A forum for reverse engineering, OS internals and malware analysis 

 #24626  by fsdhook
 Tue Dec 16, 2014 8:34 am
Hi, all.

I write a NDIS FILTER driver. I want to send the special packet back to the sender then drop the packet.
For example: If I receive a packet include string "HELLO_PACKET_WORLD", I will send this packet to the sender, then drop this packet.
But BSOD when I call NdisFSendNetBufferLists in FilterReceiveNetBufferLists. BUGCHECK CODE is IRQL_NOT_LESS_OR_EQUAL.

How to solve this problem?

Thanks in advance.
 #24884  by EP_X0FF
 Fri Jan 09, 2015 10:51 am
How do I suppose to help you? I cannot (and will not even if) debug your code looking for what you have done improperly. There is no dump in thread, no actual code posted. Telepaths are out there.
 #24952  by fsdhook
 Thu Jan 15, 2015 12:55 am
EP_X0FF wrote:How do I suppose to help you? I cannot (and will not even if) debug your code looking for what you have done improperly. There is no dump in thread, no actual code posted. Telepaths are out there.
I am sorry, I am wrong. I will paste my code when I ask question (next time).
 #24961  by Patrick
 Thu Jan 15, 2015 7:51 pm
fsdhook wrote:
EP_X0FF wrote:How do I suppose to help you? I cannot (and will not even if) debug your code looking for what you have done improperly. There is no dump in thread, no actual code posted. Telepaths are out there.
I am sorry, I am wrong. I will paste my code when I ask question (next time).
Code + crash dump would be best, specifically a kernel or complete if possible. You may want to consider enabling verifier with options/flags that apply.
 #24963  by Brock
 Fri Jan 16, 2015 6:59 am
As Patrick said, use driver verifier. In your case if you're receiving that BSOD message then enable Driver Verifier (Verifier.exe) with "Force IRQL checking" enabled to start. How can you write an NDIS driver yet not be able to debug your own errors? Are you capable of reading a dmp file? This thread should be closed or locked on principle alone, you've no business "playing" at the NDIS level if you're asking others about simple IRQ level errors. Copy and paste it sounds like to me...