I'm analyzing a post-mortem kernel dump and I'm trying to identify all processes and filter drivers that may be referencing a USB storage drive or have handles open to it. I've tried examining all the open handles but even with limiting it to only File objects the data isn't manageable. So I navigated through the !object \ list to find the volume I'm looking for:
3: kd> !devobj fffffa8007169cd0
Device object (fffffa8007169cd0) is for:
HarddiskVolume6 \Driver\volmgr DriverObject fffffa8006af2060
Current Irp 00000000 RefCount 34 Type 00000007 Flags 00001050
Vpb fffffa8007168940 Dacl fffff9a10033a3c0 DevExt fffffa8007169e20 DevObjExt fffffa8007169f88 Dope fffffa80071688d0 DevNode fffffa800716b890
3: kd> !vpb fffffa8007168940
Vpb at 0xfffffa8007168940
Flags: 0x1 mounted
DeviceObject: 0xfffffa8008880030
RealDevice: 0xfffffa8007169cd0
RefCount: 34
Volume Label:
Is it possible to find what all of these 34 references are?
Is there a simple method of identifying what is using any given volume from a memory dump?
Doesnt !devhandle on the devobject provide you any details ?
kd> .shell -ci "!object \Device" grep -i harddisk
xxxxxxxxxx
20 849a8e20 Device HarddiskVolume8
xxxxxxxx
kd> !devobj 849a8e20
Device object (849a8e20) is for:
HarddiskVolume8 \Driver\volmgr DriverObject 851708b0
Current Irp 00000000 RefCount 5 Type 00000007 Flags 00003050
Vpb 8594de78 Dacl b0c8b8a4 DevExt 849a8ed8 DevObjExt 849a8fc0 Dope 8493ee10 DevNode 86643708
ExtensionFlags (0000000000)
Characteristics (0x00000001) FILE_REMOVABLE_MEDIA <--------
AttachedDevice (Upper) 866f04c8 \Driver\fvevol
Device queue is not busy.
kd> !devhandles 849a8e20
Checking handle table for process 0x84830ae8
Kernel handle table at 89601b80 with 636 entries in use
xxxxxxxxxxxxxxxxxxxxxxxx
PROCESS 86479210 SessionId: 1 Cid: 05e8 Peb: 7ffdf000 ParentCid: 05b0
DirBase: 7e28f2c0 ObjectTable: 94dcc900 HandleCount: 923.
Image: explorer.exe
121c: Object: 84a03550 GrantedAccess: 00100081 Entry: adac3438
Object: 84a03550 Type: (848adde8) File
ObjectHeader: 84a03538 (new version)
HandleCount: 1 PointerCount: 2
Directory Object: 00000000 Name: \ {HarddiskVolume8} <----
PROCESS 86479210 SessionId: 1 Cid: 05e8 Peb: 7ffdf000 ParentCid: 05b0
DirBase: 7e28f2c0 ObjectTable: 94dcc900 HandleCount: 923.
Image: explorer.exe
12ac: Object: 84a0a038 GrantedAccess: 00100081 Entry: adac3558
Object: 84a0a038 Type: (848adde8) File
ObjectHeader: 84a0a020 (new version)
HandleCount: 1 PointerCount: 2
Directory Object: 00000000 Name: \ {HarddiskVolume8} <-----
Related
I've got a system in Azure size M64ls running CentOS 7. Sometimes in the terminal it shows what looks like a system crash but I can ssh into it and everything appears to be working just fine. What is going on here?
[305976.417482] CPU: 60 PID: 102401 Comm: threaded-ml Tainted: G B ------------ T 3.10.0-1062.9.1.el7.x86_64 #1
[305976.424445] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090007 06/02/2017
[305976.430885] Call Trace:
[305976.433264] [<ffffffff8e37ac23>] dump_stack+0x19/0x1b
[305976.437036] [<ffffffff8e375f86>] bad_page.part.75+0xdc/0xf9
[305976.441097] [<ffffffff8ddc617d>] free_pages_prepare+0x1ad/0x1d0
[305976.445316] [<ffffffff8ddc6bd4>] free_hot_cold_page+0x74/0x160
[305976.449467] [<ffffffff8ddcbfa3>] __put_single_page+0x23/0x30
[305976.453554] [<ffffffff8ddcbff5>] put_page+0x45/0x60
[305976.457225] [<ffffffff8de35877>] __split_huge_page+0x387/0x880
[305976.461513] [<ffffffff8de35de6>] split_huge_page_to_list+0x76/0xf0
[305976.465965] [<ffffffff8de368e0>] __split_huge_page_pmd+0x1d0/0x5c0
[305976.470455] [<ffffffff8ddef4d3>] unmap_page_range+0xc63/0xc80
[305976.474877] [<ffffffff8ddef571>] unmap_single_vma+0x81/0xf0
[305976.479019] [<ffffffff8ddf08f5>] zap_page_range+0xc5/0x130
[305976.483079] [<ffffffff8e381c46>] ? rt_mutex_slowunlock+0xd6/0x120
[305976.487526] [<ffffffff8ddeb62d>] SyS_madvise+0x49d/0xac0
[305976.491629] [<ffffffff8e38dede>] system_call_fastpath+0x25/0x2a
[318091.991229] blk_update_request: I/O error, dev fd0, sector 0
[318092.018231] blk_update_request: I/O error, dev fd0, sector 0
[323176.276146] BUG: Bad page state in process ld-linux-x86-64 pfn:70d9dff
[323176.281310] page:fffffe6143677fc0 count:0 mapcount:-127 mapping: (null) index:0x2
[323176.286928] page flags: 0x602b0e00000000()
[323176.290359] page dumped because: nonzero mapcount
[323176.293943] Modules linked in: fuse xt_owner iptable_security ext4 mbcache jbd2 xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stpllc ebtable_filter ebtables ip6table_filter ip6_tables devlink iptable_filter nfsv3 nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache sunrpc dm_mirror dm_region_hash dm_log dm_mod joydev hv_utils ptp pps_core sg hv_balloon sb_edac iosf_mbi kvm_intel kvm irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper i2c_piix4 ablk_helper pcspkr cryptd binfmt_misc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic hv_storvsc scsi_transport_fc hv_netvsc hyperv_keyboard hid_hyperv scsi_tgt ata_generic pata_acpi crct10dif_pclmul ata_piix crct10dif_common hyperv_fb libata crc32c_intel floppy hv_vmbus serio_raw
[323176.352511] CPU: 43 PID: 99598 Comm: ld-linux-x86-64 Tainted: G B ------------ T 3.10.0-1062.9.1.el7.x86_64 #1
[323176.359600] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090007 06/02/2017
[323176.365912] Call Trace:
[323176.368323] [<ffffffff8e37ac23>] dump_stack+0x19/0x1b
[323176.372191] [<ffffffff8e375f86>] bad_page.part.75+0xdc/0xf9
[323176.376366] [<ffffffff8ddc617d>] free_pages_prepare+0x1ad/0x1d0
[323176.380682] [<ffffffff8ddc6bd4>] free_hot_cold_page+0x74/0x160
[323176.384934] [<ffffffff8ddcbfa3>] __put_single_page+0x23/0x30
[323176.389101] [<ffffffff8ddcbff5>] put_page+0x45/0x60
[323176.392883] [<ffffffff8ddf0f70>] do_numa_page+0x230/0x250
[323176.396950] [<ffffffff8ddf1249>] handle_pte_fault+0x2b9/0xe20
[323176.401211] [<ffffffff8dcb09a2>] ? dequeue_signal+0x32/0x180
[323176.405416] [<ffffffff8ddf3ecd>] handle_mm_fault+0x39d/0x9b0
[323176.409622] [<ffffffff8e388653>] __do_page_fault+0x213/0x500
[323176.413786] [<ffffffff8e388975>] do_page_fault+0x35/0x90
[323176.417773] [<ffffffff8e384778>] page_fault+0x28/0x30
I am trying to debug the embedded Linux kernel 4.12.28, this crashes and shows kernel panic. I have put some prints inside blocks/genhd.c to print the disk_name. I see that it crashes inside - "bdget_disk" while getting the bdgt_disk for disk_name "ram0". I am using a power pc architecture.
I am a bit puzzled on how should I approach this issue or how can I debug? I am unable to understand the root cause. My understanding is that ram0 is like a RAM disk needed for initial bootup by the system. The initrd contents will be copied to ram0 for bootup. I don't understand why it crashes. I can make out that it is related to bad address. But what is the real reason and how to
debug this?
My defconfig has -
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_RAM_COUNT=16
CONFIG_BLK_DEV_RAM_SIZE=32768
The kernel panic logs are -
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xe0004500 (irq = 16, base_baud = 19531250) is a 16550A
serial8250.0: ttyS1 at MMIO 0xe0004600 (irq = 17, base_baud = 19531250) is a 16550A
console [ttyS1] enabled
console [ttyS1] enabled
bootconsole [udbg0] disabled
bootconsole [udbg0] disabled
Custom Debug..DEBUG: Passed bdget_disk 765
Custom Debug.. the disc name is ram0
Unable to handle kernel paging request for data at address 0x00005484
Faulting instruction address: 0xc0100154
Oops: Kernel access of bad area, sig: 11 [#1]
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 4.12.28-standard #1
task: df416a60 task.stack: df42a000
NIP: c0100154 LR: c011d158 CTR: c02bd990
REGS: df42bcb0 TRAP: 0300 Not tainted (4.12.28-standard)
MSR: 00009032 <EE,ME,IR,DR,RI>
CR: 242c0484 XER: 00000000
DAR: 00005484 DSISR: 20000000
GPR00: c02406bc df42bd60 df416a60 df407800 00000001 c011cb4c c011cb64 df42bd68
GPR08: 00000005 00000001 c0660000 00000000 222c0824 00000000 c00040f0 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 c0660000 c05fa2dc
GPR24: 00000007 00000093 df50d00c df50d060 00000000 df50d058 00000000 df50d040
NIP [c0100154] iget5_locked+0xc/0x250
LR [c011d158] bdget+0x40/0xf4
Call Trace:
[df42bd60] [c0652708] log_wait+0x0/0x8 (unreliable)
[df42bd80] [c02406bc] bdget_disk+0xac/0xf8
[df42bda0] [c0241780] device_add_disk+0x3f4/0x43c
[df42bdf0] [c060ed5c] brd_init+0xa8/0x184
[df42be20] [c0003a5c] do_one_initcall+0x48/0x18c
[df42be90] [c05faafc] kernel_init_freeable+0x130/0x228
[df42bf20] [c0004108] kernel_init+0x18/0x110
[df42bf40] [c00103f0] ret_from_kernel_thread+0x5c/0x64
Instruction dump:
741d7e44 3f090d7e ea9463ef 3a7ebecd fc607969 24b8044d a251c1c7 2c91258b
242aaa92 9887d4e0 2f4a22b5 8b2ef93c <8b9c5484> 7ecf225d 6a9c4a5b 1a5791d4
---[ end trace 47ca8dc77d8de71b ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
Rebooting in 180 seconds..
In simple words kernel was searching for /dev/ram0 which it couldn't find.
probable root-cause: you didn't provided proper command line argument to initialize initrd. please do post you kernel command line. we can sort it out.
Sniffed URB_INTERRUPTions
I sniffed communication between some application (SoundLab) and device (sonometer with usb). I found a packet responsible for returning current state:
USB URB
[Source: host]
[Destination: 1.1.2]
USBPcap pseudoheader length: 27
IRP ID: 0xffff858d126f4a60
IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
URB Function: URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER (0x0009)
IRP information: 0x00, Direction: FDO -> PDO
0000 000. = Reserved: 0x00
.... ...0 = Direction: FDO -> PDO (0x0)
URB bus id: 1
Device address: 1
Endpoint: 0x02, Direction: OUT
0... .... = Direction: OUT (0)
.... 0010 = Endpoint number: 2
URB transfer type: URB_INTERRUPT (0x01)
Packet Data Length: 8
[bInterfaceClass: Unknown (0xffff)]
Leftover Capture Data: b331eb4d00000000
It is sent by application to endpoint number 2 (out), and then device sends urb interruption with data to endpoint number 1 (in):
USB URB
[Source: 1.1.1]
[Destination: host]
USBPcap pseudoheader length: 27
IRP ID: 0xffff858d10207af0
IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
URB Function: URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER (0x0009)
IRP information: 0x01, Direction: PDO -> FDO
0000 000. = Reserved: 0x00
.... ...1 = Direction: PDO -> FDO (0x1)
URB bus id: 1
Device address: 1
Endpoint: 0x81, Direction: IN
1... .... = Direction: IN (1)
.... 0001 = Endpoint number: 1
URB transfer type: URB_INTERRUPT (0x01)
Packet Data Length: 8
[bInterfaceClass: Unknown (0xffff)]
Leftover Capture Data: 01a9009b90ddc0ff
Attempt to mimic interruptions with libusb
Now I want to mimic this in Linux, using libusb. I wrote this code where I can test different interruptions.
require 'libusb'
require 'pry'
vendor_id = 0x64bd
product_id = 0x74e3
module Messages
GET_STATE = ['b331eb4d00000000'].pack('H*')
end
usb = LIBUSB::Context.new
device = usb.devices(idVendor: vendor_id, idProduct: product_id).first
dev_handle = device.open
if dev_handle.kernel_driver_active?(0)
dev_handle.detach_kernel_driver(0)
end
dev_handle.claim_interface(0)
binding.pry
dev_handle.release_interface(0)
dev_handle.close
Then I run this in pry console:
dev_handle.interrupt_transfer(endpoint: 2, dataOut: Messages::GET_STATE)
And it returns 8. That is not what I expected.
URB_INTERRUPTions I see when I run my code
USB URB
[Source: host]
[Destination: 1.6.2]
URB id: 0xffff8802142fecc0
URB type: URB_SUBMIT ('S')
URB transfer type: URB_INTERRUPT (0x01)
Endpoint: 0x02, Direction: OUT
Device: 6
URB bus id: 1
Device setup request: not relevant ('-')
Data: present (0)
URB sec: 1559130571
URB usec: 534195
URB status: Operation now in progress (-EINPROGRESS) (-115)
URB length [bytes]: 8
Data length [bytes]: 8
[Response in: 126]
[bInterfaceClass: HID (0x03)]
Unused Setup Header
Interval: 8
Start frame: 0
Copy of Transfer Flags: 0x00000000
Number of ISO descriptors: 0
Leftover Capture Data: b331eb4d00000000
USB URB
[Source: 1.6.2]
[Destination: host]
URB id: 0xffff8802142fecc0
URB type: URB_COMPLETE ('C')
URB transfer type: URB_INTERRUPT (0x01)
Endpoint: 0x02, Direction: OUT
Device: 6
URB bus id: 1
Device setup request: not relevant ('-')
Data: not present ('>')
URB sec: 1559130571
URB usec: 534846
URB status: Success (0)
URB length [bytes]: 8
Data length [bytes]: 0
[Request in: 125]
[Time from request: 0.000651000 seconds]
[bInterfaceClass: HID (0x03)]
Unused Setup Header
Interval: 8
Start frame: 0
Copy of Transfer Flags: 0x00000000
Number of ISO descriptors: 0
Summary
In result I get URB_INTERRUPTions that are much different from what I saw on Windows. On Windows I had urb_interrupt to 2 (out) endpoint with data requesting state of device. Then device was sending urb_interrupt to 1 (in) endpoint with current state encoded in capture data. How can I mimic this with LIBUSB::DevHandle#interrupt_transfer? Here is documentation of this method: https://www.rubydoc.info/gems/libusb/LIBUSB/DevHandle#interrupt_transfer-instance_method.
I tried meld-ing the expected versus received USB output that you posted, and the main thing that stood out to me was that your 'actual' USB protocol captures showed one URB_INTERRUPT in (marked by the 'direction' field). In your 'actual' USB traffic dump, it looks like you have 2 URB_INTERRUPT outs.
I'm not an expert in the USB protocol (I came across this question while myself stumbling around for help reverse-engineering a USB driver as well), but from what I can tell, to get a URB_INTERRUPT 'in' (which is what you have in the expected output), you have to change the endpoint address to 0x82 instead of just 2.
This answer talks about this further: https://superuser.com/a/876773/618124
USB endpoints 0x00-0x7F are on the host, and the endpoints 0x80-0xFF
are on the device (I think).
Give that shot and see if it works?
when opening any .sln file my Visual Studio 2013 crashes with following error:
An unhandled Microsoft .NET Framework exception occurred in devenv.exe
Possible Debuggers:
New instance of Microsoft Visual Studio 2015
--> I am using 2013
This error suddenly occurred without doing anything, at least not that I am aware of. I have seen many similar problems to this but no one has solved them, yet..
EDIT local dump
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*** WARNING: Unable to verify checksum for WindowsBase.ni.dll
GetUrlPageData2 (WinHttp) failed: 12002.
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
eax=168124f8 ebx=00000001 ecx=07c44ef8 edx=00f3f15c esi=168124f0 edi=00f3f154
eip=e8000000 esp=00f3ef80 ebp=00f3f00c iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210202
e8000000 ?? ???
Resetting default scope
FAULTING_IP:
+0
e8000000 ?? ???
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: e8000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: e8000000
Attempt to execute non-executable address e8000000
DEFAULT_BUCKET_ID: SOFTWARE_NX_FAULT_NOSOS
PROCESS_NAME: devenv.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 00000008
EXCEPTION_PARAMETER2: e8000000
FOLLOWUP_IP:
vcpkg!EnvUtils::ValidateFile+9c
60ddf268 8b45c8 mov eax,dword ptr [ebp-38h]
EXECUTE_ADDRESS: ffffffffe8000000
FAILED_INSTRUCTION_ADDRESS:
+0
e8000000 ?? ???
WATSON_BKT_PROCSTAMP: 524fcb34
WATSON_BKT_PROCVER: 12.0.21005.1
PROCESS_VER_PRODUCT: Microsoft® Visual Studio® 2013
WATSON_BKT_MODULE: unknown
WATSON_BKT_MODVER: 0.0.0.0
WATSON_BKT_MODOFFSET: e8000000
WATSON_BKT_MODSTAMP: bbbbbbb4
BUILD_VERSION_STRING: 10.0.15063.296 (WinBuild.160101.0800)
MODLIST_WITH_TSCHKSUM_HASH: fb08b3e0d26f59b745effd61c5c16cb11b294362
MODLIST_SHA1_HASH: e077fef6b924063dd9adb146ae617873baf70a07
NTGLOBALFLAG: 0
PROCESS_BAM_CURRENT_THROTTLED: 0
PROCESS_BAM_PREVIOUS_THROTTLED: 0
APPLICATION_VERIFIER_FLAGS: 0
PRODUCT_TYPE: 1
SUITE_MASK: 272
DUMP_FLAGS: 8000c07
DUMP_TYPE: 3
MISSING_CLR_SYMBOL: 0
ANALYSIS_SESSION_HOST: DESKTOP-BS5SBSD
ANALYSIS_SESSION_TIME: 07-20-2017 16:11:36.0410
ANALYSIS_VERSION: 10.0.15063.468 x86fre
MANAGED_CODE: 1
MANAGED_ENGINE_MODULE: clr
MANAGED_ANALYSIS_PROVIDER: SOS
MANAGED_THREAD_ID: 8e8
THREAD_ATTRIBUTES:
ADDITIONAL_DEBUG_TEXT: SOS.DLL is not loaded for managed code. Analysis might be incomplete
OS_LOCALE: DEU
PROBLEM_CLASSES:
ID: [0n292]
Type: [#ACCESS_VIOLATION]
Class: Addendum
Scope: BUCKET_ID
Name: Omit
Data: Omit
PID: [Unspecified]
TID: [0x8e8]
Frame: [0] : unknown!unknown
ID: [0n266]
Type: [INVALID_POINTER_EXECUTE]
Class: Primary
Scope: BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0x8e8]
Frame: [0] : unknown!unknown
ID: [0n274]
Type: [SOFTWARE_NX_FAULT]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0xcc8]
TID: [0x8e8]
Frame: [0] : unknown!unknown
ID: [0n272]
Type: [INVALID_POINTER]
Class: Primary
Scope: BUCKET_ID
Name: Add
Data: Omit
PID: [0xcc8]
TID: [0x8e8]
Frame: [0] : unknown!unknown
ID: [0n234]
Type: [NOSOS]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [Unspecified]
Frame: [0]
BUGCHECK_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_INVALID_POINTER_EXECUTE_NOSOS
PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT
LAST_CONTROL_TRANSFER: from 60ddf268 to e8000000
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f3ef7c 60ddf268 168124f8 00f3f15c 3cc66705 0xe8000000
00f3f00c 60ddf66a 00f3f07c 00f3f144 00f3f154 vcpkg!EnvUtils::ValidateFile+0x9c
00f3f180 60ddfc26 00000001 3cc66699 00000000 vcpkg!CInitializeConfigurationWorkItem::ProcessFiles+0x166
00f3f2e8 60d7c573 00000001 3cc6642d 146e3ae8 vcpkg!CInitializeConfigurationWorkItem::Initialize+0xe3f
00f3f324 60d7a609 00000001 3cc66471 07a5417c vcpkg!CMultiItemWorkItem::Initialize+0x86
00f3f378 60d385c4 07ad6e1c 00f3f410 77155da0 vcpkg!CWorkItem::ProcessPendingInitializeCalls+0xad
00f3f3b8 60d382c3 07a5417c fffffffe 14073550 vcpkg!CParserManager::OnIdle+0x3a3
00f3f474 71b84ce7 07ad6e1c fffffffe ffffffff vcpkg!CVCPackage::FDoIdle+0x1d0
00f3f4a4 71b84e0f 00000000 0104e204 00000002 msenv!SCM::FDoIdleLoop+0x122
00f3f4c8 71b84e5a ffffffff 00f3f4f8 71b849df msenv!SCM::FDoIdle+0xd5
00f3f4d4 71b849df 0104e1b8 ffffffff 066313f8 msenv!SCM_MsoStdCompMgr::FDoIdle+0x11
00f3f4f8 71b84479 066313f8 ffffffff ffffffff msenv!MainMessageLoop::DoIdle+0x1a
00f3f534 71c83083 0835d33f 00000000 0104e1b0 msenv!CMsoCMHandler::EnvironmentMsgLoop+0x12e
00f3f56c 71c82fb3 066313f8 ffffffff 0104e1b0 msenv!CMsoCMHandler::FPushMessageLoop+0x132
00f3f594 71c82f12 06614bd0 ffffffff 00000cc8 msenv!SCM::FPushMessageLoop+0xae
00f3f5b4 71c82ed9 0104e1b4 06614bd0 ffffffff msenv!SCM_MsoCompMgr::FPushMessageLoop+0x2a
00f3f5e0 71c82e1d ffffffff 0835d38f 00000000 msenv!CMsoComponent::PushMsgLoop+0x2e
00f3f670 71baf730 0835d0e7 00fa1c70 71b10000 msenv!VStudioMainLogged+0x525
00f3f698 2f73f1e2 00fa16d0 280e5cc0 00fa1c70 msenv!VStudioMain+0x7c
00f3f6d8 2f73ee26 280e53b8 77154cc0 2f74b56c devenv!util_CallVsMain+0xde
00f3f9a0 2f748734 00000000 00f74865 00000001 devenv!CDevEnvAppId::Run+0x9bc
00f3f9c8 2f748799 2f730000 00000000 00f74865 devenv!WinMain+0xbd
00f3fa14 77158744 00d00000 77158720 a9dba18e devenv!WinMainCRTStartup+0x12f
00f3fa28 778b582d 00d00000 fd9eefff 00000000 kernel32!BaseThreadInitThunk+0x24
00f3fa70 778b57fd ffffffff 778d6386 00000000 ntdll!__RtlUserThreadStart+0x2f
00f3fa80 00000000 2f74c3e1 00d00000 00000000 ntdll!_RtlUserThreadStart+0x1b
THREAD_SHA1_HASH_MOD_FUNC: 0136bd6660b54be9c6ec0b5c346ba7b7017c80cb
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 43ea5823f76b450da54d29b14be5db6eb9d88bc3
THREAD_SHA1_HASH_MOD: 22f3d87dbea0d43cb2ca58d96819da8f26bffe9e
FAULT_INSTR_CODE: 8bc8458b
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: vcpkg!EnvUtils::ValidateFile+9c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: vcpkg
IMAGE_NAME: vcpkg.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5590c8c5
STACK_COMMAND: .ecxr ; kb
FAILURE_BUCKET_ID: SOFTWARE_NX_FAULT_NOSOS_c0000005_vcpkg.dll!EnvUtils::ValidateFile
BUCKET_ID: APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_INVALID_POINTER_EXECUTE_NOSOS_BAD_IP_vcpkg!EnvUtils::ValidateFile+9c
FAILURE_EXCEPTION_CODE: c0000005
FAILURE_IMAGE_NAME: vcpkg.dll
BUCKET_ID_IMAGE_STR: vcpkg.dll
FAILURE_MODULE_NAME: vcpkg
BUCKET_ID_MODULE_STR: vcpkg
FAILURE_FUNCTION_NAME: EnvUtils::ValidateFile
BUCKET_ID_FUNCTION_STR: EnvUtils::ValidateFile
BUCKET_ID_OFFSET: 9c
BUCKET_ID_MODTIMEDATESTAMP: 5590c8c5
BUCKET_ID_MODCHECKSUM: 44caac
BUCKET_ID_MODVER_STR: 12.0.40629.0
BUCKET_ID_PREFIX_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_INVALID_POINTER_EXECUTE_NOSOS_BAD_IP_
FAILURE_PROBLEM_CLASS: APPLICATION_FAULT
FAILURE_SYMBOL_NAME: vcpkg.dll!EnvUtils::ValidateFile
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/devenv.exe/12.0.21005.1/524fcb34/unknown/0.0.0.0/bbbbbbb4/c0000005/e8000000.htm?Retriage=1
TARGET_TIME: 2017-07-20T14:57:52.000Z
OSBUILD: 15063
OSSERVICEPACK: 296
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
OSPLATFORM_TYPE: x86
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt SingleUserTS
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.15063.296
ANALYSIS_SESSION_ELAPSED_TIME: 6ee0
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:software_nx_fault_nosos_c0000005_vcpkg.dll!envutils::validatefile
FAILURE_ID_HASH: {653be37d-7dca-4334-85f0-5ab76235b00d}
Followup: MachineOwner
I also had this problem. Every time I open my Visual Studio 2013, with or without a solution in it, it will crash and show:
Visual Studio 2013 has stopped working
It was solved by:
Disconnect your PC from any internet connection,
Open Visual Studio 2013. In this state, you are able to open your VS 2013 without any issue, but it will have the problem again when you connect to internet,
Logout your account from Visual Studio 2013,
Connect to internet again
In my case, it doesn't really a matter if I logout my account from my VS 2013, therefore it fixed the issue.
Close Visual Studio (ensure devenv.exe is not present in the Task Manager)
Delete the %USERPROFILE%\AppData\Local\Microsoft\VisualStudio\14.0\ComponentModelCache directory
Restart Visual Studio.
Guys When you are Facing this type issue Visual Studio When you Start It's Getting This Type "Microsoft Visual Studio 2013 has Stopped Working"
NOTE: Please check when you disconnect the internet VS 2013 It's Working Again You Start Internet Again the same Problem.
In that Case, You Can Log Out Microsoft ID Which you have logged into Visual Studio 2013
Then Problem Resolved,
I'm trying to locate the boot loader on an embedded device, I've found the root / squashfs image on /dev/mtdblock0 by cating the device, but other devices fail to cat (I get this output for /dev/mtd0-4 and /dev/mtdblock1-7):
# cat /dev/mtd0
cat: can't open '/dev/mtd0': No such device or address
Kernel command line
root=31:0 ro noinitrd console=ttyS0,115200
Another question, the flash device has 8192KB of space, but only 6488064 bytes can be accessed, How can I access the rest?
df
Filesystem 1024-blocks Used Available Use% Mounted on
/dev/root 6336 6336 0 100% /
cat /proc/mtd
# cat /proc/mtd
dev: size erasesize name
mtd0: 0062b000 0062b000 "Physically mapped flash"
boot log
<5>Linux version 2.6.30 (joan#bb4compile) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Tue Jun 5 15:40:48 CST 2012
<4>HS Serial flash device: name S25FL064, id 0x0116 size 8192KB
<4>963168VX prom init
<6>CPU revision is: 0002a080 (Broadcom4350)
<4>DSL SDRAM reserved: 0x132000
<6>Determined physical RAM map:
<6> memory: 03ece000 # 00000000 (usable)
<4>Zone PFN ranges:
<4> DMA 0x00000000 -> 0x00001000
<4> Normal 0x00001000 -> 0x00003ece
<4>Movable zone start PFN for each node
<4>early_node_map[1] active PFN ranges
<4> 0: 0x00000000 -> 0x00003ece
<7>On node 0 totalpages: 16078
<7>free_area_init_node: node 0, pgdat 803ccd10, node_mem_map 81000000
<7> DMA zone: 32 pages used for memmap
<7> DMA zone: 0 pages reserved
<7> DMA zone: 4064 pages, LIFO batch:0
<7> Normal zone: 94 pages used for memmap
<7> Normal zone: 11888 pages, LIFO batch:1
<4>Built 1 zonelists in Zone order, mobility grouping on. Total pages: 15952
<5>Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
<4>wait instruction: enabled
<4>Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
<4>Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
<6>NR_IRQS:128
<4>PID hash table entries: 256 (order: 8, 1024 bytes)
<6>console [ttyS0] enabled
<6>Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
<6>Memory: 59416k/64312k available (2979k kernel code, 4876k reserved, 866k data, 144k init, 0k highmem)
<6>Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)
<4>Mount-cache hash table entries: 512
<6>--Kernel Config--
<6> SMP=1
<6> PREEMPT=1
<6> DEBUG_SPINLOCK=0
<6> DEBUG_MUTEXES=0
<4>Broadcom Logger v0.1 Jun 1 2012 11:30:49
<6>CPU revision is: 0002a080 (Broadcom4350)
<4>Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
<4>Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
<6>Calibrating delay loop... 402.43 BogoMIPS (lpj=201314)
<6>Brought up 2 CPUs
<6>net_namespace: 828 bytes
<6>NET: Registered protocol family 16
<4>Total Flash size: 8192K with 128 sectors
<4>Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00008e93-00008e80=19<300)
<4>registering PCI controller with io_map_base unset
<4>registering PCI controller with io_map_base unset
<4>bio: create slab <bio-0> at 0
<5>SCSI subsystem initialized
<6>usbcore: registered new interface driver usbfs
<6>usbcore: registered new interface driver hub
<6>usbcore: registered new device driver usb
<7>pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10013fff]
<7>pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x0007ff]
<7>pci 0000:00:00.0: supports D1 D2
<6>pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
<6>pci 0000:00:00.0: PME# disabled
<7>pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
<7>pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
<6>pci 0000:01:00.0: PME# supported from D0 D3hot
<6>pci 0000:01:00.0: PME# disabled
<6>pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
<6>pci 0000:01:00.0: IO window: disabled
<6>pci 0000:01:00.0: MEM window: disabled
<6>pci 0000:01:00.0: PREFETCH window: disabled
<7>PCI: Setting latency timer of device 0000:01:00.0 to 64
<4>BLOG v3.0 Initialized
<4>BLOG Rule v1.0 Initialized
<4>Broadcom IQoS v0.1 Jun 1 2012 11:38:18 initialized
<4>Broadcom GBPM v0.1 Jun 1 2012 11:38:19 initialized
<6>NET: Registered protocol family 8
<6>NET: Registered protocol family 20
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 2048 (order: 2, 16384 bytes)
<6>TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
<6>TCP: Hash tables configured (established 2048 bind 2048)
<6>TCP reno registered
<6>NET: Registered protocol family 1
<6>squashfs: version 4.0 (2009/01/31) Phillip Lougher
<6>squashfs: version 4.0 with LZMA457 ported by BRCM
<6>NTFS driver 2.1.29 [Flags: R/W].
<6>fuse init (API version 7.11)
<6>msgmni has been set to 116
<6>io scheduler noop registered (default)
<7>PCI: Setting latency timer of device 0000:01:00.0 to 64
<4>Driver 'sd' needs updating - please use bus_type methods
<6>PPP generic driver version 2.4.2
<6>PPP Deflate Compression module registered
<6>PPP BSD Compression module registered
<6>NET: Registered protocol family 24
<4>bcm963xx_mtd driver v1.0
<4>File system address: 0xb8010100
<6>ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
<4>PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
<7>PCI: Setting latency timer of device 0000:00:0a.0 to 64
<6>ehci_hcd 0000:00:0a.0: EHCI Host Controller
<6>ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
<4>ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
<6>ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
<6>ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
<6>usb usb1: configuration #1 chosen from 1 choice
<6>hub 1-0:1.0: USB hub found
<6>hub 1-0:1.0: 2 ports detected
<6>ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
<4>PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
<7>PCI: Setting latency timer of device 0000:00:09.0 to 64
<6>ohci_hcd 0000:00:09.0: OHCI Host Controller
<6>ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
<6>ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
<6>usb usb2: configuration #1 chosen from 1 choice
<6>hub 2-0:1.0: USB hub found
<6>hub 2-0:1.0: 2 ports detected
<6>usbcore: registered new interface driver usblp
<6>Initializing USB Mass Storage driver...
<6>usbcore: registered new interface driver usb-storage
<6>USB Mass Storage support registered.
<4>brcmboard: brcm_board_init entry
<4>SES: Button Interrupt 0x1 is enabled
<4>SES: LED GPIO 0xc00f is enabled
<4>PCIe: No device found - Powering down
<6>Serial: BCM63XX driver $Revision: 3.00 $
<6>Magic SysRq enabled (type ^ h for list of supported commands)
<6>ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
<6>ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
<4>bcmPktDma_init: Broadcom Packet DMA Library initialized
<4>Total # RxBds=1448
<4>bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
<4>
<4>bcmxtmrt: Broadcom BCM3168C0 ATM/PTM Network Device v0.4 Jun 1 2012 11:36:30
<4>p8021ag: p8021ag_init entry
<3>IPSEC SPU: SUCCEEDED
<4>GACT probability NOT on
<4>Mirror/redirect action on
<4>u32 classifier
<4> input device check on
<4> Actions configured
<6>TCP cubic registered
<6>Initializing XFRM netlink socket
<6>NET: Registered protocol family 17
<6>NET: Registered protocol family 15
<6>Initializing MCPD Module
<6>Ebtables v2.0 registered
<6>ebt_time registered
<6>ebt_ftos registered
<6>ebt_wmm_mark registered
<6>802.1Q VLAN Support v1.8 Ben Greear <greearb#candelatech.com>
<6>All bugs added by David S. Miller <davem#redhat.com>
<4>VFS: Mounted root (squashfs filesystem) readonly on device 31:0.
<6>Freeing unused kernel memory: 144k freed
<4>bcm_ingqos: module license 'Proprietary' taints kernel.
<4>Disabling lock debugging due to kernel taint
<4>Broadcom Ingress QoS Module Char Driver v0.1 Jun 5 2012 15:35:13 Registered<243>
<4>
<4>Broadcom Ingress QoS ver 0.1 initialized
<4>BPM: tot_mem_size=67108864B (64MB), buf_mem_size=10066329B (9MB), num of buffers=4802, buf size=2096
<4>Broadcom BPM Module Char Driver v0.1 Jun 1 2012 11:34:43 Registered<244>
<4>[NTC bpm] bpm_set_status: BPM status : enabled
<4>
<4>NBUFF v1.0 Initialized
<4>Initialized fcache state
<4>Broadcom Packet Flow Cache Char Driver v2.2 Jun 5 2012 11:35:15 Registered<242>
<4>Created Proc FS /procfs/fcache
<4>Broadcom Packet Flow Cache registered with netdev chain
<4>Broadcom Packet Flow Cache learning via BLOG enabled.
<4>Constructed Broadcom Packet Flow Cache v2.2 Jun 1 2012 11:35:15
<4>chipId 0x631670E0
<4>Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jun 5 2012 15:34:45 Registered <241>
<4>FAP Debug values at 0x00000010 0x00000010
<4>Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
<4>FAP Soft Reset Done
<4>4ke Reset Done
<4>Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
<4>FAP Soft Reset Done
<4>4ke Reset Done
<4>Allocated FAP0 GSO Buffers (0xA29FC688) : 1048576 bytes # 0xA2B00000
<4>Allocated FAP1 GSO Buffers (0xA2A1C688) : 1048576 bytes # 0xA2400000
<4>[NTC fapProto] fapReset : Reset FAP Protocol layer
<4>[FAP0] DSPRAM : stack <0x80000000><1024>, global <0x80000400><7088>, free <80>, total<8192>
<4>[FAP1] DSPRAM : stack <0x80000000><1024>, global <0x80000400><7088>, free <80>, total<8192>
<4>[FAP0] PSM : addr<0x80002000>, used <24496>, free <80>, total <24576>
<4>[FAP1] PSM : addr<0x80002000>, used <24496>, free <80>, total <24576>
<4>[FAP0] Flows supported: 376 (dsp 85, psm 107, qsm 184)
<4>[FAP1] Flows supported: 376 (dsp 85, psm 107, qsm 184)
<4>[FAP0] DQM : availableMemory 14324 bytes, nextByteAddress 0xE001080C
<4>[FAP1] DQM : availableMemory 14324 bytes, nextByteAddress 0xE001080C
<4>[FAP0] GSO Buffer set to 0xA2B00000
<4>[FAP1] GSO Buffer set to 0xA2400000
<4>[FAP0] FAP BPM Initialized.
<4>[FAP1] FAP BPM Initialized.
<4>bcmPktDma_bind: FAP Driver binding successfull
<4>bcmxtmcfg: bcmxtmcfg_init entry
<4>adsl: adsl_init entry
<4>Broadcom BCM63168C0 Ethernet Network Device v0.1 Jun 1 2012 11:36:11
<4>fapDrv_psmAlloc: fapIdx=0, size: 3600, offset=b08206f0 bytes remaining 7408
<4>ETH Init: Ch:0 - 180 tx BDs at 0xb08206f0
<4>fapDrv_psmAlloc: fapIdx=1, size: 3600, offset=b0a206f0 bytes remaining 7408
<4>ETH Init: Ch:1 - 180 tx BDs at 0xb0a206f0
<4>fapDrv_psmAlloc: wastage 8 bytes
<4>fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821500 bytes remaining 2592
<4>ETH Init: Ch:0 - 600 rx BDs at 0xb0821500
<4>fapDrv_psmAlloc: wastage 8 bytes
<4>fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21500 bytes remaining 2592
<4>ETH Init: Ch:1 - 600 rx BDs at 0xb0a21500
<4>dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
<4>eth0: MAC Address: AC:F1:DF:9D:43:71
<4>eth1: MAC Address: AC:F1:DF:9D:43:71
<4>eth2: MAC Address: AC:F1:DF:9D:43:71
<4>eth3: MAC Address: AC:F1:DF:9D:43:71
<4>[eth0, speed[100], Duplex[-1]]
<2>eth0 Link UP 100 mbps full duplex
<4>[eth1, speed[100], Duplex[-1]]
<2>eth1 Link UP 100 mbps full duplex
<4>[eth3, speed[100], Duplex[-1]]
<2>eth3 Link UP 100 mbps full duplex
<6>message received before monitor task is initialized kerSysSendtoMonitorTask
<4>Broadcom BCM3168C0 USB Network Device v0.4a Jun 1 2012 11:35:43
<4>usb0: MAC Address: AC F1 DF 9D 43 71
<4>usb0: Host MAC Address: AC F1 DF 9D 43 71
<3>hub 1-0:1.0: over-current change on port 2
<4>USBD Initialization done status 0
<4>USB Link DOWN.
<6>message received before monitor task is initialized kerSysSendtoMonitorTask
<4>[NTC arl] arlEnable : Enabled ARL binding to FAP
<4>Broadcom Adress Resolution Logic Processor (ARL) Char Driver v0.1 Jun 1 2012 11:34:42 Registered <245>
<4>--SMP support
<4>wl: dsl_tx_pkt_flush_len=338
<4>wl: high_wmark_tot=3121
<7>PCI: Setting latency timer of device 0000:00:00.0 to 64
<4>wl: passivemode=1
<4>wl: napimode=0
<4>wl0: allocskbmode=1 currallocskbsz=256
<4>otp_read_pci: bad crc
<4>Neither SPROM nor OTP has valid image
<4>wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
<4>wl:loading /etc/wlan/bcm6362_vars.bin
<4>Failed to open srom image from '/etc/wlan/bcm6362_vars.bin'.
<4>wl:loading /etc/wlan/bcm6362_map.bin
<4>wl0: Broadcom BCM435f 802.11 Wireless Controller 5.110.128.2018.cpe4.12L02.3
<4>dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
<6>Broadcom 802.1Q VLAN Interface, v0.1