Ill bcome crazy with damn driver!

just a hunch...

make sure you've unloaded the previous instance of ramdisk.sys before starting up the new one. windows may be preventing the loading of another ramdisk.sys because one is already in place.

[DaGoN]

Yes, i stop the service, after i load it in winhex and i change a char and save it, i restart the service and the service doesnt start anymore...
Stop again the service, undo in winhex and save it, i restart the service and it works!
I've try it with differents xp machines...

DaGoN

fixed checksum already?

[DaGoN]

Originally Posted by pLayAr

fixed checksum already?

Ehm... how i can fix the checksum of a device drive?
I havent found nothing about it.

Thx,
DaGoN

[aliali]

Hi,

Use LordPE to recalculate the CheckSum.

[DaGoN]

LordPe reduce the file size and optimize it but the result is always the same: It doesnt work.
Lordpe result: Validate Pe image... done.

Try it, its strange, seem that there is a check from the system before driver start.

my test
bc *
bpx IoAllocateDriverObjectExtension
start service
softice break
bpx @esp (bpx on caller)
bd 00
x
sofice break here:

::::::::::::::: ENTRY POINT :::::::::::::::::::::
INIT:00018500 push ebp
INIT:00018501 mov ebp, esp
INIT:00018503 push esi
INIT:00018504 mov esi, [ebp+arg_0]
INIT:00018507 lea eax, [ebp+arg_0]
INIT:0001850A push eax
INIT:0001850B push 10h
INIT:0001850D push offset start
INIT:00018512 push esi
INIT:00018513 call ds:IoAllocateDriverObjectExtension
INIT:00018519 test eax, eax <---- good all works fine (ramdisk process)
INIT:0001851B jl loc_185DA
INIT:00018521 mov ecx, [ebp+arg_0]
INIT:00018524 push edi
INIT:00018525 mov edi, [ebp+arg_4]
INIT:00018528 mov ax, [edi]
INIT:0001852B mov [ecx], ax
INIT:0001852E mov ax, [edi+2]
...
...

i change a char
bc *
bpx IoAllocateDriverObjectExtension
i restart the service
softice doesnt break anymore

DaGoN

[aliali]

Hi,

You are using Rebuild PE. I'm said to you to recalculate the Checksum.

Open LordPE hit "PE Editor", choose the sys file, locate the checksum and you will see a "?" on the right hand side just hit it and then hit "Save".

ALiAli