62 NextEntry = ListHead->
Flink;
66 while (NextEntry != ListHead)
72 if ((
i <= 2) && (DriversOnly !=
FALSE))
75 NextEntry = NextEntry->
Flink;
85 NextEntry = NextEntry->
Flink;
86 ImageBase =
Entry->DllBase;
97 if (
i <= 2) *InKernel =
TRUE;
122 Teb->ProcessEnvironmentBlock->Ldr->InLoadOrderModuleList;
125 NextEntry = ListHead->
Flink;
129 while (NextEntry != ListHead)
137 NextEntry = NextEntry->
Flink;
138 ImageBase =
Entry->DllBase;
163 PVOID Frames[2 * 64];
177 if (FrameCount <= FramesToSkip)
return 0;
183 if ((FramesToSkip +
i) >= FrameCount)
break;
186 BackTrace[
i] = Frames[FramesToSkip +
i];
213 for (
i = 0;
i < FrameCount;
i++)
266 ULONG RealFrameCount;
269 if (!FrameCount || FrameCount > 32) FrameCount = 32;
280 DPRINT1(
"RealFrameCount =%lu\n", RealFrameCount);
286 if (FrameCount - RealFrameCount > 0)
314 ResourceInfo.
Type = 11;
315 ResourceInfo.
Name = 1;
370 (BugCheckCode <= KiBugCodeMessages->Blocks[
i].HighId))
392 while ((
Length > 0) && ((BugCode[
Length - 1] ==
'\n') ||
393 (BugCode[
Length - 1] ==
'\r') ||
407 OutputString->Buffer = BugCode;
408 OutputString->Length =
Length;
409 OutputString->MaximumLength =
Length;
448 LastEntry = ListHead;
449 NextEntry = ListHead->
Flink;
450 while (NextEntry != ListHead)
460 if (CurrentRecord->
Entry.
Blink != LastEntry)
return;
462 Checksum += (
ULONG_PTR)CurrentRecord->Buffer;
468 (CurrentRecord->
Checksum == Checksum))
486 LastEntry = NextEntry;
487 NextEntry = NextEntry->
Flink;
527 i = Unicode->Length /
sizeof(
WCHAR);
531 pw = Unicode->Buffer;
533 while (
i--) *
p++ = (
CHAR)*pw++;
558 for (
i = 0;
i < ParameterCount;
i++)
568 DPRINT1(
"Potentially unloaded driver!\n");
586 "%s** %12s - Address %p base at %p, DateStamp %08lx\r\n",
587 FirstRun ?
"\r\n*":
"*",
594 if (ParameterCount <= 1)
629 &BugCheckCode,
sizeof(BugCheckCode),
676 if (MessageId == BUGCODE_PSS_MESSAGE)
697 "\r\n\r\n*** STOP: 0x%08lX (0x%p,0x%p,0x%p,0x%p)\r\n\r\n",
748 if (BugCheckCode == POWER_FAILURE_SIMULATE)
767 switch (BugCheckCode)
770 case UNEXPECTED_KERNEL_MODE_TRAP:
771 case DRIVER_CORRUPTED_EXPOOL:
773 case ACPI_BIOS_FATAL_ERROR:
774 case THREAD_STUCK_IN_DEVICE_DRIVER:
776 case FAT_FILE_SYSTEM:
777 case NO_MORE_SYSTEM_PTES:
778 case INACCESSIBLE_BOOT_DEVICE:
781 MessageId = BugCheckCode;
785 case KERNEL_MODE_EXCEPTION_NOT_HANDLED:
786 case SYSTEM_THREAD_EXCEPTION_NOT_HANDLED:
787 case KMODE_EXCEPTION_NOT_HANDLED:
790 MessageId = KMODE_EXCEPTION_NOT_HANDLED;
794 case NTFS_FILE_SYSTEM:
797 MessageId = FAT_FILE_SYSTEM;
801 case DRIVER_CORRUPTED_MMPOOL:
804 MessageId = DRIVER_CORRUPTED_EXPOOL;
811 MessageId = BUGCODE_PSS_MESSAGE_SIGNATURE;
818 MessageId = BUGCODE_PSS_MESSAGE;
830 switch (BugCheckCode)
833 case KERNEL_MODE_EXCEPTION_NOT_HANDLED:
834 case ATTEMPTED_WRITE_TO_READONLY_MEMORY:
835 case ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY:
841 if (BugCheckParameter3) TrapFrame = (
PVOID)BugCheckParameter3;
846 (BugCheckCode != KERNEL_MODE_EXCEPTION_NOT_HANDLED))
855 case IRQL_NOT_LESS_OR_EQUAL:
865 Pc = (
PVOID)BugCheckParameter4;
901 SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD;
917 case FATAL_UNHANDLED_HARD_ERROR:
920 HardErrorParameters = (
PULONG_PTR)BugCheckParameter2;
929 HardErrCaption = (
PCHAR)BugCheckParameter3;
930 HardErrMessage = (
PCHAR)BugCheckParameter4;
935 case PAGE_FAULT_IN_NONPAGED_AREA:
944 if (BugCheckParameter3) TrapFrame = (
PVOID)BugCheckParameter3;
974 ? PAGE_FAULT_IN_FREED_SPECIAL_POOL
975 : DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL;
980 ? PAGE_FAULT_BEYOND_END_OF_ALLOCATION
981 : DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION;
984 else if (!DriverBase)
993 DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS;
1000 case DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS:
1003 Pc = (
PVOID)BugCheckParameter1;
1007 case DRIVER_USED_EXCESSIVE_PTES:
1010 LdrEntry = (
PVOID)BugCheckParameter1;
1015 case THREAD_STUCK_IN_DEVICE_DRIVER:
1052 DbgPrint(
"\n*** Fatal System Error: 0x%08lx\n"
1053 " (0x%p,0x%p,0x%p,0x%p)\n\n",
1067 DbgPrint(
"Driver at fault: %s.\n", AnsiName);
1074 if (HardErrCaption)
DbgPrint(HardErrCaption);
1075 if (HardErrMessage)
DbgPrint(HardErrMessage);
1180 NmiData = NmiData->
Next;
1343 if (!NmiData)
return NULL;
1348 NmiData->
Handle = NmiData;
1378 NmiData = *Previous;
1387 *Previous = NmiData->
Next;
1392 Previous = &NmiData->
Next;
1393 NmiData = *Previous;
static tBugCheckData BugCheckData
KBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord
ACPI_SIZE strlen(const char *String)
#define ACPI_BIOS_ERROR(plist)
#define InterlockedIncrement
#define InterlockedDecrement
LIST_ENTRY KeBugcheckCallbackListHead
PVOID NTAPI KiPcToFileHeader(IN PVOID Pc, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry, IN BOOLEAN DriversOnly, OUT PBOOLEAN InKernel)
UNICODE_STRING KeRosVideoBiosVersion
PKNMI_HANDLER_CALLBACK KiNmiCallbackListHead
VOID NTAPI KiInitializeBugCheck(VOID)
UNICODE_STRING KeRosProcessorName
BOOLEAN NTAPI KeDeregisterBugCheckCallback(IN PKBUGCHECK_CALLBACK_RECORD CallbackRecord)
BOOLEAN NTAPI KeRegisterBugCheckCallback(IN PKBUGCHECK_CALLBACK_RECORD CallbackRecord, IN PKBUGCHECK_CALLBACK_ROUTINE CallbackRoutine, IN PVOID Buffer, IN ULONG Length, IN PUCHAR Component)
PUNICODE_STRING KiBugCheckDriver
BOOLEAN NTAPI KeGetBugMessageText(IN ULONG BugCheckCode, OUT PANSI_STRING OutputString OPTIONAL)
PCHAR NTAPI KeBugCheckUnicodeToAnsi(IN PUNICODE_STRING Unicode, OUT PCHAR Ansi, IN ULONG Length)
PVOID NTAPI KeRegisterNmiCallback(IN PNMI_CALLBACK CallbackRoutine, IN PVOID Context)
VOID NTAPI KiDumpParameterImages(IN PCHAR Message, IN PULONG_PTR Parameters, IN ULONG ParameterCount, IN PKE_BUGCHECK_UNICODE_TO_ANSI ConversionRoutine)
VOID NTAPI KeEnterKernelDebugger(VOID)
KSPIN_LOCK KiNmiCallbackListLock
PVOID NTAPI KiRosPcToUserFileHeader(IN PVOID Pc, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
UNICODE_STRING KeRosBiosVersion
PMESSAGE_RESOURCE_DATA KiBugCodeMessages
LONG KeBugCheckOwnerRecursionCount
UNICODE_STRING KeRosBiosDate
BOOLEAN NTAPI KeRegisterBugCheckReasonCallback(IN PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord, IN PKBUGCHECK_REASON_CALLBACK_ROUTINE CallbackRoutine, IN KBUGCHECK_CALLBACK_REASON Reason, IN PUCHAR Component)
DECLSPEC_NORETURN VOID NTAPI KeBugCheckWithTf(IN ULONG BugCheckCode, IN ULONG_PTR BugCheckParameter1, IN ULONG_PTR BugCheckParameter2, IN ULONG_PTR BugCheckParameter3, IN ULONG_PTR BugCheckParameter4, IN PKTRAP_FRAME TrapFrame)
VOID NTAPI KiDisplayBlueScreen(IN ULONG MessageId, IN BOOLEAN IsHardError, IN PCHAR HardErrCaption OPTIONAL, IN PCHAR HardErrMessage OPTIONAL, IN PCHAR Message)
BOOLEAN NTAPI KeDeregisterBugCheckReasonCallback(IN PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord)
KSPIN_LOCK BugCheckCallbackLock
ULONG_PTR KiBugCheckData[5]
DECLSPEC_NORETURN VOID NTAPI KeBugCheckEx(IN ULONG BugCheckCode, IN ULONG_PTR BugCheckParameter1, IN ULONG_PTR BugCheckParameter2, IN ULONG_PTR BugCheckParameter3, IN ULONG_PTR BugCheckParameter4)
BOOLEAN NTAPI KiHandleNmi(VOID)
VOID FASTCALL KeRosDumpStackFrameArray(IN PULONG_PTR Frames, IN ULONG FrameCount)
NTSTATUS NTAPI KeDeregisterNmiCallback(IN PVOID Handle)
VOID NTAPI KiDoBugCheckCallbacks(VOID)
VOID NTAPI KiBugCheckDebugBreak(IN ULONG StatusCode)
UNICODE_STRING KeRosVideoBiosDate
DECLSPEC_NORETURN VOID NTAPI KeBugCheck(ULONG BugCheckCode)
NTSTATUS NTAPI KeInitializeCrashDumpHeader(IN ULONG Type, IN ULONG Flags, OUT PVOID Buffer, IN ULONG BufferSize, OUT ULONG BufferNeeded OPTIONAL)
USHORT NTAPI KeRosCaptureUserStackBackTrace(IN ULONG FramesToSkip, IN ULONG FramesToCapture, OUT PVOID *BackTrace, OUT PULONG BackTraceHash OPTIONAL)
LIST_ENTRY KeBugcheckReasonCallbackListHead
#define STATUS_INVALID_HANDLE
#define NT_SUCCESS(StatCode)
ULONG NTAPI RtlWalkFrameChain(OUT PVOID *Callers, IN ULONG Count, IN ULONG Flags)
static int Hash(const char *)
static const WCHAR Message[]
#define RemoveEntryList(Entry)
#define InsertTailList(ListHead, Entry)
#define ExAllocatePoolWithTag(hernya, size, tag)
#define KeRaiseIrql(irql, oldIrql)
#define KeLowerIrql(oldIrql)
#define KeGetCurrentIrql()
_Must_inspect_result_ _In_ PFLT_GET_OPERATION_STATUS_CALLBACK CallbackRoutine
_In_ ULONG FramesToCapture
_In_ ULONG _Out_opt_ PULONG BackTraceHash
#define KeRosDumpStackFrames(Frames, Count)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
#define KeGetCurrentThread
VOID NTAPI HalReturnToFirmware(_In_ FIRMWARE_REENTRY Action)
@ HeadlessCmdStartBugCheck
@ HeadlessCmdEnableTerminal
@ HeadlessCmdSendBlueScreenData
NTSTATUS NTAPI HeadlessDispatch(IN HEADLESS_CMD Command, IN PVOID InputBuffer, IN SIZE_T InputBufferSize, OUT PVOID OutputBuffer, OUT PSIZE_T OutputBufferSize)
VOID NTAPI InbvAcquireDisplayOwnership(VOID)
VOID NTAPI InbvInstallDisplayStringFilter(_In_ INBV_DISPLAY_STRING_FILTER DisplayFilter)
VOID NTAPI InbvSetTextColor(_In_ ULONG Color)
BOOLEAN NTAPI InbvEnableDisplayString(_In_ BOOLEAN Enable)
BOOLEAN NTAPI InbvDisplayString(_In_ PCHAR String)
BOOLEAN NTAPI InbvResetDisplay(VOID)
VOID NTAPI InbvSetScrollRegion(_In_ ULONG Left, _In_ ULONG Top, _In_ ULONG Right, _In_ ULONG Bottom)
VOID NTAPI InbvSolidColorFill(_In_ ULONG Left, _In_ ULONG Top, _In_ ULONG Right, _In_ ULONG Bottom, _In_ ULONG Color)
BOOLEAN NTAPI InbvIsBootDriverInstalled(VOID)
#define EXCEPTION_EXECUTE_HANDLER
#define InterlockedCompareExchangePointer
void __cdecl _disable(void)
BOOLEAN NTAPI KdInitSystem(_In_ ULONG BootPhase, _In_opt_ PLOADER_PARAMETER_BLOCK LoaderBlock)
NTSTATUS NTAPI KdEnableDebuggerWithLock(IN BOOLEAN NeedLock)
BOOLEAN KdbSymPrintAddress(IN PVOID Address, IN PCONTEXT Context)
Print address...
BOOLEAN KdDebuggerNotPresent
BOOLEAN KdDebuggerEnabled
KDDEBUGGER_DATA64 * KdDebuggerDataBlock
FORCEINLINE VOID KiAcquireNmiListLock(OUT PKIRQL OldIrql)
FORCEINLINE VOID KiReleaseNmiListLock(IN KIRQL OldIrql)
PLOADER_PARAMETER_BLOCK KeLoaderBlock
NTSTATUS NTAPI LdrAccessResource(_In_ PVOID BaseAddress, _In_ PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry, _Out_opt_ PVOID *Resource, _Out_opt_ PULONG Size)
NTSTATUS NTAPI LdrFindResource_U(_In_ PVOID BaseAddress, _In_ PLDR_RESOURCE_INFO ResourceInfo, _In_ ULONG Level, _Out_ PIMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry)
#define RESOURCE_DATA_LEVEL
#define RtlFillMemoryUlong(dst, len, val)
#define ExFreePoolWithTag(_P, _T)
PVOID PVOID PWCHAR PVOID USHORT PULONG Reason
#define sprintf(buf, format,...)
FORCEINLINE struct _KPRCB * KeGetCurrentPrcb(VOID)
#define DBG_STATUS_BUGCHECK_FIRST
#define DBG_STATUS_BUGCHECK_SECOND
VOID NTAPI DbgUnLoadImageSymbols(_In_ PSTRING Name, _In_ PVOID Base, _In_ ULONG_PTR ProcessId)
NTSYSAPI VOID NTAPI RtlCaptureContext(_Out_ PCONTEXT ContextRecord)
#define MESSAGE_RESOURCE_UNICODE
struct _MESSAGE_RESOURCE_ENTRY * PMESSAGE_RESOURCE_ENTRY
#define DECLSPEC_NORETURN
_In_ ULONG _In_ ULONG _In_ ULONG Length
_In_ ULONGLONG _In_ ULONGLONG _In_ BOOLEAN Enable
#define KeGetTrapFramePc(TrapFrame)
VOID NTAPI KxFreezeExecution(VOID)
PCHAR(NTAPI * PKE_BUGCHECK_UNICODE_TO_ANSI)(IN PUNICODE_STRING Unicode, IN PCHAR Ansi, IN ULONG Length)
VOID NTAPI KiSaveProcessorControlState(OUT PKPROCESSOR_STATE ProcessorState)
VOID NTAPI MmMakeKernelResourceSectionWritable(VOID)
BOOLEAN NTAPI MmIsSpecialPoolAddress(IN PVOID P)
BOOLEAN NTAPI MmIsSpecialPoolAddressFree(IN PVOID P)
#define STATUS_SYSTEM_IMAGE_BAD_SIGNATURE
NTSTRSAFEVAPI RtlStringCbPrintfA(_Out_writes_bytes_(cbDest) _Always_(_Post_z_) NTSTRSAFE_PSTR pszDest, _In_ size_t cbDest, _In_ _Printf_format_string_ NTSTRSAFE_PCSTR pszFormat,...)
LIST_ENTRY PsLoadedModuleList
SECURITY_INTEGER TimeStamp
#define _SEH2_EXCEPT(...)
PVOID MmHighestUserAddress
#define ASSERT_IRQL_LESS_OR_EQUAL(x)
STDMETHOD() Next(THIS_ ULONG celt, IAssociationElement *pElement, ULONG *pceltFetched) PURE
PULONG MinorVersion OPTIONAL
base of all file and directory entries
PKBUGCHECK_CALLBACK_ROUTINE CallbackRoutine
KBUGCHECK_CALLBACK_REASON Reason
PKBUGCHECK_REASON_CALLBACK_ROUTINE CallbackRoutine
struct _KNMI_HANDLER_CALLBACK * Next
KPROCESSOR_STATE ProcessorState
UNICODE_STRING BaseDllName
struct _LIST_ENTRY * Blink
struct _LIST_ENTRY * Flink
LIST_ENTRY LoadOrderListHead
MESSAGE_RESOURCE_BLOCK Blocks[ANYSIZE_ARRAY]
UCHAR Text[ANYSIZE_ARRAY]
#define CONTAINING_RECORD(address, type, field)
#define STATUS_UNSUCCESSFUL
__analysis_noreturn NTSYSAPI VOID NTAPI DbgBreakPointWithStatus(_In_ ULONG Status)
_Must_inspect_result_ _In_ WDFQUEUE _In_opt_ WDFREQUEST _In_opt_ WDFFILEOBJECT _Inout_opt_ PWDF_REQUEST_PARAMETERS Parameters
_Must_inspect_result_ _In_opt_ PWDF_OBJECT_ATTRIBUTES _In_ _Strict_type_match_ POOL_TYPE _In_opt_ ULONG _In_ _Out_ WDFMEMORY * Memory
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_Must_inspect_result_ _In_ ULONG Flags
_Requires_lock_held_ Interrupt _Releases_lock_ Interrupt _In_ _IRQL_restores_ KIRQL OldIrql
NMI_CALLBACK * PNMI_CALLBACK
KBUGCHECK_CALLBACK_ROUTINE * PKBUGCHECK_CALLBACK_ROUTINE
KBUGCHECK_CALLBACK_REASON
KBUGCHECK_REASON_CALLBACK_ROUTINE * PKBUGCHECK_REASON_CALLBACK_ROUTINE
NTSYSAPI USHORT NTAPI RtlCaptureStackBackTrace(_In_ ULONG FramesToSkip, _In_ ULONG FramesToCapture, _Out_writes_to_(FramesToCapture, return) PVOID *BackTrace, _Out_opt_ PULONG BackTraceHash)