poolmon and mysterious driver which leaks like a sieve?

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Drivers
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - poolmon and mysterious driver which leaks like a sieve? Hi guys, i have here a hungry little driver process that seems to be leaking: (sorry for the formatting) System pool information Tag Type Allocs Frees Diff Bytes Per Alloc Mapped_Driver OCSD Nonp 57616 ( 1) 48338 ( 1) 9278 5858256 ( 0) 631 Unknown Driver I got this info from Poolmon.exe... so i'm trying to identify what driver OCSD is.. what file is loading it etc... any ideas on doing this? i am using the -g flag already :S Thanks Jeff Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108788
  - 2
    - error calling PsLookupThreadByThreadId in thread creation callback I'm trying to keep track of new threads with a simple driver by registering a thread creation callback using PsSetCreateThreadNotifyRoutine. The WDK documentation says "In the notification callback routine, the file system filter driver can use the passed in ThreadId parameter and call PsLookupThreadByThreadId to locate the ETHREAD structure." However, this does not work for me, and calling PsLookupThreadByThreadId (or ZwOpenThread) always returns STATUS_INVALID_PARAMETER. I've seen a few other postings on the web with a similar problem. Could this be a documentation error and not possible at all? or maybe I missed anything in the code (note that my driver is pretty simple and not a file system filter driver, but this should not matter, right?) Thanks for any suggestions, Yang Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108783
  - 3
    - other file system for Vista Hi Just theoretically... is it possible to write an own file system driver and then to install Vista into a partition that is formated with this file system? Rudolf Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108775
  - 4
    - virtual printer dirver Hello! I'm newbie, and I'm learning about this world of drivers and other stuff, so... I need to build a very simple "virtual printer driver" , which is like "generic driver text", but I do not want out of the printer is a file, I want to be able to "capture" the text (just text is printed) and I want able to send another application, all this without human intervention. I could help with some guidance on where to look something like this, or any example to do what I need? Thank you very much! Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108772
  - 5
    - replace a gined driver Hi, I want to replace a driver with a new version that i've created (i also created the catalog file, inf ). How can I do that correctly, so the signature will be ok? I tried to do it by my computer ->manage->Diagnostics->Devicemanager->right click on my device and then update device software, but then i get a maassage that windows decides that update is not needed????? Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108769
  - 6
    - DIFX this is the first time i have used this so i hope i get it right ,my question is i have found a programe on my computer called DIFXwhen i clicked on it it said do i allow or not what is this program ? and what is it for? and do i need it please assist Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108768
  - 7
    - If I transfer the spooler file to another machine and then print it Hi All, I am writing a printer driver which should Print to Remote machine. I want to know Can I send the spool file itself to the remote machine and then print it. Also I am new to spooling what does spool file contains? Thanks Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108763
  - 8
    - wdfCoInstaller01007.dll Hi I am using wdk\6001.18001 version "hidusbfx2" sample code. when i install this driver for my hardware, it asks for "wdfCoInstaller01007.dll" file. But it is not in WDK. I searched in microsoft.connect webpage also, here also i cant get the coinstaller file. If anybody know, how to get it, send the steps to download it. Thanks for advance. Regards - Dsrking. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108760
  - 9
    - Need help with Network Location Awareness on Vista I work on a VPN client that runs on Vista. We are a TDI filter (yes, I know TDI is going away post-Vista) and we also have a virtual network adapter. The problem I am having is that when my VPN client is loaded, Vista's NLA claims that the machine is not connected to the Internet. The globe is missing from the network icon in the taskbar notification area, Network and Sharing Center shows a red X in the diagram in the connection to the Internet, and INetworkListManager::get_IsConnectedToInternet returns FALSE. This is more than just a cosmetic issue as apparently Google Desktop's News gadget on Vista relies on NLA indicating Internet connectivity in order to retrieve news headlines from the Internet. If my virtual network adapter signals a media disconnect to NDIS, then NLA thinks that the machine is connected to the Internet (via the physical adapter). When my virtual network adapter once again signals a media connect to NDIS, NLA thinks that we are no longer connected to the Internet, even though the system can access the Internet just fine through our VPN via IE, ping, etc. My question is, how does INetworkListManager and/or NLASVC detect Internet connectivity? When my adapter indicates media connected, I see ARP and DHCP requests to my virtual adapter but we handle these and answer them successfully, just like what happens with the real physical adapter. And I don't see requests for any OIDs when my virtual adapter connects, at least not for any that we say we support. Is there a new OID or NDIS request or other such API that I need to handle? Any help would be greatly appreciated! Thanks. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108732
  - 10
    - Surprise removal of keyboard device waking from S3 We have a USB keyboard that we have written a filter driver for. The filter driver creates a raw PDO to enable side-band communication with an application through an IOCTL interface. When we put the system in S3, and then wake it up, the keyboard is sometimes experiencing surprise removals. When this happens, the filter driver is not able to clean up properly because the application still has an open handle to it. So AddDevice gets called a second time because the device is suddenly detected again, and things get bad from there. A few questions: 1) what would cause a surprise removal, and then re-detection of a USB keyboard during wake? 2) apart from the filter driver, it seems that Windows can gracefully handle the surprise removal and re-detection of the keyboard device. How is it that Windows can handle this? Does the component that communicates with the keyboard stack get notified that the device was removed, and notified again when the device comes back? Is there a way to implement this same type of behavior in our sideband PDO and application? Thanks, Michael Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108721
  - 11
    - Problem with resuming from standby with multiple EHCI controllers Hi, We have a PCI card with multiple EHCI and OHCI controllers on it. Each controller resides on a different function. We have an issue with resuming from standby or hibernate state of the system. The system when put into standby and resumed, can resume only when one of the following criteria is met : 1) No OHCI controllers are enabled, i.e. only EHCI controllers are enabled 2) No EHCI controllers are enabled, i.e. only OHCI controllers are enabled 3) Only a single EHCI controller is enabled and zero or more OHCI controllers are enabled It does NOT resume from the standby when : 1) More than one EHCI controllers are enabled and at least one OHCI controller is enabled My first doubt is whether such a configuration is valid after all, i.e. having multiple EHCI controllers in the same PCI card? I have never seen this configuration in any of the products in the market. Upon debugging a little we have found that the USBPORT does not issue ResumeController command to the second EHCI controller, whereas first EHCI controller and all other OHCI controllers (if present) get that command from USBPORT. We can break into the system and notice that both EHCI and OHCI drivers are periodically reading the contents of their PORT_STATUS register. I think this is the normal working condition of both the drivers. This might not be the proper newsgroup to post this query but I couldn't really figure out proper newsgroup for this peculiar query. Any hints will be greatly appreciated. Also please let me know of a more relevant newsgroup if you know. Regards, Suresh Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108716
  - 12
    - HwStorStartIO on Full duplex I have a doubt on storport behavior on Full duplex. As per the WDK, "Storport always calls HwStorStartIo at DISPATCH IRQL by using an internal spin lock to ensure that requests are initiated sequentially". As per the "Storport in Windows Serverâ?¢ 2003" (Storport.doc from Microsoft), "both the Start I/O and the build on different processors can overlap in time, and can also overlap ISRs". Also picture (Figure 8) shows that two StartIOs are overlapping in different processors. So my questions are: 1. How does two StartIO overlap if it internally using a SpinLock? 2. Do we need to synchronize the resource in StartIO (in Full duplex mode), if it overlaps? Thanks, Deepakumar Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108715
  - 13
    - Windows filesystems This is pretty trivial because under ordinary conditions it's not likely to cause loss of data. But it's still good for laughs. If Windows Explorer is showing you a file named Ã?Ã?.txt and you want to rename it to Ã?s.txt, can you do the rename? Windows 98 + FAT file system --> yes Windows XP + NTFS file system --> yes Windows XP + FAT file system --> no By the way, I've been accused of not listening to authorities on Windows. The accuser is an authority on Windows. Does anyone know which authority I should listen to in order to hear that Windows operates this way? Or in order to hear that Windows doesn't operate this way? Did XP listen to a higher authority than 98 did? Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108714
  - 14
    - CM_PROB_FAILED_ADD - driver installed successfully? Hi all! UMDF/USB driver installed with devcon. Devcon says: Driver installed successfully. Setupapi.dev.log says: error: CM_PROB_FAILED_ADD. Windows device manager says: Could not load driver (err. 31). USB device is NOT attached to the computer. Is there a way to debug the error? I tried it with windbg and wdfverifier but I can not break during loading or starting. Any other ideas? Do I need to sign my driver to get it loaded? I am currently trying to get behind the secrets of driver developing without going through the driver signation process. Thanks in advance. Dee Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108713
  - 15
    - Transport Data Interface (TDI) Hi, are there any samples or more informations avaible about the TDI? i dont find anything, i think its includet in old ddk's but i didnt find it i know tdi is not realy support in vista/newer windows versions but i need to modify netbios datastreams, i have an ndis driver for this, but i whant to see the whole stream and i think TDI is the correct place to see/modify netbios streams, the ndis driver only see's the singe packages but i whant to encrypt the whole stream, when i encrypt only the single packages of the netbios streams for filetransfers i get an overlapping encryption, so that are big files unreadable because of some other packages go through the encryption (keep alive ...) if somebody has an better idea to encrypt the data in an netbios stream than TDI or some samples please give it to me thanks for any tipps best regards f.k. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108711
  - 16
    - Need help with signing inf-only driver installs. Hello. Our company makes several simple non-isochronous USB devices that we talk to using the winusb.sys driver. Our installer package consists of only an INF file and the various microsoft co-installers required for making sure winusb is installed properly. We want to pre-install our INF file using DPInst.exe so that when one of our USB devices is plugged in, the driver will install without any user interaction. This, of course, requires that the driver be signed. My questions: What is the simplest path to achieve this goal? Do I just make a .cat file with makecat and sign it with signtool or do we need to go through WHQL? If we need to go through WHQL, do we need to go through all of the HCT hardware tests, or is there a fast-track for INF-only installs? Will one signature work for XP32, XP64, Vista32, and Vista64? We are currently waiting for our VeriSign key, so we can try it out. Thank you Scott Wild Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108700
  - 17
    - meaning of SERIAL_COMMP Hi, All I am working around our virtual COM port driver. In IOCTL_SERIAL_GET_PROPERTIES, I don't know what our driver return parameters. I would like to know about meaing each parameters of SERIAL_COMMPROP structure. Could you tel me about any tips or documents ? Thanks in advance. shinji. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108699
  - 18
    - using unidrv to print one-line bitmap Hi, I'm attempting to print data to a thermal printer as it is received from a measuring device. Each sample is to be printed as a single scan line. As time goes on, the thinking goes, the individual lines will create a meaningful picture. The page length will depend on how many measurements are recorded. Here's the issue. I'm using the universal print driver. In the .gpd file I've set the paper size feature up like this: *Feature: PaperSize { *rcNameID: =PAPER_SIZE_DISPLAY *DefaultOption: LETTER *Option: LETTER { *rcNameID: =RCID_DMPAPER_SYSTEM_NAME *PrintableArea: PAIR(1728, 1) *PrintableOrigin: PAIR(0, 0) } } Although I'm sending valid data to the driver, it's sending 1728 <FF>s to the printer. The printer doesn't see the valid data unless the *PrintableArea is at least (1728, 5). Then I get the correct output followed by 4 blank lines. Thanks in advance for any input. Dave. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108697
  - 19
    - INF Error in NDIS IM Driver Signing Hi All, We are trying to get WHQL certification for our miniport driver(Windows 2008 server) and Intermediate driver(Windows 2003 server).For miniport we got an error "Could not find user specified INF files. Bailing out ..." error in the Run INF test against a single INF test.We are using WLK 1.2 for this certification Process.But this error was filtered by using WLK latest updated DTM filter.So after this filter configuration this INF test is passed in Miniport Driver. For this same setup we are using for IM driver signing.In this they done same INF test and also we got same baling out error what we got in Miniport.For Intermediate this error was not filtered by DTM filter and also IM Submission Status shows "Run INF test against a single INF test" is Failed.Our driver passed all other Driver Reliability tests except this INF test .So please anyone give your valuable solution to solve this problem. Thanks -Sasi- Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108694
  - 20
    - UMDF Skeleton OSR-FX-2 Board - driver times out during restart Hi all, I am still trying to get my device (not the OSR board) connected via USB to Vista SP1. After trying with the umdf/usb/OSR example, failing due to 0x1f: CM_PROB_FAILED_ADD during restart and no idea how to solve the problem, I have tried the simplest of all examples: the umdf/Skeleton example (with the UMDF_SkeletonOSR.inf). This should work with any USB device too. So this time I did not change anything in the inf-file besides the VID and PID. Unfortunately during driver loading the driver timesout. Excerpt from setupapi.dev.log: dvi: {Restarting Devices} 08:41:49.029 dvi: Restart: USB\VID_05EB&PID_201A\00000 !!! ump: Timed out waiting 300 seconds for device install process DrvInst.exe to complete 15:28:00.659 ump: Server install process exited with code 0x000005b4 15:28:00.659 dvi: Restart complete. What can this mean? Where can my fault be? I am getting crazy here, because I am not even able to debug anything since the driver is never loaded/started. I just need the driver to load or start so I am able to debug or develop further. Please help me, any ideas are welcome. Thanks Dee Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108692
  - 21
    - How to send ioctl to kernel driver of AVStream class? Hi What are the ways to send ioctl from application to AVStream kernel driver? Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108687
  - 22
    - Virtual MIDI Ports Hello! I'm planing to write a Driver which does the following things: - provide virtual MIDI Ports to the System - read MIDI Data from existing Ports and forward them (based on a flexible message-routing) to virtual Ports I could not find anything about MIDI Driver Development. MIDI Ports should be very simular to serial Ports I think, or is it any kind of Multimedia Driver? Does anybody have links to docs, or maybe an example I can look at? BTW: This is my first Device Driver Project. Is this too advanced or may it be achievable for a experienced User-Mode dev with Windows System Architecture knowledge? Thanks! GP Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108685
  - 23
    - HID non-usb device driver in windows XP Hi Anyone have HID non-usb Device driver in windows XP? In WDK, they provide hidusbfx driver... I have taken this one, and compiled and tested for non-usb keyboard (removed usb supported functions and tested for just HID enumeration only). But my *.inf is not recognized by system (i.e., it shows : the inf does not contain specified information ). If anybody checked it for non-usb hid devices, can u send the code and also if you have application, send it. Thanks in Advance. Regards - Dsrking. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108684
  - 24
    - doubts regarding driver signing I want to minimize the validity period of my certificate so that I can check if my signed driver works even after the certificate expires. But I am not able to edit the properties of it,basically validity period. can this be possible.Is this editing allowed first of all???? Thanks in advance Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108680
  - 25
    - question on driver signing Hi, I have a driver that is authenticode signed. say my certificate expires within one month.say this September. If I launch my product month end,by september wont that certficate in my driver in the cutomer's place expire???? In that case is it necessary that my customer should again get a valid signed driver. will the expired certificate in the driver in the customer place work after it expires???? Thanks in advance Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108676
- Next
  - 1
    - programatically register device co-installer from class co-install As the subject says, what is the recommended approach to programatically register device co-installer from class co-installer. The class coinstaller is already registered on the system for the device class. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108672
  - 2
    - Only dmDuplex member cannot be updated on reason of Hi All I am developing a printer driver by modifying WindowsXP ddk samples "Windows 2000 OEM UI Customization Sample (PS)", and encounterring a problem on updating dmDuplex member of public DEVMODE. It's very weird: 1. On original sample, system standard "Layout" and "Color" sheet is hidden, if I don't hide the 2 sheets then dmDuplex can be updated normally. 2. The problem is not reproduced on updating other public DEVMODE members, such as dmOrientation, dmCopies, dmPaperSize and dmScale. I was not using CPSUI to make my plugin property sheets, so I cannot use DrvUpdateUISetting() to update user settings. Below is the testing code I am using to update public and private DEVMODE under reason of PROPSHEETUI_REASON_DESTROY on hrOEMDocumentPropertySheets(PPROPSHEETUI_INFO pPSUIInfo, ...): ... POEMUIPSPARAM pOEMUIParam; PDEVMODE pTestDevmode; pOEMUIParam = (POEMUIPSPARAM)pPSUIInfo->lParamInit; pTestDevmode = (PDEVMODE) pOEMUIParam->pPublicDM; //check value of pTestDevmode->dmDuplex at here: it is 1. pTestDevmode->dmDuplex = 2; pPSUIInfo->pfnComPropSheet(pPSUIInfo->hComPropSheet, CPSFUNC_SET_RESULT, (LPARAM)NULL, (LPARAM)CPSUI_OK); //check value of pTestDevmode->dmDuplex at here: // it is 1 if Layout and Color sheet is hidden. <-- Problem! // it is 2 if Layout and Color sheet is not hidden. <-- Expected ... I will be appreciated if anyone can give me any advice on this. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108671
  - 3
    - Close event with pending IO Is it possible to get a close event on a device that has outstanding IO requests? If an application tries to close its handle to my driver, Iâ??d like my driver to cancel any pending IO requests and let the app close down instead of hanging. Iâ??ve added a close event handler with WdfDeviceInitSetFileObjectConfig, but I only get that call when all the IO is complete and the device handle is being closed. I want to get notification even if IO is still pending so I can clean up for the bad app. Thanks, -Daniel Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108670
  - 4
    - Requirements for a GDI primary surface I wonder whether it is possible to have a graphics driver that has a primary surface which does not use any system memory for a GDI bitmap. I tried something like EngCreateDeviceSurface followed by EngAssociateSurface, which resulted in a blue screen (Access violation in hsurfCreateCompatibleSurface). My questions are: 1. The documentation (MSDN) says that the 'hsurf' parameter of EngAssociateSurface must have been created using EngCreateBitmap or EngCreateDeviceBitmap. I have seen examples that pass a EngCreateDeviceSurface created handle. Is this legal? 2. If not, is the only possibility to use EngModifySurface with a EngCreateDeviceSurface created surface handle? And EngModifySurface requires me to provide framebuffer/bitmap memory in any case, doesn't it? 3. If so, is there any possibility for me to make a driver work without a GDI framebuffer bitmap and how would I do this? I do not want to do GDI any work for me at the moment, so I do not need a GDI-managed backbuffer to to this. Thanks in advance, Christoph Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108669
  - 5
    - free sex moves download free sex moves download http://kumaripud.blogspot.com/ Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108659
  - 6
    - about UVC, interlace camera Hi, all We are making UVC device for interlace(YUY2 VGA) camera module. In CATC, streaming packets of our device is good, probably. But, AMCap image is only black. I have 2 question. 1). about FID of stream header. Our device toggles FID bit each field(640x240), not each frame(640x480). Is this bad ? 2). about field recognition. I think there is no field information in streaming header. How do UsbVideo.sys recognize odd field or even field ? Thanks in advance shinji Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108650
  - 7
    - Upper Usb camera(webcam) filter driver on windows 64 bits hi all, I use example upper toaster filter driver of DDK to install to Upper Usb camera(webcam) filter driver on window 32 bits it work well, but on window 64 bits it is not work, when i plug webcam system notice webcam cannot connected anybody know this problem pls help me. Thanks very much Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108647
  - 8
    - Question on USB HID composite device Hello. I am going to code device driver that has HID keyboard and consumer device functionality. It seems that I have to implement 2 interfaces. I have done on 2 interfaces in ATMEL microcontroller and things seem to be different in windows driver. I have no idea how I can send 2 report descriptors when IOCTL_HID_GET_REPORT_DESCRIPTOR is received and I have no idea if I should make another DriverEntry or IOCTL function... etc. I have examined DDK hid sample but there was no sample on multiple interfaces. and search of web and this group showed no sample or detailed solution. Please inform me site that has some material on this. Thanks. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108646
  - 9
    - Windows Server 2008 ON-DEMAND! Hey everyone, My name is Mehvish Naquvi, I am interning for GoGrid(http:// www.GoGrid.com/.) My intentions to post are not to sound "salesy" at all, but more to inform Microsft users. Instant Window Servers 2008 are now available "in the cloud." Currently GoGrid is giving away free trials, which looks like a great way to get experience with Windows Server 2008 for those who are considering transitioning. Use this code "GGMN" to sign up and you get a $50 credit applied before they charge you anything! Test and plan your transition to Windows Server 2008, let GoGrid know what you think...your feedback is highly appreciated. Best, Mehvish Naquvi Marketing Intern ServePath/GoGrid Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108637
  - 10
    - FSCTL_LOCK_VOLUME prevents deletion of disk device object on Vista On Vista with SP1 installed, when the following code exits, the reference count of a disk device object, on which filesystem of drive D: resides, is incremented by 10. The filesystem on drive D: must be NTFS. On Windows before Vista SP1, the reference count is not incremented. for (int i = 10; i > 0; ) { HANDLE vol = CreateFile (TEXT ("\\\\.\\D:"), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); DWORD br; if (DeviceIoControl (vol, FSCTL_LOCK_VOLUME, NULL, 0, NULL, 0, &br, NULL)) { DeviceIoControl (vol, FSCTL_UNLOCK_VOLUME, NULL, 0, NULL, 0, &br, NULL); --i; } CloseHandle (vol); } This bug prevents deletion of disk device objects on Vista SP1 as their reference count never reaches 0 after using FSCTL_LOCK_VOLUME. Regards, Ondrej Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108633
  - 11
    - HalGetBusData Hi In WDF driver, i want to read all pci devices configuration space in system. In WDM, we can use HalGetBusData function. But in WDF, shall we use the same one. If anyone have a snippet for above case (WDM or WDF) , also give it. Thanks in advance. Regards - Dsrking Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108619
  - 12
    - diff between kdprint and dbgprint Is there any diff between kdprint and dbgprint??? Let me know if there are any diff between the two. If not then why 2 routines?????? Thanks in advance Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108614
  - 13
    - NDIS ntohs/htons Hi, I am trying to inspect the Ethertype/length field in the Ethernet header of an egress NDIS packet handed to the miniport by a protocol driver. What byte-order does NDIS use for the header and payload? Do I need to put the Ethertype/length value through a call to ntohs() or htons() or just use the value as is? I am assuming for an ingress NDIS packet, the byte order is network byte order so I would need to use ntohs() to inpect a short. Is this correct? Thanks. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108606
  - 14
    - USB device with no drive letter I need to show a device installed as USB but not storage(no drive letter) provided it's VID, PID & Serial Number. Can I make any changes in the registry to get this kind of behavior? Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108604
  - 15
    - Driver not signed by Microsoft messagebox appears multiple times Many systems using our drivers have 10 or more devices attached. When the driver is updated (by calling UpdateDriverForPlugAndPlayDevices() found in cfgmgr32.dll) the user must click Continue once for each device installed. Is there a way have one approval that applies for all devices controlled by the driver? -- Mr. Fixit needs your help! - John Bond, AudioCodes Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108600
  - 16
    - Driver not signed by Microsoft messagebox appears for EVERY device Many systems using our drivers have 10 or more devices attached. When the driver is updated (by calling UpdateDriverForPlugAndPlayDevices() found in cfgmgr32.dll) the user must click Continue once for each device installed. Is there a way have one approval that applies for all devices controlled by the driver? -- Mr. Fixit needs your help! - John Bond, AudioCodes Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108598
  - 17
    - Testing random IOCTL calls Hello, I am working on a driver based upon the KMDF sample usbsamp. I am trying to pass the DevPathExer tests and I have encountered a wierd set of cases. I have created a handler for EvtIoDeviceControl and I have set it up so every IoControlCode value is to return STATUS_INVALID_DEVICE_REQUEST with a information field of zero indicating the number of bytes transferred. I then call WdfCompleteRequestWithInformation. In most cases this seems fine but there are a few IOCTL codes that produce: Break instruction exception - code 80000003 (first chance) nt!DbgBreakPoint: fffff800`01026cd0 cc int 3 1: kd> in the debugger. The stack trace for this looks like: nt!DbgBreakPoint wdf01000!FxRequest::CompleteInternal+0x182 wdf01000!imp_WdfRequestCompleteWithInformation+0x12e iwrstreo!WdfRequestCompleteWithInformation+0x2e iwrstreo!UsbSamp_EvtIoDeviceControl+0x2a wdf01000!FxIoQueue::DispatchRequestToDriver+0x6d9 wdf01000!FxIoQueue::DispatchEvents+0x83e wdf01000!FxIoQueue::QueueRequest+0x4a6 wdf01000!FxPkgIo::Dispatch+0x718 wdf01000!FxDevice::Dispatch+0xa9 nt!IopXxxControlFile+0xa79 nt!NtDeviceIoControlFile+0x56 nt!KiSystemServiceCopyEnd+0x3 ntdll!NtDeviceIoControlFile+0xa 0x1`00020615 0x1`00000002 0x1 0x1`0005afd0 0x0 0x1`0005bb48 Needless to say I am baffled. I am not sure why some IOCTL codes are fine and others are not. Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108595
  - 18
    - BOD on using usb ethernet Hi, I have been using an USB ethernet device to connect. Last couple of days, I noticed that the LAN would get disconnected automatically. Then, I saw a crash with the blue screen. Now, its happening almost every hour. Any idea what the problem is?. It was device which was functioning perfectly fine for over 4 months. I tried an update driver but no help. Could something be wrong with the USB port?. I have tried it another port. Its been an hour and no crash. Any clues what might be wrong?. I am on XP. If the USB port is a little lose, could there be some problem?. If so, how can I fix it?. Thanks Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108580
  - 19
    - OverlappedIO - Q126282: is this applies to New windows OS also? Hi, I am using Overlapped IO structure in my driver for read, write operation and also for 1 DeviceIOControl out of 20. for rest of them, i am filling the Overlapped structure as NULL. I am executing a rigurous test of Two DeviceIoControl operations(One with OVL & other with NULL overlapped) with read operation, continuosly for a long period, i am observing that, when i start read operation, after some time other functions are failing. CPU utilization will be always 100% But during the read operation, if i give 1ms delay b/w each read, it is working fine with all operations. I was going through this article: Q126282: http://support.microsoft.com/kb/126282/en-us#appliesto Output behaviour of this article is appears to be similar with above observation, but it says that, it is applicable to old OS, i am finding this observation in Vista. I tried to provide the other IOCTL with OVL structure also, but i didnt find any change. Any suggestions regarding this problem or OVL usage? Thanks, Prafulla Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108578
  - 20
    - Dynamic Enumeration Problem Hi, I have a PCI multi function device. I'm enumerating child devices dynamically. The enumeration happen whenever an interrupt is rasied. In DPC routine i had called the routine Bus_PlugInDevice() as mentioned in toaster (dynamic) sample. In adddevice i did the following. WDF_CHILD_LIST_CONFIG_INIT(&config, sizeof(PDO_IDENTIFICATION_DESCRIPTION), PCIEvtDeviceListCreatePdo // callback to create a child device. ); WdfFdoInitSetDefaultChildListConfig(DeviceInit, &config, WDF_NO_OBJECT_ATTRIBUTES); I get a BSOD after the callback routine PCIEvtDeviceListCreatePdo() is completed. Can any one let me know if i'm missing anything? Here is the crash dump and WDFLog. BugCheck 7E, {c0000005, aa168717, f88cc890, f88cc58c} Probably caused by : Wdf01000.sys ( Wdf01000! FxChildList::ProcessBusRelations+6d7 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 80526fc8 cc int 3 kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: aa168717, The address that the exception occurred at Arg3: f88cc890, Exception Record Address Arg4: f88cc58c, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". FAULTING_IP: Wdf01000!FxChildList::ProcessBusRelations+6d7 aa168717 6683780600 cmp word ptr [eax+6],0 EXCEPTION_RECORD: f88cc890 -- (.exr 0xfffffffff88cc890) ExceptionAddress: aa168717 (Wdf01000!FxChildList::ProcessBusRelations +0x000006d7) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 00000006 Attempt to read from address 00000006 CONTEXT: f88cc58c -- (.cxr 0xfffffffff88cc58c) eax=00000000 ebx=824adc40 ecx=00aa3044 edx=00000020 esi=aa198854 edi=8298bb18 eip=aa168717 esp=f88cc958 ebp=f88cc984 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210246 Wdf01000!FxChildList::ProcessBusRelations+0x6d7: aa168717 6683780600 cmp word ptr [eax+6],0 ds: 0023:00000006=???? Resetting default scope PROCESS_NAME: System ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". READ_ADDRESS: 00000006 BUGCHECK_STR: 0x7E DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE LOCK_ADDRESS: 805513e0 -- (!locks 805513e0) Resource @ nt!IopDeviceTreeLock (0x805513e0) Shared 1 owning threads Threads: 82dc83c8-01<*> 1 total locks, 1 locks currently held PNP_TRIAGE: Lock address : 0x805513e0 Thread Count : 1 Thread address: 0x82dc83c8 Thread wait : 0x2cea LAST_CONTROL_TRANSFER: from 804f79d7 to 80526fc8 STACK_TEXT: f88cc984 aa17a271 f88cc9ac 00000000 aa19a0f8 Wdf01000! FxChildList::ProcessBusRelations+0x6d7 f88cc9b4 aa17f835 f88cc9f8 82784960 aa199790 Wdf01000! FxPkgPnp::HandleQueryBusRelations+0x94 f88cc9cc aa1801c8 f88cc9f8 f88cc9fc aa17a0d6 Wdf01000! FxPkgFdo::PnpQueryDeviceRelations+0x7f f88cc9d8 aa17a0d6 82784960 f88cc9f8 00000000 Wdf01000! FxPkgFdo::_PnpQueryDeviceRelations+0x10 f88cc9fc aa163d9a 82605e70 f88cca24 aa163f9f Wdf01000! FxPkgPnp::Dispatch+0x26e f88cca08 aa163f9f 82067be0 82605e70 82605f28 Wdf01000! FxDevice::Dispatch+0x7f f88cca24 804edfe3 82067be0 82605e70 f88ccaa4 Wdf01000! FxDevice::DispatchWithLock+0x5d f88cca34 80587021 00000000 82dce300 82dce3e0 nt!IopfCallDriver+0x31 f88cca60 804f5b89 82067be0 f88cca80 82dce3e0 nt!IopSynchronousCall +0xb7 f88ccaa8 8058332d 00000000 82dcee50 00000001 nt!IopQueryDeviceRelations +0x45 f88ccac0 8058678f 82dce300 00000001 82067b88 nt!PipEnumerateDevice +0x23 f88ccd18 80586bce 82dce300 00000001 00000000 nt!PipProcessDevNodeTree +0x21b f88ccd4c 804f573d 00000003 80551440 8055a3fc nt!PiProcessReenumeration +0x60 f88ccd74 80533fe6 00000000 00000000 82dc83c8 nt!PipDeviceActionWorker +0x141 f88ccdac 805c4cce 00000000 00000000 00000000 nt!ExpWorkerThread+0x100 f88ccddc 805411c2 80533ee6 00000001 00000000 nt!PspSystemThreadStartup +0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 FOLLOWUP_IP: Wdf01000!FxChildList::ProcessBusRelations+6d7 aa168717 6683780600 cmp word ptr [eax+6],0 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Wdf01000!FxChildList::ProcessBusRelations+6d7 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Wdf01000 IMAGE_NAME: Wdf01000.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4549b23a STACK_COMMAND: .cxr 0xfffffffff88cc58c ; kb FAILURE_BUCKET_ID: 0x7E_Wdf01000!FxChildList::ProcessBusRelations+6d7 BUCKET_ID: 0x7E_Wdf01000!FxChildList::ProcessBusRelations+6d7 Followup: MachineOwner --------- WDFLog ------- 74: FxPkgPnp::Dispatch - WDFDEVICE 0x7D87B3A0 !devobj 0x82067BE0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) IRP 0x8206ABB0 75: FxPkgFdo::PnpQueryDeviceRelations - Entering QueryDeviceRelations handler, type 0 76: FxChildList::ProcessBusRelations - Nothing to report on WDFCHILLIST 7D300268, returning early 77: FxChildList::ProcessModificationsLocked - Begin processing modifications on WDFCHILDLIST 7D300268 78: FxChildList::ProcessModificationsLocked - end processing modifications on WDFCHILDLIST 7D300268 79: FxChildList::ProcessBusRelations - Nothing to report on WDFCHILLIST 7DB523B8, returning early 80: FxChildList::ProcessModificationsLocked - Begin processing modifications on WDFCHILDLIST 7DB523B8 81: FxChildList::ProcessModificationsLocked - end processing modifications on WDFCHILDLIST 7DB523B8 82: FxPkgPnp::HandleQueryBusRelations - WDFDEVICE 7D87B3A0, returning 0xc00000bb(STATUS_NOT_SUPPORTED) from processing bus relations 83: FxPkgFdo::PnpQueryDeviceRelations - Exiting QueryDeviceRelations handler, status 0xc00000bb(STATUS_NOT_SUPPORTED) 84: FxWmiIrpHandler::Dispatch - WDFDEVICE 0x7D87B3A0 !devobj 0x82067BE0 IRP_MJ_SYSTEM_CONTROL, 0x0000000b(IRP_MN_REGINFO_EX) IRP 0x82783E28 85: imp_WdfChildListAddOrUpdateChildDescriptionAsPresent - Enter: WDFCHILDLIST 7DB523B8 86: FxChildList::ProcessModificationsLocked - Begin processing modifications on WDFCHILDLIST 7DB523B8 87: FxChildList::ProcessModificationsLocked - entry 8298BB18, mod state is 0x00000001(ModificationInsert) 88: FxChildList::ProcessModificationsLocked - marking entry 8298BB18 as needing instantiation 89: FxChildList::ProcessModificationsLocked - end processing modifications on WDFCHILDLIST 7DB523B8 90: imp_WdfChildListAddOrUpdateChildDescriptionAsPresent - Exit: WDFCHILDLIST 7DB523B8, STATUS_SUCCESS 91: FxPkgPnp::Dispatch - WDFDEVICE 0x7D87B3A0 !devobj 0x82067BE0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) IRP 0x82605E70 92: FxPkgFdo::PnpQueryDeviceRelations - Entering QueryDeviceRelations handler, type 0 93: FxChildList::ProcessBusRelations - Nothing to report on WDFCHILLIST 7D300268, returning early 94: FxChildList::ProcessModificationsLocked - Begin processing modifications on WDFCHILDLIST 7D300268 95: FxChildList::ProcessModificationsLocked - end processing modifications on WDFCHILDLIST 7D300268 96: FxChildList::ProcessBusRelations - Creating PDO device object from reported device 97: imp_WdfChildListGetDevice - Enter: WDFCHILDLIST 7DB523B8 Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108577
  - 21
    - How to get Physical NIC in system? Hi, I want to get all physical NIC in system. GetAdapterInfo returns all Miniport even if it is virtual adapter. I tried with Setupdi api. It also returns all miniport including virtual adapter. Could you please tell me that how can I achieve it? Thanks and Regards, Anand Choubey Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108576
  - 22
    - How to get the partition letter from the disk notification? Hi, my driver registers for notification of GUID_DEVINTERFACE_DISK and then monitors GUID_IO_MEDIA_ARRIVAL and GUID_IO_MEDIA_REMOVAL, but I now need to access the associated partition for file access. How to get it? I relied on IOCTL_MOUNTDEV_QUERY_DEVICE_NAME request but it returns something like "Device\Harddisk1\DRxx", I add "\filename" but it is not accepted by ZwCreateFile. How to map the symbolic link received by GUID_DEVINTERFACE_DISK to the partition letter or partition symbolic link in order for ZwCreateFile to work? Thanks, Roger Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108573
  - 23
    - Get Resources ? Hi In my hardware, i use more than one Memory Range, example : Memory Range 000A0000 - 000BFFFF Memory Range 000E0000 - 000EFFFF Can I get the base address for both memory range in Start device routine in wdm driver or EvtDevicePrepareHardware in WDF driver? and also how can i differentiate both baseaddress (memory)? Regards - Dsrking Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108572
  - 24
    - Two HID report descriptor in one interface Hello. I am going to implement HID keyboard and consumer COLLECTIONs in one interface. I have tried this but I don't know if this is possible. If not, I am going to make 2 interfaces. I have posted this question before and some one tell me to post descriptor. Below is my report descriptor . I have also tried putting consumer descriptor in front of keyboard, but only keyboard has worked as when keyboard comes first. Please answer. Thanks. HID_REPORT_DESCRIPTOR DefaultReportDescriptor[] = { 0x05,0x01, //USAGE_PAGE (Generic Desktop) 05 01 0x09,0x06, //USAGE (Keyboard) 09 06 0xA1,0x01, //COLLECTION (Application) 0x05,0x07, // USAGE_PAGE (Keyboard) 05 07 0x19,0xE0, // USAGE_MINIMUM (Keyboard LeftControl) 19 E0 0x29,0xE7, // USAGE_MAXIMUM (Keyboard Right GUI) 29 E7 0x15,0x00, // LOGICAL_MINIMUM (0) 15 00 0x25,0x01, // LOGICAL_MAXIMUM (1) 25 01 0x75,0x01, // REPORT_SIZE (1) 75 01 0x95,0x08, // REPORT_COUNT (8) 95 08 0x81,0x02, // INPUT (Data,Var,Abs) 81 02 0x95,0x01, // REPORT_COUNT (1) 95 01 0x75,0x08, // REPORT_SIZE (8) 75 08 0x81,0x03, // INPUT (Cnst,Var,Abs) 81 03 0x95,0x06, // REPORT_COUNT (6) 95 06 0x75,0x08, // REPORT_SIZE (8) 75 08 0x15,0x00, // LOGICAL_MINIMUM (0) 15 00 0x25,0x90, //0, // LOGICAL_MAXIMUM (101) 25 65 0x05,0x07, // USAGE_PAGE (Keyboard) 05 07 0x19,0x00, // USAGE_MINIMUM (Reserved (no event indicated)) 19 00 0x29,0x90, // USAGE_MAXIMUM (Keyboard Application) 29 65 0x81,0x00, // INPUT (Data,Ary,Abs) 81 00 0x05, 0x0C, // USAGE_PAGE (Consumer Devices) 05 0C 0x09, 0x01, // USAGE (ConsumerControl) 09 01 0xA1, 0x01, //COLLECTION (Application) 0x09, 0xcd, // USAGE (Play/Pause) 0x15, 0x01, // LOGICAL_MINIMUM (1) 0x25, 0x01, // LOGICAL_MAXIMUM (1) 0x75, 0x04, // REPORT_SIZE (4) 0x95, 0x01, // REPORT_COUNT (1) 0x81, 0x00, // INPUT (Data,Ary,Abs) 81 00 0x15, 0x04, // LOGICAL_MINIMUM (4) 0x81, 0x03, // INPUT (Cnst,Var,Abs) 0xC0, //END_COLLECTION C0 0xC0 //END_COLLECTION C0 } Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108571
  - 25
    - How to get Full Image path in NotifyRoutine I have register a callback by PsSetLoadImageNotifyRoutine, But I got a relative path such \Test\A.exe,I want to get the a absolute path, e.g. D:\Test\A.exe or \Device\HardDiskVolume2\Test\A.exe How can I get it in the callback? Thanks Tag: poolmon and mysterious driver which leaks like a sieve? Tag: 108562

Hi guys,

i have here a hungry little driver process that seems to be leaking: (sorry
for the formatting)

System pool information
Tag Type Allocs Frees Diff Bytes Per Alloc
Mapped_Driver

OCSD Nonp 57616 ( 1) 48338 ( 1) 9278 5858256 ( 0)
631 Unknown Driver

I got this info from Poolmon.exe... so i'm trying to identify what driver
OCSD is.. what file is loading it etc... any ideas on doing this? i am using
the -g flag already :S
Thanks Jeff

Top

RE: poolmon and mysterious driver which leaks like a sieve? by Deepakumar

Deepakumar
Tue Aug 26 01:08:02 CDT 2008

> I got this info from Poolmon.exe... so i'm trying to identify what driver
> OCSD is..

Run the following command to search for the driver having the tag OCSD:
findstr /S /m /l hOCSD *.sys

Top

Re: poolmon and mysterious driver which leaks like a sieve? by Doron

Doron
Tue Aug 26 13:56:30 CDT 2008

you might need to look it up in the correct endian form, e.g. DSCO

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.

"Deepakumar" <Deepakumar@discussions.microsoft.com> wrote in message
news:34E02A0F-108E-4E2F-9BFF-EF8011AF9289@microsoft.com...
>
>> I got this info from Poolmon.exe... so i'm trying to identify what driver
>> OCSD is..
>
> Run the following command to search for the driver having the tag OCSD:
> findstr /S /m /l hOCSD *.sys
>

Top

RE: poolmon and mysterious driver which leaks like a sieve? by Jeff

Jeff
Tue Aug 26 15:43:02 CDT 2008

Ah thanks! :) found the responsible driver.. in this case a product called
replistor from EMC.

Thanks for your help

"Deepakumar" wrote:

>
> > I got this info from Poolmon.exe... so i'm trying to identify what driver
> > OCSD is..
>
> Run the following command to search for the driver having the tag OCSD:
> findstr /S /m /l hOCSD *.sys
>

Top