Hey There,
I have the following code, and it gives me the BSOD when it tries to
unload the driver.
The windbg output of the error is:
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address
pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this
address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never
have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f88db0c8, The address that the exception occurred at
Arg3: f8988b90, Exception Record Address
Arg4: f898888c, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
TDIDriver+20c8
f88db0c8 ?? ???
EXCEPTION_RECORD: f8988b90 -- (.exr fffffffff8988b90)
Cannot read Exception record @ f8988b90
CONTEXT: f898888c -- (.cxr fffffffff898888c)
Unable to read context, Win32 error 30
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 81ea3550 to f88db0c8
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may
be wrong.
f8988c54 81ea3550 e291c264 00320030 f88de078 TDIDriver+0x20c8
f8988c7c 805a0799 81ea3550 82199000 00000000 0x81ea3550
f8988d4c 805a0a6e 00000a08 00000001 00000000 nt!IopLoadDriver+0x66c
f8988d74 804e426b 00000a08 00000000 823c8b30
nt!IopLoadUnloadDriver+0x45
f8988dac 8057be15 f8a1ccf4 00000000 00000000 nt!ExpWorkerThread+0x100
f8988ddc 804fa4da 804e4196 00000001 00000000
nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
TDIDriver+20c8
f88db0c8 ?? ???
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: TDIDriver+20c8
MODULE_NAME: TDIDriver
IMAGE_NAME: TDIDriver.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 44d0a5ac
FAILURE_BUCKET_ID: 0x7E_TDIDriver+20c8
BUCKET_ID: 0x7E_TDIDriver+20c8
Followup: MachineOwner
---------
The code I have executing is:
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING
pRegistryPath)
{
NTSTATUS NtStatus = STATUS_SUCCESS;
UINT uiIndex = 0;
PDEVICE_OBJECT pDeviceObject = NULL, pFilteredDevice = NULL;
UNICODE_STRING usDriverName, usDosDeviceName, usDeviceToFilter;
PEXAMPLE_FILTER_EXTENSION pFilterDeviceContext;
RtlInitUnicodeString(&usDeviceToFilter, L"\\Device\\Tcp");
RtlInitUnicodeString(&usDriverName, L"\\Device\\TdiDriver");
RtlInitUnicodeString(&usDosDeviceName,
L"\\DosDevices\\TdiDosDriver");
NtStatus = IoCreateDevice(pDriverObject, 0, &usDriverName,
FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDeviceObject);
for(uiIndex = 0; uiIndex < IRP_MJ_MAXIMUM_FUNCTION; uiIndex++)
pDriverObject->MajorFunction[uiIndex] = TDIInvalidFunction;
pDriverObject->MajorFunction[IRP_MJ_CLEANUP] = TDICleanUp;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = TDIClose;
pDriverObject->MajorFunction[IRP_MJ_CREATE] = TDICreate;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = TDIIoControl;
pDriverObject->MajorFunction[IRP_MJ_INTERNAL_DEVICE_CONTROL] =
TDIIoControlInternal;
pDriverObject->MajorFunction[IRP_MJ_READ] = TDIRead;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = TDIWrite;
pDriverObject->DriverUnload = TDIUnload;
pFilterDeviceContext =
(PEXAMPLE_FILTER_EXTENSION)pDeviceObject->DeviceExtension;
NtStatus = IoAttachDevice(pDeviceObject, &usDeviceToFilter,
&pFilterDeviceContext->pNextDeviceInChain);
if(!NT_SUCCESS(NtStatus))
{
IoDeleteDevice(pDeviceObject);
}
else
{
// pFilteredDevice = pFilterDeviceContext->pNextDeviceInChain;
//pDeviceObject->Flags |= pFilteredDevice->Flags &
(DO_BUFFERED_IO | DO_DIRECT_IO);
//pDeviceObject->DeviceType = pFilteredDevice->DeviceType;
// pDeviceObject->Characteristics =
pFilteredDevice->Characteristics;
pDeviceObject->Flags |= DO_BUFFERED_IO;
pDeviceObject->Flags &= (~DO_DEVICE_INITIALIZING);
}
IoCreateSymbolicLink(&usDosDeviceName, &usDriverName);
return NtStatus;
}
VOID TDIUnload(PDRIVER_OBJECT pDriverObject)
{
UNICODE_STRING usDosDeviceName;
PEXAMPLE_FILTER_EXTENSION pFilterDeviceContext =
(PEXAMPLE_FILTER_EXTENSION)pDriverObject->DeviceObject->DeviceExtension;
RtlInitUnicodeString(&usDosDeviceName,
L"\\DosDevices\\TdiDosDriver");
IoDeleteSymbolicLink(&usDosDeviceName);
ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL);
IoDetachDevice(pFilterDeviceContext->pNextDeviceInChain);
ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
IoDeleteDevice(pDriverObject->DeviceObject);
}
It is a very simple driver. Any ideas?
-Jay
(patelj27b at gmail dot com)