tag:blogger.com,1999:blog-8870806323064576540.post356680575308100253..comments2024-03-29T03:18:36.316-04:00Comments on Debugging and reverse engineering: Another 9F example!Anonymoushttp://www.blogger.com/profile/15323083398160586642noreply@blogger.comBlogger2125tag:blogger.com,1999:blog-8870806323064576540.post-8579518249598430222017-08-25T05:34:30.151-04:002017-08-25T05:34:30.151-04:00STACK_TEXT:
ffffd001`d841b948 fffff802`c8059eda ...STACK_TEXT: <br />ffffd001`d841b948 fffff802`c8059eda : 00000000`0000009f 00000000`00000004 00000000`00000258 00000000`00000000 : nt!KeBugCheckEx<br />ffffd001`d841b950 fffff802`c82082b2 : ffffe001`00000000 ffffd001`00000000 ffffe001`09ba0300 ffffd001`00000000 : nt!PnpBugcheckPowerTimeout+0x6a<br />ffffd001`d841b9b0 fffff802`c7ef5b68 : 00000000`00000002 00000000`0026a65d 00000000`00000000 00000000`00000000 : nt!PopBuildDeviceNotifyListWatchdog+0x16<br />ffffd001`d841b9e0 fffff802`c7fd58ea : ffffd001`d83ef180 ffffd001`d83ef180 ffffd001`d83fb4c0 ffffe001`08f0e080 : nt!KiRetireDpcList+0x4f8<br />ffffd001`d841bc60 00000000`00000000 : ffffd001`d841c000 ffffd001`d8416000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a<br /><br />kd> dt ffffd001d841b980<br />Symbol not found at address ffffd001d841b980.<br />1: kd> !irp ffffd001d841b980<br />IRP signature does not match, probably not an IRP. Use any flag to force.<br /><br />kd> !poaction<br />Error reading PopAction<br /><br /><br />Allocated power irps (PopIrpList - fffff802c813d450)<br />Error resolving nt!_LIST_ENTRY...<br /><br /><br />Irp worker threads (PopIrpThreadList - fffff802c813c700)<br />Error resolving nt!_LIST_ENTRY...<br /><br /><br />Error resolving nt!_POP_CURRENT_BROADCAST...<br /><br /><br />1: kd> !wdfkd<br />No export wdfkd found<br />1: kd> !stacks<br />Proc.Thread .Thread Ticks ThreadState Blocker<br />Unable to get value of PsActiveProcessHead.Flink<br /><br />Threads Processed: 0<br />1: kd> dt nt!TRIAGE_9F_PNP on Win7 and higher<br />dtx is unsupported for this scenario. It only recognizes dtx [] [] with -a, -h, and -r. Reverting to dt.<br />Symbol nt!TRIAGE_9F_PNP not found.<br />1: kd> dt nt!TRIAGE_9F_PNP ffffd001d841b980<br />Symbol nt!TRIAGE_9F_PNP not found.<br /><br /><br />Could you possibly help please !!Avishekhttps://www.blogger.com/profile/13912349633919506569noreply@blogger.comtag:blogger.com,1999:blog-8870806323064576540.post-23689229312900024992017-08-25T05:33:44.940-04:002017-08-25T05:33:44.940-04:00Hi Thank you for this post, first of all i would l...Hi Thank you for this post, first of all i would like to thank you as your post's are really helpful. <br /><br />The thing that i would like to point out to you is i have a similar issue but unfortunately am not able get my head around it as cause the *.sys is not being depicted in KB. Sending over the dmp file analysis.<br />-----------------------------------<br /><br />DRIVER_POWER_STATE_FAILURE (9f)<br />A driver has failed to complete a power IRP within a specific time.<br />Arguments:<br />Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp<br /> subsystem.<br />Arg2: 0000000000000258, Timeout in seconds.<br />Arg3: 0000000000000000, The thread currently holding on to the Pnp lock.<br />Arg4: ffffd001d841b980, nt!TRIAGE_9F_PNP on Win7 and higher<br />Avishekhttps://www.blogger.com/profile/13912349633919506569noreply@blogger.com