ZwCreateFile BSOD

I have a weird problem.

ZwCreateFile is causing my computer to crash. I have issolated the
problem in ZwCreateFile using SoftIce. However, I don't understand
why.

I'm in the process of converting an NT driver to WDM. This part of the
code is the same between the NT version and the WDM version. The NT
version works find. Thje WDM version crashes with the following
error:
Error=A (IRQL_NOT_LESS_OR_EQUAL) P1=E1307008 P2=2 P3=1 P4=F451C12

This tells me that I have a pointer problem but I can't figure it out.
The pointer(filename) is the same between the NT version and the WDM
version.

Thanks

Don
Tue Oct 16 07:56:55 PDT 2007

No, it does not say you have a pointer problem. All it says is you have a
problem. Drop SoftIce since it is worthless and unsupported. Take the dump
and then do a !analyze with WinDbg and submit that to the group.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply


"John" <jvasquez@cox.net> wrote in message
news:kmj9h3h6h0i1gnvti39tvrb1aadt2n28tj@4ax.com...
>I have a weird problem.
>
> ZwCreateFile is causing my computer to crash. I have issolated the
> problem in ZwCreateFile using SoftIce. However, I don't understand
> why.
>
> I'm in the process of converting an NT driver to WDM. This part of the
> code is the same between the NT version and the WDM version. The NT
> version works find. Thje WDM version crashes with the following
> error:
> Error=A (IRQL_NOT_LESS_OR_EQUAL) P1=E1307008 P2=2 P3=1 P4=F451C12
>
> This tells me that I have a pointer problem but I can't figure it out.
> The pointer(filename) is the same between the NT version and the WDM
> version.
>
> Thanks
>
>
>

J
Tue Oct 16 10:02:40 PDT 2007

J> Error=A (IRQL_NOT_LESS_OR_EQUAL) P1=E1307008 P2=2 P3=1 P4=F451C12
J>
J> This tells me that I have a pointer problem but I can't figure it
out.

It tells me that you are very probably calling ZwCreateFile() when the
IRQL is at DISPATCH_LEVEL.

John
Tue Oct 16 14:06:44 PDT 2007

On Tue, 16 Oct 2007 10:56:55 -0400, "Don Burn"
<burn@stopspam.windrvr.com> wrote:

>No, it does not say you have a pointer problem. All it says is you have a
>problem. Drop SoftIce since it is worthless and unsupported. Take the dump
>and then do a !analyze with WinDbg and submit that to the group.

Ok, Its not always a pointer problem. However, with my experience 90%
of the time it was.

Softice is great. I know it no longer supported in Vista but for XP it
works perfectly. WinDbg is ok but it requires two computer, which
sometimes I don't have.

I have used WinDbg and I wasn't too thrilled about it. It took awhile
for me to get debug statements to be transmitted over the serial port.
And then when I made a change to the driver, it appeared that I had to
reboot the target machine. In SoftIce when I make a change to the
driver, I just have to unload and then reload the driver for the
changes to take place. But I am a newbie to Windbg and probably not
using it correctly. Also because of the serial inteface, debugging was
very slow compared to Sotfice. It took what appears to be seconds
for a breakpoint to be hit. Whereas, the same break point was
instantanious.

There was some good features like !verify in WinDbg

Thank for the responds

John
Tue Oct 16 14:09:59 PDT 2007

On Tue, 16 Oct 2007 10:02:40 -0700, J de Boyne Pollard
<j.deboynepollard@tesco.net> wrote:

>J> Error=A (IRQL_NOT_LESS_OR_EQUAL) P1=E1307008 P2=2 P3=1 P4=F451C12
>J>
>J> This tells me that I have a pointer problem but I can't figure it
>out.
>
>It tells me that you are very probably calling ZwCreateFile() when the
>IRQL is at DISPATCH_LEVEL.


Thanks I just saw it, I was in the DISPATCH_LEVEL level. I wonder why
the NT driver didn't cause a BSOD like the WDM driver did.

John

Don
Tue Oct 16 14:13:12 PDT 2007


"John" <jvasquez@cox.net> wrote in message
news:mb9ah35e4jb9dgcupsn7iqhe95ek4gkjcc@4ax.com...
> On Tue, 16 Oct 2007 10:56:55 -0400, "Don Burn"
> <burn@stopspam.windrvr.com> wrote:
>
>>No, it does not say you have a pointer problem. All it says is you have a
>>problem. Drop SoftIce since it is worthless and unsupported. Take the
>>dump
>>and then do a !analyze with WinDbg and submit that to the group.
>
> Ok, Its not always a pointer problem. However, with my experience 90%
> of the time it was.
>
> Softice is great. I know it no longer supported in Vista but for XP it
> works perfectly. WinDbg is ok but it requires two computer, which
> sometimes I don't have.
>
> I have used WinDbg and I wasn't too thrilled about it. It took awhile
> for me to get debug statements to be transmitted over the serial port.
> And then when I made a change to the driver, it appeared that I had to
> reboot the target machine. In SoftIce when I make a change to the
> driver, I just have to unload and then reload the driver for the
> changes to take place. But I am a newbie to Windbg and probably not
> using it correctly. Also because of the serial inteface, debugging was
> very slow compared to Sotfice. It took what appears to be seconds
> for a breakpoint to be hit. Whereas, the same break point was
> instantanious.
>
The only way to find crashes well is !analyze. I gave up on SoftIce years
ago after discovering that SoftIce created bugs because they have
replacement of kernel functions that they implemented incorrectly.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

John
Wed Oct 17 07:40:00 PDT 2007

I found out what I was doing wrong. I should have analyzed the debug
screen better. I was calling ZwCreateFile() at DISPATCHED_LEVEL vicef
PASSIVE_LEVEL.



On Tue, 16 Oct 2007 17:13:12 -0400, "Don Burn"
<burn@stopspam.windrvr.com> wrote:

>
>"John" <jvasquez@cox.net> wrote in message
>news:mb9ah35e4jb9dgcupsn7iqhe95ek4gkjcc@4ax.com...
>> On Tue, 16 Oct 2007 10:56:55 -0400, "Don Burn"
>> <burn@stopspam.windrvr.com> wrote:
>>
>>>No, it does not say you have a pointer problem. All it says is you have a
>>>problem. Drop SoftIce since it is worthless and unsupported. Take the
>>>dump
>>>and then do a !analyze with WinDbg and submit that to the group.
>>
>> Ok, Its not always a pointer problem. However, with my experience 90%
>> of the time it was.
>>
>> Softice is great. I know it no longer supported in Vista but for XP it
>> works perfectly. WinDbg is ok but it requires two computer, which
>> sometimes I don't have.
>>
>> I have used WinDbg and I wasn't too thrilled about it. It took awhile
>> for me to get debug statements to be transmitted over the serial port.
>> And then when I made a change to the driver, it appeared that I had to
>> reboot the target machine. In SoftIce when I make a change to the
>> driver, I just have to unload and then reload the driver for the
>> changes to take place. But I am a newbie to Windbg and probably not
>> using it correctly. Also because of the serial inteface, debugging was
>> very slow compared to Sotfice. It took what appears to be seconds
>> for a breakpoint to be hit. Whereas, the same break point was
>> instantanious.
>>
>The only way to find crashes well is !analyze. I gave up on SoftIce years
>ago after discovering that SoftIce created bugs because they have
>replacement of kernel functions that they implemented incorrectly.

Gary
Thu Oct 18 11:16:51 PDT 2007

Do you need the entire checked build? The checked HAL and kernel usually are
sufficient. About a year ago Don was working on a utility that would switch
those easily.

--
The personal opinion of
Gary G. Little


"Don Burn" <burn@stopspam.windrvr.com> wrote in message
news:OCd3KTAEIHA.5324@TK2MSFTNGP02.phx.gbl...
> No, it does not say you have a pointer problem. All it says is you have a
> problem. Drop SoftIce since it is worthless and unsupported. Take the
> dump and then do a !analyze with WinDbg and submit that to the group.
>
>
> --
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
> Remove StopSpam to reply
>
>
> "John" <jvasquez@cox.net> wrote in message
> news:kmj9h3h6h0i1gnvti39tvrb1aadt2n28tj@4ax.com...
>>I have a weird problem.
>>
>> ZwCreateFile is causing my computer to crash. I have issolated the
>> problem in ZwCreateFile using SoftIce. However, I don't understand
>> why.
>>
>> I'm in the process of converting an NT driver to WDM. This part of the
>> code is the same between the NT version and the WDM version. The NT
>> version works find. Thje WDM version crashes with the following
>> error:
>> Error=A (IRQL_NOT_LESS_OR_EQUAL) P1=E1307008 P2=2 P3=1 P4=F451C12
>>
>> This tells me that I have a pointer problem but I can't figure it out.
>> The pointer(filename) is the same between the NT version and the WDM
>> version.
>>
>> Thanks
>>
>>
>>
>
>