Identinator [BSOD] KMODE_EXCEPTION_NOT_HANDLED in combination with MS gameflt

[BSOD] KMODE_EXCEPTION_NOT_HANDLED in combination with MS gameflt

Open nefarius opened this issue 1 year ago • 0 comments

The crash culprit is gameflt (Microsoft driver) but since it can only be provoked with Identinator present, the underlying issue is probably corrupted memory used by said driver triggering a crash.

WinDbg

11: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8033ea30837, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 15140

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 15296

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 6

    Key  : Analysis.IO.Write.Mb
    Value: 6

    Key  : Analysis.Init.CPU.mSec
    Value: 34859

    Key  : Analysis.Init.Elapsed.mSec
    Value: 10898130

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 691

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x1e

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x1e

    Key  : Bugcheck.Code.Register
    Value: 0x1e

    Key  : Dump.Attributes.AsUlong
    Value: 1800

    Key  : Dump.Attributes.DiagDataWrittenToHeader
    Value: 1

    Key  : Dump.Attributes.ErrorCode
    Value: 0

    Key  : Dump.Attributes.LastLine
    Value: Dumping physical memory to disk:  100% 

    Key  : Dump.Attributes.ProgressPercentage
    Value: 100

    Key  : WER.OS.Branch
    Value: ni_release

    Key  : WER.OS.Timestamp
    Value: 2022-05-06T12:50:00Z

    Key  : WER.OS.Version
    Value: 10.0.22621.1


FILE_IN_CAB:  1.DMP

TAG_NOT_DEFINED_202b:  *** Unknown TAG in analysis list 202b


DUMP_FILE_ATTRIBUTES: 0x1800

BUGCHECK_CODE:  1e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8033ea30837

BUGCHECK_P3: 0

BUGCHECK_P4: ffffffffffffffff

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff 

PROCESS_NAME:  explorer.exe

STACK_TEXT:  
ffffca0e`e579e878 fffff803`3eb3676a     : 00000000`0000001e ffffffff`c0000005 fffff803`3ea30837 00000000`00000000 : nt!KeBugCheckEx
ffffca0e`e579e880 fffff803`3ea318ef     : ffffca0e`e579f090 ffffca0e`e579e950 fffff803`3e600000 fffff803`3ea2bdce : nt!HvlpVtlCallExceptionHandler+0x22
ffffca0e`e579e8c0 fffff803`3e80c1b3     : ffffca0e`e579ff30 ffffca0e`e579f878 fffff803`3ea2bdce fffff803`3e6e9c00 : nt!RtlpExecuteHandlerForException+0xf
ffffca0e`e579e8f0 fffff803`3e810027     : ffffffff`ffffffff ffffca0e`e579f920 ffffca0e`e579f920 ffffca0e`e579f090 : nt!RtlDispatchException+0x2f3
ffffca0e`e579f060 fffff803`3ea3b1fc     : ffffca0e`e579f740 ffffca0e`e579f740 ffffca0e`e579f750 ffffca0e`e579f750 : nt!KiDispatchException+0x317
ffffca0e`e579f740 fffff803`3ea36b77     : ffff968f`8a58caa0 fffff803`3e8d3cab 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x13c
ffffca0e`e579f920 fffff803`3ea30837     : fffff803`3c2ad500 fffff803`3e8930f1 ffff968f`89b444e0 fffff803`3c2bdb20 : nt!KiGeneralProtectionFault+0x337
ffffca0e`e579fab0 fffff803`3e8930f1     : ffff968f`89b444e0 fffff803`3c2bdb20 ffff968f`907b2700 ffff968f`89b444e0 : nt!ExpInterlockedPopEntrySListFault
ffffca0e`e579fac0 fffff803`3c2be9ca     : ffffca0e`e579fb98 00000000`00000000 ffff968f`7295f848 00000000`00000000 : nt!ExAllocateFromNPagedLookasideList+0x11
ffffca0e`e579faf0 fffff803`3c2be70c     : ffff968f`89b444e0 ffff968f`907b2704 ffff968f`907b2773 00000000`00000000 : FLTMGR!FltpAllocateFileNameInformation+0x5a
ffffca0e`e579fb20 fffff803`3c286828     : ffffca0e`e57a0000 ffffca0e`e5799000 00000000`00000000 ffff968f`9354a3f0 : FLTMGR!FltpCreateFileNameInformation+0x14c
ffffca0e`e579fb90 fffff803`3c28757c     : ffff968f`00008000 ffff968f`907b2700 00000000`00000000 ffff968f`9354a3f0 : FLTMGR!FltpGetFileNameInformation+0x5e8
ffffca0e`e579fc30 fffff803`7ebbe1d0     : ffff968f`89b444e0 ffff968f`89b4fa90 00000000`00000000 ffff968f`7c2cf001 : FLTMGR!FltGetFileNameInformation+0xfc
ffffca0e`e579fcc0 fffff803`3c2bddb2     : ffff968f`89b40001 00000000`00000000 ffff968f`89b4fa90 ffff968f`7af8c028 : luafv!LuafvGenerateFileName+0x60
ffffca0e`e579fcf0 fffff803`3c2bdb20     : ffff968f`907b2700 ffff968f`89b4fa90 ffff968f`907b2773 fffff803`3e8cc9c5 : FLTMGR!FltpCallOpenedFileNameHandler+0x7a
ffffca0e`e579fd40 fffff803`3c2be7cb     : ffff968f`89b4fa90 ffffca0e`e579fea8 ffff968f`907b2704 ffff968f`907b2773 : FLTMGR!FltpGetNormalizedFileNameWorker+0x30
ffffca0e`e579fd90 fffff803`3c286828     : ffffca0e`e57a0000 ffffca0e`e5799000 00000000`00000000 ffff968f`9354a3f0 : FLTMGR!FltpCreateFileNameInformation+0x20b
ffffca0e`e579fe00 fffff803`3c28757c     : ffff968f`00008000 ffff968f`907b2700 ffff968f`78c82010 ffff968f`9354a3f0 : FLTMGR!FltpGetFileNameInformation+0x5e8
ffffca0e`e579fea0 fffff803`41771b3a     : ffff968f`89b4fa90 ffffca0e`e5ec6e80 ffffca0e`e57a0000 ffff968f`939da080 : FLTMGR!FltGetFileNameInformation+0xfc
ffffca0e`e579ff30 fffff803`3ea2bdce     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : gameflt+0x1b3a
ffffca0e`e579ff60 fffff803`3ea2bd8c     : ffffca0e`e579ffb0 ffffca0e`e5ec1000 ffff968f`939da080 fffff803`3e84d75d : nt!KxSwitchKernelStackCallout+0x2e
ffffca0e`e5ec6c80 fffff803`3e84d75d     : ffffca0e`e579ffb0 ffffca0e`e5ec1000 ffffca0e`e57a0000 00000000`00000001 : nt!KiSwitchKernelStackContinue
ffffca0e`e5ec6ca0 fffff803`3e8cf9df     : fffff803`41771b20 ffffca0e`e5ec6e80 00000000`00000000 fffff803`00000004 : nt!KiExpandKernelStackAndCalloutOnStackSegment+0x1ad
ffffca0e`e5ec6d30 fffff803`3e8cf7f3     : ffffca0e`e5ec6f88 00000000`00000001 00000000`00000000 ffff968f`8b2ec090 : nt!KiExpandKernelStackAndCalloutSwitchStack+0x13f
ffffca0e`e5ec6da0 fffff803`3e8cf7ad     : fffff803`41771b20 ffffca0e`e5ec6e80 ffff968f`8b2ec0f8 fffff803`3c286e2a : nt!KeExpandKernelStackAndCalloutInternal+0x33
ffffca0e`e5ec6e10 fffff803`41771b10     : 00000000`00000000 00000000`00000000 00000000`00000000 ffff968f`8b2ec090 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffca0e`e5ec6e50 fffff803`41771abd     : 00000000`00000000 fffff803`3c2ab060 00000000`00000000 fffff803`3e8e51c9 : gameflt+0x1b10
ffffca0e`e5ec6eb0 fffff803`41786989     : ffff968f`8b2ec0f8 ffffca0e`e5ec6f88 00000000`00000001 ffff968f`72f5bd80 : gameflt+0x1abd
ffffca0e`e5ec6ee0 fffff803`3c28939b     : ffff968f`8b2ec010 00000000`00000000 ffff968f`78792a30 ffffba05`c336ad10 : gameflt+0x16989
ffffca0e`e5ec6f20 fffff803`3c288e21     : ffffca0e`e5ec7140 ffff968f`8b2ec112 00000000`00000000 00000000`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x37b
ffffca0e`e5ec7030 fffff803`3c287da9     : ffffca0e`e5ec8000 ffffca0e`e5ec1000 ffff968f`91ace920 ffffca0e`e5ec7150 : FLTMGR!FltpPassThroughInternal+0xd1
ffffca0e`e5ec7080 fffff803`3c287b8b     : ffffffff`fffe7960 00000000`00000000 00000000`00000000 ffff968f`72784ad0 : FLTMGR!FltpPassThrough+0x179
ffffca0e`e5ec7120 fffff803`3e8cb875     : ffff968f`9354a3f0 fffff803`3e8d4468 00000000`00000000 00000000`00000000 : FLTMGR!FltpDispatch+0x8b
ffffca0e`e5ec7180 fffff803`3ecc792f     : ffff968f`9354a3f0 ffff968f`72784ad0 ffff968f`7b37c080 ffff968f`91ace920 : nt!IofCallDriver+0x55
ffffca0e`e5ec71c0 fffff803`3ecbee18     : ffffca0e`e5ec7309 00000000`00000000 00000000`00001100 00000000`00000001 : nt!IopCloseFile+0x18f
ffffca0e`e5ec7250 fffff803`3ecbc549     : 00000000`00000000 00000000`00000000 00000000`00001100 00000000`00000000 : nt!ObpCloseHandle+0x298
ffffca0e`e5ec7370 fffff803`3ea3aa65     : ffff968f`939da080 ffff968f`00000000 00000000`00000000 00000000`00000000 : nt!NtClose+0x39
ffffca0e`e5ec73a0 00007fff`6a06ef54     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`0375f778 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`6a06ef54


SYMBOL_NAME:  nt!HvlpVtlCallExceptionHandler+22

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  22

FAILURE_BUCKET_ID:  AV_R_nt!HvlpVtlCallExceptionHandler

OS_VERSION:  10.0.22621.1

BUILDLAB_STR:  ni_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {2c3256b5-db34-672c-33f3-a1ba2e97ab20}

Followup:     MachineOwner
---------

!wdfkd.wdflogdump nssidswap.sys -d

11: kd> !wdfkd.wdflogdump nssidswap.sys -d
Trace searchpath is: 

Trace format prefix is: %7!u!: %!FUNC! - 
Trying to extract TMF information from - d:\symbols\nssidswap.pdb\94C49E4E9E3E4D9CBC94D04967DB71F92\nssidswap.pdb
--- start of log ---
235353: Registry_HandleClose -  [Registry_HandleClose] --> Entry
235354: Registry_HandleClose -  [Registry_HandleClose] <-- Exit
235355: BusFilterQueryID -  [BusFilterQueryID] <-- Exit <status=STATUS_SUCCESS>
235356: BusFilterQueryID -  [BusFilterQueryID] --> Entry
235357: BusFilterQueryID -  [BusFilterQueryID] --> Entry
235358: BusFilterQueryID -  [BusFilterQueryID]Request is for BusQueryHardwareIDs
235359: DMF_Registry_HandleOpenParametersRegistryKey -  [DMF_Registry_HandleOpenParametersRegistryKey] --> Entry
235360: DMF_Registry_HandleOpenParametersRegistryKey -  [DMF_Registry_HandleOpenParametersRegistryKey] <-- Exit <ntStatus=STATUS_SUCCESS>
235361: DMF_Registry_ValueReadDword -  [DMF_Registry_ValueReadDword] --> Entry
235362: DMF_Registry_ValueRead -  [DMF_Registry_ValueRead] --> Entry
235363: Registry_ValueActionAlways -  [Registry_ValueActionAlways] --> Entry
235364: Registry_ValueActionIfNeeded -  [Registry_ValueActionIfNeeded] --> Entry
235365: Registry_ValueActionIfNeeded -  [Registry_ValueActionIfNeeded] <-- Exit <ntStatus=STATUS_SUCCESS>
235366: Registry_ValueActionAlways -  [Registry_ValueActionAlways] <-- Exit <ntStatus=STATUS_SUCCESS>
235367: DMF_Registry_ValueRead -  [DMF_Registry_ValueRead] <-- Exit <ntStatus=STATUS_SUCCESS>
235368: DMF_Registry_ValueReadDword -  [DMF_Registry_ValueReadDword] <-- Exit <ntStatus=STATUS_SUCCESS>
235369: FindRegistryKeyById -  [FindRegistryKeyById] --> Entry
235370: BusQueryId -  [BusQueryId] --> Entry
235371: BusQueryId -  [BusQueryId] <-- Exit <status=STATUS_SUCCESS>
235372: FindRegistryKeyById -  [FindRegistryKeyById]Enumerating ID USB\VID_1532&PID_0088&REV_0200
235373: DMF_Registry_HandleOpenByHandle -  [DMF_Registry_HandleOpenByHandle] --> Entry
235374: Registry_HandleOpenByHandle -  [Registry_HandleOpenByHandle] --> Entry
235375: Registry_HandleOpenByHandle -  [Registry_HandleOpenByHandle] <-- Exit <handle=0x0000000000000000>
235376: DMF_Registry_HandleOpenByHandle -  [DMF_Registry_HandleOpenByHandle] <-- Exit <handle=0x0000000000000000>
235377: FindRegistryKeyById -  [FindRegistryKeyById]Enumerating ID USB\VID_1532&PID_0088
235378: DMF_Registry_HandleOpenByHandle -  [DMF_Registry_HandleOpenByHandle] --> Entry
235379: Registry_HandleOpenByHandle -  [Registry_HandleOpenByHandle] --> Entry
235380: Registry_HandleOpenByHandle -  [Registry_HandleOpenByHandle] <-- Exit <handle=0x0000000000000000>
235381: DMF_Registry_HandleOpenByHandle -  [DMF_Registry_HandleOpenByHandle] <-- Exit <handle=0x0000000000000000>
235382: FindRegistryKeyById -  [FindRegistryKeyById] <-- Exit <status=0xc0000225(STATUS_NOT_FOUND)>
235383: DMF_Registry_HandleClose -  [DMF_Registry_HandleClose] --> Entry
235384: Registry_HandleClose -  [Registry_HandleClose] --> Entry
235385: Registry_HandleClose -  [Registry_HandleClose] <-- Exit
235386: BusFilterQueryID -  [BusFilterQueryID] <-- Exit <status=STATUS_SUCCESS>
235387: BusFilterQueryID -  [BusFilterQueryID] --> Entry
235388: BusFilterQueryID -  [BusFilterQueryID]Request is for BusQueryCompatibleIDs
235389: DMF_Registry_HandleOpenParametersRegistryKey -  [DMF_Registry_HandleOpenParametersRegistryKey] --> Entry
235390: DMF_Registry_HandleOpenParametersRegistryKey -  [DMF_Registry_HandleOpenParametersRegistryKey] <-- Exit <ntStatus=STATUS_SUCCESS>
235391: DMF_Registry_ValueReadDword -  [DMF_Registry_ValueReadDword] --> Entry
235392: DMF_Registry_ValueRead -  [DMF_Registry_ValueRead] --> Entry
235393: Registry_ValueActionAlways -  [Registry_ValueActionAlways] --> Entry
235394: Registry_ValueActionIfNeeded -  [Registry_ValueActionIfNeeded] --> Entry
235395: Registry_ValueActionIfNeeded -  [Registry_ValueActionIfNeeded] <-- Exit <ntStatus=STATUS_SUCCESS>
235396: Registry_ValueActionAlways -  [Registry_ValueActionAlways] <-- Exit <ntStatus=STATUS_SUCCESS>
235397: DMF_Registry_ValueRead -  [DMF_Registry_ValueRead] <-- Exit <ntStatus=STATUS_SUCCESS>
235398: DMF_Registry_ValueReadDword -  [DMF_Registry_ValueReadDword] <-- Exit <ntStatus=STATUS_SUCCESS>
235399: FindRegistryKeyById -  [FindRegistryKeyById] --> Entry
235400: BusQueryId -  [BusQueryId] --> Entry
235401: BusQueryId -  [BusQueryId] <-- Exit <status=STATUS_SUCCESS>
235402: FindRegistryKeyById -  [FindRegistryKeyById]Enumerating ID USB\VID_1532&PID_0088&REV_0200
235403: DMF_Registry_HandleOpenByHandle -  [DMF_Registry_HandleOpenByHandle] --> Entry
235404: Registry_HandleOpenByHandle -  [Registry_HandleOpenByHandle] --> Entry
235405: Registry_HandleOpenByHandle -  [Registry_HandleOpenByHandle] <-- Exit <handle=0x0000000000000000>
235406: DMF_Registry_HandleOpenByHandle -  [DMF_Registry_HandleOpenByHandle] <-- Exit <handle=0x0000000000000000>
235407: FindRegistryKeyById -  [FindRegistryKeyById]Enumerating ID USB\VID_1532&PID_0088
235408: DMF_Registry_HandleOpenByHandle -  [DMF_Registry_HandleOpenByHandle] --> Entry
235409: Registry_HandleOpenByHandle -  [Registry_HandleOpenByHandle] --> Entry
235410: Registry_HandleOpenByHandle -  [Registry_HandleOpenByHandle] <-- Exit <handle=0x0000000000000000>
235411: DMF_Registry_HandleOpenByHandle -  [DMF_Registry_HandleOpenByHandle] <-- Exit <handle=0x0000000000000000>
235412: FindRegistryKeyById -  [FindRegistryKeyById] <-- Exit <status=0xc0000225(STATUS_NOT_FOUND)>
235413: DMF_Registry_HandleClose -  [DMF_Registry_HandleClose] --> Entry
235414: Registry_HandleClose -  [Registry_HandleClose] --> Entry
235415: Registry_HandleClose -  [Registry_HandleClose] <-- Exit
235416: BusFilterQueryID -  [BusFilterQueryID] <-- Exit <status=STATUS_SUCCESS>
235417: BusFilterQueryID -  [BusFilterQueryID] --> Entry
235418: BusFilterDeviceEnumerated -  [BusFilterDeviceEnumerated] --> Entry
235419: BusQueryId -  [BusQueryId] --> Entry
235420: BusQueryId -  [BusQueryId] <-- Exit <status=STATUS_SUCCESS>
235421: BusQueryId -  [BusQueryId] --> Entry
235422: BusQueryId -  [BusQueryId] <-- Exit <status=STATUS_SUCCESS>
235423: BusQueryId -  [BusQueryId] --> Entry
235424: BusQueryId -  [BusQueryId] <-- Exit <status=STATUS_SUCCESS>
235425: BusFilterDeviceEnumerated -  [BusFilterDeviceEnumerated] <-- Exit <status=STATUS_SUCCESS>
235426: nssidswapEvtDeviceAdd -  [nssidswapEvtDeviceAdd]nssidswapEvtDeviceAdd Entry
235427: nssidswapCreateDevice -  [nssidswapCreateDevice] --> Entry
235428: DMF_ModulesCreate -  [DMF_ModulesCreate] --> Entry
235429: DmfDeviceModulesAdd -  [DmfDeviceModulesAdd] --> Entry
235430: DmfDeviceModulesAdd -  [DmfDeviceModulesAdd] <--
235431: DMF_ModuleCollectionCreate -  [DMF_ModuleCollectionCreate] --> Entry
235432: DMF_Registry_Create -  [DMF_Registry_Create] --> Entry
235433: DMF_ModuleCreate -  [DMF_ModuleCreate] --> Entry
235434: DMF_SynchronizationCreate -  [DMF_SynchronizationCreate] --> Entry <DmfObject=0xFFFF968F8EDE70A0 [Registry]
235435: DMF_SynchronizationCreate -  [DMF_SynchronizationCreate]DMF_MODULE_OPTIONS_PASSIVE
235436: DMF_SynchronizationCreate -  [DMF_SynchronizationCreate] <-- Exit <DmfObject=0xFFFF968F8EDE70A0 [Registry] ntStatus=STATUS_SUCCESS>
235437: DMF_Generic_ChildModulesAdd -  [DMF_Generic_ChildModulesAdd] --> Entry <DmfModule=0x0000697071218FD8 [Registry]
235438: DMF_Generic_ChildModulesAdd -  [DMF_Generic_ChildModulesAdd] <-- Exit <DmfModule=0x0000697071218FD8 [Registry] ntStatus=STATUS_SUCCESS>
235439: DMF_ModuleCreate -  [DMF_ModuleCreate] <-- Exit <dmfObject=0xFFFF968F8EDE70A0 [Registry]>
235440: DMF_Registry_Create -  [DMF_Registry_Create] <-- Exit <ntStatus=STATUS_SUCCESS>
235441: DMF_ModuleCreate -  [DMF_ModuleCreate] --> Entry
235442: DMF_SynchronizationCreate -  [DMF_SynchronizationCreate] --> Entry <DmfObject=0xFFFF968F7C38A0A0 [Bridge]
235443: DMF_SynchronizationCreate -  [DMF_SynchronizationCreate]DMF_MODULE_OPTIONS_PASSIVE
235444: DMF_SynchronizationCreate -  [DMF_SynchronizationCreate] <-- Exit <DmfObject=0xFFFF968F7C38A0A0 [Bridge] ntStatus=STATUS_SUCCESS>
235445: DMF_Generic_ChildModulesAdd -  [DMF_Generic_ChildModulesAdd] --> Entry <DmfModule=0x0000697083C75FD8 [Bridge]
235446: DMF_Generic_ChildModulesAdd -  [DMF_Generic_ChildModulesAdd] <-- Exit <DmfModule=0x0000697083C75FD8 [Bridge] ntStatus=STATUS_SUCCESS>
235447: DMF_ModuleCreate -  [DMF_ModuleCreate] <-- Exit <dmfObject=0xFFFF968F7C38A0A0 [Bridge]>
235448: DMF_ModuleCollectionCreate -  [DMF_ModuleCollectionCreate] <-- Exit <moduleCollectionHandle=0xFFFF968F82A1AAA0 ntStatus=STATUS_SUCCESS>
235449: DMF_ModuleCollectionPostCreate -  [DMF_ModuleCollectionPostCreate] --> Entry
235450: DMF_Internal_Open -  [DMF_Internal_Open] --> Entry <DmfModule=0x0000697071218FD8 [Registry]
235451: DMF_Registry_Open -  [DMF_Registry_Open] --> Entry
235452: DMF_Registry_Open -  [DMF_Registry_Open] <-- Exit <ntStatus=STATUS_SUCCESS>
235453: EVT_DMF_MODULE_Generic_OnDeviceNotificationPostOpen -  [EVT_DMF_MODULE_Generic_OnDeviceNotificationPostOpen] --> Entry <DmfModule=0x0000697071218FD8
235454: EVT_DMF_MODULE_Generic_OnDeviceNotificationPostOpen -  [EVT_DMF_MODULE_Generic_OnDeviceNotificationPostOpen] <-- Exit <DmfModule=0x0000697071218FD8 ntStatus=STATUS_SUCCESS>
235455: DMF_Internal_Open -  [DMF_Internal_Open] <-- Exit <DmfModule=0x0000697071218FD8 [Registry] ntStatus=STATUS_SUCCESS>
235456: DMF_Internal_Open -  [DMF_Internal_Open] --> Entry <DmfModule=0x0000697083C75FD8 [Bridge]
235457: DMF_Bridge_Open -  [DMF_Bridge_Open] --> Entry
235458: DMF_Bridge_Open -  [DMF_Bridge_Open] <-- Exit <ntStatus=STATUS_SUCCESS>
235459: EVT_DMF_MODULE_Generic_OnDeviceNotificationPostOpen -  [EVT_DMF_MODULE_Generic_OnDeviceNotificationPostOpen] --> Entry <DmfModule=0x0000697083C75FD8
235460: EVT_DMF_MODULE_Generic_OnDeviceNotificationPostOpen -  [EVT_DMF_MODULE_Generic_OnDeviceNotificationPostOpen] <-- Exit <DmfModule=0x0000697083C75FD8 ntStatus=STATUS_SUCCESS>
235461: DMF_Internal_Open -  [DMF_Internal_Open] <-- Exit <DmfModule=0x0000697083C75FD8 [Bridge] ntStatus=STATUS_SUCCESS>
235462: FilterCreateControlDevice -  [FilterCreateControlDevice] --> Entry
235463: nssidswapCreateDevice -  [nssidswapCreateDevice] <-- Exit <status=STATUS_SUCCESS>
235464: nssidswapEvtDeviceAdd -  [nssidswapEvtDeviceAdd]nssidswapEvtDeviceAdd Exit
235465: BusFilterStartDevice -  [BusFilterStartDevice] --> Entry
235466: BusFilterStartDevice -  [BusFilterStartDevice] <-- Exit <status=STATUS_SUCCESS>
---- end of log ----

!wdfkd.wdflogdump nssidswap.sys -f

11: kd> !wdfkd.wdflogdump nssidswap.sys -f
Trace searchpath is: 

Trace format prefix is: %7!u!: %4!s! %!FUNC! - 
Trying to extract TMF information from - d:\symbols\Wdf01000.pdb\42313A2326918F5C90DBA9A17CD5E4AC1\Wdf01000.pdb
Gather log: Please wait, this may take a moment (reading 4024 bytes).
% read so far ... 10, 20, 30, 40, 50, 60, 70, 80, 90, 100
There are 67 log entries
--- start of log ---
305: 10/14/2022-19:43:13.6289555 FxPkgPnp::NotPowerPolicyOwnerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering not power policy owner state WdfDevStatePwrPolStarted from WdfDevStatePwrPolStarting
306: 10/14/2022-19:43:13.6289555 FxPkgPnp::NotPowerPolicyOwnerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering not power policy owner state WdfDevStatePwrPolStartingSucceeded from WdfDevStatePwrPolStarted
307: 10/14/2022-19:43:13.6289555 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpEnableInterfaces from WdfDevStatePnpHardwareAvailable
308: 10/14/2022-19:43:13.6289555 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpStarted from WdfDevStatePnpEnableInterfaces
309: 10/14/2022-19:43:13.6299576 FxPkgPnp::Dispatch - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0, IRP_MJ_PNP, 0x00000014(IRP_MN_QUERY_PNP_DEVICE_STATE) IRP 0xFFFF968F84E71DA0
310: 10/14/2022-19:43:13.6299576 FxPkgFdo::HandleQueryPnpDeviceStateCompletion - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 returning PNP_DEVICE_STATE 0x0 IRP 0xFFFF968F84E71DA0
311: 10/14/2022-19:43:13.6299576 FxPkgPnp::Dispatch - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F84E71DA0
312: 10/14/2022-19:43:13.6299576 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
313: 10/14/2022-19:43:13.6299576 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
314: 10/14/2022-19:43:13.6299576 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
315: 10/14/2022-19:43:13.6349562 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
316: 10/14/2022-19:43:13.6349562 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
317: 10/14/2022-19:43:13.6369561 FxPkgPnp::Dispatch - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F8B1EB800
318: 10/14/2022-19:43:25.7797627 FxPkgPnp::Dispatch - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type RemovalRelations IRP 0xFFFF968F81CE0DD0
319: 10/14/2022-19:43:25.7797627 FxPkgPnp::Dispatch - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type EjectionRelations IRP 0xFFFF968F81CE0DD0
320: 10/14/2022-19:43:25.7797627 FxPkgPnp::Dispatch - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0, IRP_MJ_PNP, 0x00000017(IRP_MN_SURPRISE_REMOVAL) IRP 0xFFFF968F81CE0DD0
321: 10/14/2022-19:43:25.7797627 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpSurpriseRemoveIoStarted from WdfDevStatePnpStarted
322: 10/14/2022-19:43:25.7797627 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpFailedIoStarting from WdfDevStatePnpSurpriseRemoveIoStarted
323: 10/14/2022-19:43:25.7797627 FxPkgPnp::NotPowerPolicyOwnerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering not power policy owner state WdfDevStatePwrPolStopping from WdfDevStatePwrPolStartingSucceeded
324: 10/14/2022-19:43:25.7797627 FxPkgPnp::PowerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering Power State WdfDevStatePowerGotoD3Stopped from WdfDevStatePowerD0
325: 10/14/2022-19:43:25.7797627 FxSelfManagedIoMachine::ProcessEvent - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering self managed io state FxSelfManagedIoSuspending from FxSelfManagedIoStarted
326: 10/14/2022-19:43:25.7797627 FxSelfManagedIoMachine::ProcessEvent - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering self managed io state FxSelfManagedIoStopped from FxSelfManagedIoSuspending
327: 10/14/2022-19:43:25.7797627 FxPkgIo::StopProcessingForPower - Perform FxIoStopProcessingForPowerHold for all queues of WDFDEVICE 0x000069706AEE1338
328: 10/14/2022-19:43:25.7797627 FxPkgPnp::PowerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering Power State WdfDevStatePowerStopped from WdfDevStatePowerGotoD3Stopped
329: 10/14/2022-19:43:25.7797627 FxPkgPnp::NotPowerPolicyOwnerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering not power policy owner state WdfDevStatePwrPolStoppingWaitingForImplicitPowerDown from WdfDevStatePwrPolStopping
330: 10/14/2022-19:43:25.7797627 FxPkgPnp::NotPowerPolicyOwnerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering not power policy owner state WdfDevStatePwrPolStoppingSendStatus from WdfDevStatePwrPolStoppingWaitingForImplicitPowerDown
331: 10/14/2022-19:43:25.7797627 FxPkgPnp::NotPowerPolicyOwnerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering not power policy owner state WdfDevStatePwrPolStopped from WdfDevStatePwrPolStoppingSendStatus
332: 10/14/2022-19:43:25.7797627 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpFailedOwnHardware from WdfDevStatePnpFailedIoStarting
333: 10/14/2022-19:43:25.7797627 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpFailed from WdfDevStatePnpFailedOwnHardware
334: 10/14/2022-19:43:25.7797627 FxPkgIo::StopProcessingForPower - Perform FxIoStopProcessingForPowerPurgeManaged for all queues of WDFDEVICE 0x000069706AEE1338
335: 10/14/2022-19:43:25.7797627 FxSelfManagedIoMachine::ProcessEvent - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering self managed io state FxSelfManagedIoFlushing from FxSelfManagedIoStopped
336: 10/14/2022-19:43:25.7797627 FxSelfManagedIoMachine::ProcessEvent - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering self managed io state FxSelfManagedIoFlushed from FxSelfManagedIoFlushing
337: 10/14/2022-19:43:25.7797627 FxPkgPnp::NotPowerPolicyOwnerEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering not power policy owner state WdfDevStatePwrPolRemoved from WdfDevStatePwrPolStopped
338: 10/14/2022-19:43:25.7797627 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpFailedPowerPolicyRemoved from WdfDevStatePnpFailed
339: 10/14/2022-19:43:25.7797627 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpFailedWaitForRemove from WdfDevStatePnpFailedPowerPolicyRemoved
340: 10/14/2022-19:43:28.4983770 FxPkgPnp::Dispatch - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0, IRP_MJ_PNP, 0x00000002(IRP_MN_REMOVE_DEVICE) IRP 0xFFFF968F95007DB0
341: 10/14/2022-19:43:28.4983770 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpRemoved from WdfDevStatePnpFailedWaitForRemove
342: 10/14/2022-19:43:28.4983770 FxChildList::NotifyDeviceRemove - WDFCHILDLIST 000069707F163C08:  removing children
343: 10/14/2022-19:43:28.4983770 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpRemovedChildrenRemoved from WdfDevStatePnpRemoved
344: 10/14/2022-19:43:28.4983770 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpFdoRemoved from WdfDevStatePnpRemovedChildrenRemoved
345: 10/14/2022-19:43:28.4983770 FxPkgIo::StopProcessingForPower - Perform FxIoStopProcessingForPowerPurgeNonManaged for all queues of WDFDEVICE 0x000069706AEE1338
346: 10/14/2022-19:43:28.4983770 FxSelfManagedIoMachine::ProcessEvent - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering self managed io state FxSelfManagedIoCleanup from FxSelfManagedIoFlushed
347: 10/14/2022-19:43:28.4983770 FxSelfManagedIoMachine::ProcessEvent - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering self managed io state FxSelfManagedIoFinal from FxSelfManagedIoCleanup
348: 10/14/2022-19:43:28.4983770 FxIoTarget::WaitForDisposeEvent - WDFIOTARGET 000069706D621918, Waiting on Dispose event FFFFCA0EE0FEE9C0
349: 10/14/2022-19:43:28.4983770 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706AEE1338 !devobj 0xFFFF968F7C0F99F0 entering PnP State WdfDevStatePnpFinal from WdfDevStatePnpFdoRemoved
350: 10/14/2022-19:43:28.4983770 FxPkgPnp::_PnpRemoveDevice - WDFDEVICE 000069706AEE1338, !devobj FFFF968F7C0F99F0 waiting for remove event to finish processing
351: 10/14/2022-19:43:28.4983770 FxDevice::Destroy - Deleting !devobj FFFF968F7C0F99F0, WDFDEVICE 000069706AEE1338, attached to !devobj FFFF968F8451EDD0
352: 10/14/2022-19:43:42.0638879 FxPkgPnp::Dispatch - WDFDEVICE 0x000069708B97AB08 !devobj 0xFFFF968F74686510, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F88D08560
353: 10/14/2022-19:43:42.0831049 FxPkgPnp::Dispatch - WDFDEVICE 0x000069708AE11A48 !devobj 0xFFFF968F7639CD70, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F8F3CB9A0
354: 10/14/2022-19:43:42.0831049 FxPkgPnp::Dispatch - WDFDEVICE 0x000069708AE32AC8 !devobj 0xFFFF968F7608CDA0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F951B89A0
355: 10/14/2022-19:43:42.0831049 FxPkgPnp::Dispatch - WDFDEVICE 0x0000697089A91FD8 !devobj 0xFFFF968F76573DC0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F92762210
356: 10/14/2022-19:43:42.0831049 FxPkgPnp::Dispatch - WDFDEVICE 0x00006970895DB338 !devobj 0xFFFF968F76A25CE0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F7646E620
357: 10/14/2022-19:43:42.0831049 FxPkgPnp::Dispatch - WDFDEVICE 0x00006970899E0348 !devobj 0xFFFF968F766B0DE0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F8E1E07F0
358: 10/14/2022-19:43:42.0831049 FxPkgPnp::Dispatch - WDFDEVICE 0x0000697089BF1F18 !devobj 0xFFFF968F7640EB80, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F8BDD99E0
359: 10/14/2022-19:43:46.8320308 FxPkgPnp::Dispatch - WDFDEVICE 0x0000697089A91FD8 !devobj 0xFFFF968F76573DC0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F92762210
360: 10/14/2022-19:43:46.8320308 FxPkgPnp::Dispatch - WDFDEVICE 0x00006970895DB338 !devobj 0xFFFF968F76A25CE0, IRP_MJ_PNP, 0x00000007(IRP_MN_QUERY_DEVICE_RELATIONS) type BusRelations IRP 0xFFFF968F85288010
361: 10/14/2022-19:43:46.8320308 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
362: 10/14/2022-19:43:46.8320308 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
363: 10/14/2022-19:43:46.8330313 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
364: 10/14/2022-19:43:46.8330313 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
365: 10/14/2022-19:43:46.8330313 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
366: 10/14/2022-19:43:46.8330313 imp_WdfRegistryOpenKey - new WDFKEY object open failed, 0xc0000034(STATUS_OBJECT_NAME_NOT_FOUND)
367: 10/14/2022-19:43:46.8340316 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706C258D38 !devobj 0xFFFF968F7640EDC0 entering PnP State WdfDevStatePnpInit from WdfDevStatePnpObjectCreated
368: 10/14/2022-19:43:46.8340316 FxObjectGetTypedContext - Attempting to get context type WdfCustomType_DMFMODULE_TYPE from FxObject 0xFFFF968F93DA72C0
369: 10/14/2022-19:43:46.8340316 FxObjectGetTypedContext - Attempting to get context type WdfCustomType_DMFMODULE_TYPE from FxObject 0xFFFF968F93DA72C0
370: 10/14/2022-19:43:46.8340316 FxPkgPnp::Dispatch - WDFDEVICE 0x000069706C258D38 !devobj 0xFFFF968F7640EDC0, IRP_MJ_PNP, 0x00000000(IRP_MN_START_DEVICE) IRP 0xFFFF968F85288010
371: 10/14/2022-19:43:46.8340316 FxPkgPnp::PnpEnterNewState - WDFDEVICE 0x000069706C258D38 !devobj 0xFFFF968F7640EDC0 entering PnP State WdfDevStatePnpInitStarting from WdfDevStatePnpInit
---- end of log ----
13 error events encountered in logs

Oct 16 '22 16:10 nefarius

Identinator Identinator copied to clipboard

[BSOD] KMODE_EXCEPTION_NOT_HANDLED in combination with MS gameflt

WinDbg

!wdfkd.wdflogdump nssidswap.sys -d

!wdfkd.wdflogdump nssidswap.sys -f

Identinator
Identinator copied to clipboard