have a machine that is using internet connection sharing and I have an NDIS IM driver monitoring the public interface. My IM driver sees NAT'd addresses and I need to associate these addresses to the original addresses. I've seen some stuff on the net about a user mode API which you can use to query the NAT table that ipnat.sys maintains, but I want to do this in kernel mode - perhaps by filtering the interface between tcpip.sys and ipnat.sys. Perhaps I can use a TDI driver to do this, or perhaps I can get my IM driver to send IOCTRL's directly to ipnat.sys to query the NAT table. Any suggestions? Tag: Debugging kernel mode driver on remote machine Tag: 88262
  - 11
    - Questions about Windows Installer, DIFX and non-device drivers Hi, I am using Wise for Windows Installer for creating an msi package that will install 32-bit non-device minifilter drivers plus the end user app. The driver package consists of three .SYS files, one INF and one CAT file. All of the drivers will be signed with the Authenticode (not WHQL). I am using the latest version of DIFxApp.msm. I have configured my test system (XP) to run in a debug mode, so I can avoid the problems related to signature validation. So far I have been unable to successfully install using the DIFx tools. I have examined the INF using chkinf.bat and fixed all of the errors. This INF works fine when I use right-click menu option "Install". The Setupapi.log shows only warnings related to drivers' signatures, but everything else gets installed. When I use the same INF with the msi and DIFx, the install fails with the msg in the log: "Could not get services associated with driver package". there is no problem with starting the services when I use right-click menu option "Install". 1. Can I use one INF file for all the three signed drivers? "The Requirements for Driver Packages That Are Used with the DIFx Tools" MS doc reads: "Each signed driver package INF must have its own catalog file, which contains the signature for the driver package. The DIFx tools do not support catalog files that contain signatures for more one driver package". Does it mean that I need to have three separate INFs and corresponding catalog files? That would be strange since a single INF works with the setupapi. 2. DDK docs state explicitly that CatalogFile entry in the Version section of the INF file is "for signed antivirus minifilters, this entry contains the name of a WHQL-supplied catalog file. All other minifilters should leave this entry blank. For more information, see the description of the CatalogFile entry in INF Version Section". When I use DIFxApp.msm, the install will fail if there is no CatalogFile entry and there is nothing in the documentation that would suggest this entry is optional. So, I have assumed that when using DIFx tools I must use catalog files even when installing minifilter drivers. Is that correct? 3. The DriverPackageType in the [Version] section is listed as "FileSystemMinifilter". The latest version of the DIFx tools lists only two types: ClassFilter and PlugAndPlay. Should I change that entry to ClassFilter or is it backwards compatible. I recall seeing a post somewhere stating that using FileSystemMinifilter is OK. 4. I came across a post stating: "The issue is if you talk with the DIFx guys they will tell you that non-device drivers are not supported with DIFx. If it works be happy and continue to use it but if you have issues they won't do anything about it right now. Hopefully we will get this resolved (and supported) soon". Does this statement apply to Vista only or DIFx tools in general? What are my options in a situation where I need to use Windows Installer technology to install drivers with the application. My understanding is that there is no other other built-in support for installing drivers using Windows Installer than DIFx. If DIFx does not support non-device drivers it leaves me with no alternative. What am I supposed to do to install in a supported way non-device drivers using Windows Installer technology? I would appreciate your advice. Thanks, Jack Tag: Debugging kernel mode driver on remote machine Tag: 88258
  - 12
    - Help-Mux virtual miniport dirver showed as Disabled. Hi all, When I install Mux driver, the virtual miniport always showed up as Disabled. When I do right click to Eanbled and it said "Connection Failed." Yes, NdisImInitializeDeviceInstanceEx get called twice in PtBindAdapter and PtPnpNetEventReconfigure(by callling NdisReEnumerateProtocolBindings). I used DDk debuger but it still doesn't help, any suggestion? Sorry, I have to reposted again because someone used my last thread as a test page and I don't get any more responds after that. thanks, Tag: Debugging kernel mode driver on remote machine Tag: 88255
  - 13
    - Q: Are there multiple 'Plug and Play' drivers that I can try for my monitor? Someone jsut gave me a AXESS EP718 17" LCD and it works, but the picture is all pixelly. I have a feeling that it's just about toast, but I'm wonding if it could be a driver issue. I don't have the software that came with it, so I was wondering if there were different versions of XP's 'plug and Play' driver that I could try, to see it it makes any difference. Any other thoughts or ideas? Nice to have a monitor that doesn't take up half my desk, but I don't know how much longer I can look at it. It seems to be constantly changing; sometimes the brightness fades a bit, colour changes a touch or (like just now) the screen vibrates for a second. Any help would be greatly appreciated. (now the grey is gold; ok, now its grey again). Tag: Debugging kernel mode driver on remote machine Tag: 88254
  - 14
    - RtlInitUnicodeString and RtlFreeUnicodeString conventions For an uninitialized UNICODE_STRING, is it necessary to call RtlInitUnicodeString before calling a function like RtlStringFromGUID (or do functions like that unconditionally overwrite the previous contents of the structure)? For an initialized UNICODE_STRING, is it necessary to call RtlFreeUnicodeString before calling a function like RtlStringFromGUID (or do functions like that attempt to free the previously allocated buffer before overwriting the structure)? (Basically, are the conventions for UNICODE_STRING's and ANSI_STRING's similar to the conventions for BSTR's in COM?) Tag: Debugging kernel mode driver on remote machine Tag: 88249
  - 15
    - Problem with synchronous ReadFile() calls inside the NDIS miniport driver & some strange behaviour...please help URGENT Hello all, I am developing a NDIS miniport driver which also exposes a file interface (for CreateFile(), ReadFile(), WriteFile() etc).I created this file interface inside the MiniportInitialize() function using NdisMRegisterDevice() API. There are few problems which I am getting as follows: 1. If I try to assign different dispatch entry point functions then my driver is breaking the system (I am getting blue screen). The only way to avoid this I found is to use the same function for all the IRP dispatche entry points like below: DispatchTable[IRP_MJ_CREATE] = MyDeviceHook; DispatchTable[IRP_MJ_CLOSE] = MyDeviceHook; DispatchTable[IRP_MJ_READ] = MyDeviceHook; DispatchTable[IRP_MJ_WRITE] = MyDeviceHook; DispatchTable[IRP_MJ_DEVICE_CONTROL] = MyDeviceHook; DispatchTable[IRP_MJ_CLEANUP] = MyDeviceHook; NdisInitUnicodeString(&DeviceName, NT_DEVICE_NAME); NdisInitUnicodeString(&DosDeviceName, DOS_DEVICE_NAME); Status = NdisMRegisterDevice(g_NdisWrapperHandle, &DeviceName,&DosDeviceName,&DispatchTable[0],&tapDevice->devObj,&tapDevice->handle); and then use switch cases inside the MyDeviceHook() function for pIrpSp->MajorFunction to direct to particular function for handling read, write, close etc. My question is why I am unable to specify different dispatch entry point functions here? Is it something wrong with NDisMRegisterDevice() API. DDK documentation says that I should use as many different dispatch entry point functions for my different IRP_MJ_XXX codes handle by the driver. 2. Secondly I am using Cancel-Safe Irp (not Ex version) mechanism to pend read Irps until data is available from the other end of my Ndis miniport (i am transferring TCP/IP packets to my the user application via ReadFile()). However, when a read Irp is pending and I call CloseHandle() from my user application to close the handle, I expect that Close Irp will be called but it never get called and my application hangs. Please tell me why is it happening like that? I am using WinDDK (2600~1.110) on my Windows XP machine. Please reply soon as I am meeting deadlines. Thanks, Arsalan Tag: Debugging kernel mode driver on remote machine Tag: 88244
  - 16
    - RNDIS drivers don't support IAD ? I have a USB composite device and one of the subdevice is RNDIS. By monitoring the debug traces with checked build of usb8023.sys and rndismp.sys, I found windows RNDIS driver cannot find the pipes (bulk endpoints and interrupt endpoint) it needs. The USB configuration descriptors use IAD (Interface Association Descriptor) to indicate the group of interfaces by each device. While I modify the USB configuration device on my USB device, it is working fine as ususal. I am speculating the existing RNDIS drivers could not deal with IAD correctly. Anyone in MS can confirm this ? If this is the case, how to approach MS to fix this problem to make it support USB composite device and IAD correctly ? -Gary Tag: Debugging kernel mode driver on remote machine Tag: 88242
  - 17
    - How to send IOCTLs to a filter driver KB uses wrong mutex? The microsoft KB on "How to send IOCTLs to a filter driver" http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q262305 uses a FastMutex to synchronize creation and deletion of control objects. The documentation for ExAcquireFastMutexUnsafe says: ExAcquireFastMutexUnsafe can be safely called only at IRQL = APC_LEVEL. Even if you were to use ExAcquireFastMutex, it sets the IRQL to APC_LEVEL. However, in the MS example, FilterCreateControlObject calls IoCreateSymbolicLink after calling ExAcquireFastMutexUnsafe and the documentation for IoCreateSymbolicLink says: Callers of IoCreateSymbolicLink must be running at IRQL = PASSIVE_LEVEL So is this a bug? Or did I miss some documentation where this is ok? I've run the code and it didn't crash, but according to the documentation, this isn't right. Gabe Tag: Debugging kernel mode driver on remote machine Tag: 88239
  - 18
    - CD/DVD read only - lower filter driver question Hi all, I have implemented a filter driver below CdRom and above StoragePort (atapi in my test case) as a lower filter to CdRom. I see all the traffic and specifially GET_CONFIGURATION resp READ_DISC_INFORMATION opcodes depending on the drive. My questions: To say that the disk is not writable, is it enough to patch the - CurrentProfile in the GET_CONFIGURATION response or - the Erasable bit and Disc Status in the READ_DISC_INFORMATION response I would tend to do the patch work in the respective completion routine and thus take the srb->DataBuffer and amend the buffer data appropriately. Is this the right way / place to do it? Could the SRB's DataBuffer be accessed directly or is it an MDL? Tag: Debugging kernel mode driver on remote machine Tag: 88235
  - 19
    - Multiple Report ID Problem Hi All, I have a HID keyboard application. I have single interface with one IN endpoint EP1(IN) for keyboard and one OUT endpoint EP2(OUT) for recieving data from the PC software. I have modified the existing report descriptor with addition of a vendor defined collection for output report descriptor as follows. DESCRIPTOR MyRepDesc[L_F_KBD_REP] PROGMEM = { // bootable keyboard report 0x05, 0x01, // Usage Page (Generic Desktop) 0x09, 0x06, // Usage (Keyboard) 0xA1, 0x01, // Collection (Application) 0x05, 0x07, // Usage Page (Key Codes) 0x19, 0xE0, // Usage Min (E0h = 224d) 0x29, 0xE7, // Usage Max (E7h = 231d) 0x15, 0x00, // Logical Min (0) 0x25, 0x01, // Logical Max (1) 0x75, 0x01, // Report Size (1) 0x95, 0x08, // Report Count (8) 0x81, 0x02, // Input (Data, Variable, Abs) 0x95, 0x01, // Report Count (1) 0x75, 0x08, // Report Size (8) 0x81, 0x01, // Input (Const, Ary, Abs) 0x95, 0x05, // Report Count (5) 0x75, 0x01, // Report Size (1) 0x05, 0x08, // Usage Page (LED) 0x19, 0x01, // Usage Min (1) 0x29, 0x05, // Usage Max (5) 0x91, 0x02, // Output (Data, Var, Abs); LED report 0x95, 0x01, // Report Count (1) 0x75, 0x03, // Report Size (3) 0x91, 0x01, // Output (Constant); padding 0x95, 0x06, // Report Count (6) 0x75, 0x08, // Report Size (8) 0x15, 0x00, // Logical Min (0) 0x26, 0xFF, 0x00, // Logical Max (255); all allowed key codes 0x05, 0x07, // Usage Page (Key Codes) 0x19, 0x00, // Usage Min (0) 0x2A, 0xFF, 0x00, // Usage Max (255); all allowed key codes 0x81, 0x00, // Input (Data, Ary); Key arrays (6 bytes) 0xC0 // End Collection total 65 (41h) bytes 0x06, 0xA0, 0xFF, // USAGE_PAGE (Vendor Usage Page 1) 0x09, 0x01, // USAGE (Vendor Usage 1) 0xA1, 0x01, // COLLECTION (Application) 0x85, 0x02, // Report ID (1) 0x09, 0x01, // USAGE (Vendor Usage 1) 0x15, 0x00, // LOGICAL_MINIMUM (0) 0x26, 0xFF, 0x00, // LOGICAL_MAXIMUM (255) 0x75, 0x08, // REPORT_SIZE (8) 0x95, 0x06, // REPORT_COUNT(6) 0x91, 0x02, // OUTPUT (Data,Var,Abs) 0xC0 // END_COLLECTION But its not enumarating ...whether i need to make any changes in my report descriptor? Thanks in Advance Tag: Debugging kernel mode driver on remote machine Tag: 88231
  - 20
    - determining what property sets are supported by a WDM streaming device Is there a way for an application to enumerate all the property set GUID's that a given WDM streaming device supports via its IKsPropertySet implementation? (I would like an application I am writing to have its own UI for all the properties supported by a given streaming WDM video capture device, even its custom properties.) Kronon Tag: Debugging kernel mode driver on remote machine Tag: 88230
  - 21
    - Help required with ddk sample FPFilter I compiled the 'fpfilter' driver from the ddk samples and the 'addfilter' app which is used to apply it to disk volumes. In the fpfilter I find an 'inf' file, I installed it with the 'install' context menu of explorer, then I added a volume with addfilter, then rebooted, and it doesn't work, i.e. the drive letter which corresponds to the volume has now disappeared from the explorer folder view? Thanks. Tag: Debugging kernel mode driver on remote machine Tag: 88228
  - 22
    - How to obtain a Handle on Tescap driver ?? Hi, I actually try to modify the TestCap sample of the DDK. And I would communicate with it in a user-mode application but I can't obtain a handle on it. The CreateFile functions always reject the name of the driver. Could you help me ?? I've found a message named "Use IOCTL in testcap ddk sample question?" but it was not useful for me... Tag: Debugging kernel mode driver on remote machine Tag: 88223
  - 23
    - UpdateDriverForPlugAndPlayDevices() return ERROR_FILE_NOT_FOUND on Vista x86 Hi, On Vista build 5744 x86, my uninstallation program calls UpdateDriverForPlugAndPlayDevices() to uninstall my proprietary mouse filter driver, but gets return value ERROR_FILE_NOT_FOUND. The parameter fullInfPath passed to UpdateDriverForPlugAndPlayDevices() is the full path to inbox msmouse.inf. I am sure it exists. Could someone please tell me how to solve the problem or advise some alternatives? Thanks. Regards, David Tag: Debugging kernel mode driver on remote machine Tag: 88216
  - 24
    - dont get the removecomplete message from the window XP. Hello, I'm working on WIN32 application which monitors and passes data from and to USB Device which also support serial communication . I monitors device arrival/removal notification ( Serial Port ), by the way, especially while I try to read data from USB device, if i remove usb device from PC, I dont get the removecomplete message from Windows. My process is the following. 1) Device Arrival ( Serial Port -DBT_DEVTYP_PORT) 2) Open Serial Port 3) Write/Read Serial Port 4) Close Serial Port 5) Open USB Device Port 6) Write/Read USB Device 7) if Read Failed, Close USB Device Handle 8) Device RemoveComplete ( Serial Port - DBT_DEVTYP_PORT ) ==> dont get that message . The Device Driver Developer said to me that He verified the following fact. My app closes serial com port, and closes USB Device port, and Device Driver called WinAPI for Windows Event iosetdeviceinterfacestate() to OS. => But My App or the other windows event collector(test program ) dont get that messages. After I kill My App, The RemoveComplete Event is notified. Except closing opened port, what else should I do? Any suggestion will be appreciated. Regards, kiyo, Tag: Debugging kernel mode driver on remote machine Tag: 88210
  - 25
    - video capture filter driver, detect current streaming format Hello all. I wrote a usb camera filter driver that can do some processing before the image data was submited to the appliction from the driver. Now I can modified the image data(which comes with the IOCTL of IOCTL_KS_READ_STREAM), but I can't get the format(such as size, rgb or yuv...)of current stream. I also found something from here: http://groups.google.com/group/microsoft.public.development.device.drivers/browse_thread/thread/72d37da008f62553/c84a2e1dadc7af13?lnk=st&q=filter+driver+format&rnum=2&hl=zh-CN#c84a2e1dadc7af13 but it seems not work. Any one can help me? Best Regards __ Martin Zhang Tag: Debugging kernel mode driver on remote machine Tag: 88209

Hi,

For debugging driver on a target machine, can I use eithernet instead of a
null-modem cable connecting the 2 machines?

Thanks.

Top

Re: Debugging kernel mode driver on remote machine by Don

Don
Wed Nov 15 13:21:48 CST 2006

No, you can use serial or 1394 and on Vista USB,.

--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

"Dev" <Dev@discussions.microsoft.com> wrote in message
news:838B92B2-5DB0-4D0D-A64B-E935EF5AED69@microsoft.com...
> Hi,
>
> For debugging driver on a target machine, can I use eithernet instead of
> a
> null-modem cable connecting the 2 machines?
>
> Thanks.

Top

Re: Debugging kernel mode driver on remote machine by Dev

Dev
Wed Nov 15 13:53:02 CST 2006

would that be special kind of 1394 cable (like null-modem)?

"Don Burn" wrote:

> No, you can use serial or 1394 and on Vista USB,.
>
>
> --
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> http://www.windrvr.com
> Remove StopSpam from the email to reply
>
>
> "Dev" <Dev@discussions.microsoft.com> wrote in message
> news:838B92B2-5DB0-4D0D-A64B-E935EF5AED69@microsoft.com...
> > Hi,
> >
> > For debugging driver on a target machine, can I use eithernet instead of
> > a
> > null-modem cable connecting the 2 machines?
> >
> > Thanks.
>
>
>

Top

Re: Debugging kernel mode driver on remote machine by Don

Don
Wed Nov 15 15:25:45 CST 2006

Nope normal 1394 since 1394 is multi-initiator. 1394 debugging can be
sensitive to the controller chip.

--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

"Dev" <Dev@discussions.microsoft.com> wrote in message
news:0146F153-50FF-4960-ADEB-6B4A5400EAF6@microsoft.com...
> would that be special kind of 1394 cable (like null-modem)?
>
> "Don Burn" wrote:
>
>> No, you can use serial or 1394 and on Vista USB,.
>>
>>
>> --
>> Don Burn (MVP, Windows DDK)
>> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>> http://www.windrvr.com
>> Remove StopSpam from the email to reply
>>
>>
>> "Dev" <Dev@discussions.microsoft.com> wrote in message
>> news:838B92B2-5DB0-4D0D-A64B-E935EF5AED69@microsoft.com...
>> > Hi,
>> >
>> > For debugging driver on a target machine, can I use eithernet instead
>> > of
>> > a
>> > null-modem cable connecting the 2 machines?
>> >
>> > Thanks.
>>
>>
>>

Top