How to stop Mirror Driver

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Drivers
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Regarding FastFat Hi all, I'm still trying to understand how the filesytem is working under XP. As a learning exercise I've written a small driver which locates, and hooks into the \FileSystem\FastFat driver - all I'm doing is replacing the function pointer in the FastFat dispatch-table with a pointer to a function in my driver, which looks like this: NTSTATUS NewDispatchRead(PDEVICE_OBJECT DeviceObj, PIRP Irp) { NTSTATUS status; PMDL Mdl = Irp->MdlAddress; PVOID Buffer; /* step1: lock down IRP here and access memory */ if(Mdl != 0) Buffer = MmGetMdlForNonPagedPool(Mdl, ...); status = OldDispatchRead(DeviceObj, Irp); /* step2: lock down IRP and access memory */ if(Mdl != 0) Buffer = MmGetMdlForNonPagedPool(Mdl, ...); return status; } OK, I don't want to get into a debate as to whether this is good practise or not (I know it isn't) - this is for experimental purposes only. So what I'm observing is the following: the "original" dispatch routine for FastFat IRP_MJ_READ generally returns STATUS_SUCCESS rather than STATUS_PENDING. This presumably means that the original handler has (during it's processing) set up it's own completion routine, called whatever the next driver might be with the IRP, and then waited for the completion routine to execute (using an event and KeWaitForxxx) before finally returning "yes, the read is complete" Does this diagnositic sound correct? So my conclusion from this is that the buffer described by Irp->MdlAddress should contain valid data when the OldDispatchRead function returns STATUS_SUCCESS, right? But....if you look at the code I posted, I have two steps (1+2). At step1, I can see the contents of the buffer no problems (using ProbeForRead etc). But this is not useful because the buffer hasn't been filled up by the read operation yet. What I really want to do is access the buffer contents at step2 (after the OldDispatchRead) but the memory range the Mdl references seems to be invalid at this point - so my second conclusion is that the normal FastFat IRP_MJ_READ function completes the read operation and then frees the memory referenced by the Mdl in the original IRP. Does this sound correct? So my next goal is to somehow access the buffer the Mdl references *after* the original dispatch routine has returned. My current "hack" is to do this at step 1: Mdl = IoAllocateMdl(IoCurrentStack->UserBuffer); MmBuildMdlForNonPagedPool(Mdl); MmMapLockedPages(Mdl, KernelMode); /* call the original dispatch routine */ and then this at step 2: PVOID Buffer = MmGetSystemAddressForMdlSafe(Mdl, LowPriority); MmUnmapLockedPages(Buffer, Mdl); IoFreeMdl(Mdl); I can now access the Buffer and see the results of the read operation!!! But I'm pretty wary of why this is even possible, or even legal, as I'm assuming that the original memory range has been freed, and the Mdl I build myself points to "dirty" pages that by chance contain valid data . So, could someone please explain what the effect is of locking down the buffer in this manner, why it is unsafe, any better methods to achieve what I want...? Note: FileSystem filter driver is too much for my needs, this is just a quick one-off experiment, but I'd like to know what's really happening here. Cheers, James Tag: How to stop Mirror Driver Tag: 35928
  - 2
    - Accessing flash pcmcia under W2K/XP Hi, I am trying to develop a driver that runs under W2K and XP, allowing the bitwise reading/writing of a Flash/ATA pcmcia card by absolute memory location. I have access to a previous driver that worked under NT by accessing the APSoft CardWare API, which uses the Card Services protocol, but W2K and XP don't support that protocol so I have to start from scratch. Can anybody point me towards any resources that will help me? My project can afford to buy driver software such as CardWare, but I'd need the SDK for code examples. Alternatively I could (I assume) use the OS's native support, but I don't know how to even start! Thanks Jim Tag: How to stop Mirror Driver Tag: 35924
  - 3
    - PDEV_BROADCAST_HDR is NULL I register for device notification by specifying DEVICE_NOTIFY_WINDOW_HANDLE and the ClassGuid. #1 is the ClassGuid from the inf file the correct guid to register for? #2 in my handler I have this code under WM_DEVICECHANGE PDEV_BROADCAST_HDR pHdr = reinterpret_cast<PDEV_BROADCAST_HDR>(lParam); if( pHdr && pHdr->dbch_devicetype == DBT_DEVTYP_DEVICEINTERFACE ) pHdr is always NULL So I am a litle confused as to what I can do. Without Phdr I really cannot even say it was the device I was looking for or if it was removed or arrived. Thanks for any suggestions. -- Mike Pulice http://www.puliceworx.com Tag: How to stop Mirror Driver Tag: 35917
  - 4
    - wpa-psk Hello, I have googled this but havn't found any answers just questions. I want to get wpa-psk with tkip up and running. at the moment I guess I am not authenticated because I don't get any ip address from the dhcp. I use hmac_sha1 algorithm to create the key material (is this the right one to use?)http://www.deadhat.com/wlancrypto/ http://www.deadhat.com/wlancrypto/password_hashing.c I don't get any error when I make the ndis requests. Since I havn't set any KeyIndex on the access point should that be left out in the NDIS_802_11_KEY? when I set NDIS_802_11_WEP_STATUS should I use Ndis802_11Encryption2Enabled or Ndis802_11Encryption2KeyAbsent? (if I try to use KeyAbsent I get NDIS_STATUS_NOT_ACCEPTED back from the request) Since I can't think of anything that can be wrong except the key material (and keyindex - wep_status), is there somehow I can verify that my key has the correct format? Since there isn't that many new oids from using wep I assume I shouldn't be that difficult to get it working. I have set OID_802_11_AUTHENTICATION_MODE to Ndis802_11AuthModeWPAPSK the OID_802_11_ENCRYPTION_STATUS as I wrote above not sure which one to use but it is fairly easy to test a few values to see if it works so it gets down to OID_802_11_ADD_KEY and with this one I can only think of the key material. any ideas? thanks /Niklas Tag: How to stop Mirror Driver Tag: 35904
  - 5
    - USB MOUSE- WDM hello everyone, i'm told o start with "Usb 2.0 drivers" under "wdm architecture"(win 2k). The preferred device was "Usb Mouse". Now, i'm in a dilemma where to start with. Do i have to know about Human input devices(hid) and exactly where my usb mouse driver will fit in the wdm-hid-usb drivers. how to proceed. can anyone give me some guidance. just reading ddk and wdm didnt help me, i'm not getting a starting point and where to start with. and also can anyone suggest me a good USB book which will explain the concepts, by any author Thanks in advance, hope i get the answers to my querries -- Prashanth R M -------------------------------------------------------- Global Edge Software Ltd. No. 218, JP Royale, Sampige road, Bangalore- 560003 Voice: 3467944 (ext) 475, Mobile : 98861-45641 Fax:3467948 Tag: How to stop Mirror Driver Tag: 35903
  - 6
    - usbser.sys changes between 2k and XP? Hi, We use usbser.sys to provide a basic virtual serial port for communication with a number of different devices over USB. This has always worked well, but recently we have had reports of intermittent BSOD stop errors under windows XP when transferring data from a device to the PC. This can be reproduced regularly. (see end of post) The BSOD has not been observed on any other platform, and if we replace usbser.sys on XP machines with the 2k version, then the BSOD is not seen. We have observed that our data rate under XP is higher than 2k, and there has obviously been a rearchitecture of the USB stack in XP. Does anybody know the nature of the changes made to usbser.sys between 2k and XP that might result in stop errors? Also, our software that communicates with serial ports is multithreaded - is usbser.sys thread-safe? Thanks for any ideas, Gavin. ///////////////////////////////// *************************************************************************= ****** * =20 *=20 * Bugcheck Analysis =20 *=20 * =20 *=20 *************************************************************************= ****** Use !analyze -v to get detailed debugging information.=20 BugCheck 1000008E, {c0000005, fa1f69fd, f923fad0, 0}=20 *** WARNING: Unable to verify timestamp for usbser.sys=20 *** WARNING: Unable to verify timestamp for Modem.SYS=20 Probably caused by : usbser.sys ( usbser!WaitOnMask+13d )=20 Followup: MachineOwner=20 ---------=20 kd> !analyze -v C:\XP_crashData\Mini110503-01.dmp=20 Unknown option '-0'=20 *************************************************************************= ****** * =20 *=20 * Bugcheck Analysis =20 *=20 * =20 *=20 *************************************************************************= ****** KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)=20 This is a very common bugcheck. Usually the exception address pinpoints=20 the driver/function that caused the problem. Always note this address=20 as well as the link date of the driver/image that contains this address.=20 Some common problems are exception code 0x80000003. This means a hard=20 coded breakpoint or assertion was hit, but this system was booted=20 /NODEBUG. This is not supposed to happen as developers should never have=20 hardcoded breakpoints in retail code, but ...=20 If this happens, make sure a debugger gets connected, and the=20 system is booted /DEBUG. This will let us see why this breakpoint is=20 happening.=20 An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates=20 that an unaligned data reference was encountered. The trap frame will=20 supply additional information.=20 Arguments:=20 Arg1: c0000005, The exception code that was not handled=20 Arg2: fa1f69fd, The address that the exception occurred at=20 Arg3: f923fad0, Trap Frame=20 Arg4: 00000000=20 Debugging Details:=20 ------------------=20 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".=20 FAULTING_IP:=20 usbser!WaitOnMask+13d=20 fa1f69fd ?? ???=20 TRAP_FRAME: f923fad0 -- (.trap fffffffff923fad0)=20 Unable to read trap frame at f923fad0=20 DEFAULT_BUCKET_ID: DRIVER_FAULT=20 BUGCHECK_STR: 0x8E=20 LAST_CONTROL_TRANSFER: from fa1f61da to fa1f69fd=20 STACK_TEXT: =20 f923fb5c fa1f61da 02295c08 811be1f0 81295d00 usbser!WaitOnMask+0x13d=20 f923fb88 804eca36 811be040 81295c08 8120a3c0 usbser!UsbSer_Dispatch+0x25a=20 f923fb98 fa17808c 8120a40c 81295d08 8120a3c0 nt!IopfCallDriver+0x31=20 f923fbc0 fa178cb0 8120a3c0 8120a308 001b0048 Modem!UniMaskStarter+0x23a=20 f923fbd8 fa1790e3 8120a3c0 8120a3c8 81295c08 Modem!UniStartOrQueue+0x5c=20 f923fc00 fa17773c 8120a308 81295c08 8116b958 Modem!UniSniffOwnerSettings+0xe7=20 f923fc34 804eca36 8120a308 81295c08 806c7fe0 Modem!UniIoControl+0x5f8=20 f923fc44 8058b076 81295d08 ffa8c028 81295c08 nt!IopfCallDriver+0x31=20 f923fc58 8058bc62 8120a308 81295c08 ffa8c028 nt!IopSynchronousServiceTail+0x5e=20 f923fd00 805987ec 000002ec 000002e4 00000000 nt!IopXxxControlFile+0x5ec=20 f923fd34 804da140 000002ec 000002e4 00000000 nt!NtDeviceIoControlFile+0x28=20 f923fd34 7ffe0304 000002ec 000002e4 00000000 nt!KiSystemService+0xc4=20 0249fa70 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4=20 FOLLOWUP_IP:=20 usbser!WaitOnMask+13d=20 fa1f69fd ?? ???=20 FOLLOWUP_NAME: MachineOwner=20 SYMBOL_NAME: usbser!WaitOnMask+13d=20 MODULE_NAME: usbser=20 IMAGE_NAME: usbser.sys=20 DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8690=20 STACK_COMMAND: .trap fffffffff923fad0 ; kb=20 BUCKET_ID: 0x8E_usbser!WaitOnMask+13d=20 Tag: How to stop Mirror Driver Tag: 35901
  - 7
    - Windows Update Driver Publishing - really no coinstaller allowed? Hi there, I work for a graphics card manufacturer and we'd really like to use Windows Update to distribute driver upgrades. However, our driver ships with a co-installer dll that does certain vital bits of PnP arcana that are necessary on Win2K. According to the document at http://www.microsoft.com/whdc/hwdev/driver/WinUp.mspx, "Drivers must install core functionality from the INF file. (snip). There can be no setup utilities for files that provide core device functionality." Does this mean we're not allowed to have a co-installer? Many thanks, Reuben Harris Tag: How to stop Mirror Driver Tag: 35898
  - 8
    - keyboard filter driver in Win Me, I need help! Hello! I made a keyboard upper filter driver (WDM) for Win XP several months ago. It works without any problems. And now I need to redevelop for Win Me. As I read in documentation, WDM drivers are supported also by 98/Me. But I didn't understand can I use in 98/Me such technology as in XP (compiling WDM driver for Win Me, adding upperfilters value in keyboard key). So I have 3 questions: Is it possible to attach WDM filter driver to VxD drivers in Win98/ME? And how? How can I make filtration of input data from keyboard/mouse? Thanks! Tag: How to stop Mirror Driver Tag: 35897
  - 9
    - Can someone help?! PCMCIA LogConfigOverride Hi, I have a PCMCIA which I need to have an I/O Window mapped to it and I require the PCMCIA bus controller to use the wait signal to access the i/o registers on my card. After searching high and low for the past few days, I realised that I can specify logConfigOverride section in the .inf file. The thing is there are so many things to it that I think I am getting everything wrong and my driver installation keeps crashing my PC. Here is what I have: [card.override0] ConfigPriority = NORMAL IOConfig = 128@fd00-fdff IRQConfig = 9 PCCardConfig = 1:0(W XI1) First of all I will like to know what is the address range specified in the IOConfig directive. I took the address range above from the resource properties of my PCMCIA card bus controller (in Device Manager). Then for the PCCardConfig, what is the configuration index? Is it the mask of the configuration option register of PCMCIA card? Finally, if I use the method above, does that mean that my driver installation will only work on my pc? Tag: How to stop Mirror Driver Tag: 35896
  - 10
    - questions about USB bandwidth consumption under Windows2000 professional Hi, I have some questions about USB device bandwidth consumption under platform of Windows2000 Professional. 1/ How does OS calculate each USB device bandwidth consumption? 2/ is there any relations between the bandwidth consumption and the driver of USB device ? or the bandwidth consumption is only determined by USB device? Any advices are appreciated! Tag: How to stop Mirror Driver Tag: 35891
  - 11
    - How to prevent USB surprise removal dialog box on Windows ME/2000? I would write a program to trigger the usb device to replug in. However, USB surprise removal dialog box always pops up. Is it possible to prevent this dialog box from the user mode program? Best Regards Jackal Huang Tag: How to stop Mirror Driver Tag: 35890
  - 12
    - why PassThru couldn't pass ChkINF test? When I tested PassThru, a sample IM driver in Windows 2003 DDK,with HCT 11.2 ChkINF, I found the following error "Line 33: ERROR: (DE22.19.4011) The AddService ServiceName parameter must match the NDI\Service entry in the Registry. " Can't the sample driver supplied by Microsoft pass the HCT test? Tag: How to stop Mirror Driver Tag: 35882
  - 13
    - Trouble loading WIA minidriver DLL under Windows 2000 I have a problem related to a WIA minidriver. I'm not sure which newsgroup is the correct one for this; let me know if there is a more appropriate group. I've created a WIA scanner minidriver that loads and works fine on Windows XP. I also intend for this minidriver DLL to provide STI functionality in Windows 2000 and Windows 98. My problem is that this WIA/STI DLL is not getting loaded under Windows 2000 for some reason. The STI_Trace.log file contains only the following error line: e STISVC [stisvc.exe::0x65c] Could not open device ({6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0001) . Received from STI: hResult=(80040154). Object not maintained Win2K does not like my DLL for some reason. My entry point function never gets called. However, under Windows XP and Windows 98ME my DLL does get loaded. These are the only three Windows versions I've tried so far. I do have two other working minidrivers I can use as references. One, of course, is the DDK WIA sample scanner minidriver. The other is an existing scanner product that currently works under Win2K, although its STI DLL was not built by me. I believe that my INF file is correct and the registry entries all look good to me. Anyway, to rule out those possibilities, I decided to install the other working scanner product and then rename and substitute my own WIA DLL in place of the other DLL. When I did this, my DLL was still not loaded. But when I substituted the WIA sample scanner DLL, that DLL is loaded ok---its entry point gets called. It's only my DLL that will not get loaded. So there is apparently no problem with the registry, and the DLL can be found. It just won't get loaded and get its entry point called for some reason. I then compared my DLL with the WIA sample minidriver to see what could be different. I built both using the build utility and the Windows XP SP1 DDK, build 2600.1106. I initially had a different entry point than the sample scanner. I was using _DllMainCRTStartup because my DLL uses the C runtime library---in fact, it uses STL as well. So normally I see my DllMain() function get called by _DllMainCRTStartup . But to make sure this wasn't the problem, I made my entry point to be "DllEntryPoint" to match the WIA sample code (remembering to specify DLLENTRY=DllEntryPoint in the sources file of course). But this did not help. I checked the exports (using DUMPBIN) to make sure both DLLs have the same exports. The only difference is the DliHook export in the sample minidriver, but that should not matter. I then compared the "sources" files. Mine is almost the same as the sample minidriver's. There are only two differences. Since I'm using STL, I need to set USE_STL=1 and USE_NATIVE_EH=1. Other than that they look the same. So why does my DLL not get loaded under Win2K?? It should not be a problem with a GUID---the DLL entry point does not even get called. So Windows doesn't even know anything about the GUID yet. The only thing I can imagine is that my entry point looks different in some way, maybe of because the way it was compiled. But I cannot see any significant difference between how my DLL and the sample minidriver are built. Tag: How to stop Mirror Driver Tag: 35880
  - 14
    - Capturing Unicode string in DrvTextOut Hi, I am writing a virtual printer driver for WinXP. In DrvTextOut(), I need to capture and record the Unicode text string to be printed. Sometimes, this string is contained in STROBJ->pwszOrg. However, when STROBJ->flAccel contains SO_GLYPHINDEX_TEXTOUT, "pwszOrg points to an array of glyph indexes, rather than a Unicode array." As hard as I tried, I could not figure out how to convert this array of glyph indexes back into Unicode characters. Am I missing something here? Please help! Regards. Tag: How to stop Mirror Driver Tag: 35878
  - 15
    - a keybaord/mousr filter driver Hi, After reviewing some website (http://www.sysinternal.com) I programmed a keyboard/mouse filter driver. But there is something strange. I have a global variable to control whether to ignore keyboard scan code: if (ignore) { for (i=0; i<numOfKey; i++) KeyData[i].makecode=0; } I initialized the variable "ignore=0" in DriverEntry but once I rebooted my PC, the driver starts working and my keyboard does not have any respond. It seems that the variable ignore is non-zero even I initialized it with zero!! Can anoyone help? Tag: How to stop Mirror Driver Tag: 35875
  - 16
    - Parallel and/or serial port What are the requirments for programming using these ports ie. picking data sending data etc. My programming language is C#.NET or VB.NET Tag: How to stop Mirror Driver Tag: 35874
  - 17
    - compilation error: ConvertStringSecurityDescriptorToSecurityDescriptor I am comliling user-mode dll from DDK build window (DDK version 3790). After I added security attributes code, I get compilation errors. I tried to include "sddl.h" file. I even tried to give include path for sddl.h. But still "Cannot open file sddl.h". I dont see sddl.h anywhere in c:\winddk. I found few DACL related definitions in wdm.h which is included in my workspace. How can I compile code with function "ConvertsecurityDescriptorToSecurityDescriptor" from DDK window. TARGETTYPE=DYNLINK DLLENTRY=DLLMain TARGETLIBS=$(SDK_LIB_PATH)\kernel32.lib \ $(SDK_LIB_PATH)\user32.lib \ $(SDK_LIB_PATH)\setupapi.lib \ $(SDK_LIB_PATH)\winmm.lib \ $(SDK_LIB_PATH)\advapi32.lib USE_MAPSYM=1 USE_MSVCRT=1 DEBUG_CRTS=1 UMTYPE=windows USER_C_FLAGS=/FAcs SYNCHRONIZE_BLOCK=1 INCLUDES=..\..\inc; \ ..\..\driver\common; \ c:\winddk\inc\wnet; \ c:\Program Files\Microsoft Platform SDK\Include; \ C:\Program Files\Microsoft SDK\Include SOURCES= 1394apidll.c \ 1394dllmain.c Tag: How to stop Mirror Driver Tag: 35865
  - 18
    - Parallel port direct i/o? Hi, is it possible to program the parallel port with system-supplied drivers? The DDK help says something like "raw access to ports", but it seems it is only for controlling printers. I need to program the port directly, i.e. setting and releasing port lines. At the moment, I'm using this "user-mode- security-hack-driver" and inb/outb calls. Do I have to do these inb/outb calls in kernel mode to have a reliable communication without scheduler- interrupts? I'm doing time-critical communication over the port but the scheduler switches in stages where it mustn't. Are kernel drivers "safe" from unwanted scheduler switches or would it also don't work? Thanks for your help. Thomas Tag: How to stop Mirror Driver Tag: 35858
  - 19
    - Talk to RAIDs (Promise/Adaptec)? Eliyas: How do you talk to a RAID miniport? Specifically to get the status of the drives masked by the driver. Samples/specs/IOCTL's/structures unique to RAIDS greatly appreciated. Regards, Jorg Tag: How to stop Mirror Driver Tag: 35856
  - 20
    - How to develop netmeeting like app I need to develop an application that takes control over tcp/ip on a client computer by specifing the client ip and port. This app will need to show the client desktop as he see it and have access to its machine. Any ideas? Ron Tag: How to stop Mirror Driver Tag: 35853
  - 21
    - USB performance I have been measuring the performance of a USB 2.0 device we have developed and a driver based on the code provided in the Walter Oney book and discovered some strange things. 1. On dual processor machines, the throughput is 50% greater when one of the processors is removed. This is under Windows 2000 SP4. 2. On some machines, the throughput is more than twice as much under USB1 than under USB2. This is generally with USB1 ports integrated on the motherboard and with a PCI USB2 card. This has only been observed under Windows 2000, never under XP. I wonder if anyone else has observed similar behaviour, or has ideas as to how I could investigate further. Regards, John Hall Tag: How to stop Mirror Driver Tag: 35850
  - 22
    - digital still camera sony dsc p1 I want to enum the stillimage-devices but the enumerator has the count 0. But I have a digitalcamera plugged in into the USB-Port and XP is showing a trayicon that can remove the device. A USB-Digitalcamera has to be a WIA-Device so why isn t it showing in the enumerator? Thanks for replies. Tag: How to stop Mirror Driver Tag: 35843
  - 23
    - BugCheck 0x7e Hi, My driver bugchecks after the AddDevice routine. The meaning is SYSTEM_THREAD_EXCEPTION_NOT_HANDLED with code STATUS_ACCESS_VIOLATION. I need help debugging this issue. *** Fatal System Error: 0x0000007e (0xC0000005,0x8051FCDD,0xFD5BB930,0xFD5BB630) Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE Loading Kernel Symbols ........................................................... .......................... Loading unloaded module list .... Loading User Symbols *********************************************************** ******************** * * * Bugcheck Analysis * * * *********************************************************** ******************** Use !analyze -v to get detailed debugging information. BugCheck 7E, {c0000005, 8051fcdd, fd5bb930, fd5bb630} Probably caused by : ntoskrnl.exe ( nt! IovUtilMarkDeviceObject+9 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 805103fa cc int 3 kd> !analyze -v *********************************************************** ******************** * * * Bugcheck Analysis * * * *********************************************************** ******************** SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 8051fcdd, The address that the exception occurred at Arg3: fd5bb930, Exception Record Address Arg4: fd5bb630, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "% s". FAULTING_IP: nt!IovUtilMarkDeviceObject+9 8051fcdd 8b81b0000000 mov eax,[ecx+0xb0] EXCEPTION_PARAMETER1: fd5bb930 CONTEXT: fd5bb630 -- (.cxr fffffffffd5bb630) eax=00000000 ebx=00000000 ecx=00000000 edx=00000002 esi=ffbc5960 edi=00000000 eip=8051fcdd esp=fd5bb9f8 ebp=fd5bba04 iopl=0 nv up ei pl nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 nt!IovUtilMarkDeviceObject+9: 8051fcdd 8b81b0000000 mov eax,[ecx+0xb0] Resetting default context DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from 804d6946 to 8051fcdd STACK_TEXT: fd5bb9f4 804d6946 8112a0e8 00000000 fd5bba60 nt!IovUtilMarkDeviceObject+0x9 fd5bba04 80554a53 81133190 00000000 00000001 nt! IovUtilMarkStack+0x54 fd5bbacc 8055a657 00000000 05000001 81133190 nt!PipCallDriverAddDevice+0x404 fd5bbd18 8055af62 81248590 00000001 00000000 nt!PipProcessDevNodeTree+0x147 fd5bbd4c 804d7125 00000003 80549fc0 8054eddc nt!PiProcessReenumeration+0x5e fd5bbd74 804ed629 00000000 00000000 81259020 nt!PipDeviceActionWorker+0x133 fd5bbdac 8057c73a 00000000 00000000 00000000 nt! ExpWorkerThread+0xfe fd5bbddc 805124c1 804ed556 00000001 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt! KiThreadStartup+0x16 FOLLOWUP_IP: nt!IovUtilMarkDeviceObject+9 8051fcdd 8b81b0000000 mov eax,[ecx+0xb0] FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: nt!IovUtilMarkDeviceObject+9 MODULE_NAME: nt IMAGE_NAME: ntoskrnl.exe DEBUG_FLR_IMAGE_TIMESTAMP: 3d6de35c STACK_COMMAND: .cxr fffffffffd5bb630 ; kb BUCKET_ID: 0x7E_nt!IovUtilMarkDeviceObject+9 Followup: MachineOwner --------- TIA Dayalan. Tag: How to stop Mirror Driver Tag: 35839
  - 24
    - USB MIDI device driver development I'd completed the design of the hardware side of a USB MIDI music keyboard. However, I have no idea what will be the Windows XP device driver development. I read some books on the Windows WDM already but still have no idea. I understand that Windows XP/2K had USB-MINI class driver but don't know what else is needed? Can someone give me some pointer on what is needed? I had experienced in the VxD but not WDM Thanks Kan. Tag: How to stop Mirror Driver Tag: 35836
  - 25
    - hibernate & WM_POWERBROADCAST Hi, is it possible to send "BROADCAST_QUERY_DENY", from my application to Operatibg system . i want to do that to avoid waiting for Operating system message. Tag: How to stop Mirror Driver Tag: 35834
- Next
  - 1
    - Help on NDIS WDM (USB) Miniport for Win9x Hello Everyone, I am writing NDIS-WDM Miniport Driver for my USB Network Device. I have the sample code from Eliyas. I am able to understand the Win2k/XP way of NDIS-WDM as NDIS5.x supports built-in NDIS-WDM functionality. I want to understand what additions or changes required for making the NDIS-WDM (USB) miniport driver work on Win98/Me. Thanks in advance for the great help. Best Regards, GNRaj Tag: How to stop Mirror Driver Tag: 35831
  - 2
    - Creation of a file on Win ME OS I used ZwCreateFile to create a file in Win ME OS. I got a blue screen saying Windows Protection Error. According to Walter Oney ZwXXX routines are not supported by Win 9x and if used an error similar to what I have got will be seen. Is there any other way to create a file in kernel mode on Win ME OS? Tag: How to stop Mirror Driver Tag: 35828
  - 3
    - PCMCIA Window Access Speed Wait Hello, I have a PCMCIA card that uses i/o window and I need to specify window access speed to use the wait signal. I wonder if anyone has any idea how I can specify this in my driver. Thanks. Regards, Wei Wei Tag: How to stop Mirror Driver Tag: 35827
  - 4
    - Do GCAPS_VECTORFONT and GCAPS_HIGHRESTEXT work, and if so how? Neither of these seem to function, at least on Win2K they don't. No matter if GCAPS_VECTORFONT is set the vector fonts always come through DrvStrokePath instead. And even if GCAPS_HIGHRESTEXT is set the coordinates for placement are just as LONGs, not at FIX resolution. Regards, Joe Hindmarsh Tag: How to stop Mirror Driver Tag: 35820
  - 5
    - Please help with this crashdump This crash dump is my only lead (for now) I don't understand it. Where is the instruction pointer, it seems to be 0. And virtually there is no stack trace because the first frame is not found If you can understand any of this please help out :) 1: kd> !analyze -v **************************************************************************** *** * * * Bugcheck Analysis * * * **************************************************************************** *** DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 00000000, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, value 0 = read operation, 1 = write operation Arg4: 00000000, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: 00000000 CURRENT_IRQL: 2 FAULTING_IP: +0 00000000 ?? ??? DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xD1 LAST_CONTROL_TRANSFER: from f6100b6c to 00000000 STACK_TEXT: f38a0b74 f6100b6c 86278008 8627df58 8627dfb8 0x0 WARNING: Stack unwind information not available. Following frames may be wrong. f38a0ba4 f60f7385 858dfc48 00000011 f38a0bd4 fwdrv+0xcb6c f38a0bb4 f60f5d25 858dfc48 864b0a08 864acca8 fwdrv+0x3385 f38a0bd4 f60f5d7e 864067e8 f38a0bec f60f639b fwdrv+0x1d25 f38a0be0 f60f639b 864067e8 f38a0bfc f60f5116 fwdrv+0x1d7e f38a0bec f60f5116 864067e8 00000139 f38a0c14 fwdrv+0x239b f38a0bfc f60f68de 864067e8 00000139 f38a0c94 fwdrv+0x1116 f38a0c14 f60f6c28 86585210 00000020 0000000e fwdrv+0x28de f38a0c30 f60f6d76 864b3af0 86585210 f38a0c64 fwdrv+0x2c28 f38a0c40 804eb3c1 864b3af0 86585210 806bb2cc fwdrv+0x2d76 f38a0c50 805644d2 86585280 8652e0e0 86585210 nt!IopfCallDriver+0x31 f38a0c64 805651f6 864b3af0 86585210 8652e0e0 nt!IopSynchronousServiceTail+0x5e f38a0d00 8055e288 000000a4 00000000 00000000 nt!IopXxxControlFile+0x5a6 f38a0d34 805306a4 000000a4 00000000 00000000 nt!NtDeviceIoControlFile+0x28 f38a0d34 7ffe0304 000000a4 00000000 00000000 nt!KiSystemService+0xc9 00f1ddbc 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4 FAILED_INSTRUCTION_ADDRESS: +0 00000000 ?? ??? FOLLOWUP_IP: fwdrv+cb6c f6100b6c 8945f8 mov [ebp-0x8],eax FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: fwdrv+cb6c MODULE_NAME: fwdrv IMAGE_NAME: fwdrv.sys DEBUG_FLR_IMAGE_TIMESTAMP: 3cbaab4f STACK_COMMAND: kb BUCKET_ID: 0xD1_CODE_AV_BAD_IP_fwdrv+cb6c Followup: MachineOwner --------- Tag: How to stop Mirror Driver Tag: 35809
  - 6
    - hibernate & WM_POWERBROADCAST Hi, is anyone can suggest how can i open an entry for os that can enter and observe if i permit to activate a hibernate or i deny hibernate activation?? Thanks Tag: How to stop Mirror Driver Tag: 35806
  - 7
    - print spooler driver PLEASE HELP every time i try to install my printer i get a message saying PRINT (SPOOL DRIVER STOPPED) AND THEN IT SAYS DO YOU WANT TO START DRIVER Y/N when i press the yes nothing happens . so i went into the drivers and tryed to start it but cant ! because one of its dependeces is ether stopped or up for deletion, but all are running PLEASE HELP THANKS Tag: How to stop Mirror Driver Tag: 35805
  - 8
    - Question: about hard drive serial numbers? hello, Does anybody know if there API or COM objects available to access the serial number of hard drives? The volume management functions appear to be specific just for the label :-( thank you in advance. beth Tag: How to stop Mirror Driver Tag: 35803
  - 9
    - Device Driver Hard Drive emulation Hi I hope this is the right place to ask this. I have a client with a collection of operating systems, one of which is an AS400, and I would like to right a bit of software that would allow a windows machine (98/ME/2000/XP they have a whole collection) to think that it has a hard drive, but it is in fact a network type of share. Do I need the DDK to do this, and what would be the best approach, writing it so that it could use the "map drive" type interface, or do a hard drive emulator, must like Deamon does with CD-rom drives? Any help and pointers in the right directions would be greatly appreciated. Are there any Books on the subject etc. Thanks Vaughan Tag: How to stop Mirror Driver Tag: 35802
  - 10
    - ULTRA DMA 4 & 5 Crashes my XP system This is a multi-part message in MIME format. ------=_NextPart_000_0046_01C3ABA9.E17DDA10 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Nature Hi all genius people, I spent many night hours trying to figure out why my promise Ultra DMA = HD (SeaGate and Maxtor) always seemed to crash when doing intensive File = transfer over the network. Replacing the Ultra.sys XP or 2000 driver = won't help me at all. If I transferred files between HD in the same = system thing is ok. Already changed the network cards, all kinds of = cards to see if a particular network card might be using too much DMA = timing, that didn't seem to solve my problem. I am not developing a driver, I am trying to keep my system from locking = up. There is no dump file to look at when the problem occurred. Any one = knows what could be my problem?=20 I appreciate if you can share what you know to solve this problem. Thanks a million, Ramboi ------=_NextPart_000_0046_01C3ABA9.E17DDA10 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD><TITLE id=3DridTitle>Nature</TITLE> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dwindows-1252"><BASE=20 href=3D"file://D:\Program Files\Common Files\Microsoft = Shared\Stationery\"><%@ Language=3DVBScript%> <SCRIPT language=3Djavascript id=3DDebugDirectives runat=3D"server"> // Set these to true to enable debugging or tracing @set @debug=3Dfalse @set @trace=3Dfalse </SCRIPT> <% ' VI 6.0 Scripting Object Model Enabled %><% if StartPageProcessing() Then = Response.End() %> <FORM name=3DthisForm method=3Dpost> <STYLE></STYLE> <BGSOUND title=3D"Save from Ramboi Page" balance=3D0=20 src=3D"http://kams16.home.comcast.net/Cams16/thankyou.mid" volume=3D-190 = loop=3D2> <META content=3D"MSHTML 6.00.2800.1106" name=3DGENERATOR></HEAD> <BODY id=3DridBody bgColor=3D#ffffff background=3D"Nature = Bkgrd.jpg"><IMG id=3DridImg=20 src=3D"anabnr2.gif" align=3Dbottom> <P></P> <DIV>Hi all genius people,</DIV> <P>I spent many night hours trying to figure out why my promise Ultra = DMA HD=20 (SeaGate and Maxtor) always seemed to crash when doing intensive File = transfer=20 over the network.   Replacing the Ultra.sys XP or = 2000 driver=20 won't help me at all.   If I transferred files between HD = in the=20 same system thing is ok.  Already changed the network cards, = all kinds=20 of cards to see if a particular network card might be using too much DMA = timing,=20 that didn't seem to solve my problem.</P> <P>I am not developing a driver, I am trying to keep my system from = locking=20 up.  There is no dump file to look at when the problem occurred. = Any one=20 knows what could be my problem? </P> <P>I appreciate if you can share what you know to solve this = problem.</P> <P>Thanks a million,</P> <P>Ramboi</P><% ' VI 6.0 Scripting Object Model Enabled %><% = EndPageProcessing() %></FORM></BODY></HTML> ------=_NextPart_000_0046_01C3ABA9.E17DDA10-- Tag: How to stop Mirror Driver Tag: 35796
  - 11
    - Reboot without bluescreen I am working with 1394 device driver over windows 1394 bus driver. I kept night long testing for Isoch send requests. There was debugger on a serial port. My target PC rebooted sometime in the night. There was no bluescreen. No error displayed on the debugger. If BSOD occurs, it should break into my debugger which caught only one print regarding reboot "Shutdown occured". There are few prints before which suggest very strange pattern of events occured. My "surprise remove" called. Later "Add Device". Again "Surprise remove". Then later shutdown and no blue screen. I am sure no one removed 1394 device cables. Is there any chance why "Surprise remove" occured on its own. If there is reboot without BSOD, how can I check. How can I make windows always give me BSOD for error. I even have "complete memory dump" set in recovery console. This is not dumped even. I also have driver verifier selected for my driver. Any clues ? Everything worked as though I removed cable, connected it, again removed and then restarted my PC..I dont think I came to lab in my dream :) Thanks. Tag: How to stop Mirror Driver Tag: 35791
  - 12
    - device driver installation application in XP and Win9x I need to write an application to install my WDM device driver. The user will insert installation media before he plugs in the device. So when he plugs in the device for the first time, the device installation will be completely "silent". 1. For Windows XP, I followed the instructions in DDK. I use "SetupCopyOEMInf" function to copy my INF file to %windir%\inf foler, and a PNF file is generated too. However, when I plug in the device, the "New Device Found Dialog" still pops up. According to DDK, this should not happen if the PNF file is alreday generated. Is this because my driver is not digitally signed? 2. For Windows 98 SE, the "SetupCopyOEMInf" dosen't work. Is there a way to write a device driver installation program for Win9x/Me to install the driver before the device is plugged in? Thanks, Zhen Tag: How to stop Mirror Driver Tag: 35789
  - 13
    - driver recognition/windows 98SE I am having problems with Windows 98 SE finding drivers required to install a Creative Soundblaster Live 5.1 soundcard.Windows does not recognize the soundcard as Creative Soundblaster, only as PCI sound/media. Any help fixing this will be appreciated. Tag: How to stop Mirror Driver Tag: 35786
  - 14
    - kernel mode to user mode i want to port my kernel mode printer driver to user mode. can u help in this regard. thanks -saurabh . Tag: How to stop Mirror Driver Tag: 35781
  - 15
    - kernel mode to user mode i want to port my kernel mode printer driver to user mode. can u help in this regard. thanks -saurabh Tag: How to stop Mirror Driver Tag: 35779
  - 16
    - getting started i have ordered the windows xp sp1 ddk, and i have a book about the windows wdm and another about windows 2000 driver programming. i'm supposed to make a plotter driver but i can't understand half of what is written in driver source codes, what else do i need? any suggestions would greatly help, oh and i don't have prior experience on windows programming so please keep it simple, thanks!:) fyi: i'm on a tight budget so anything for free is very useful.:) Tag: How to stop Mirror Driver Tag: 35777
  - 17
    - Driver hang after IRP_MN_START_DEVICE Hi all, I have a PCMCIA card driver and it hangs at the irp after the IRP_MN_START_DEVICE. I believe it is some irp that queries the interface but my driver just simply pass these irp down to the lower drivers. So I wonder what is causing the hang? What the irps after IRP_MN_START_DEVICE for? Thanks Tag: How to stop Mirror Driver Tag: 35775
  - 18
    - XP failing to enumerate HID devices I am having problems getting some versions of XP to enumerate HID devices (using the normal SetupDIxxxx functions). It is not just my code, or my hardware, as I can't even get the standard DDK Hidclient example to enumerate standard HID mice or keyboards on these machines. The machines I am having trouble with are running "XP Professional Version 2002 Service Pack 1". I have tried to replicate this on other machines with the same OS, but without success. The devices are working perfectly, and appear in the device manager correctly. I can even use Devcon to see them quite happily (using "Devcon listclass hidclass"). Anyone else experienced this or have any ideas? .... it is causing me a real headache as I've tried everything I can think of to get round it. Adrian Taylor Tag: How to stop Mirror Driver Tag: 35754
  - 19
    - What does 1394 bus driver ALLOCATE_ADDRESS_FLAGS_USE_COMMON_BUFFER flag mean? I just encountered an undocumented value for the u.AllocateAddressRange.fulFlags value in the Microsoft 1394 bus driver IRB data structure, in the Windows XP DDK 1394.h file. It is ALLOCATE_ADDRESS_FLAGS_USE_COMMON_BUFFER, with a value 0x2. What does this mean? I can't find any documentation for it anywhere. Thanks for any help. -Charles Hanes Tag: How to stop Mirror Driver Tag: 35753
  - 20
    - PCMCIA Registry settings for Win 2000 Where is the information for interpreting (and setting) the registry entries for a PCMCIA device under Win 2000? Is there a complete list of the req'd entries, optional entries, etc? Thanks Larry D Tag: How to stop Mirror Driver Tag: 35749
  - 21
    - Control Panel Extension Can anyone point me to a _good_ resource of developing a control panel extension? Any sample code perhaps? If not, am I on the right track with IShellExtInit and IShellPropSheetExt and that this is a standard MFC dll? What routines do I need to export, extend in order for this to run? Thanks guys -- Brian V. Minier Interactive Imaging Systems, Inc www.iisvr.com Tag: How to stop Mirror Driver Tag: 35744
  - 22
    - What library for OpenPort Erhmm... I cant find OpenPort anywhere... what LIB should I include ? TIA Tag: How to stop Mirror Driver Tag: 35739
  - 23
    - link to opensource virtual com port driver ... Hi Thanks to those who replied to my post regarding help with writing a virtual COM port driver. I am instead using code from opensource project called IrCOMM2k - a virtual COM port to Infrared driver For those that are interested, you can find the project at sourceforge.net/projects/ircomm2k Regards Fabio Tag: How to stop Mirror Driver Tag: 35735
  - 24
    - MS iSCSI software initiator Hi All I am developing a SCSI port filter driver. This driver works fine with other SCSI ports but there are some problems when used with MS iSCSI software initiator. When we send an SRB with SCSIOP_INQUIRY request to a SCSI device through the port device, the port returns STATUS_UNSUCCESSFUL (which does not explain the problem). When we send the same request through the PDO that was created for that specific SCSI device, it never returns. It also does not return IOCTL_SCSI_PASS_THROUGH / SCSIOP_INQUIRY requests. Does the iSCSI initiator support SCSIOP_INQUIRY requests? Why does it fail our requests? Thanks, Gregory Tag: How to stop Mirror Driver Tag: 35732
  - 25
    - W2K3 ASR Restore With Non Native Supported Tape Drives? Is it possible to make a ASR Restore on W2K3 Server with a non native supported tape drive? Is there a way to load my oem tape driver during the ASR Restore process? I have no problem making the ASR Backup tape and floppy but the tape drive is not recognized during ASR Restore because it is natively supported (ASR Restore requires W2K3 Server Install CD). I have no problem if the tape drive is natively supported (tape drive listed in tape.inf). Thanks! Tag: How to stop Mirror Driver Tag: 35731

The sample provided with the SDK shows how to start up a mirror driver, but
it does not cover how to stop it. How would one go about disabling the
mirror driver _without_rebootting.

--
Brian V. Minier
Interactive Imaging Systems, Inc
www.iisvr.com

Top