BSODs with BitDefender and other AV suites containing filesystem minidrivers
419 views
Skip to first unread message
Steve Sanders
Jul 15, 2016, 12:33:33 PM7/15/16
to Dokan, Taru Karttunen, Maxwell Krohn
Hi,
We have been using Dokany on a streaming filesystem product with an open source client (https://github.com/keybase/kbfs/), which includes a golang interface to Dokany (A more formal open sourcing of this layer is in the works). Initial alpha testers are reporting BSODs when they have BitDefender and similar AV suites installed. We've been able to reproduce these, but only with our product, not the dokany sample program mirror.exe. Also, the BSODs occur with BitDefender's minidriver in the stack (gzflt, below) but not dokan1.sys. Removing either product (AV or ours) eliminates the BSODs. So there is something we are doing that mirror.exe does not, and it is unclear how to identify what it could be. Any suggestions would be greatly appreciated. Below is a trace from a live debugging session.
# Child-SP RetAddr Call Site 00 ffffd000`278376b8 fffff803`1626c366 nt!DbgBreakPointWithStatus 01 ffffd000`278376c0 fffff803`1626bc96 nt!KeEnterKernelDebugger+0x206 02 ffffd000`27837720 fffff803`161c7584 nt!KeInitializeEnumerationContextFromAffinity+0x94e 03 ffffd000`27837e30 fffff803`16216dfc nt!KeBugCheckEx+0x104 04 ffffd000`27837e70 fffff803`160ca526 nt!memset+0x4407c 05 ffffd000`27837f60 fffff803`161d04bd nt!PfFileInfoNotify+0x71a6 06 ffffd000`278380b0 fffff803`165337bf nt!setjmpex+0x21cd 07 ffffd000`27838240 fffff803`1658ec7a nt!CmCallbackGetKeyObjectIDEx+0xb7f 08 ffffd000`27838360 fffff800`af13954c nt!ObQueryNameString+0xe 09 ffffd000`278383a0 fffff800`af138322 FLTMGR!FltpGetObjectName+0x30 0a ffffd000`278383d0 fffff800`af132d8c FLTMGR!FltpFsControlMountVolume+0xa2 0b ffffd000`278384b0 fffff803`164e3f5a FLTMGR!FltpFsControl+0x14c 0c ffffd000`27838510 fffff803`160f8f74 nt!FsRtlNotifyVolumeEventEx+0x58e 0d ffffd000`27838790 fffff803`164c56c7 nt!PoRegisterDeviceForIdleDetection+0x430 0e ffffd000`278387e0 fffff803`16496bc0 nt!NtAllocateVirtualMemory+0x2b87 0f ffffd000`278389f0 fffff803`16494c2c nt!RtlEqualUnicodeString+0xbd0 10 ffffd000`27838b60 fffff803`16502e7c nt!ObOpenObjectByName+0x1ec 11 ffffd000`27838c90 fffff803`165029d3 nt!NtCreateFile+0x41c 12 ffffd000`27838d30 fffff800`af131222 nt!IoCreateFileEx+0x103 13 ffffd000`27838dc0 fffff800`af12f7ea FLTMGR!FltpCreateFile+0x1a6 14 ffffd000`27838ec0 fffff800`af12f6f9 FLTMGR!FltOpenVolume+0xaa 15 ffffd000`27838f90 fffff800`afbb4456 FLTMGR!FltQueryVolumeInformation+0x29 16 ffffd000`27838fe0 fffff800`afbb870f gzflt+0x24456 17 ffffd000`278390a0 fffff800`af1374a0 gzflt+0x2870f 18 ffffd000`278390d0 fffff800`af136c0f FLTMGR!FltpDoInstanceSetupNotification+0x8c 19 ffffd000`27839140 fffff800`af137155 FLTMGR!FltpInitInstance+0x2f3 1a ffffd000`27839200 fffff800`af1372f1 FLTMGR!FltpCreateInstanceFromName+0x1ad 1b ffffd000`278392e0 fffff800`af12f9a2 FLTMGR!FltpEnumerateRegistryInstances+0x145 1c ffffd000`27839380 fffff800`af1339ba FLTMGR!FltpDoFilterNotificationForNewVolume+0x126 1d ffffd000`27839400 fffff803`164c5bc6 FLTMGR!FltpCreate+0x4ca 1e ffffd000`278394b0 fffff803`16496bc0 nt!NtAllocateVirtualMemory+0x3086 1f ffffd000`278396c0 fffff803`16494c2c nt!RtlEqualUnicodeString+0xbd0 20 ffffd000`27839830 fffff803`16502e7c nt!ObOpenObjectByName+0x1ec 21 ffffd000`27839960 fffff803`16502ad9 nt!NtCreateFile+0x41c 22 ffffd000`27839a00 fffff803`161d1a63 nt!NtCreateFile+0x79 23 ffffd000`27839a90 00007ffe`09f03d7a nt!setjmpex+0x3773 24 00000000`3458ea38 00000000`568a6778 ntdll!NtCreateFile+0xa 25 00000000`3458ea40 00000000`568a7d15 wow64!whNtCreateFile+0xf8 26 00000000`3458eb10 00000000`56891927 wow64!Wow64SystemServiceEx+0x155 27 00000000`3458f3d0 00000000`568adf82 wow64cpu!ServiceNoTurbo+0xb 28 00000000`3458f480 00000000`568adea7 wow64!RunCpuSimulation+0x22 29 00000000`3458f4b0 00007ffe`09edbfd3 wow64!Wow64LdrpInitialize+0x177 2a 00000000`3458f750 00007ffe`09edbe6e ntdll!_LdrpInitialize+0x10f 2b 00000000`3458f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe
Liryna
Jul 15, 2016, 1:17:19 PM7/15/16
to Dokan, tar...@taruti.net, m...@keybase.io
Hi Steve,
At which moment does the BSOD happen ?
At which moment does the BSOD happen ?
Steve Sanders
Jul 15, 2016, 1:21:08 PM7/15/16
to Dokan, tar...@taruti.net, m...@keybase.io
Still narrowing that down; it seems to be very soon after mounting, maybe the first access of the volume.
Liryna
Jul 15, 2016, 1:32:43 PM7/15/16
to Dokan, tar...@taruti.net, m...@keybase.io
It seems to happen when the device mount when CreateFile happen.
I would say that there is a race condition at the mount and the AV access dokan device without it finished to mount.
Mirror is probably just lucky to be more fast than the Go wrapper.
https://github.com/dokan-dev/dokany/issues/230#issuecomment-231561974
I would say that there is a race condition at the mount and the AV access dokan device without it finished to mount.
Mirror is probably just lucky to be more fast than the Go wrapper.
https://github.com/dokan-dev/dokany/issues/230#issuecomment-231561974
Marinko Babic
Jul 15, 2016, 3:37:26 PM7/15/16
to Dokan
Please can you post the full report ! analyze -v
Steve Sanders
Jul 15, 2016, 4:37:57 PM7/15/16
to Dokan, tar...@taruti.net, m...@keybase.io
Here is another one but I can't get the symbols to load, I'll try some more.
*** ERROR: Module load completed but symbols could not be loaded for dokan1.sys
dokan1+0x3f2b:
fffff801`47ad3f2b cc int 3
kd>
KDTARGET: Refreshing KD connection
*** Fatal System Error: 0x0000003b
(0x00000000C0000005,0xFFFFF80147AD23B6,0xFFFFD00075F6BCA0,0x0000000000000000)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
Connected to Windows 10 10586 x64 target at (Fri Jul 15 13:29:45.689 2016 (UTC - 7:00)), ptr64 TRUE
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
.....
Loading unloaded module list
.......
Loading Wow64 Symbols
.........................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80147ad23b6, ffffd00075f6bca0, 0}
*** ERROR: Module load completed but symbols could not be loaded for dokan1.sys
*** ERROR: Module load completed but symbols could not be loaded for gzflt.sys
*** ERROR: Module load completed but symbols could not be loaded for kbfsdokan.exe
"KERNELBASE.dll" was not found in the image list.
Debugger will attempt to load "KERNELBASE.dll" at given base 00000000`00000000.
Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to add module at 00000000`00000000
Probably caused by : dokan1.sys ( dokan1+23b6 )
Followup: MachineOwner
---------
nt!DbgBreakPointWithStatus:
fffff800`15350090 cc int 3
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*
OK C:\work\bin\dokan-dev\dokan-v1.0.0-RC4.3\x64\Win10Release
kd>
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80147ad23b6, Address of the instruction which caused the bugcheck
Arg3: ffffd00075f6bca0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
"KERNELBASE.dll" was not found in the image list.
Debugger will attempt to load "KERNELBASE.dll" at given base 00000000`00000000.
Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to add module at 00000000`00000000
DUMP_CLASS: 1
DUMP_QUALIFIER: 0
BUILD_VERSION_STRING: 10586.494.amd64fre.th2_release_sec.160630-1736
DUMP_TYPE: 0
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80147ad23b6
BUGCHECK_P3: ffffd00075f6bca0
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
FAULTING_IP:
dokan1+23b6
fffff801`47ad23b6 0fb706 movzx eax,word ptr [rsi]
CONTEXT: ffffd00075f6bca0 -- (.cxr 0xffffd00075f6bca0)
rax=ffffe0003a1f2a00 rbx=00000000c0000002 rcx=ffffe0003a1f2c00
rdx=0000000000000000 rsi=0000000000000000 rdi=ffffe0003a1f2a00
rip=fffff80147ad23b6 rsp=ffffd00075f6c6c0 rbp=ffffe00039e02ee0
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000801 r12=0000000000000200 r13=00000000004d0008
r14=ffffe0003a274d70 r15=0000000000000004
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
dokan1+0x23b6:
fffff801`47ad23b6 0fb706 movzx eax,word ptr [rsi] ds:002b:00000000`00000000=????
Resetting default scope
CPU_COUNT: 1
CPU_MHZ: af8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 4e
CPU_STEPPING: 3
CPU_MICROCODE: 6,4e,3,0 (F,M,S,R) SIG: 82'00000000 (cache) 82'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: kbfsdokan.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: STEVE-SURFACE
ANALYSIS_SESSION_TIME: 07-15-2016 13:32:05.0074
ANALYSIS_VERSION: 10.0.10586.567 amd64fre
LAST_CONTROL_TRANSFER: from fffff80147ad260c to fffff80147ad23b6
STACK_TEXT:
ffffd000`75f6c6c0 fffff801`47ad260c : ffffe000`39e02ee0 fffff800`000001c8 00000000`c0000002 ffffd000`75f6cdf0 : dokan1+0x23b6
ffffd000`75f6cc40 fffff801`47ad2d2b : ffffe000`3a274c01 ffffe000`39e02ee0 ffffe000`39e02ee0 fffff800`00000200 : dokan1+0x260c
ffffd000`75f6cca0 fffff800`155e3b77 : ffffe000`3a274c20 ffffe000`39e02ee0 ffffe000`3a274c20 00000000`00000000 : dokan1+0x2d2b
ffffd000`75f6ccf0 fffff801`45ae1be1 : ffffd000`75f6d130 fffff800`00000141 ffffd000`75f6d130 00000000`00000000 : nt!IoVolumeDeviceToDosName+0xb7
ffffd000`75f6cfc0 fffff801`45b048b3 : ffffc000`ea3a3000 ffffd000`75f6d130 ffffe000`3a274c20 ffffe000`3a274c20 : gzflt+0x1be1
ffffd000`75f6d010 fffff801`45b0870f : ffffe000`37e0f880 ffffd000`75f6d200 ffffd000`00000000 ffffe000`3a275100 : gzflt+0x248b3
ffffd000`75f6d0d0 fffff801`4509a9e0 : 00000000`00000005 ffffd000`75f6d2c1 00000000`00000000 ffffe000`37e21d08 : gzflt+0x2870f
ffffd000`75f6d100 fffff801`4509a341 : 00000000`00000000 ffffe000`3a275010 ffffd000`75f6d202 ffffe000`3a2739d0 : FLTMGR!FltpDoInstanceSetupNotification+0x8c
ffffd000`75f6d170 fffff801`45092e2d : ffffe000`37e21c40 ffffe000`3a275010 00000000`00000005 ffffd000`75f6d270 : FLTMGR!FltpInitInstance+0x2f5
ffffd000`75f6d230 fffff801`45092c31 : 00000000`00000000 ffffe000`3a275010 00000000`00000000 fffff800`0000001a : FLTMGR!FltpCreateInstanceFromName+0x1ad
ffffd000`75f6d310 fffff801`45093172 : ffffe000`37e21c50 ffffe000`37e21c40 ffffe000`39066002 00000000`0000002c : FLTMGR!FltpEnumerateRegistryInstances+0x145
ffffd000`75f6d3b0 fffff801`4509642c : ffffe000`3a275010 ffffd000`00000000 ffffe000`37e21c50 ffffe000`373f0660 : FLTMGR!FltpDoFilterNotificationForNewVolume+0x126
ffffd000`75f6d430 fffff800`156bcff8 : 00000000`00000000 00000000`00000025 00000000`00000000 ffffe000`39dc6b01 : FLTMGR!FltpCreate+0x49c
ffffd000`75f6d4e0 fffff800`156b6e32 : fffff800`15208000 fffff800`15208000 00000000`00000001 fffff800`156bc830 : nt!IopParseDevice+0x7c8
ffffd000`75f6d6b0 fffff800`156b80dc : ffffe000`39dc6b00 ffffd000`75f6d8a0 fffff6e0`00000040 ffffe000`36770c60 : nt!ObpLookupObjectName+0x992
ffffd000`75f6d830 fffff800`1564a058 : ffff3c57`00000001 ffffe000`39cf2b10 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ec
ffffd000`75f6d950 fffff800`15649bb9 : 00000000`3445ea98 00000100`00000000 00000000`3445f360 00000000`3445eab0 : nt!IopCreateFile+0x3d8
ffffd000`75f6da00 fffff800`153551a3 : fffff6fb`7da00000 fffff6fb`40000000 fffff680`00000000 ffff3c57`1f1f1a80 : nt!NtCreateFile+0x79
ffffd000`75f6da90 00007ffe`d0065b84 : 00000000`70c144c8 00000000`3465fc6c 00000000`00000004 00000000`3445ea98 : nt!KiSystemServiceCopyEnd+0x13
00000000`3445ea28 00000000`70c144c8 : 00000000`3465fc6c 00000000`00000004 00000000`3445ea98 00000000`70c1cb1d : ntdll!NtCreateFile+0x14
00000000`3445ea30 00000000`70c16245 : 00000000`3465fc6c 00000000`00000000 00000000`00000000 00000000`00000060 : wow64!whNtCreateFile+0xf8
00000000`3445eb00 00000000`70c61c87 : 00000000`77438f00 00000000`00000023 00000000`00000003 00000000`3465fff0 : wow64!Wow64SystemServiceEx+0x155
00000000`3445f3c0 00000000`70c1bdb2 : 00000000`3465fd14 00000000`3445f4d0 00000000`00000000 00000000`3445f4d0 : wow64cpu!ServiceNoTurbo+0xb
00000000`3445f470 00000000`70c1bcc0 : 00000000`00000000 00000000`3445f4d0 00000000`00000000 00000000`00000000 : wow64!RunCpuSimulation+0x22
00000000`3445f4a0 00007ffe`d0036e91 : 00000000`00000000 00000000`70c1bba0 00000000`00000000 00000000`00000000 : wow64!Wow64LdrpInitialize+0x120
00000000`3445f750 00007ffe`d0036d5e : 00000000`3445f820 00000000`00000000 00000000`00311000 00000000`00000000 : ntdll!_LdrpInitialize+0xdd
00000000`3445f7d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe
THREAD_SHA1_HASH_MOD_FUNC: ea78a325c28f30a3f80fa287cc16b6dd7c41b308
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6c59b4be6990ca9cede67a968a70c3f00fa3e278
THREAD_SHA1_HASH_MOD: 9abffff0363dd629825bf3b16324996c9e8be5f6
FOLLOWUP_IP:
dokan1+23b6
fffff801`47ad23b6 0fb706 movzx eax,word ptr [rsi]
FAULT_INSTR_CODE: 6606b70f
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: dokan1+23b6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dokan1
IMAGE_NAME: dokan1.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5764a1f1
STACK_COMMAND: .cxr 0xffffd00075f6bca0 ; kb
BUCKET_ID_FUNC_OFFSET: 23b6
FAILURE_BUCKET_ID: 0x3B_dokan1!Unknown_Function
BUCKET_ID: 0x3B_dokan1!Unknown_Function
PRIMARY_PROBLEM_CLASS: 0x3B_dokan1!Unknown_Function
TARGET_TIME: 2016-07-15T20:30:00.000Z
OSBUILD: 10586
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2016-06-30 20:26:45
BUILDDATESTAMP_STR: 160630-1736
BUILDLAB_STR: th2_release_sec
BUILDOSVER_STR: 10.0.10586.494.amd64fre.th2_release_sec.160630-1736
ANALYSIS_SESSION_ELAPSED_TIME: e72
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_dokan1!unknown_function
FAILURE_ID_HASH: {bbfd3279-10f8-8476-928a-d11f6bed0d72}
Followup: MachineOwner
---------
Steve Sanders
Jul 15, 2016, 4:43:10 PM7/15/16
to Dokan, tar...@taruti.net, m...@keybase.io
Not sure if this is correct but the 3 dokan1 entries show as this if I force a pdb it says is mismatched:
0b ffffd000`75f6c6c0 fffff801`47ad260c dokan1!DiskDeviceControl(struct _DEVICE_OBJECT * DeviceObject = <Value unavailable error>, struct _IRP * Irp = 0xffffe000`39e02ee0)+0x74a [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\device.c @ 397]
0c ffffd000`75f6cc40 fffff801`47ad2d2b dokan1!DokanDispatchDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0xffffe000`3a274c20 Device for "\FileSystem\dokan1", struct _IRP * Irp = 0xffffe000`39e02ee0)+0x7c [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\device.c @ 854]
0d ffffd000`75f6cca0 fffff800`155e3b77 dokan1!DokanBuildRequest(struct _DEVICE_OBJECT * DeviceObject = 0xffffe000`3a274c20 Device for "\FileSystem\dokan1", struct _IRP * Irp = 0xffffe000`39e02ee0)+0x67 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\dispatch.c @ 45]
On Friday, July 15, 2016 at 9:33:33 AM UTC-7, Steve Sanders wrote:
Steve Sanders
Jul 15, 2016, 5:29:18 PM7/15/16
to Dokan, tar...@taruti.net, m...@keybase.io
The previous ones were made with dokan that we build; for this next one, I replaced it with https://ci.appveyor.com/api/buildjobs/e6yrehkwa8belu1s/artifacts/DokanSetup-1.0.0.3645.exe
Still working on the pdb
*** Fatal System Error: 0x0000003b
(0x00000000C0000005,0xFFFFF8019777262C,0xFFFFD001BE39BCA0,0x0000000000000000)
Break instruction exception - code 80000003 (first chance)
nt_fffff800bbe0d000!DbgBreakPointWithStatus:
fffff800`bbf55090 cc int 3
kd> kp
# Child-SP RetAddr Call Site
00 ffffd001`be39ac08 fffff800`bbfceaf2 nt_fffff800bbe0d000!DbgBreakPointWithStatus
01 ffffd001`be39ac10 fffff800`bbfce4c3 nt_fffff800bbe0d000!KiBugCheckDebugBreak+0x12
02 ffffd001`be39ac70 fffff800`bbf4fa44 nt_fffff800bbe0d000!KeBugCheck2+0x893
03 ffffd001`be39b380 fffff800`bbf5a4e9 nt_fffff800bbe0d000!KeBugCheckEx+0x104
04 ffffd001`be39b3c0 fffff800`bbf59dfc nt_fffff800bbe0d000!KiBugCheckDispatch+0x69
05 ffffd001`be39b500 fffff800`bbf559ed nt_fffff800bbe0d000!KiSystemServiceHandler+0x7c
06 ffffd001`be39b540 fffff800`bbe77469 nt_fffff800bbe0d000!RtlpExecuteHandlerForException+0xd
07 ffffd001`be39b570 fffff800`bbefeffc nt_fffff800bbe0d000!RtlDispatchException+0x429
08 ffffd001`be39bc70 fffff800`bbf5a5c2 nt_fffff800bbe0d000!KiDispatchException+0x144
09 ffffd001`be39c350 fffff800`bbf58ca1 nt_fffff800bbe0d000!KiExceptionDispatch+0xc2
0a ffffd001`be39c530 fffff801`9777262c nt_fffff800bbe0d000!KiPageFault+0x221
0b ffffd001`be39c6c0 fffff801`9777287c dokan1_fffff80197770000+0x262c
0c ffffd001`be39cc40 fffff801`97772f9b dokan1_fffff80197770000+0x287c
0d ffffd001`be39cca0 fffff800`bc1e8b77 dokan1_fffff80197770000+0x2f9b
*** ERROR: Module load completed but symbols could not be loaded for gzflt.sys
0e ffffd001`be39ccf0 fffff801`96271be1 nt_fffff800bbe0d000!IoVolumeDeviceToDosName+0xb7
0f ffffd001`be39cfc0 fffff801`962948b3 gzflt+0x1be1
10 ffffd001`be39d010 fffff801`9629870f gzflt+0x248b3
11 ffffd001`be39d0d0 fffff801`9582a9e0 gzflt+0x2870f
12 ffffd001`be39d100 fffff801`9582a341 FLTMGR!FltpDoInstanceSetupNotification+0x8c
13 ffffd001`be39d170 fffff801`95822e2d FLTMGR!FltpInitInstance+0x2f5
14 ffffd001`be39d230 fffff801`95822c31 FLTMGR!FltpCreateInstanceFromName+0x1ad
15 ffffd001`be39d310 fffff801`95823172 FLTMGR!FltpEnumerateRegistryInstances+0x145
16 ffffd001`be39d3b0 fffff801`9582642c FLTMGR!FltpDoFilterNotificationForNewVolume+0x126
17 ffffd001`be39d430 fffff800`bc2c1ff8 FLTMGR!FltpCreate+0x49c
18 ffffd001`be39d4e0 fffff800`bc2bbe32 nt_fffff800bbe0d000!IopParseDevice+0x7c8
19 ffffd001`be39d6b0 fffff800`bc2bd0dc nt_fffff800bbe0d000!ObpLookupObjectName+0x992
1a ffffd001`be39d830 fffff800`bc24f058 nt_fffff800bbe0d000!ObOpenObjectByNameEx+0x1ec
1b ffffd001`be39d950 fffff800`bc24ebb9 nt_fffff800bbe0d000!IopCreateFile+0x3d8
1c ffffd001`be39da00 fffff800`bbf5a1a3 nt_fffff800bbe0d000!NtCreateFile+0x79
1d ffffd001`be39da90 00007ff9`2ba55b84 nt_fffff800bbe0d000!KiSystemServiceCopyEnd+0x13
1e 00000000`3478ea28 00000000`765d44c8 ntdll_7ff92b9b0000!NtCreateFile+0x14
1f 00000000`3478ea30 00000000`3498fc6c shell32!_tls_end <PERF>
20 00000000`3478ea38 00000000`00000004 0x3498fc6c
21 00000000`3478ea40 00000000`3478ea98 0x4
22 00000000`3478ea48 00000000`765dcb1d 0x3478ea98
23 00000000`3478ea50 00000000`00000000 shell32!_tls_end <PERF>
On Friday, July 15, 2016 at 9:33:33 AM UTC-7, Steve Sanders wrote:
Marinko Babic
Jul 15, 2016, 6:04:26 PM7/15/16
to do...@googlegroups.com
This is a Null Reference issue. Please can you give me more details how you are reproducing the issue?
Are you just using one instance or multiple devices?
It seems to me like you are mounting and unmounting several times and then the BSOD occurs. The reason of the most BSOD I faced is using of a deleted device.
Here we have 2 Options. Maybe we need both of them. Do proper locking to prevent the DeviceObject from being deleted during the usage. Another option is to delete the symbolic link and the volume device but not the disk device. Just mark it as deleted using custom flags. After some time remove the device it self, because after some time there will no be any pending Irps. Using the second option also any filter should get always a valid DeviceObject.
In your case the driver log would be helpful to understand what is happening.
Steve Sanders
Jul 17, 2016, 5:00:54 PM7/17/16
to Dokan
I may be causing extra confusion by posting results from more than one driver version. The first stack I posted was from running a driver built with some changes Taru made to try to mitigate the BSODs (https://github.com/keybase/dokany/tree/taruti/mitigate-bsod). Since the BSODs continued I didn't think they made much difference, so I switched back to master of dokan-dev/dokany (https://github.com/dokan-dev/dokany/commit/84c38f8eb48ee703fd3eaa18abed09ab1072d029) for us all to be on the same page, which is were the rest of the above stacks came from. So, it now appears that Taru's changes do prevent at least one null reference.
To reproduce, I run a trial version of BitDefender Antivirus Plus 2016. I think the trial is necessary to run the whole suite, so that it installs its filter driver, not just the free scanner. I then run our product, which mounts a volume and consults a second process and some external servers to establish filesystem contents. I don't think it does multiple mounting or unmounting, except for a retry loop at the beginning if mounting was unsuccessful.
There are also reports in the field of BSODs when running our Dokan with Symantec Desktop Encryption, but I could not get a trial version to work.
I will continue trying to generate driver logs but I had little luck Friday. Would it be more helpful to continue generating exceptions with Dokany master, or with Taru's changes? Also note that I'm able to catch these live in a guest vm using windbg and VirtualKD, in case there is something extra I can capture with that.
Marinko Babic
Jul 17, 2016, 8:14:08 PM7/17/16
to do...@googlegroups.com
I will create a new branch for you. I can imagine that the keep alive does the unmount in background. Therefore the log is needed. The question is in generally why the mirror works properly and your software not. Try to remove as much as possible components so that we can identify the source of difference.
Marinko Babic
Jul 17, 2016, 8:26:22 PM7/17/16
to do...@googlegroups.com
To understand your problem please create the log using the master branch. Later I will provide a branch with some modifications.
Steve Sanders
Jul 18, 2016, 6:25:28 PM7/18/16
to Dokan
Hi, I managed to capture a log today with a driver built off master of dokan-dev\dokany.
Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64Copyright (c) Microsoft Corporation. All rights reserved.
Opened \\.\pipe\kd_Windows_10_x64Waiting to reconnect...Connected to Windows 10 10586 x64 target at (Mon Jul 18 15:17:13.381 2016 (UTC - 7:00)), ptr64 TRUEKernel Debugger connection established.Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 10586 MP (1 procs) Free x64Built by: 10586.494.amd64fre.th2_release_sec.160630-1736Machine Name:Kernel base = 0xfffff800`33278000 PsLoadedModuleList = 0xfffff800`33555cf0System Uptime: 0 days 0:00:00.088nt!DebugService2+0x5:fffff800`333c00e5 cc int 3kd> gP#00400080x15175196, s\minifilter.c, 471 | DriverEntryMiniFilter: [ERROR] : FltRegisterFilter failed, status = 0xc01c0007P#00400080x15175196, rufos\driver.c, 1829 | DrvReinitRoutine: [ERROR] : DriverEntryMiniFilter failed, status = 0xc01c0007KDTARGET: Refreshing KD connectionP#00401940x15175953, s\minifilter.c, 183 | GetPathIfReparsePointCSC: [INFO] : CSCLocation not a junction!+++++>WskKnrInit.[DokanFS] IOCTL_SET_DEBUG_MODE: 9[DokanFS] <= DokanGlobalDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4416[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 4416[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DGL[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DGL[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DGL[DokanFS] => DokanGlobalDeviceControl[DokanFS] IOCTL_EVENT_START[DokanFS] ==> DokanEventStart[DokanFS] DeviceCharacteristics |= FILE_REMOVABLE_MEDIA[DokanFS] Using Mount Manager[DokanFS] Mounting on current session only[DokanFS] DiskDeviceName: \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9} - SymbolicLinkName: \DosDevices\Global\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9} - MountPoint: \DosDevices\K:[DokanFS] IoCreateDevice DeviceType: 8[DokanFS] SymbolicLink: \DosDevices\Global\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9} -> \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9} created[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_GET_HOTPLUG_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_CHECK_VERIFY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_CHECK_VERIFY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_IS_WRITABLE[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery Unknown 6[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery Unknown 7[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery Unknown 8[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_MEDIA_REMOVAL[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_GET_HOTPLUG_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_MEDIA_REMOVAL[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_GPT_ATTRIBUTES[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_GET_DEVICE_NUMBER[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery StorageDeviceProperty[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery StorageAdapterProperty[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000002[DokanFS] status = STATUS_NOT_IMPLEMENTED[DokanFS] status = 0xc0000002[DokanFS] status = STATUS_NOT_IMPLEMENTED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery Unknown 14[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery Unknown 8[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery Unknown 11[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery Unknown 13[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_QUERY_PROPERTY[DokanFS] PropertyStandardQuery Unknown 7[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] status = 0xc0000022[DokanFS] status = STATUS_ACCESS_DENIED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] Unknown Code 0x4d008[DokanFS] BaseCode: 0x4(unknown) FunctionCode 0x402(1026)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] Unknown Code 0x2d1190[DokanFS] BaseCode: 0x2d(IOCTL_STORAGE_BASE) FunctionCode 0x464(1124)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCreate[DokanFS] ProcessId 4[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is dcb which is not mounted[DokanFS] status = 0xc000026e[DokanFS] status = STATUS_VOLUME_DISMOUNTED[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCreate[DokanFS] ProcessId 4[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is dcb which is not mounted[DokanFS] status = 0xc000026e[DokanFS] status = STATUS_VOLUME_DISMOUNTED[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_GET_HOTPLUG_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_CHECK_VERIFY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanFileSystemControl[DokanFS] ProcessId 5016[DokanFS] IRP_MN_MOUNT_VOLUME[DokanFS] IdType = DCB[DokanFS] FindMountEntry \DosDevices\K: -> \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] ==> DokanStartCheckThread[DokanFS] <== DokanStartCheckThread[DokanFS] => DokanSendVolumeArrivalNotification[DokanFS] => DokanSendIoContlToMountManager[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_UNIQUE_ID[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_UNIQUE_ID[DokanFS] UniqueName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_STABLE_GUID[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000002[DokanFS] status = STATUS_NOT_IMPLEMENTED[DokanFS] status = 0xc0000002[DokanFS] status = STATUS_NOT_IMPLEMENTED[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] Unknown Code 0x560048[DokanFS] BaseCode: 0x56(IOCTL_VOLUME_BASE) FunctionCode 0x12(18)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_SUGGESTED_LINK_NAME[DokanFS] LinkName \DosDevices\K: (28)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_LINK_CREATED[DokanFS] MountDev Name: \??\Volume{2497dc26-4ab1-11e6-a918-000c29293fe2}[DokanFS] Mount Point is not DosDevices, ignored.[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] Unknown Code 0x4d0010[DokanFS] BaseCode: 0x4d(MOUNTDEVCONTROLTYPE) FunctionCode 0x4(4)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_ONLINE[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] Unknown Code 0x56c064[DokanFS] BaseCode: 0x56(IOCTL_VOLUME_BASE) FunctionCode 0x19(25)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] IoCallDriver success[DokanFS] <= DokanSendIoContlToMountManager[DokanFS] IoCallDriver IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION success[DokanFS] <= DokanSendVolumeArrivalNotification[DokanFS] => DokanSendVolumeCreatePoint[DokanFS] DeviceName: \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] MountPoint: \DosDevices\K:[DokanFS] => DokanSendIoContlToMountManager[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_LINK_CREATED[DokanFS] MountDev Name: \DosDevices\K:[DokanFS] Mount Point already assigned to the device. New mount point ignored.[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] Unknown Code 0x4d0010[DokanFS] BaseCode: 0x4d(MOUNTDEVCONTROLTYPE) FunctionCode 0x4(4)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 4[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_ONLINE[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] Unknown Code 0x56c064[DokanFS] BaseCode: 0x56(IOCTL_VOLUME_BASE) FunctionCode 0x19(25)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] IoCallDriver success[DokanFS] <= DokanSendIoContlToMountManager[DokanFS] IoCallDriver success[DokanFS] <= DokanSendVolumeCreatePoint[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanFileSystemControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_GPT_ATTRIBUTES[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] MountId:1[DokanFS] DeviceName:\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] ==> DokanStartEventNotificationThread[DokanFS] <== DokanStartEventNotificationThread[DokanFS] <== DokanEventStart[DokanFS] <= DokanGlobalDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanTimeoutThread[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] IrpQueue is Empty[DokanFS] ==> NotificationThread[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5016[DokanFS] FileName:(null)[DokanFS] IdType = VCB[DokanFS] Here we only go in if some antivirus software tries to create files before startup is finished.[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanQueryVolumeInformation[DokanFS] ProcessId 5016[DokanFS] FileName: (null)[DokanFS] FileFsSizeInformation[DokanFS] ==> DokanRegisterPendingIrp[DokanFS] ==> DokanRegisterPendingIrpMain[DokanFS] <== DokanRegisterPendingIrpMain[DokanFS] <== DokanRegisterPendingIrp[DokanFS] status = 0x103[DokanFS] status = STATUS_PENDING[DokanFS] <== DokanQueryVolumeInformation[DokanFS] => NotificationLoop[DokanFS] Try acquire SpinLock...[DokanFS] SpinLock irp Acquired[DokanFS] SpinLock notify Acquired[DokanFS] Clear Events...[DokanFS] Notify event cleared[DokanFS] Pending event cleared[DokanFS] Release SpinLock...[DokanFS] SpinLock notify Released[DokanFS] SpinLock irp Released[DokanFS] <= NotificationLoop[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3092[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3092[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3092[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] System seems to be awaken from sleep mode. So do not Check Keep Alive yet.[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> DokanCreate[DokanFS] ProcessId 2488[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 2488[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 2488[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> DokanCreate[DokanFS] ProcessId 528[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 528[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 528[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 528[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 528[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 528[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 528[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 528[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] Timeout, umount[DokanFS] ==> DokanUnmount[DokanFS] Send Unmount to Service : \Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] => NotificationLoop[DokanFS] Try acquire SpinLock...[DokanFS] SpinLock irp Acquired[DokanFS] SpinLock notify Acquired[DokanFS] Clear Events...[DokanFS] Notify event cleared[DokanFS] Pending event cleared[DokanFS] Release SpinLock...[DokanFS] SpinLock notify Released[DokanFS] SpinLock irp Released[DokanFS] <= NotificationLoop[DokanFS] ==> DokanEventRelease[DokanFS] => DokanSendVolumeDeletePoints[DokanFS] MountPoint: \DosDevices\K:[DokanFS] DeviceName: \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] => DokanSendIoContlToMountManager[DokanFS] ==> DokanCreate[DokanFS] ProcessId 4[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 4[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_LINK_DELETED[DokanFS] Mount Manager is not enabled for this device. Ignored.[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 4[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] Unknown Code 0x4d0014[DokanFS] BaseCode: 0x4d(MOUNTDEVCONTROLTYPE) FunctionCode 0x5(5)[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] status = 0xc0000010[DokanFS] status = STATUS_INVALID_DEVICE_REQUEST[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] IoCallDriver success[DokanFS] <= DokanSendIoContlToMountManager[DokanFS] IoCallDriver success, 1 mount points deleted.[DokanFS] <= DokanSendVolumeDeletePoints[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] ==> DokanStopCheckThread[DokanFS] <== DokanStopCheckThread[DokanFS] ==> DokanStopEventNotificationThread[DokanFS] <== DokanStopEventNotificationThread[DokanFS] FindMountEntry \DosDevices\K: -> \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] Delete Symbolic Name: \DosDevices\Global\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] FCB allocated: 0[DokanFS] FCB freed: 0[DokanFS] CCB allocated: 0[DokanFS] CCB freed: 0[DokanFS] Delete Volume DeviceObject[DokanFS] Delete Disk DeviceObject[DokanFS] <== DokanEventRelease[DokanFS] <== DokanUnmount[DokanFS] DokanTimeoutThread catched KillEvent[DokanFS] <== DokanTimeoutThread[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 5016[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_GPT_ATTRIBUTES[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_GET_HOTPLUG_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5016[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAMEBreak instruction exception - code 80000003 (first chance)*** ERROR: Module load completed but symbols could not be loaded for dokan1.sysdokan1+0xa003:fffff800`3779a003 cc int 3
************* Symbol Path validation summary **************Response Time (ms) LocationDeferred srv*OK C:\work\bin\dokan-dev\master_july18\x64\Win10Debugkd> .reloadConnected to Windows 10 10586 x64 target at (Mon Jul 18 15:22:16.373 2016 (UTC - 7:00)), ptr64 TRUELoading Kernel Symbols..........................................................................................................................................................................Loading User Symbols.....Loading unloaded module list.......Loading Wow64 Symbols.......................................*** ERROR: Module load completed but symbols could not be loaded for dokan1.sys
************* Symbol Loading Error Summary **************Module name Errordokan1 PDB not found : cache* The system cannot find the file specified : SRV*https://msdl.microsoft.com/download/symbols PDB not found : c:\work\bin\dokan-dev\master_july18\x64\win10debug\symbols\sys\dokan1.pdb
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.You should also verify that your symbol search path (.sympath) is correct.kd> .reload /i dokan1.syskd> kp # Child-SP RetAddr Call Site00 ffffd001`cd1c7060 fffff800`377ada5d dokan1!DokanRegisterPendingIrpForService(struct _DEVICE_OBJECT * DeviceObject = 0x00000000`0000002f, struct _IRP * Irp = 0xfffff800`3333ac26)+0x3 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\event.c @ 279]01 ffffd001`cd1c70a0 fffff800`333aa23f dokan1! ?? ::FNODOBFM::`string'+0xd02 ffffd001`cd1c70d0 fffff800`333c09ed nt!_C_specific_handler+0x9f03 ffffd001`cd1c7140 fffff800`332e2469 nt!RtlpExecuteHandlerForException+0xd04 ffffd001`cd1c7170 fffff800`33369ffc nt!RtlDispatchException+0x42905 ffffd001`cd1c7870 fffff800`333c55c2 nt!KiDispatchException+0x14406 ffffd001`cd1c7f50 fffff800`333c3ca1 nt!KiExceptionDispatch+0xc207 ffffd001`cd1c8130 fffff800`377942e2 nt!KiPageFault+0x22108 ffffd001`cd1c82c0 fffff800`37795931 dokan1!DiskDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0xffffe001`1879d080 Device for "\FileSystem\dokan1", struct _IRP * Irp = 0xffffe001`17e54510)+0x972 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\device.c @ 292]09 ffffd001`cd1c8c00 fffff800`3779725c dokan1!DiskDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0x0012019f`00000000, struct _IRP * Irp = 0x00000000`00000000)+0x1fc1 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\device.c @ 710]0a ffffd001`cd1c8c60 fffff800`37797010 dokan1!DokanQueryDirectory(struct _DEVICE_OBJECT * DeviceObject = 0xffffd001`cd1c8d90 Device for {...}, struct _IRP * Irp = 0x00000000`00000200)+0x4ac [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\directory.c @ 184]0b ffffd001`cd1c8ca0 fffff800`33653b77 dokan1!DokanQueryDirectory(struct _DEVICE_OBJECT * DeviceObject = 0xffff000a`6c6f7274, struct _IRP * Irp = 0x00000000`33060000)+0x260 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\directory.c @ 129]*** ERROR: Module load completed but symbols could not be loaded for gzflt.sys0c ffffd001`cd1c8cf0 fffff800`35dd1be1 nt!IoVolumeDeviceToDosName+0xb70d ffffd001`cd1c8fc0 fffff800`35df48b3 gzflt+0x1be10e ffffd001`cd1c9010 fffff800`35df870f gzflt+0x248b30f ffffd001`cd1c90d0 fffff800`3538a9e0 gzflt+0x2870f10 ffffd001`cd1c9100 fffff800`3538a341 FLTMGR!FltpDoInstanceSetupNotification+0x8c11 ffffd001`cd1c9170 fffff800`35382e2d FLTMGR!FltpInitInstance+0x2f512 ffffd001`cd1c9230 fffff800`35382c31 FLTMGR!FltpCreateInstanceFromName+0x1ad13 ffffd001`cd1c9310 fffff800`35383172 FLTMGR!FltpEnumerateRegistryInstances+0x14514 ffffd001`cd1c93b0 fffff800`3538642c FLTMGR!FltpDoFilterNotificationForNewVolume+0x12615 ffffd001`cd1c9430 fffff800`3372cff8 FLTMGR!FltpCreate+0x49c16 ffffd001`cd1c94e0 fffff800`33726e32 nt!IopParseDevice+0x7c817 ffffd001`cd1c96b0 fffff800`337280dc nt!ObpLookupObjectName+0x99218 ffffd001`cd1c9830 fffff800`336ba058 nt!ObOpenObjectByNameEx+0x1ec19 ffffd001`cd1c9950 fffff800`336b9bb9 nt!IopCreateFile+0x3d81a ffffd001`cd1c9a00 fffff800`333c51a3 nt!NtCreateFile+0x791b ffffd001`cd1c9a90 00007ff9`431a5b84 nt!KiSystemServiceCopyEnd+0x131c 00000000`345bea28 00000000`656044c8 ntdll!NtCreateFile+0x141d 00000000`345bea30 00000000`65606245 wow64!whNtCreateFile+0xf81e 00000000`345beb00 00000000`656d1c87 wow64!Wow64SystemServiceEx+0x1551f 00000000`345bf3c0 00000000`6560bdb2 wow64cpu!ServiceNoTurbo+0xb20 00000000`345bf470 00000000`6560bcc0 wow64!RunCpuSimulation+0x2221 00000000`345bf4a0 00007ff9`43176e91 wow64!Wow64LdrpInitialize+0x12022 00000000`345bf750 00007ff9`43176d5e ntdll!_LdrpInitialize+0xdd23 00000000`345bf7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe
Marinko Babic
Jul 18, 2016, 7:05:02 PM7/18/16
to do...@googlegroups.com
Hi Steve
It's like I thought.
DokanFS] Timeout, umount
[DokanFS] ==> DokanUnmount
[DokanFS] Send Unmount to Service : \Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}
The keep alive tries to talk to the device but it's blocked. Time out is reached so the device is unmounting. There you get the BSOD. You are using the MountManager option? Did you try without MountManager option?
For this specific test how did you prepare your environment to get it fail?
We need to understand what response the Antivirus Software is expecting from driver and we need to behave this way.
Thanks
Marinko
Steve Sanders
Jul 18, 2016, 7:35:32 PM7/18/16
to Dokan
We do seem to use the mount manager option - are you suggesting we try taking it off? I didn't write this part so I'm not sure why it is used.
https://github.com/keybase/kbfs/blob/f487f7dc59cbeb90173336e87d63d11bc2c2ac66/dokan/bridge.c#L311I can try removing it tomorrow to see what happens.
As I said above, BitDefender. I also installed our product and moved its startup shortcuts to start it manually later. Dokany is installed too. At boot, with BitDefender active, I issued `doianctl /d 9`, then launched our processes, one of which is kbfsdokan.exe and mounts the drive. A few moments later it's crashed.
Marinko Babic
Jul 18, 2016, 7:39:22 PM7/18/16
to do...@googlegroups.com
Hi Steve
Just to see if it makes a difference, but I don't think so. Wondering why you can't reproduce the issue using the mirror?
Thanks
Marinko
Marinko Babic
Jul 19, 2016, 7:53:01 AM7/19/16
to do...@googlegroups.com
Hi Steve
Please try to increase the keep alive time to see if the all works properly? Maybe it just takes more time.
Like you said I was not able to reproduce the issue using my vm and BitDefender.
Thanks
Marinko
Marinko Babic
Jul 19, 2016, 8:01:01 AM7/19/16
to do...@googlegroups.com
If it still doesn't work so please create a driver with this line commented out
https://github.com/dokan-dev/dokany/blob/master/sys/timeout.c#L108
Create a log file again and post it here please.
Thanks
Marinko
Steve Sanders
Jul 19, 2016, 3:22:22 PM7/19/16
to Dokan
This is the result of running without DOKAN_OPTION_MOUNT_MANAGER.
Timeout is already set to 10 minutes, which is way longer than it takes to repro.
Next I will try your suggestion of removing the DokanUnmount call.
Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64Copyright (c) Microsoft Corporation. All rights reserved.
Opened \\.\pipe\kd_Windows_10_x64Waiting to reconnect...Connected to Windows 10 10586 x64 target at (Tue Jul 19 11:48:17.200 2016 (UTC - 7:00)), ptr64 TRUEKernel Debugger connection established.Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 10586 MP (1 procs) Free x64Built by: 10586.494.amd64fre.th2_release_sec.160630-1736Machine Name:Kernel base = 0xfffff801`b0c76000 PsLoadedModuleList = 0xfffff801`b0f53cf0System Uptime: 0 days 0:00:00.084nt!DebugService2+0x5:fffff801`b0dbe0e5 cc int 3kd> gP#00400080x11482426, s\minifilter.c, 471 | DriverEntryMiniFilter: [ERROR] : FltRegisterFilter failed, status = 0xc01c0007P#00400080x11482426, rufos\driver.c, 1829 | DrvReinitRoutine: [ERROR] : DriverEntryMiniFilter failed, status = 0xc01c0007KDTARGET: Refreshing KD connectionP#00401940x11482722, s\minifilter.c, 183 | GetPathIfReparsePointCSC: [INFO] : CSCLocation not a junction!+++++>WskKnrInit.[DokanFS] IOCTL_SET_DEBUG_MODE: 9[DokanFS] <= DokanGlobalDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 5700[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 5700[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5876[DokanFS] FileName:(null)[DokanFS] IdType = DGL[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5876[DokanFS] FileName:(null)[DokanFS] IdType = DGL[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DGL[DokanFS] => DokanGlobalDeviceControl[DokanFS] IOCTL_EVENT_START[DokanFS] ==> DokanEventStart[DokanFS] DeviceCharacteristics |= FILE_REMOVABLE_MEDIA[DokanFS] Mounting on current session only[DokanFS] DiskDeviceName: \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9} - SymbolicLinkName: \DosDevices\Global\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9} - MountPoint: \DosDevices\K:[DokanFS] IoCreateDevice DeviceType: 8[DokanFS] SymbolicLink: \DosDevices\Global\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9} -> \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9} created[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_GET_HOTPLUG_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_LENGTH_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_DISK_GET_DRIVE_GEOMETRY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_GET_HOTPLUG_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_CHECK_VERIFY[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanRead[DokanFS] Reads by File System Recognizers[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanRead[DokanFS] ==> DokanFileSystemControl[DokanFS] ProcessId 5876[DokanFS] IRP_MN_MOUNT_VOLUME[DokanFS] IdType = DCB[DokanFS] FindMountEntry \DosDevices\K: -> \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] ==> DokanStartCheckThread[DokanFS] <== DokanStartCheckThread[DokanFS] => DokanCreateMountPointSysProc[DokanFS] <= DokanCreateMountPointSysProc[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanFileSystemControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_GPT_ATTRIBUTES[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5876[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 5876[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] MountId:1[DokanFS] DeviceName:\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] ==> DokanStartEventNotificationThread[DokanFS] <== DokanStartEventNotificationThread[DokanFS] <== DokanEventStart[DokanFS] <= DokanGlobalDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 5876[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 5876[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanTimeoutThread[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] IrpQueue is Empty[DokanFS] ==> NotificationThread[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCreate[DokanFS] ProcessId 5876[DokanFS] FileName:(null)[DokanFS] IdType = VCB[DokanFS] Here we only go in if some antivirus software tries to create files before startup is finished.[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanQueryVolumeInformation[DokanFS] ProcessId 5876[DokanFS] FileName: (null)[DokanFS] FileFsSizeInformation[DokanFS] ==> DokanRegisterPendingIrp[DokanFS] ==> DokanRegisterPendingIrpMain[DokanFS] <== DokanRegisterPendingIrpMain[DokanFS] <== DokanRegisterPendingIrp[DokanFS] status = 0x103[DokanFS] status = STATUS_PENDING[DokanFS] <== DokanQueryVolumeInformation[DokanFS] => NotificationLoop[DokanFS] Try acquire SpinLock...[DokanFS] SpinLock irp Acquired[DokanFS] SpinLock notify Acquired[DokanFS] Clear Events...[DokanFS] Notify event cleared[DokanFS] Pending event cleared[DokanFS] Release SpinLock...[DokanFS] SpinLock notify Released[DokanFS] SpinLock irp Released[DokanFS] <= NotificationLoop[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3292[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3292[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3292[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3292[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3292[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3292[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3292[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanCreate[DokanFS] ProcessId 3292[DokanFS] FileName:(null)[DokanFS] IdType = DCB[DokanFS] IdentifierType is not vcb[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCreate[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] status = 0x80000005[DokanFS] status = STATUS_BUFFER_OVERFLOW[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 3292[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAME[DokanFS] DeviceName \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanClose[DokanFS] ProcessId 3292[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] System seems to be awaken from sleep mode. So do not Check Keep Alive yet.[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] ==> ReleaseTimeoutPendingIRP[DokanFS] <== ReleaseTimeoutPendingIRP[DokanFS] Timeout, umount[DokanFS] ==> DokanUnmount[DokanFS] Send Unmount to Service : \Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] ==> DokanEventRelease[DokanFS] => DokanDeleteMountPointSysProc[DokanFS] Delete Mount Point Symbolic Name: \DosDevices\K:[DokanFS] <= DokanDeleteMountPointSysProc[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] ==> DokanStopCheckThread[DokanFS] <== DokanStopCheckThread[DokanFS] ==> DokanStopEventNotificationThread[DokanFS] <== DokanStopEventNotificationThread[DokanFS] FindMountEntry \DosDevices\K: -> \Device\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] Delete Symbolic Name: \DosDevices\Global\Volume{d6cc17c5-1734-4085-bce7-964f1e9f5de9}[DokanFS] FCB allocated: 0[DokanFS] FCB freed: 0[DokanFS] CCB allocated: 0[DokanFS] CCB freed: 0[DokanFS] Delete Volume DeviceObject[DokanFS] Delete Disk DeviceObject[DokanFS] ==> DokanCleanup[DokanFS] ProcessId 4[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanCleanup[DokanFS] ==> DokanClose[DokanFS] ProcessId 5876[DokanFS] FileName: (null) FCB.FileName: (null)[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanClose[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_VOLUME_GET_GPT_ATTRIBUTES[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_STORAGE_GET_HOTPLUG_INFO[DokanFS] <= DokanDiskDeviceControl[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] status = 0x0[DokanFS] status = STATUS_SUCCESS[DokanFS] <== DokanDispatchIoControl[DokanFS] ==> DokanDispatchIoControl[DokanFS] ProcessId 5876[DokanFS] IdType = DCB[DokanFS] => DokanDiskDeviceControl[DokanFS] IOCTL_MOUNTDEV_QUERY_DEVICE_NAMEBreak instruction exception - code 80000003 (first chance)*** ERROR: Module load completed but symbols could not be loaded for dokan1.sysdokan1+0xa003:fffff801`5101a003 cc int 3
************* Symbol Path validation summary **************Response Time (ms) LocationDeferred srv*OK C:\work\bin\dokan-dev\master_july18\x64\Win10Debugkd> .reload /i dokan1.syskd> kp # Child-SP RetAddr Call Site00 ffffd001`57338060 fffff801`5102da5d dokan1!DokanRegisterPendingIrpForService(struct _DEVICE_OBJECT * DeviceObject = 0x00000000`0000002f, struct _IRP * Irp = 0xfffff801`b0d38c26)+0x3 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\event.c @ 279]01 ffffd001`573380a0 fffff801`b0da823f dokan1! ?? ::FNODOBFM::`string'+0xd02 ffffd001`573380d0 fffff801`b0dbe9ed nt!_C_specific_handler+0x9f03 ffffd001`57338140 fffff801`b0ce0469 nt!RtlpExecuteHandlerForException+0xd04 ffffd001`57338170 fffff801`b0d67ffc nt!RtlDispatchException+0x42905 ffffd001`57338870 fffff801`b0dc35c2 nt!KiDispatchException+0x14406 ffffd001`57338f50 fffff801`b0dc1ca1 nt!KiExceptionDispatch+0xc207 ffffd001`57339130 fffff801`510142e2 nt!KiPageFault+0x22108 ffffd001`573392c0 fffff801`51015931 dokan1!DiskDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0xffffe000`f377ac20 Device for "\FileSystem\dokan1", struct _IRP * Irp = 0xffffe000`f249ec10)+0x972 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\device.c @ 292]09 ffffd001`57339c00 fffff801`5101725c dokan1!DiskDeviceControl(struct _DEVICE_OBJECT * DeviceObject = 0x0012019f`00000000, struct _IRP * Irp = 0x00000000`00000000)+0x1fc1 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\device.c @ 710]0a ffffd001`57339c60 fffff801`51017010 dokan1!DokanQueryDirectory(struct _DEVICE_OBJECT * DeviceObject = 0xffffd001`57339d90 Device for {...}, struct _IRP * Irp = 0x00000000`00000200)+0x4ac [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\directory.c @ 184]0b ffffd001`57339ca0 fffff801`b1051b77 dokan1!DokanQueryDirectory(struct _DEVICE_OBJECT * DeviceObject = 0xffff000a`6c6f7274, struct _IRP * Irp = 0x00000000`b0060000)+0x260 [c:\jenkins\jobs\dokany\workspace\src\github.com\keybase\dokany\sys\directory.c @ 129]*** ERROR: Module load completed but symbols could not be loaded for gzflt.sys0c ffffd001`57339cf0 fffff801`500d1be1 nt!IoVolumeDeviceToDosName+0xb70d ffffd001`57339fc0 fffff801`500f48b3 gzflt+0x1be10e ffffd001`5733a010 fffff801`500f870f gzflt+0x248b30f ffffd001`5733a0d0 fffff801`4f62a9e0 gzflt+0x2870f10 ffffd001`5733a100 fffff801`4f62a341 FLTMGR!FltpDoInstanceSetupNotification+0x8c11 ffffd001`5733a170 fffff801`4f622e2d FLTMGR!FltpInitInstance+0x2f512 ffffd001`5733a230 fffff801`4f622c31 FLTMGR!FltpCreateInstanceFromName+0x1ad13 ffffd001`5733a310 fffff801`4f623172 FLTMGR!FltpEnumerateRegistryInstances+0x14514 ffffd001`5733a3b0 fffff801`4f62642c FLTMGR!FltpDoFilterNotificationForNewVolume+0x12615 ffffd001`5733a430 fffff801`b112aff8 FLTMGR!FltpCreate+0x49c16 ffffd001`5733a4e0 fffff801`b1124e32 nt!IopParseDevice+0x7c817 ffffd001`5733a6b0 fffff801`b11260dc nt!ObpLookupObjectName+0x99218 ffffd001`5733a830 fffff801`b10b8058 nt!ObOpenObjectByNameEx+0x1ec19 ffffd001`5733a950 fffff801`b10b7bb9 nt!IopCreateFile+0x3d81a ffffd001`5733aa00 fffff801`b0dc31a3 nt!NtCreateFile+0x791b ffffd001`5733aa90 00007ff9`cead5b84 nt!KiSystemServiceCopyEnd+0x131c 00000000`34a4ea28 00000000`67a444c8 ntdll!NtCreateFile+0x141d 00000000`34a4ea30 00000000`34c4fc34 0x67a444c81e 00000000`34a4ea38 00000000`00000004 0x34c4fc341f 00000000`34a4ea40 00000000`34a4ea98 0x420 00000000`34a4ea48 00000000`67a4cb1d 0x34a4ea9821 00000000`34a4ea50 00000000`00000000 0x67a4cb1d
Steve Sanders
Jul 19, 2016, 4:17:00 PM7/19/16
to Dokan, tar...@taruti.net, m...@keybase.io
FWIW, I also just got Symantec installed and got this crash - will try later to enable logging, etc. This is on Taru's branch of dokany:
Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64Copyright (c) Microsoft Corporation. All rights reserved.
Opened \\.\pipe\kd_Windows_10_x64Waiting to reconnect...Connected to Windows 10 10586 x64 target at (Tue Jul 19 13:04:15.408 2016 (UTC - 7:00)), ptr64 TRUEKernel Debugger connection established.Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 10586 MP (1 procs) Free x64Built by: 10586.494.amd64fre.th2_release_sec.160630-1736Machine Name:Kernel base = 0xfffff802`5f688000 PsLoadedModuleList = 0xfffff802`5f965cf0System Uptime: 0 days 0:00:00.079nt!DebugService2+0x5:fffff802`5f7d00e5 cc int 3kd> gKDTARGET: Refreshing KD connectionKDTARGET: Refreshing KD connection
*** Fatal System Error: 0x00000139 (0x0000000000000003,0xFFFFD000A2CDFAB0,0xFFFFD000A2CDFA08,0x0000000000000000)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
Connected to Windows 10 10586 x64 target at (Tue Jul 19 13:05:59.575 2016 (UTC - 7:00)), ptr64 TRUELoading Kernel Symbols............................................................................................................................................................................Loading User Symbols.......................................................................................................................................................................................................................................Loading unloaded module list.....................******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 139, {3, ffffd000a2cdfab0, ffffd000a2cdfa08, 0}
*** ERROR: Module load completed but symbols could not be loaded for dokan1.sys*** ERROR: Module load completed but symbols could not be loaded for PGPfsfd.sysProbably caused by : dokan1.sys ( dokan1+19c8 )
Followup: MachineOwner---------
nt!DbgBreakPointWithStatus:fffff802`5f7d0090 cc int 3kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)A kernel component has corrupted a critical data structure. The corruptioncould potentially allow a malicious user to gain control of this machine.Arguments:Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).Arg2: ffffd000a2cdfab0, Address of the trap frame for the exception that caused the bugcheckArg3: ffffd000a2cdfa08, Address of the exception record for the exception that caused the bugcheckArg4: 0000000000000000, Reserved
Debugging Details:------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 0
BUILD_VERSION_STRING: 10586.494.amd64fre.th2_release_sec.160630-1736
DUMP_TYPE: 0
BUGCHECK_P1: 3
BUGCHECK_P2: ffffd000a2cdfab0
BUGCHECK_P3: ffffd000a2cdfa08
BUGCHECK_P4: 0
TRAP_FRAME: ffffd000a2cdfab0 -- (.trap 0xffffd000a2cdfab0)NOTE: The trap frame does not contain all registers.Some register values may be zeroed or incorrect.rax=ffffe0005ac46738 rbx=0000000000000000 rcx=0000000000000003rdx=ffffe0005a36d220 rsi=0000000000000000 rdi=0000000000000000rip=fffff800a53019c8 rsp=ffffd000a2cdfc40 rbp=0000000000000000 r8=ffffe0005a36d220 r9=0000000000000000 r10=ffffe0005bfcc778r11=ffffd000a2cdfc10 r12=0000000000000000 r13=0000000000000000r14=0000000000000000 r15=0000000000000000iopl=0 nv up ei ng nz ac po cydokan1+0x19c8:fffff800`a53019c8 cd29 int 29hResetting default scope
EXCEPTION_RECORD: ffffd000a2cdfa08 -- (.exr 0xffffd000a2cdfa08)ExceptionAddress: fffff800a53019c8 (dokan1+0x00000000000019c8) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001NumberParameters: 1 Parameter[0]: 0000000000000003Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 1
CPU_MHZ: af8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 4e
CPU_STEPPING: 3
CPU_MICROCODE: 6,4e,3,0 (F,M,S,R) SIG: 82'00000000 (cache) 82'00000000 (init)
DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT
BUGCHECK_STR: 0x139
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: STEVE-SURFACE
ANALYSIS_SESSION_TIME: 07-19-2016 13:08:11.0741
ANALYSIS_VERSION: 10.0.10586.567 amd64fre
LAST_CONTROL_TRANSFER: from fffff8025f849af2 to fffff8025f7d0090
STACK_TEXT: ffffd000`a2cdefd8 fffff802`5f849af2 : 00000000`00000003 00000000`00000139 ffffd000`a2cdf140 fffff802`5f6a7848 : nt!DbgBreakPointWithStatusffffd000`a2cdefe0 fffff802`5f8494c3 : 00000000`00000003 ffffd000`a2cdf140 fffff802`5f7d7600 00000000`00000139 : nt!KiBugCheckDebugBreak+0x12ffffd000`a2cdf040 fffff802`5f7caa44 : 00000000`00000000 fffff800`a489db66 ffffe000`5ac466c0 00000000`00000000 : nt!KeBugCheck2+0x893ffffd000`a2cdf750 fffff802`5f7d54e9 : 00000000`00000139 00000000`00000003 ffffd000`a2cdfab0 ffffd000`a2cdfa08 : nt!KeBugCheckEx+0x104ffffd000`a2cdf790 fffff802`5f7d5810 : 00000000`00000000 fffff802`5f6161ce ffffc001`1bd441e0 ffffe000`5a259180 : nt!KiBugCheckDispatch+0x69ffffd000`a2cdf8d0 fffff802`5f7d49f3 : ffffd000`00010027 00000000`11599add 00000000`00000000 fffff802`5f9a4180 : nt!KiFastFailDispatch+0xd0ffffd000`a2cdfab0 fffff800`a53019c8 : ffffe000`5bebfd02 ffffe000`5ac466c0 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf3ffffd000`a2cdfc40 fffff800`a5301467 : ffffe000`5bebfd60 ffffe000`5a36d010 ffffe000`5a36d010 ffffe000`5beeb540 : dokan1+0x19c8ffffd000`a2cdfc70 fffff800`a5302d2b : ffffe000`5bb05601 ffffe000`5bfcc5d0 ffffe000`5bfcc5d0 ffffd000`a2cdfee0 : dokan1+0x1467ffffd000`a2cdfcc0 fffff800`a3b07895 : ffffe000`5bebfc10 ffffe000`5bfcc5d0 ffffe000`5bb05620 ffffe000`5bfcc500 : dokan1+0x2d2bffffd000`a2cdfd10 fffff800`a3b05816 : ffffe000`59f59880 fffff800`a434f9b5 ffffd000`a2cdb001 ffffe000`59f11840 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5ffffd000`a2cdfda0 fffff800`a4343235 : ffffe000`5bfcc5d0 00000000`00000000 ffffe000`5b2b45c0 ffffe000`5b2b45c0 : FLTMGR!FltpDispatch+0xb6ffffd000`a2cdfe00 fffff800`a3b07895 : ffffe000`5c033a90 00000000`00000000 ffffe000`5bfcc5d0 ffffe000`5bfcc500 : PGPfsfd+0x23235ffffd000`a2cdfe30 fffff800`a3b05816 : ffffe000`5a162a00 ffffe000`5b5d1ca0 00000000`00000001 ffffe000`59a27140 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5ffffd000`a2cdfec0 fffff802`5fb46acd : ffffe000`5b2b45c0 ffffe000`5b2b45c0 ffffe000`5bfcc5d0 00000000`00000000 : FLTMGR!FltpDispatch+0xb6ffffd000`a2cdff20 fffff802`5fb1c1e8 : ffffd000`a2ce0189 00000000`00000000 ffffe000`58d70dc0 00000000`c0000034 : nt!IopDeleteFile+0x12dffffd000`a2cdffa0 fffff802`5f749461 : 00000000`00000000 00000000`00000000 ffffd000`a2ce0189 ffffe000`5b2b45c0 : nt!ObpRemoveObjectRoutine+0x78ffffd000`a2ce0000 fffff800`a434ef51 : ffffe000`5c149dc8 00000000`00000000 00000000`00000014 00000000`466c6946 : nt!ObfDereferenceObject+0xa1ffffd000`a2ce0040 fffff800`a434f7f6 : ffffe000`5b5d1ac8 ffffe000`5c149c01 ffffe000`5a236010 ffffe000`5bb10f20 : PGPfsfd+0x2ef51ffffd000`a2ce0110 fffff800`a434fb84 : ffffe000`5a15e270 ffffe000`5c149cb0 ffffe000`5a236010 ffffe000`5c149cb0 : PGPfsfd+0x2f7f6ffffd000`a2ce01f0 fffff800`a4351710 : 00000000`00000000 ffffe000`5b5d1ac8 ffffe000`5c149cb0 ffffe000`5c149e10 : PGPfsfd+0x2fb84ffffd000`a2ce0230 fffff800`a4351ab0 : 00000000`00000000 ffffd000`a2ce0309 ffffe000`5b5d1ac8 ffffe000`5a236010 : PGPfsfd+0x31710ffffd000`a2ce02a0 fffff800`a4343fda : ffffe000`5c149dc8 ffffe000`5c149cb0 ffffe000`5b5d1a80 ffffe000`00000180 : PGPfsfd+0x31ab0ffffd000`a2ce0370 fffff800`a3b07895 : ffffe000`5c007010 00000000`00000000 ffffe000`5c149cb0 ffffe000`5c149e58 : PGPfsfd+0x23fdaffffd000`a2ce03a0 fffff800`a3b362d7 : ffffe000`5b5d1ca0 00000000`000007ff ffffe000`58c03001 00000000`00000801 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5ffffd000`a2ce0430 fffff802`5fb3cff8 : 00000000`00000000 00000000`00000005 00000000`00000000 ffffe000`00000189 : FLTMGR!FltpCreate+0x347ffffd000`a2ce04e0 fffff802`5fb36e32 : fffff802`5f688000 fffff802`5f688000 00000000`00000001 fffff802`5fb3c830 : nt!IopParseDevice+0x7c8ffffd000`a2ce06b0 fffff802`5fb380dc : ffffe000`5bb07000 ffffd000`a2ce08a0 00000000`00000040 ffffe000`58d70dc0 : nt!ObpLookupObjectName+0x992ffffd000`a2ce0830 fffff802`5faca058 : 00000000`00000001 ffffe000`5bd766b0 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ecffffd000`a2ce0950 fffff802`5fac9bb9 : 00000000`04c8f548 ffffd000`a2cec240 00000000`04c8f5c0 00000000`04c8f560 : nt!IopCreateFile+0x3d8ffffd000`a2ce0a00 fffff802`5f7d51a3 : ffffe000`5b6c7840 00000000`04c8f988 ffffd000`a2ce0aa8 00000000`00000000 : nt!NtCreateFile+0x79ffffd000`a2ce0a90 00007ffc`aac85b84 : 00007ffc`a7bda484 00000000`00000000 00000000`00000000 00000000`00000002 : nt!KiSystemServiceCopyEnd+0x1300000000`04c8f4c8 00007ffc`a7bda484 : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000003 : ntdll!NtCreateFile+0x1400000000`04c8f4d0 00007ffc`a7bda156 : 00000000`00010118 00000000`00000401 ffffffff`ffffffff 00000000`14c3df20 : KERNELBASE!CreateFileInternal+0x31400000000`04c8f650 00007ffc`a90490fc : 00000000`00000000 00000000`14c40408 00000000`00d528d0 00000000`0991c290 : KERNELBASE!CreateFileW+0x6600000000`04c8f6b0 00007ffc`a904c084 : 00000000`00df8ca0 00000000`04c8fab0 00007ffc`a9049090 00007ffc`a736d660 : SHELL32!CLocalInterruptSource::v_CreateEvent+0x6c00000000`04c8f9b0 00007ffc`a8fcda0a : 00000000`00de1930 00000000`00de1930 00000000`00000005 00007ffc`a955d1c4 : SHELL32!CChangeNotify::_MessagePump+0x79400000000`04c8faf0 00007ffc`a7919080 : 00000000`00000000 00000000`00000000 00000000`04c8fbd9 00000000`00000000 : SHELL32!CChangeNotify::s_ThreadProc+0xaa00000000`04c8fb50 00007ffc`a8138102 : 00000000`00000000 00000000`00000000 00007ffc`a7918f90 00000000`00000000 : SHCORE!??$MakeAndInitialize@VCClosableStreamWrapper@@UIStream@@PEAU2@$$T@Details@WRL@Microsoft@@YAJPEAPEAUIStream@@$$QEAPEAU3@$$QEA$$T@Z+0x1c400000000`04c8fc40 00007ffc`aac3c5b4 : 00007ffc`a81380e0 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x2200000000`04c8fc70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34
STACK_COMMAND: kb
THREAD_SHA1_HASH_MOD_FUNC: 7dcd3b7aad63a533284db76947249d5ef3344ce3
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: e06f153043d7f5b06f333c24394348983b72c798
THREAD_SHA1_HASH_MOD: 386232f64450dba60e77b9a2c737a6b743c04624
FOLLOWUP_IP: dokan1+19c8fffff800`a53019c8 cd29 int 29h
FAULT_INSTR_CODE: cccc29cd
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: dokan1+19c8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dokan1
IMAGE_NAME: dokan1.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5764a1f1
BUCKET_ID_FUNC_OFFSET: 19c8
FAILURE_BUCKET_ID: 0x139_3_dokan1!Unknown_Function
BUCKET_ID: 0x139_3_dokan1!Unknown_Function
PRIMARY_PROBLEM_CLASS: 0x139_3_dokan1!Unknown_Function
TARGET_TIME: 2016-07-19T20:06:02.000Z
OSBUILD: 10586
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2016-06-30 20:26:45
BUILDDATESTAMP_STR: 160630-1736
BUILDLAB_STR: th2_release_sec
BUILDOSVER_STR: 10.0.10586.494.amd64fre.th2_release_sec.160630-1736
ANALYSIS_SESSION_ELAPSED_TIME: 173c
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_dokan1!unknown_function
FAILURE_ID_HASH: {32fe5419-78b3-5b4b-d8d6-cbda58bc9b39}
Followup: MachineOwner---------
On Friday, July 15, 2016 at 9:33:33 AM UTC-7, Steve Sanders wrote:
Taru Karttunen
Jul 19, 2016, 4:57:06 PM7/19/16
to do...@googlegroups.com, m...@keybase.io
On 19.07 13:16, Steve Sanders wrote:
> FWIW, I also just got Symantec installed and got this crash - will try
> later to enable logging, etc. This is on Taru's branch of dokany:
Hello
> FWIW, I also just got Symantec installed and got this crash - will try
> later to enable logging, etc. This is on Taru's branch of dokany:
It seems like the AV related BSODs goes away if we set
dokan_options.Timeout to 0 and use marinkobabic's
FixBsodMounting branch[1].
With non-zero Timeout there are issues, but
this helps us avoid BSODs and should
make finding the underlying issue easier.
Mirror by default also leaves the timeout as zero.
[1] https://github.com/marinkobabic/dokany/tree/FixBsodMounting
- Taru
Marinko Babic
Jul 19, 2016, 5:01:40 PM7/19/16
to do...@googlegroups.com, m...@keybase.io
I'm very interested to know what happens if the unmount line is commented out and you are using BitDefender?
Please provide the log.
If the process hangs, we should be able to identify the source of the problem. I have already an assumption based on the log, but let's see what the result is.
Marinko Babic
Jul 19, 2016, 7:13:54 PM7/19/16
to do...@googlegroups.com
If the Timeout is 0 then the driver set's the timeout to 15000 milliseconds. The max timeout is 5 Minutes. Driver changes your value to 5 Minutes if it's higher. It's Irp limit set by os so it makes sense.
As one of the last tests you should take this branch https://github.com/marinkobabic/dokany/tree/FixBsodMounting and test it in your vm where BitDefender is installed.
Then please provide the log file. Have made a small change in my branch to see if this fixes your problem.
Thanks
Marinko
Steve Sanders
Jul 20, 2016, 1:10:54 AM7/20/16
to Dokan
I get no BSOD when using this branch (40d4a702300b28d105a607263b4b7f599446a1ca), both with and without commenting out the unmount line above, though our software seems to work better with the unmount commented out. Log of this case attached - let me know if you want the one with unmount intact.
Thanks!
Marinko Babic
Jul 20, 2016, 7:54:54 AM7/20/16
to do...@googlegroups.com
Have made s small fix in my branch. Now it should work like it is, there is no need to comment anything out. Please let me know if it works properly using BitDefender and Symantec.
--You received this message because you are subscribed to the Google Groups "Dokan" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dokan+un...@googlegroups.com.
To post to this group, send email to do...@googlegroups.com.
Visit this group at https://groups.google.com/group/dokan.
For more options, visit https://groups.google.com/d/optout.
Steve Sanders
Jul 20, 2016, 1:54:45 PM7/20/16
to Dokan, tar...@taruti.net, m...@keybase.io
Hi, I used your latest (9ddcc7ed85f90869f1081a679963f477b9fa93b2) and still no BSOD with BitDefender, but there still is with Symantec. I don't know why windbg/VirtualKD aren't capturing logging like in the other snapshot - is this enough to go on?
Great work on the BitDefender BSOD.
Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64Copyright (c) Microsoft Corporation. All rights reserved.
Opened \\.\pipe\kd_Windows_10_x64Waiting to reconnect...Connected to Windows 10 10586 x64 target at (Wed Jul 20 10:12:28.152 2016 (UTC - 7:00)), ptr64 TRUEKernel Debugger connection established.Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 10586 MP (1 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 10586.494.amd64fre.th2_release_sec.160630-1736Machine Name:Kernel base = 0xfffff802`b4483000 PsLoadedModuleList = 0xfffff802`b4760cf0Debug session time: Wed Jul 20 10:12:25.043 2016 (UTC - 7:00)System Uptime: 0 days 1:58:50.823nt!DebugService2+0x5:fffff802`b45cb0e5 cc int 3kd> gShutdown occurred at (Wed Jul 20 10:24:15.524 2016 (UTC - 7:00))...unloading all symbol tables.Waiting to reconnect...Connected to Windows 10 10586 x64 target at (Wed Jul 20 10:24:23.776 2016 (UTC - 7:00)), ptr64 TRUEKernel Debugger connection established.
************* Symbol Path validation summary **************Response Time (ms) LocationDeferred srv*Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 10586 MP (1 procs) Free x64Built by: 10586.494.amd64fre.th2_release_sec.160630-1736Machine Name:Kernel base = 0xfffff800`6061c000 PsLoadedModuleList = 0xfffff800`608f9cf0System Uptime: 0 days 0:00:00.081nt!DebugService2+0x5:fffff800`607640e5 cc int 3kd> gKDTARGET: Refreshing KD connectionKDTARGET: Refreshing KD connection
*** Fatal System Error: 0x00000139 (0x0000000000000003,0xFFFFD000214E6960,0xFFFFD000214E68B8,0x0000000000000000)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
Connected to Windows 10 10586 x64 target at (Wed Jul 20 10:27:55.004 2016 (UTC - 7:00)), ptr64 TRUELoading Kernel Symbols............................................................................................................................................................................Loading User Symbols......................................................................................................................................................................................................................................................Loading unloaded module list...................******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 139, {3, ffffd000214e6960, ffffd000214e68b8, 0}
*** ERROR: Module load completed but symbols could not be loaded for PGPfsfd.sysProbably caused by : dokan1.sys ( dokan1!RtlFailFast+a )
Followup: MachineOwner---------
nt!DbgBreakPointWithStatus:fffff800`60764090 cc int 3kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)A kernel component has corrupted a critical data structure. The corruptioncould potentially allow a malicious user to gain control of this machine.Arguments:Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).Arg2: ffffd000214e6960, Address of the trap frame for the exception that caused the bugcheckArg3: ffffd000214e68b8, Address of the exception record for the exception that caused the bugcheckArg4: 0000000000000000, Reserved
Debugging Details:------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 0
BUILD_VERSION_STRING: 10586.494.amd64fre.th2_release_sec.160630-1736
DUMP_TYPE: 0
BUGCHECK_P1: 3
BUGCHECK_P2: ffffd000214e6960
BUGCHECK_P3: ffffd000214e68b8
BUGCHECK_P4: 0
TRAP_FRAME: ffffd000214e6960 -- (.trap 0xffffd000214e6960)NOTE: The trap frame does not contain all registers.Some register values may be zeroed or incorrect.rax=0000000000000003 rbx=0000000000000000 rcx=0000000000000003rdx=ffffe001f73483e8 rsi=0000000000000000 rdi=0000000000000000rip=fffff800720638ba rsp=ffffd000214e6af8 rbp=0000000000000000 r8=ffffe001f7348220 r9=0000000000000001 r10=0000000000000258r11=ffffd000214e6b50 r12=0000000000000000 r13=0000000000000000r14=0000000000000000 r15=0000000000000000iopl=0 nv up ei ng nz na po ncdokan1!RtlFailFast+0xa:fffff800`720638ba cd29 int 29hResetting default scope
EXCEPTION_RECORD: ffffd000214e68b8 -- (.exr 0xffffd000214e68b8)ExceptionAddress: fffff800720638ba (dokan1!RtlFailFast+0x000000000000000a) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001NumberParameters: 1 Parameter[0]: 0000000000000003Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 1
CPU_MHZ: af8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 4e
CPU_STEPPING: 3
CPU_MICROCODE: 6,4e,3,0 (F,M,S,R) SIG: 82'00000000 (cache) 82'00000000 (init)
DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT
BUGCHECK_STR: 0x139
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: STEVE-SURFACE
ANALYSIS_SESSION_TIME: 07-20-2016 10:28:10.0735
ANALYSIS_VERSION: 10.0.10586.567 amd64fre
LAST_CONTROL_TRANSFER: from fffff800607ddaf2 to fffff80060764090
STACK_TEXT: ffffd000`214e5e88 fffff800`607ddaf2 : 00000000`00000003 00000000`00000139 ffffd000`214e5ff0 fffff800`6063b848 : nt!DbgBreakPointWithStatusffffd000`214e5e90 fffff800`607dd4c3 : 00000000`00000003 ffffd000`214e5ff0 fffff800`6076b600 00000000`00000139 : nt!KiBugCheckDebugBreak+0x12ffffd000`214e5ef0 fffff800`6075ea44 : ffffe001`f5932900 fffff800`70906366 ffffe001`f5117670 ffffe001`f6b044f8 : nt!KeBugCheck2+0x893ffffd000`214e6600 fffff800`607694e9 : 00000000`00000139 00000000`00000003 ffffd000`214e6960 ffffd000`214e68b8 : nt!KeBugCheckEx+0x104ffffd000`214e6640 fffff800`60769810 : ffffe001`f529da58 ffffe001`f529d700 ffffd000`214e6a00 ffffd000`214e6a01 : nt!KiBugCheckDispatch+0x69ffffd000`214e6780 fffff800`607689f3 : 00000000`000000c4 00000000`00000000 00000000`00000000 ffffe001`f437f301 : nt!KiFastFailDispatch+0xd0ffffd000`214e6960 fffff800`720638ba : fffff800`7206367d 00000000`00000003 fffff800`6063dfd9 ffffe001`f5122fb8 : nt!KiRaiseSecurityCheckFailure+0xf3ffffd000`214e6af8 fffff800`7206367d : 00000000`00000003 fffff800`6063dfd9 ffffe001`f5122fb8 ffffe001`f5122e10 : dokan1!RtlFailFast+0xa [c:\program files (x86)\windows kits\10\include\10.0.10586.0\km\wdm.h @ 10780]ffffd000`214e6b00 fffff800`72063867 : ffffe001`f7348220 ffffe001`f73483e8 ffffe001`f7348220 fffff800`00000258 : dokan1!FatalListEntryError+0x1d [c:\program files (x86)\windows kits\10\include\10.0.10586.0\km\wdm.h @ 11014]ffffd000`214e6b30 fffff800`72062c84 : ffffe001`f73483e8 ffffe001`f5117670 00000000`00000000 ffffe001`f7348370 : dokan1!RemoveEntryList+0x57 [c:\program files (x86)\windows kits\10\include\10.0.10586.0\km\wdm.h @ 11051]ffffd000`214e6b80 fffff800`72062171 : ffffe001`f7348370 ffffe001`f5122e10 fffff800`72077590 ffffe001`f7348370 : dokan1!DokanFreeCCB+0x94 [c:\work\src\github.com\dokan-dev\dokany\sys\create.c @ 249]ffffd000`214e6bc0 fffff800`72067774 : ffffe001`f6028450 ffffe001`f5122e10 ffffe001`f7514010 ffffe001`f6613f20 : dokan1!DokanDispatchClose+0x511 [c:\work\src\github.com\dokan-dev\dokany\sys\close.c @ 126]ffffd000`214e6c80 fffff800`720675f0 : ffffe001`f6028450 ffffe001`f5122e10 ffffe001`f73f2800 ffffd000`214e6ee0 : dokan1!DokanDispatchRequest+0x134 [c:\work\src\github.com\dokan-dev\dokany\sys\dispatch.c @ 98]ffffd000`214e6cc0 fffff800`70907895 : ffffe001`f6028450 ffffe001`f5122e10 00000000`00000002 ffffe001`f5122e00 : dokan1!DokanBuildRequest+0x80 [c:\work\src\github.com\dokan-dev\dokany\sys\dispatch.c @ 45]ffffd000`214e6d10 fffff800`70905816 : ffffe001`f5554400 fffff800`7114f9b5 ffffd000`214e2001 ffffe001`f4f5e840 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5ffffd000`214e6da0 fffff800`71143235 : ffffe001`f5122e10 00000000`00000000 ffffe001`f6613f20 ffffe001`f6613f20 : FLTMGR!FltpDispatch+0xb6ffffd000`214e6e00 fffff800`70907895 : ffffe001`f514bc00 00000000`00000000 ffffe001`f5122e10 ffffe001`f5122e00 : PGPfsfd+0x23235ffffd000`214e6e30 fffff800`70905816 : ffffe001`f5812b80 ffffe001`f73f2800 00000000`00000001 ffffe001`f5810980 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5ffffd000`214e6ec0 fffff800`60adaacd : ffffe001`f6613f20 ffffe001`f6613f20 ffffe001`f5122e10 00000000`00000000 : FLTMGR!FltpDispatch+0xb6ffffd000`214e6f20 fffff800`60ab01e8 : ffffd000`214e7189 00000000`00000000 ffffe001`f416ac60 00000000`c0000034 : nt!IopDeleteFile+0x12dffffd000`214e6fa0 fffff800`606dd461 : 00000000`00000000 00000000`00000000 ffffd000`214e7189 ffffe001`f6613f20 : nt!ObpRemoveObjectRoutine+0x78ffffd000`214e7000 fffff800`7114ef51 : ffffe001`f71cb558 00000000`00000000 00000000`00000014 fffff800`466c6946 : nt!ObfDereferenceObject+0xa1ffffd000`214e7040 fffff800`7114f7f6 : ffffe001`f72bb608 ffffe001`f71cb401 ffffe001`f61e0850 ffffe001`f5aa8090 : PGPfsfd+0x2ef51ffffd000`214e7110 fffff800`7114fb84 : ffffe001`f5810270 ffffe001`f71cb440 ffffe001`f61e0850 ffffe001`f71cb440 : PGPfsfd+0x2f7f6ffffd000`214e71f0 fffff800`71151710 : 00000000`00000000 ffffe001`f72bb608 ffffe001`f71cb440 ffffe001`f71cb5a0 : PGPfsfd+0x2fb84ffffd000`214e7230 fffff800`71151ab0 : 00000000`00000000 ffffd000`214e7309 ffffe001`f72bb608 ffffe001`f61e0850 : PGPfsfd+0x31710ffffd000`214e72a0 fffff800`71143fda : ffffe001`f71cb558 ffffe001`f71cb440 ffffe001`f72bb5c0 ffffe001`00000180 : PGPfsfd+0x31ab0ffffd000`214e7370 fffff800`70907895 : ffffe001`f52a1010 00000000`00000000 ffffe001`f71cb440 ffffe001`f71cb5e8 : PGPfsfd+0x23fdaffffd000`214e73a0 fffff800`709362d7 : ffffe001`f73f2800 00000000`000007ff ffffe001`f4003001 00000000`00000801 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5ffffd000`214e7430 fffff800`60ad0ff8 : 00000000`00000000 00000000`00000005 00000000`00000000 fffff800`00000189 : FLTMGR!FltpCreate+0x347ffffd000`214e74e0 fffff800`60acae32 : fffff800`6061c000 fffff800`6061c000 00000000`00000001 fffff800`60ad0830 : nt!IopParseDevice+0x7c8ffffd000`214e76b0 fffff800`60acc0dc : ffffe001`f7461b00 ffffd000`214e78a0 00000000`00000040 ffffe001`f416ac60 : nt!ObpLookupObjectName+0x992ffffd000`214e7830 fffff800`60a5e058 : 00000000`00000001 ffffe001`f70cbb10 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ecffffd000`214e7950 fffff800`60a5dbb9 : 00000000`049af598 ffffd000`214ec240 00000000`049af610 00000000`049af5b0 : nt!IopCreateFile+0x3d8ffffd000`214e7a00 fffff800`607691a3 : ffffe001`f68c0840 00000000`049af9d8 ffffd000`214e7aa8 00000000`00000000 : nt!NtCreateFile+0x79ffffd000`214e7a90 00007ffb`a8945b84 : 00007ffb`a59fa484 00000000`00000000 00000000`00000000 00000000`00000002 : nt!KiSystemServiceCopyEnd+0x1300000000`049af518 00007ffb`a59fa484 : 00000000`00000000 00000000`00000000 00000000`00000002 00000000`00000003 : ntdll!NtCreateFile+0x1400000000`049af520 00007ffb`a59fa156 : 00000000`00010118 00000000`00000401 ffffffff`ffffffff 00000000`14ce3880 : KERNELBASE!CreateFileInternal+0x31400000000`049af6a0 00007ffb`a67890fc : 00000000`00000000 00000000`14cdde88 00000000`00a513c0 00000000`1036e3d0 : KERNELBASE!CreateFileW+0x6600000000`049af700 00007ffb`a678c084 : 00000000`00acd390 00000000`049afb00 00007ffb`a6789090 00007ffb`a50ed660 : SHELL32!CLocalInterruptSource::v_CreateEvent+0x6c00000000`049afa00 00007ffb`a670da0a : 00000000`00ad03a0 00000000`00ad03a0 00000000`00000005 00007ffb`a6c9d1c4 : SHELL32!CChangeNotify::_MessagePump+0x79400000000`049afb40 00007ffb`a4f89080 : 00000000`00000000 00000000`00000000 00000000`049afc29 00000000`00000000 : SHELL32!CChangeNotify::s_ThreadProc+0xaa00000000`049afba0 00007ffb`a65d8102 : 00000000`00000000 00000000`00000000 00007ffb`a4f88f90 00000000`00000000 : SHCORE!??$MakeAndInitialize@VCClosableStreamWrapper@@UIStream@@PEAU2@$$T@Details@WRL@Microsoft@@YAJPEAPEAUIStream@@$$QEAPEAU3@$$QEA$$T@Z+0x1c400000000`049afc90 00007ffb`a88fc5b4 : 00007ffb`a65d80e0 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x2200000000`049afcc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34
STACK_COMMAND: kb
THREAD_SHA1_HASH_MOD_FUNC: 1a92b233edb09af620dd843852b1da7c472f1c2c
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: e6a4e333b6e9d8e8e95f2954a43fb4ab19f43683
THREAD_SHA1_HASH_MOD: 276f178c0c32578a5b49b5c7b663c78ae00499da
FOLLOWUP_IP: dokan1!RtlFailFast+a [c:\program files (x86)\windows kits\10\include\10.0.10586.0\km\wdm.h @ 10780]fffff800`720638ba cd29 int 29h
FAULT_INSTR_CODE: ccc329cd
FAULTING_SOURCE_LINE: c:\program files (x86)\windows kits\10\include\10.0.10586.0\km\wdm.h
FAULTING_SOURCE_FILE: c:\program files (x86)\windows kits\10\include\10.0.10586.0\km\wdm.h
FAULTING_SOURCE_LINE_NUMBER: 10780
FAULTING_SOURCE_CODE: 10776: ) 10777: 10778: { 10779: >10780: __fastfail(Code); 10781: } 10782: 10783: #endif // _MSC_VER 10784: 10785: //
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: dokan1!RtlFailFast+a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dokan1
IMAGE_NAME: dokan1.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 578ea951
BUCKET_ID_FUNC_OFFSET: a
FAILURE_BUCKET_ID: 0x139_3_dokan1!RtlFailFast
BUCKET_ID: 0x139_3_dokan1!RtlFailFast
PRIMARY_PROBLEM_CLASS: 0x139_3_dokan1!RtlFailFast
TARGET_TIME: 2016-07-20T17:28:13.000Z
OSBUILD: 10586
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2016-06-30 20:26:45
BUILDDATESTAMP_STR: 160630-1736
BUILDLAB_STR: th2_release_sec
BUILDOSVER_STR: 10.0.10586.494.amd64fre.th2_release_sec.160630-1736
ANALYSIS_SESSION_ELAPSED_TIME: 14dd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_dokan1!rtlfailfast
FAILURE_ID_HASH: {57f3176e-e2a4-bc39-2580-58de34da564e}
Followup: MachineOwner---------
On Friday, July 15, 2016 at 9:33:33 AM UTC-7, Steve Sanders wrote:
Marinko Babic
Jul 20, 2016, 4:43:06 PM7/20/16
to do...@googlegroups.com
It looks like we are removing the same ccb two times. Please can you provide a log file?
--
You received this message because you are subscribed to a topic in the Google Groups "Dokan" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/dokan/7ahNxJ7XNOI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to dokan+un...@googlegroups.com.
Marinko Babic
Jul 22, 2016, 10:28:52 AM7/22/16
to do...@googlegroups.com
Hi Steve
Thanks a lot. It's actually not obvious why the same entry is removed twice. I have done anyway some refactoring. So please can you test using the last version of this branch https://github.com/marinkobabic/dokany/tree/FixBsodMounting and paste the log here.
If we still have the same problem I will put some extra information into the log, so that we can narrow the issue down.
Thanks
Marinko
--
Marinko Babic
Jul 22, 2016, 2:29:46 PM7/22/16
to do...@googlegroups.com
Have now added extra logging information. Please can you create a new log file using the newest code?
Marinko Babic
Jul 22, 2016, 5:09:38 PM7/22/16
to do...@googlegroups.com
Hi Steve
This is not the actual code. As you can see, the following line is not in the log
Please create a new log file.
Thanks
Marinko
--
You received this message because you are subscribed to a topic in the Google Groups "Dokan" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/dokan/7ahNxJ7XNOI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to dokan+un...@googlegroups.com.
Marinko Babic
Jul 22, 2016, 9:12:22 PM7/22/16
to do...@googlegroups.com
Hi Steve
Thanks a lot. I think, that I have identified the source of the problem. Therefore you need to take the latest source and post the log here. You can check the log for the following message !!WARNING!! Do not return STATUS_PENDING DokanCompleteIrp!"
Here what I think is happening: Your application cant't find the file \private\zanderz\PGPFS.INI then it sets FILE_DOES_NOT_EXIST in dispatch create and returns back STATUS_PENDING. Driver will not compete the IRP using this state, but the driver will free the CCB. Operating system will after some time it self close the file, so we will free the CCB the second time. It must be an issue in usermode or in your application.
Have done some small change, maybe you will not get the BSOD anymore. Independent of the result, please post the log here. Based on the log, we an decide to let user mode throw an exception if this happens again. Would be better, than an BSOD.
Thanks
Marinko
--
tar...@taruti.net
Jul 25, 2016, 1:43:44 PM7/25/16
to do...@googlegroups.com, m...@keybase.io
On 25.07 08:57, Steve Sanders wrote:
> I still get a BSOD with those changes. I understand your point that our
> user mode code should not return pending for a file that doesn't exist - is
> that why?
Seems like:
> I still get a BSOD with those changes. I understand your point that our
> user mode code should not return pending for a file that doesn't exist - is
> that why?
1) File open PGPFS.INI (and CCB & FCB allocated)
2) Userspace is pending
3) DokanCompleteCreate reply with file does not exist and free CCB&FCB
4) DokanClose which tries to free the freed CCB
5) Crash
- Taru
Marinko Babic
Jul 25, 2016, 1:52:00 PM7/25/16
to do...@googlegroups.com
Hi Taru
The problem is that I have no idea why the file is closed after the DokanCompleteCreate is over. The file was never opened, because it does not exist. Must be an issue in AntiVirus. Anyway the last change will fix your BSOD.
Please let me know if all now works as expected.
Thanks
Marinko
--
You received this message because you are subscribed to the Google Groups "Dokan" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dokan+un...@googlegroups.com.
Marinko Babic
Jul 25, 2016, 5:40:52 PM7/25/16
to do...@googlegroups.com
Hi Steve
Please can you ensure, that you are using the last code version. Just check the following lines https://github.com/marinkobabic/dokany/blob/FixBsodMounting/sys/create.c#L253-L256
Thanks
Marinko
--
Steve Sanders
Jul 25, 2016, 6:35:21 PM7/25/16
to Dokan, tar...@taruti.net, m...@keybase.io
Those lines do appear in that most recent log, but just in case, to make sure it is the latest, I added part of the githash (d40f19e3) to that debug output and made another crash log, attached.
Marinko Babic
Jul 25, 2016, 6:42:02 PM7/25/16
to do...@googlegroups.com
What is now the output of anlyze -v?
Do you see any chance I can run your software on my VM. The source code is not needed of your application.
--
Steve Sanders
Jul 25, 2016, 6:57:21 PM7/25/16
to Dokan, tar...@taruti.net, m...@keybase.io
Sorry, I forgot to do the !analyze part. Attached.
The current version is generally publicly available at https://s3.amazonaws.com/prerelease.keybase.io/keybase_setup_386.exe. Client source is all open (https://github.com/keybase/client, https://github.com/keybase/kbfs). Taru has made some changes to kbfsdokan.exe that aren't yet in the publicly shipping version - if they are important we can send an updated .exe or special installer. I will send you a Keybase account invite separately (let me know if anyone else wants one).
As far as symantec encryption desktop, I got a trial license online and downloaded it, but the license didn't work and I had to call them.
Thanks!
Marinko Babic
Jul 26, 2016, 6:38:56 PM7/26/16
to do...@googlegroups.com
Hi Steve
Please use the latest version of my branch and say bye to your BSOD, hopefully 😉
Thanks
Marinko
--
Steve Sanders
Jul 26, 2016, 9:46:23 PM7/26/16
to Dokan
Just tried it for a few minutes, but it always crashed before that. Looks good so far, thanks again!
I made an installer based on your branch here: https://s3.amazonaws.com/prerelease.keybase.io/windows/Keybase_1.0.16-20160726182036%2B0c2a52a.386.exe
Marinko Babic
Jul 27, 2016, 11:45:37 AM7/27/16
to do...@googlegroups.com
This means you are not able to reproduce the BSOD anymore? So I can make a pull request so that the changes can be merged into master.
Thanks
Marinko
Steve Sanders
Jul 27, 2016, 12:11:02 PM7/27/16
to do...@googlegroups.com
Please do, thanks.
--
You received this message because you are subscribed to a topic in the Google Groups "Dokan" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/dokan/7ahNxJ7XNOI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to dokan+un...@googlegroups.com.
Reply all
Reply to author
Forward
0 new messages