windows


BSOD (3b) x64 Windows driver


recently I wanted to use iscflashx64.sys driver functionality in my user-mode app. Reading CPU MSRs works, but write attemption cause BSoD with 0x0000003B code (executing a routine that transitions from non-privileged code to privileged code).
Also reading 100 bytes from 0x0x00000000 cause BSoD with 0x00000050 code (that invalid system memory has been referenced).
I use RWeverything to view memory dump and MSRs state, so MSRs numbers are correct and memory at 0x000000000 is not empty.
Here is crash dump displayed in WinDbg:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff80802a33f28, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800028a8c62, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Page ec4b not present in the dump file. Type ".hh dbgerr004" for details
READ_ADDRESS: fffff80802a33f28
FAULTING_IP:
nt!MiInsertCachedPte+82
fffff800`028a8c62 48 dec eax
MM_INTERNAL_CODE: 5
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000
STACK_TEXT:
00000000 00000000 00000000 00000000 00000000 0x0
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!MiInsertCachedPte+82
fffff800`028a8c62 48 dec eax
SYMBOL_NAME: nt!MiInsertCachedPte+82
FOLLOWUP_NAME: MachineOwner
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 6.1.7601.17514
IMAGE_NAME: Unknown_Image
BUCKET_ID: INVALID_KERNEL_CONTEXT
MODULE_NAME: Unknown_Module
FAILURE_BUCKET_ID: INVALID_KERNEL_CONTEXT
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:invalid_kernel_context
FAILURE_ID_HASH: {ef5f68ed-c19c-e34b-48ec-8a37cd6f3937}
So may be someone knows why driver cause system crash and how to figure it out? Thank you for any suggestions.

Related Links

CreateProcessWithLogon Error requires elevation
msysgit vim cursorline is dark on my light background. how to set it to light or off
Statically linking libs in Visual Studio
How to get file owner name?
TextOut() and the Cambria Math font
Problem with backticks in multi-threaded Perl script on Windows
Please help me in adding a printer in windows xp mode on windows 7 professional [closed]
Interprocess communication using sockets between windows service and form app
ccache with MingW on Windows
Virtual printer in windows, where to start?
Why does my app appear to be using a Windows 95 GUI?
Is moving a window with SetWindowPos the 'normal way' to do?
is this the only way to install IIS on windows server 2008?
sqlite setBytes() not working for BLOB data type on Windows
passing '=' in arguments to windows batch files
How to approximately know the function trace from crash dump from optimized windows binary?

Categories

HOME
google-cloud-platform
oracle12c
paraview
awk
merge
nvd3.js
themes
visual-studio-emulator
vsm
banner
webix
little-proxy
octave
openpyxl
watson-conversation
ycsb
cmdb
mathprog
vuejs
google-container-registry
mapstruct
sencha-touch
kendo-mobile
href
exit
opentk
syntax-highlighting
bulletphysics
shared
appirater
fractions
tizen-tv
google-earth
mobx
postback
turfjs
angularjs-material
erb
classcastexception
reactjs.net
pop3
hackintosh
kill
sharp-snmp
http-request
importerror
photos
getchar
httrack
ntvs
robomongo
qtranslate
azure-cli
java-6
libjpeg
vibrate
ampps
rsa-archer-grc
sandcastle
testrail
gets
cudd
custom-lists
redbeard-ios
seek
firebase-security
udpclient
freepbx
grass
oracle-spatial
ons-api
video-player
zen-cart
dronekit-android
jsvc
pyobjc
alloy-ui
bufferedinputstream
public-html
procedural-programming
nodelist
sip-server
webfinger
wcm
rmysql
encryption-asymmetric
parallel-testing
dot42
renderer
bin
windows-phone-8-sdk
beaker-testing
wp7test
alice
mkv
iboutlet
correlated-subquery
failing-tests
virtualpathprovider
hibernateexception
google-ajax-api
jqote
instantiationexception
delimited-text
vs-android
pagemethods
echo3
cuda.net
interop-domino
alsb
great-circle
pnrp

Resources

Encrypt Message