Crash Dump Analysis Patterns (Part 25e)

Device Stack Trace analysis pattern is about the analysis of a hierarchy of devices based on the current location of IRP Stack Trace:

0: kd> !irp ffffffa80095e6c10
Irp is active with 7 stacks 6 is current (= 0xfffffa80095e6e48)
No Mdl: System buffer=fffffa8007b52380: Thread fffffa8007486060:  Irp stack trace.
cmd  flg cl Device   File     Completion-Context
[N/A(0), N/A(0)]
0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0  0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0  0 00000000 00000000 00000000-00000000

Args: 00000000 fffffa8008b045f0 00000000 00000000
>[IRP_MJ_DEVICE_CONTROL(e), N/A(0)]
5  0 fffffa80095e6060 fffffa8009883b60 00000000-00000000
\Driver\usbscan
Args: 00000000 00000010 80002010 00000000
[IRP_MJ_DEVICE_CONTROL(e), N/A(0)]
5  0 fffffa8007ee4bd0 fffffa8009883b60 00000000-00000000
\Driver\ksthunk
Args: 00000000 00000010 80002010 00000000

0: kd> !devstack  fffffa80095e6060
!DevObj           !DrvObj            !DevExt           ObjectName
fffffa8007ee4bd0  \Driver\ksthunk    fffffa8007ee4d20  00000098
> fffffa80095e6060  \Driver\usbscan    fffffa80095e61b0  Usbscan0
fffffa80073a3060 \Driver\DriverA    fffffa8007e767e0  00000097
[…]

0: kd> !devobj fffffa8007ee4bd0
Device object (fffffa8007ee4bd0) is for:
00000098 \Driver\ksthunk DriverObject fffffa8006396c60
Current Irp 00000000 RefCount 0 Type 00000019 Flags 00002050
Dacl fffff9a100099e11 DevExt fffffa8007ee4d20 DevObjExt fffffa8007ee4d28
ExtensionFlags (0x00000800)  DOE_DEFAULT_SD_PRESENT
Characteristics (0000000000)
AttachedTo (Lower) fffffa80095e6060 \Driver\usbscan
Device queue is not busy.

0: kd> !devobj fffffa80095e6060
Device object (fffffa80095e6060) is for:
Usbscan0 \Driver\usbscan DriverObject fffffa8007943570
Current Irp 00000000 RefCount 3 Type 00000019 Flags 00002050
Dacl fffff9a100099e11 DevExt fffffa80095e61b0 DevObjExt fffffa80095e6530
ExtensionFlags (0x00000800)  DOE_DEFAULT_SD_PRESENT
Characteristics (0000000000)
AttachedDevice (Upper) fffffa8007ee4bd0 \Driver\ksthunk
AttachedTo (Lower) fffffa80073a3060 \Driver\DriverA

Device queue is not busy.

0: kd> !devobj fffffa80073a3060
Device object (fffffa80073a3060) is for:
00000097 \Driver\DriverA DriverObject fffffa80063bd540
Current Irp 00000000 RefCount 1 Type 00000022 Flags 00003044
Dacl fffff9a100099e11 DevExt fffffa8007e767e0 DevObjExt fffffa80073a31d8 DevNode fffffa80086e1cb0
ExtensionFlags (0x00000800)  DOE_DEFAULT_SD_PRESENT
Characteristics (0x00000080)  FILE_AUTOGENERATED_DEVICE_NAME
AttachedDevice (Upper) fffffa80095e6060 \Driver\usbscan
Device queue is not busy.

The direction of device Stack Trace is from top to bottom, opposite to I/O Request Stack Trace which is from bottom to top.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Leave a Reply

You must be logged in to post a comment.