Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #7  
Old 08-09-2004, 21:55
homersux
 
Posts: n/a
This does not happen when Hyper Threading is disabled (although the system is then incredibly slow).

Error Code is: 0x100000d1 (0x00000048, 0x00000002, 0x00000000, 0xf45cae42)

File is AGFUCAPI.SYS, Adress F45CAE42 base at F45C8000.

Based on this information, you should be able to disassemble the driver file agfucapi.sys, you can use livekd+kd to help you decide where this driver is loaded (probably f45c8000). For some reason this bug check line is different from what w2k displays normally, so I am guessing you are not using w2k. There are a few ways to go to figure out the reason of the crash. The best way is to enable crash dump and use windbg (or kd) on the crashdump to analyze the state of the computer/driver at the moment of the crash. kd will give you a detailed stack trace at the moment of the crash.

Another approach is to use softice to bpx the offending the intruction with some condition (preferrably after a crashdump analysis of possible causes of the crash).

Since .sys file is normally a valid PE file, you should be able to disassemble it and look around the virtual
offset ae42-8000 (raw offset can be calculated from this virtual offset of course). In any event, this sounds like a bad driver that has thread-unsafe code, so you should pay attention to the global variable references in the dead listing.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Hades:Windows kernel driver lets reverse engineers monitor user and kernel mode code sh3dow Source Code 0 05-12-2016 03:15
How to pass the large data in kernel mode to user mode? benina General Discussion 3 03-06-2010 04:50
Kernel Mode Driver for NT SPeY General Discussion 12 04-22-2004 15:34


All times are GMT +8. The time now is 20:14.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )