58 NextEntry = ListHead->
Flink;
62 while (NextEntry != ListHead)
68 if ((
i <= 2) && (DriversOnly !=
FALSE))
71 NextEntry = NextEntry->
Flink;
81 NextEntry = NextEntry->
Flink;
82 ImageBase =
Entry->DllBase;
93 if (
i <= 2) *InKernel =
TRUE;
118 Teb->ProcessEnvironmentBlock->Ldr->InLoadOrderModuleList;
121 NextEntry = ListHead->
Flink;
125 while (NextEntry != ListHead)
133 NextEntry = NextEntry->
Flink;
134 ImageBase =
Entry->DllBase;
159 PVOID Frames[2 * 64];
173 if (FrameCount <= FramesToSkip)
return 0;
179 if ((FramesToSkip +
i) >= FrameCount)
break;
182 BackTrace[
i] = Frames[FramesToSkip +
i];
209 for (
i = 0;
i < FrameCount;
i++)
262 ULONG RealFrameCount;
265 if (!FrameCount || FrameCount > 32) FrameCount = 32;
276 DPRINT1(
"RealFrameCount =%lu\n", RealFrameCount);
282 if (FrameCount - RealFrameCount > 0)
310 ResourceInfo.
Type = 11;
311 ResourceInfo.
Name = 1;
366 (BugCheckCode <= KiBugCodeMessages->Blocks[
i].HighId))
388 while ((
Length > 0) && ((BugCode[
Length - 1] ==
'\n') ||
389 (BugCode[
Length - 1] ==
'\r') ||
403 OutputString->Buffer = BugCode;
404 OutputString->Length =
Length;
405 OutputString->MaximumLength =
Length;
444 LastEntry = ListHead;
445 NextEntry = ListHead->
Flink;
446 while (NextEntry != ListHead)
456 if (CurrentRecord->
Entry.
Blink != LastEntry)
return;
458 Checksum += (
ULONG_PTR)CurrentRecord->Buffer;
464 (CurrentRecord->
Checksum == Checksum))
482 LastEntry = NextEntry;
483 NextEntry = NextEntry->
Flink;
523 i = Unicode->Length /
sizeof(
WCHAR);
527 pw = Unicode->Buffer;
529 while (
i--) *
p++ = (
CHAR)*pw++;
554 for (
i = 0;
i < ParameterCount;
i++)
564 DPRINT1(
"Potentially unloaded driver!\n");
582 "%s** %12s - Address %p base at %p, DateStamp %08lx\r\n",
583 FirstRun ?
"\r\n*":
"*",
590 if (ParameterCount <= 1)
660 if (MessageId == BUGCODE_PSS_MESSAGE)
681 "\r\n\r\n*** STOP: 0x%08lX (0x%p,0x%p,0x%p,0x%p)\r\n\r\n",
735 if (BugCheckCode == POWER_FAILURE_SIMULATE)
754 switch (BugCheckCode)
757 case UNEXPECTED_KERNEL_MODE_TRAP:
758 case DRIVER_CORRUPTED_EXPOOL:
760 case ACPI_BIOS_FATAL_ERROR:
761 case THREAD_STUCK_IN_DEVICE_DRIVER:
763 case FAT_FILE_SYSTEM:
764 case NO_MORE_SYSTEM_PTES:
765 case INACCESSIBLE_BOOT_DEVICE:
768 MessageId = BugCheckCode;
772 case KERNEL_MODE_EXCEPTION_NOT_HANDLED:
773 case SYSTEM_THREAD_EXCEPTION_NOT_HANDLED:
774 case KMODE_EXCEPTION_NOT_HANDLED:
777 MessageId = KMODE_EXCEPTION_NOT_HANDLED;
781 case NTFS_FILE_SYSTEM:
784 MessageId = FAT_FILE_SYSTEM;
788 case DRIVER_CORRUPTED_MMPOOL:
791 MessageId = DRIVER_CORRUPTED_EXPOOL;
798 MessageId = BUGCODE_PSS_MESSAGE_SIGNATURE;
805 MessageId = BUGCODE_PSS_MESSAGE;
817 switch (BugCheckCode)
820 case KERNEL_MODE_EXCEPTION_NOT_HANDLED:
821 case ATTEMPTED_WRITE_TO_READONLY_MEMORY:
822 case ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY:
828 if (BugCheckParameter3) TrapFrame = (
PVOID)BugCheckParameter3;
833 (BugCheckCode != KERNEL_MODE_EXCEPTION_NOT_HANDLED))
842 case IRQL_NOT_LESS_OR_EQUAL:
852 Pc = (
PVOID)BugCheckParameter4;
888 SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD;
904 case FATAL_UNHANDLED_HARD_ERROR:
907 HardErrorParameters = (
PULONG_PTR)BugCheckParameter2;
916 HardErrCaption = (
PCHAR)BugCheckParameter3;
917 HardErrMessage = (
PCHAR)BugCheckParameter4;
922 case PAGE_FAULT_IN_NONPAGED_AREA:
931 if (BugCheckParameter3) TrapFrame = (
PVOID)BugCheckParameter3;
961 ? PAGE_FAULT_IN_FREED_SPECIAL_POOL
962 : DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL;
967 ? PAGE_FAULT_BEYOND_END_OF_ALLOCATION
968 : DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION;
971 else if (!DriverBase)
980 DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS;
987 case DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS:
990 Pc = (
PVOID)BugCheckParameter1;
994 case DRIVER_USED_EXCESSIVE_PTES:
997 LdrEntry = (
PVOID)BugCheckParameter1;
1002 case THREAD_STUCK_IN_DEVICE_DRIVER:
1039 DbgPrint(
"\n*** Fatal System Error: 0x%08lx\n"
1040 " (0x%p,0x%p,0x%p,0x%p)\n\n",
1054 DbgPrint(
"Driver at fault: %s.\n", AnsiName);
1061 if (HardErrCaption)
DbgPrint(HardErrCaption);
1062 if (HardErrMessage)
DbgPrint(HardErrMessage);
1173 NmiData = NmiData->
Next;
1336 if (!NmiData)
return NULL;
1341 NmiData->
Handle = NmiData;
1371 NmiData = *Previous;
1380 *Previous = NmiData->
Next;
1385 Previous = &NmiData->
Next;
1386 NmiData = *Previous;
static tBugCheckData BugCheckData
KBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord
ACPI_SIZE strlen(const char *String)
#define ACPI_BIOS_ERROR(plist)
#define InterlockedIncrement
#define InterlockedDecrement
VOID NTAPI KeStallExecutionProcessor(IN ULONG MicroSeconds)
LIST_ENTRY KeBugcheckCallbackListHead
PVOID NTAPI KiPcToFileHeader(IN PVOID Pc, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry, IN BOOLEAN DriversOnly, OUT PBOOLEAN InKernel)
UNICODE_STRING KeRosVideoBiosVersion
PKNMI_HANDLER_CALLBACK KiNmiCallbackListHead
VOID NTAPI KiInitializeBugCheck(VOID)
UNICODE_STRING KeRosProcessorName
BOOLEAN NTAPI KeDeregisterBugCheckCallback(IN PKBUGCHECK_CALLBACK_RECORD CallbackRecord)
BOOLEAN NTAPI KeRegisterBugCheckCallback(IN PKBUGCHECK_CALLBACK_RECORD CallbackRecord, IN PKBUGCHECK_CALLBACK_ROUTINE CallbackRoutine, IN PVOID Buffer, IN ULONG Length, IN PUCHAR Component)
PUNICODE_STRING KiBugCheckDriver
BOOLEAN NTAPI KeGetBugMessageText(IN ULONG BugCheckCode, OUT PANSI_STRING OutputString OPTIONAL)
PCHAR NTAPI KeBugCheckUnicodeToAnsi(IN PUNICODE_STRING Unicode, OUT PCHAR Ansi, IN ULONG Length)
PVOID NTAPI KeRegisterNmiCallback(IN PNMI_CALLBACK CallbackRoutine, IN PVOID Context)
VOID NTAPI KiDumpParameterImages(IN PCHAR Message, IN PULONG_PTR Parameters, IN ULONG ParameterCount, IN PKE_BUGCHECK_UNICODE_TO_ANSI ConversionRoutine)
VOID NTAPI KeEnterKernelDebugger(VOID)
KSPIN_LOCK KiNmiCallbackListLock
PVOID NTAPI KiRosPcToUserFileHeader(IN PVOID Pc, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
UNICODE_STRING KeRosBiosVersion
PMESSAGE_RESOURCE_DATA KiBugCodeMessages
LONG KeBugCheckOwnerRecursionCount
UNICODE_STRING KeRosBiosDate
BOOLEAN NTAPI KeRegisterBugCheckReasonCallback(IN PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord, IN PKBUGCHECK_REASON_CALLBACK_ROUTINE CallbackRoutine, IN KBUGCHECK_CALLBACK_REASON Reason, IN PUCHAR Component)
DECLSPEC_NORETURN VOID NTAPI KeBugCheckWithTf(IN ULONG BugCheckCode, IN ULONG_PTR BugCheckParameter1, IN ULONG_PTR BugCheckParameter2, IN ULONG_PTR BugCheckParameter3, IN ULONG_PTR BugCheckParameter4, IN PKTRAP_FRAME TrapFrame)
VOID NTAPI KiDisplayBlueScreen(IN ULONG MessageId, IN BOOLEAN IsHardError, IN PCHAR HardErrCaption OPTIONAL, IN PCHAR HardErrMessage OPTIONAL, IN PCHAR Message)
BOOLEAN NTAPI KeDeregisterBugCheckReasonCallback(IN PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord)
KSPIN_LOCK BugCheckCallbackLock
ULONG_PTR KiBugCheckData[5]
DECLSPEC_NORETURN VOID NTAPI KeBugCheckEx(IN ULONG BugCheckCode, IN ULONG_PTR BugCheckParameter1, IN ULONG_PTR BugCheckParameter2, IN ULONG_PTR BugCheckParameter3, IN ULONG_PTR BugCheckParameter4)
BOOLEAN NTAPI KiHandleNmi(VOID)
VOID FASTCALL KeRosDumpStackFrameArray(IN PULONG_PTR Frames, IN ULONG FrameCount)
NTSTATUS NTAPI KeDeregisterNmiCallback(IN PVOID Handle)
VOID NTAPI KiDoBugCheckCallbacks(VOID)
VOID NTAPI KiBugCheckDebugBreak(IN ULONG StatusCode)
UNICODE_STRING KeRosVideoBiosDate
DECLSPEC_NORETURN VOID NTAPI KeBugCheck(ULONG BugCheckCode)
NTSTATUS NTAPI KeInitializeCrashDumpHeader(IN ULONG Type, IN ULONG Flags, OUT PVOID Buffer, IN ULONG BufferSize, OUT ULONG BufferNeeded OPTIONAL)
USHORT NTAPI KeRosCaptureUserStackBackTrace(IN ULONG FramesToSkip, IN ULONG FramesToCapture, OUT PVOID *BackTrace, OUT PULONG BackTraceHash OPTIONAL)
LIST_ENTRY KeBugcheckReasonCallbackListHead
#define NT_SUCCESS(StatCode)
ULONG NTAPI RtlWalkFrameChain(OUT PVOID *Callers, IN ULONG Count, IN ULONG Flags)
static int Hash(const char *)
static const WCHAR Message[]
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define KeRaiseIrql(irql, oldIrql)
#define KeLowerIrql(oldIrql)
#define KeGetCurrentIrql()
_Must_inspect_result_ _In_ PFLT_GET_OPERATION_STATUS_CALLBACK CallbackRoutine
_In_ ULONG FramesToCapture
_In_ ULONG _Out_opt_ PULONG BackTraceHash
#define KeRosDumpStackFrames(Frames, Count)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
#define KeGetCurrentThread
VOID NTAPI HalReturnToFirmware(IN FIRMWARE_REENTRY Action)
VOID NTAPI InbvAcquireDisplayOwnership(VOID)
VOID NTAPI InbvInstallDisplayStringFilter(_In_ INBV_DISPLAY_STRING_FILTER DisplayFilter)
VOID NTAPI InbvSetTextColor(_In_ ULONG Color)
BOOLEAN NTAPI InbvEnableDisplayString(_In_ BOOLEAN Enable)
BOOLEAN NTAPI InbvDisplayString(_In_ PCHAR String)
BOOLEAN NTAPI InbvResetDisplay(VOID)
VOID NTAPI InbvSetScrollRegion(_In_ ULONG Left, _In_ ULONG Top, _In_ ULONG Right, _In_ ULONG Bottom)
VOID NTAPI InbvSolidColorFill(_In_ ULONG Left, _In_ ULONG Top, _In_ ULONG Right, _In_ ULONG Bottom, _In_ ULONG Color)
BOOLEAN NTAPI InbvIsBootDriverInstalled(VOID)
#define EXCEPTION_EXECUTE_HANDLER
#define InterlockedCompareExchangePointer
void __cdecl _disable(void)
BOOLEAN NTAPI KdInitSystem(_In_ ULONG BootPhase, _In_opt_ PLOADER_PARAMETER_BLOCK LoaderBlock)
NTSTATUS NTAPI KdEnableDebuggerWithLock(IN BOOLEAN NeedLock)
BOOLEAN KdbSymPrintAddress(IN PVOID Address, IN PCONTEXT Context)
Print address...
BOOLEAN KdDebuggerNotPresent
BOOLEAN KdDebuggerEnabled
KDDEBUGGER_DATA64 * KdDebuggerDataBlock
FORCEINLINE VOID KiAcquireNmiListLock(OUT PKIRQL OldIrql)
FORCEINLINE VOID KiReleaseNmiListLock(IN KIRQL OldIrql)
PLOADER_PARAMETER_BLOCK KeLoaderBlock
NTSTATUS NTAPI LdrAccessResource(_In_ PVOID BaseAddress, _In_ PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry, _Out_opt_ PVOID *Resource, _Out_opt_ PULONG Size)
NTSTATUS NTAPI LdrFindResource_U(_In_ PVOID BaseAddress, _In_ PLDR_RESOURCE_INFO ResourceInfo, _In_ ULONG Level, _Out_ PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry)
#define RESOURCE_DATA_LEVEL
#define RtlFillMemoryUlong(dst, len, val)
#define ExFreePoolWithTag(_P, _T)
PVOID PVOID PWCHAR PVOID USHORT PULONG Reason
#define sprintf(buf, format,...)
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
#define DBG_STATUS_BUGCHECK_FIRST
#define DBG_STATUS_BUGCHECK_SECOND
VOID NTAPI DbgUnLoadImageSymbols(_In_ PSTRING Name, _In_ PVOID Base, _In_ ULONG_PTR ProcessId)
NTSYSAPI VOID NTAPI RtlCaptureContext(_Out_ PCONTEXT ContextRecord)
#define MESSAGE_RESOURCE_UNICODE
struct _MESSAGE_RESOURCE_ENTRY * PMESSAGE_RESOURCE_ENTRY
#define DECLSPEC_NORETURN
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define KeGetTrapFramePc(TrapFrame)
VOID FASTCALL KiIpiSend(KAFFINITY TargetSet, ULONG IpiRequest)
PCHAR(NTAPI * PKE_BUGCHECK_UNICODE_TO_ANSI)(IN PUNICODE_STRING Unicode, IN PCHAR Ansi, IN ULONG Length)
VOID NTAPI KiSaveProcessorControlState(OUT PKPROCESSOR_STATE ProcessorState)
VOID NTAPI MmMakeKernelResourceSectionWritable(VOID)
BOOLEAN NTAPI MmIsSpecialPoolAddress(IN PVOID P)
BOOLEAN NTAPI MmIsSpecialPoolAddressFree(IN PVOID P)
#define STATUS_INVALID_HANDLE
#define STATUS_SYSTEM_IMAGE_BAD_SIGNATURE
NTSTRSAFEVAPI RtlStringCbPrintfA(_Out_writes_bytes_(cbDest) _Always_(_Post_z_) NTSTRSAFE_PSTR pszDest, _In_ size_t cbDest, _In_ _Printf_format_string_ NTSTRSAFE_PCSTR pszFormat,...)
LIST_ENTRY PsLoadedModuleList
SECURITY_INTEGER TimeStamp
#define _SEH2_EXCEPT(...)
PVOID MmHighestUserAddress
#define ASSERT_IRQL_LESS_OR_EQUAL(x)
FORCEINLINE ULONG KeGetCurrentProcessorNumber(VOID)
PULONG MinorVersion OPTIONAL
base of all file and directory entries
PKBUGCHECK_CALLBACK_ROUTINE CallbackRoutine
KBUGCHECK_CALLBACK_REASON Reason
PKBUGCHECK_REASON_CALLBACK_ROUTINE CallbackRoutine
struct _KNMI_HANDLER_CALLBACK * Next
KPROCESSOR_STATE ProcessorState
UNICODE_STRING BaseDllName
struct _LIST_ENTRY * Blink
struct _LIST_ENTRY * Flink
LIST_ENTRY LoadOrderListHead
MESSAGE_RESOURCE_BLOCK Blocks[ANYSIZE_ARRAY]
UCHAR Text[ANYSIZE_ARRAY]
#define CONTAINING_RECORD(address, type, field)
#define STATUS_UNSUCCESSFUL
__analysis_noreturn NTSYSAPI VOID NTAPI DbgBreakPointWithStatus(_In_ ULONG Status)
_Must_inspect_result_ _In_ WDFQUEUE _In_opt_ WDFREQUEST _In_opt_ WDFFILEOBJECT _Inout_opt_ PWDF_REQUEST_PARAMETERS Parameters
_Must_inspect_result_ _In_opt_ PWDF_OBJECT_ATTRIBUTES _In_ _Strict_type_match_ POOL_TYPE _In_opt_ ULONG _In_ _Out_ WDFMEMORY * Memory
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_Must_inspect_result_ _In_ ULONG Flags
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
NMI_CALLBACK * PNMI_CALLBACK
KBUGCHECK_CALLBACK_ROUTINE * PKBUGCHECK_CALLBACK_ROUTINE
KBUGCHECK_CALLBACK_REASON
KBUGCHECK_REASON_CALLBACK_ROUTINE * PKBUGCHECK_REASON_CALLBACK_ROUTINE
NTSYSAPI USHORT NTAPI RtlCaptureStackBackTrace(_In_ ULONG FramesToSkip, _In_ ULONG FramesToCapture, _Out_writes_to_(FramesToCapture, return) PVOID *BackTrace, _Out_opt_ PULONG BackTraceHash)