Guest User

Untitled

a guest
Mar 21st, 2021
74
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. i'm developing minfilter driver( Isolation and Shadow FileObject ). but, currently in IRP_MJ_CLEANUP leads to deadlock.
  2.  
  3. ------ windbg output
  4.  
  5. 0: kd> !locks
  6. **** DUMP OF ALL RESOURCE OBJECTS ****
  7. KD: Scanning for held
  8.  
  9. Resource @ 0xffff9b88c1c27d80 Exclusively owned
  10. Threads: ffff9b88beb24080-01<*>
  11.  
  12.  
  13. 0:kd> !stacks 2 imonfsd
  14.  
  15. [ffff9b88ba85d080 System]
  16. 4.000020 ffff9b88ba9d6140 00000ba READY nt!KiSwapContext+0x76
  17. nt!KiQuantumEnd+0x398
  18. nt!KiDispatchInterruptContinue+0x16
  19. nt!KiDpcInterrupt+0x2ee
  20. nt!MiUnlockWorkingSetShared+0xad
  21. nt!MiUserFault+0xf27
  22. nt!MmAccessFault+0x16a
  23. nt!KiPageFault+0x35e
  24. nt!ExpInterlockedPopEntrySListFault
  25. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  26. iMonFSDd!CreateIrpContext+0x9d
  27. iMonFSDd!FilterPreDisOwnClose+0x40
  28. iMonFSDd!FilterPreClose+0x77
  29. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  30. FLTMGR!FltpPassThroughInternal+0xc7
  31. FLTMGR!FltpPassThrough+0x1d6
  32. FLTMGR!FltpDispatch+0x8b
  33. nt!IofCallDriver+0x55
  34. nt!IopDeleteFile+0x13a
  35. nt!ObpRemoveObjectRoutine+0x80
  36. nt!ObfDereferenceObjectWithTag+0xc7
  37. nt!HalPutDmaAdapter+0xe
  38. nt!CcDeleteSharedCacheMap+0x19a
  39. nt!CcWriteBehindInternal+0x389
  40. nt!ExpWorkerThread+0x105
  41. nt!PspSystemThreadStartup+0x55
  42. nt!KiStartSystemThread+0x28
  43. 4.001ab0 ffff9b88c0f8c040 0000005 RUNNING nt!MiUserFault+0x620
  44. nt!MmAccessFault+0x16a
  45. nt!KiPageFault+0x35e
  46. nt!ExpInterlockedPopEntrySListFault
  47. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  48. iMonFSDd!CreateIrpContext+0x9d
  49. iMonFSDd!FilterPreDisOwnClose+0x40
  50. iMonFSDd!FilterPreClose+0x77
  51. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  52. FLTMGR!FltpPassThroughInternal+0xc7
  53. FLTMGR!FltpPassThrough+0x1d6
  54. FLTMGR!FltpDispatch+0x8b
  55. nt!IofCallDriver+0x55
  56. nt!IopDeleteFile+0x13a
  57. nt!ObpRemoveObjectRoutine+0x80
  58. nt!ObfDereferenceObjectWithTag+0xc7
  59. nt!HalPutDmaAdapter+0xe
  60. nt!CcDeleteSharedCacheMap+0x19a
  61. nt!CcWriteBehindInternal+0x389
  62. nt!CcWriteBehind+0x91
  63. nt!CcCachemapUninitWorkerThread+0xf1
  64. nt!ExpWorkerThread+0x105
  65. nt!PspSystemThreadStartup+0x55
  66. nt!KiStartSystemThread+0x28
  67. 4.0021b0 ffff9b88c1318080 00000a0 RUNNING nt!KeYieldProcessorEx+0xd
  68. nt!KxWaitForLockOwnerShip+0x2a
  69. nt!MiLockPageTableInternal+0x38f
  70. nt!MiUserFault+0x467
  71. nt!MmAccessFault+0x16a
  72. nt!KiPageFault+0x35e
  73. nt!ExpInterlockedPopEntrySListFault
  74. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  75. iMonFSDd!CreateIrpContext+0x9d
  76. iMonFSDd!CommonPreSetInformation+0x77
  77. iMonFSDd!FilterPreSetInformation+0x7c
  78. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  79. FLTMGR!FltpPassThroughInternal+0xc7
  80. FLTMGR!FltpPassThrough+0x1d6
  81. FLTMGR!FltpDispatch+0x8b
  82. nt!IofCallDriver+0x55
  83. nt!IopCallDriverReference+0xd0
  84. nt!NtSetInformationFile+0x514
  85. nt!KiSystemServiceCopyEnd+0x28
  86. nt!KiServiceLinkage
  87. nt!EtwpRealtimeSaveState+0x7c
  88. nt!EtwpLogger+0x453
  89. nt!PspSystemThreadStartup+0x55
  90. nt!KiStartSystemThread+0x28
  91. 4.002370 ffff9b88c1ecb040 00000ba READY nt!KiSwapContext+0x76
  92. nt!KiQuantumEnd+0x398
  93. nt!KiDispatchInterruptContinue+0x16
  94. nt!KiDpcInterrupt+0x2ee
  95. nt!MiUnlockWorkingSetShared+0xad
  96. nt!MiUserFault+0xf27
  97. nt!MmAccessFault+0x16a
  98. nt!KiPageFault+0x35e
  99. nt!ExpInterlockedPopEntrySListFault
  100. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  101. iMonFSDd!CreateIrpContext+0x9d
  102. iMonFSDd!FilterPreDisOwnClose+0x40
  103. iMonFSDd!FilterPreClose+0x77
  104. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  105. FLTMGR!FltpPassThroughInternal+0xc7
  106. FLTMGR!FltpPassThrough+0x1d6
  107. FLTMGR!FltpDispatch+0x8b
  108. nt!IofCallDriver+0x55
  109. nt!IopDeleteFile+0x13a
  110. nt!ObpRemoveObjectRoutine+0x80
  111. nt!ObfDereferenceObjectWithTag+0xc7
  112. nt!HalPutDmaAdapter+0xe
  113. nt!CcDeleteSharedCacheMap+0x19a
  114. nt!CcWriteBehindInternal+0x389
  115. nt!ExpWorkerThread+0x105
  116. nt!PspSystemThreadStartup+0x55
  117. nt!KiStartSystemThread+0x28
  118.  
  119. [ffff9b88bed06080 svchost.exe]
  120. 720.002380 ffff9b88c1762080 00000c9 READY nt!KxDispatchInterrupt+0x144
  121. nt!KiDpcInterrupt+0x2ee
  122. nt!MiUnlockWorkingSetShared+0xad
  123. nt!MiUserFault+0xf27
  124. nt!MmAccessFault+0x16a
  125. nt!KiPageFault+0x35e
  126. nt!ExpInterlockedPopEntrySListFault
  127. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  128. iMonFSDd!CreateIrpContext+0x9d
  129. iMonFSDd!CommonPreCreate+0x3a
  130. iMonFSDd!FilterPreCreate+0x95
  131. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  132. FLTMGR!FltpPassThroughInternal+0xc7
  133. FLTMGR!FltpCreate+0x310
  134. nt!IofCallDriver+0x55
  135. nt!IoCallDriverWithTracing+0x34
  136. nt!IopParseDevice+0x117d
  137. nt!ObpLookupObjectName+0x3fe
  138. nt!ObOpenObjectByNameEx+0x1fa
  139. nt!IopCreateFile+0x40f
  140. nt!NtCreateFile+0x79
  141. nt!KiSystemServiceCopyEnd+0x28
  142. ntdll!NtCreateFile+0x14
  143.  
  144. [ffff9b88c024a080 vmtoolsd.exe]
  145. d34.000f1c ffff9b88c03b8080 0000098 RUNNING nt!DbgBreakPointWithStatus
  146. kdnic!RxReceiveIndicateDpc+0x74
  147. nt!KiProcessExpiredTimerList+0x172
  148. nt!KiRetireDpcList+0x5dd
  149. nt!KxRetireDpcList+0x5
  150. nt!KiDispatchInterruptContinue
  151. nt!KiDpcInterrupt+0x2ee
  152. nt!MiUnlockWorkingSetShared+0xad
  153. nt!MiUserFault+0xf27
  154. nt!MmAccessFault+0x16a
  155. nt!KiPageFault+0x35e
  156. nt!ExpInterlockedPopEntrySListFault
  157. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  158. iMonFSDd!CreateIrpContext+0x9d
  159. iMonFSDd!CommonPreCreate+0x3a
  160. iMonFSDd!FilterPreCreate+0x95
  161. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  162. FLTMGR!FltpPassThroughInternal+0xc7
  163. FLTMGR!FltpCreate+0x310
  164. nt!IofCallDriver+0x55
  165. nt!IoCallDriverWithTracing+0x34
  166. nt!IopParseDevice+0x117d
  167. nt!ObpLookupObjectName+0x3fe
  168. nt!ObOpenObjectByNameEx+0x1fa
  169. nt!IopCreateFile+0x40f
  170. nt!NtOpenFile+0x58
  171. nt!KiSystemServiceCopyEnd+0x28
  172. ntdll!NtOpenFile+0x14
  173. +0x7ffb42fd0cfd
  174.  
  175. [ffff9b88ba991080 MsMpEng.exe]
  176. d70.001810 ffff9b88c0ef9040 00000d2 READY nt!KiSwapContext+0x76
  177. nt!KiQuantumEnd+0x398
  178. nt!KiDispatchInterruptContinue+0x16
  179. nt!KiDpcInterruptBypass+0x25
  180. nt!KiInterruptDispatchNoLockNoEtw+0xb1
  181. nt!KiPageFault+0x315
  182. nt!ExpInterlockedPopEntrySListFault
  183. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  184. iMonFSDd!CreateIrpContext+0x9d
  185. iMonFSDd!CommonPreCreate+0x3a
  186. iMonFSDd!FilterPreCreate+0x95
  187. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  188. FLTMGR!FltpPassThroughInternal+0xc7
  189. FLTMGR!FltpCreate+0x310
  190. nt!IofCallDriver+0x55
  191. nt!IoCallDriverWithTracing+0x34
  192. nt!IopParseDevice+0x117d
  193. nt!ObpLookupObjectName+0x3fe
  194. nt!ObOpenObjectByNameEx+0x1fa
  195. nt!IopCreateFile+0x40f
  196. nt!NtOpenFile+0x58
  197. nt!KiSystemServiceCopyEnd+0x28
  198. ntdll!NtOpenFile+0x14
  199.  
  200. [ffff9b88c0d5c080 taskhostw.exe]
  201. 1658.0016e0 ffff9b88c0d73080 00000c4 READY nt!KiSwapContext+0x76
  202. nt!KiQuantumEnd+0x398
  203. nt!KiDispatchInterruptContinue+0x16
  204. nt!KiDpcInterrupt+0x2ee
  205. nt!MiUnlockWorkingSetShared+0xad
  206. nt!MiUserFault+0xf27
  207. nt!MmAccessFault+0x16a
  208. nt!KiPageFault+0x35e
  209. nt!ExpInterlockedPopEntrySListFault
  210. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  211. iMonFSDd!CreateIrpContext+0x9d
  212. iMonFSDd!CommonPreCreate+0x3a
  213. iMonFSDd!FilterPreCreate+0x95
  214. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  215. FLTMGR!FltpPassThroughInternal+0xc7
  216. FLTMGR!FltpCreate+0x310
  217. nt!IofCallDriver+0x55
  218. nt!IoCallDriverWithTracing+0x34
  219. nt!IopParseDevice+0x117d
  220. nt!ObpLookupObjectName+0x3fe
  221. nt!ObOpenObjectByNameEx+0x1fa
  222. nt!IopCreateFile+0x40f
  223. nt!NtCreateFile+0x79
  224. nt!KiSystemServiceCopyEnd+0x28
  225. ntdll!NtCreateFile+0x14
  226.  
  227. [ffff9b88c0e8a080 explorer.exe]
  228. 574.000bf8 ffff9b88c0a7c080 0000093 READY nt!KiSwapContext+0x76
  229. nt!KiQuantumEnd+0x398
  230. nt!KiDispatchInterruptContinue+0x16
  231. nt!KiDpcInterrupt+0x2ee
  232. nt!MiUnlockWorkingSetShared+0xad
  233. nt!MiUserFault+0xf27
  234. nt!MmAccessFault+0x16a
  235. nt!KiPageFault+0x35e
  236. nt!ExpInterlockedPopEntrySListFault
  237. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  238. iMonFSDd!CreateIrpContext+0x9d
  239. iMonFSDd!CommonPreCreate+0x3a
  240. iMonFSDd!FilterPreCreate+0x95
  241. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  242. FLTMGR!FltpPassThroughInternal+0xc7
  243. FLTMGR!FltpCreate+0x310
  244. nt!IofCallDriver+0x55
  245. nt!IoCallDriverWithTracing+0x34
  246. nt!IopParseDevice+0x117d
  247. nt!ObpLookupObjectName+0x3fe
  248. nt!ObOpenObjectByNameEx+0x1fa
  249. nt!NtQueryAttributesFile+0x1c5
  250. nt!KiSystemServiceCopyEnd+0x28
  251. ntdll!NtQueryAttributesFile+0x14
  252. 574.001804 ffff9b88c0efa080 0000001 RUNNING nt!KiPageFault
  253. nt!ExpInterlockedPopEntrySListFault
  254. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  255. iMonFSDd!CreateIrpContext+0x9d
  256. iMonFSDd!CommonPreCreate+0x3a
  257. iMonFSDd!FilterPreCreate+0x95
  258. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  259. FLTMGR!FltpPassThroughInternal+0xc7
  260. FLTMGR!FltpCreate+0x310
  261. nt!IofCallDriver+0x55
  262. nt!IoCallDriverWithTracing+0x34
  263. nt!IopParseDevice+0x117d
  264. nt!ObpLookupObjectName+0x3fe
  265. nt!ObOpenObjectByNameEx+0x1fa
  266. nt!NtQueryAttributesFile+0x1c5
  267. nt!KiSystemServiceCopyEnd+0x28
  268. ntdll!NtQueryAttributesFile+0x14
  269. 574.001924 ffff9b88c10d5080 00000bf READY nt!KiSwapContext+0x76
  270. nt!KiQuantumEnd+0x398
  271. nt!KiDispatchInterruptContinue+0x16
  272. nt!KiDpcInterruptBypass+0x25
  273. nt!KiInterruptDispatchNoLockNoEtw+0xb1
  274. nt!KiPageFault+0x315
  275. nt!ExpInterlockedPopEntrySListFault
  276. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  277. iMonFSDd!CreateIrpContext+0x9d
  278. iMonFSDd!CommonPreCreate+0x3a
  279. iMonFSDd!FilterPreCreate+0x95
  280. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  281. FLTMGR!FltpPassThroughInternal+0xc7
  282. FLTMGR!FltpCreate+0x310
  283. nt!IofCallDriver+0x55
  284. nt!IoCallDriverWithTracing+0x34
  285. nt!IopParseDevice+0x117d
  286. nt!ObpLookupObjectName+0x3fe
  287. nt!ObOpenObjectByNameEx+0x1fa
  288. nt!NtQueryAttributesFile+0x1c5
  289. nt!KiSystemServiceCopyEnd+0x28
  290. ntdll!NtQueryAttributesFile+0x14
  291.  
  292. [ffff9b88c18020c0 SearchIndexer.]
  293. 1938.001da4 ffff9b88c17d30c0 00000d0 READY nt!KiSwapContext+0x76
  294. nt!KiQuantumEnd+0x398
  295. nt!KiDispatchInterruptContinue+0x16
  296. nt!KiDpcInterruptBypass+0x25
  297. nt!KiInterruptDispatchNoLockNoEtw+0xb1
  298. nt!KeContextFromKframes+0x164
  299. nt!KiDispatchException+0x127
  300. nt!KiExceptionDispatch+0x12c
  301. nt!KiPageFault+0x443
  302. nt!ExpInterlockedPopEntrySListFault
  303. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  304. iMonFSDd!CreateIrpContext+0x9d
  305. iMonFSDd!CommonPreCreate+0x3a
  306. iMonFSDd!FilterPreCreate+0x95
  307. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  308. FLTMGR!FltpPassThroughInternal+0xc7
  309. FLTMGR!FltpCreate+0x310
  310. nt!IofCallDriver+0x55
  311. nt!IoCallDriverWithTracing+0x34
  312. nt!IopParseDevice+0x117d
  313. nt!IopParseFile+0xc7
  314. nt!ObpLookupObjectName+0x3fe
  315. nt!ObOpenObjectByNameEx+0x1fa
  316. nt!IopCreateFile+0x40f
  317. nt!NtCreateFile+0x79
  318. nt!KiSystemServiceCopyEnd+0x28
  319. ntdll!NtCreateFile+0x14
  320.  
  321. [ffff9b88c1759080 vmtoolsd.exe]
  322. 2144.002148 ffff9b88be742080 00000bd READY nt!KiSwapContext+0x76
  323. nt!KiQuantumEnd+0x398
  324. nt!KiDispatchInterruptContinue+0x16
  325. nt!KiDpcInterruptBypass+0x25
  326. nt!KiInterruptDispatchNoLockNoEtw+0xb1
  327. nt!KeContextFromKframes+0x2cf
  328. nt!KiDispatchException+0x127
  329. nt!KiExceptionDispatch+0x12c
  330. nt!KiPageFault+0x443
  331. nt!ExpInterlockedPopEntrySListFault
  332. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  333. iMonFSDd!CreateIrpContext+0x9d
  334. iMonFSDd!CommonPreCreate+0x3a
  335. iMonFSDd!FilterPreCreate+0x95
  336. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  337. FLTMGR!FltpPassThroughInternal+0xc7
  338. FLTMGR!FltpCreate+0x310
  339. nt!IofCallDriver+0x55
  340. nt!IoCallDriverWithTracing+0x34
  341. nt!IopParseDevice+0x117d
  342. nt!ObpLookupObjectName+0x3fe
  343. nt!ObOpenObjectByNameEx+0x1fa
  344. nt!NtQueryAttributesFile+0x1c5
  345. nt!KiSystemServiceCopyEnd+0x28
  346. ntdll!NtQueryAttributesFile+0x14
  347.  
  348. [ffff9b88c20eb080 ADPClientServi]
  349. 5b4.002030 ffff9b88ba891400 00000d7 READY nt!KiSwapContext+0x76
  350. nt!KiQuantumEnd+0x398
  351. nt!KiDispatchInterruptContinue+0x16
  352. nt!KiDpcInterruptBypass+0x25
  353. nt!KiInterruptDispatchNoLockNoEtw+0xb1
  354. nt!KiPageFault+0x315
  355. nt!ExpInterlockedPopEntrySListFault
  356. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  357. iMonFSDd!CreateIrpContext+0x9d
  358. iMonFSDd!CommonPreCreate+0x3a
  359. iMonFSDd!FilterPreCreate+0x95
  360. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  361. FLTMGR!FltpPassThroughInternal+0xc7
  362. FLTMGR!FltpCreate+0x310
  363. nt!IofCallDriver+0x55
  364. nt!IoCallDriverWithTracing+0x34
  365. nt!IopParseDevice+0x117d
  366. nt!ObpLookupObjectName+0x3fe
  367. nt!ObOpenObjectByNameEx+0x1fa
  368. nt!NtQueryAttributesFile+0x1c5
  369. nt!KiSystemServiceCopyEnd+0x28
  370. ntdll!NtQueryAttributesFile+0x14
  371.  
  372. [ffff9b88c1eef080 iMonFTS-SVC.ex]
  373. 13cc.0013e8 ffff9b88c20da080 00000ca READY nt!KxDispatchInterrupt+0x144
  374. nt!KiDpcInterruptBypass+0x25
  375. nt!KiInterruptDispatch+0xb1
  376. nt!KeContextFromKframes+0x2f1
  377. nt!KiDispatchException+0x127
  378. nt!KiExceptionDispatch+0x12c
  379. nt!KiPageFault+0x443
  380. nt!ExpInterlockedPopEntrySListFault
  381. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  382. iMonFSDd!CreateIrpContext+0x9d
  383. iMonFSDd!FilterPreDisOwnCleanup+0x4e
  384. iMonFSDd!FilterPreCleanup+0x76
  385. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  386. FLTMGR!FltpPassThroughInternal+0xc7
  387. FLTMGR!FltpPassThrough+0x1d6
  388. FLTMGR!FltpDispatch+0x8b
  389. nt!IofCallDriver+0x55
  390. nt!IopCloseFile+0x17a
  391. nt!ObCloseHandleTableEntry+0x24c
  392. nt!NtClose+0xec
  393. nt!KiSystemServiceCopyEnd+0x28
  394. nt!KiServiceLinkage
  395. FLTMGR!FltpGetNormalizedFileNameWorker+0x261
  396. FLTMGR!FltpCreateFileNameInformation+0x2eb
  397. FLTMGR!HandleStreamListNotSupported+0x134
  398. FLTMGR!FltpGetFileNameInformation+0x5c4
  399. FLTMGR!FltGetFileNameInformation+0x101
  400. WdFilter+0x27565
  401. WdFilter+0x23ef0
  402. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  403. FLTMGR!FltpPassThroughInternal+0xc7
  404. FLTMGR!FltpCreate+0x310
  405. nt!IofCallDriver+0x55
  406. nt!IoCallDriverWithTracing+0x34
  407. nt!IopParseDevice+0x117d
  408. nt!ObpLookupObjectName+0x3fe
  409. nt!ObOpenObjectByNameEx+0x1fa
  410. nt!IopCreateFile+0x40f
  411. nt!NtCreateFile+0x79
  412. nt!KiSystemServiceCopyEnd+0x28
  413. ntdll!NtCreateFile+0x14
  414. 13cc.001d90 ffff9b88c16c5080 00000c7 READY nt!KxDispatchInterrupt+0x144
  415. nt!KiDpcInterrupt+0x2ee
  416. nt!ExpInterlockedPopEntrySListResume
  417. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  418. iMonFSDd!CreateIrpContext+0x9d
  419. iMonFSDd!FilterPreDisOwnCleanup+0x4e
  420. iMonFSDd!FilterPreCleanup+0x76
  421. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  422. FLTMGR!FltpPassThroughInternal+0xc7
  423. FLTMGR!FltpPassThrough+0x1d6
  424. FLTMGR!FltpDispatch+0x8b
  425. nt!IofCallDriver+0x55
  426. nt!IopCloseFile+0x17a
  427. nt!ObCloseHandleTableEntry+0x24c
  428. nt!NtClose+0xec
  429. nt!KiSystemServiceCopyEnd+0x28
  430. ntdll!NtClose+0x14
  431.  
  432. [ffff9b88c255b200 sppsvc.exe]
  433. c04.000744 ffff9b88ba99e080 00000c1 READY nt!KiSwapContext+0x76
  434. nt!KiQuantumEnd+0x398
  435. nt!KiDispatchInterruptContinue+0x16
  436. nt!KiDpcInterruptBypass+0x25
  437. nt!KiInterruptDispatchNoLockNoEtw+0xb1
  438. nt!KeContextToKframes+0x73
  439. nt!KiDispatchException+0x1a6
  440. nt!KiExceptionDispatch+0x12c
  441. nt!KiPageFault+0x443
  442. nt!ExpInterlockedPopEntrySListFault
  443. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  444. iMonFSDd!CreateIrpContext+0x9d
  445. iMonFSDd!CommonPreCreate+0x3a
  446. iMonFSDd!FilterPreCreate+0x95
  447. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  448. FLTMGR!FltpPassThroughInternal+0xc7
  449. FLTMGR!FltpCreate+0x310
  450. nt!IofCallDriver+0x55
  451. nt!IoCallDriverWithTracing+0x34
  452. nt!IopParseDevice+0x117d
  453. nt!ObpLookupObjectName+0x3fe
  454. nt!ObOpenObjectByNameEx+0x1fa
  455. nt!NtQueryAttributesFile+0x1c5
  456. nt!KiSystemServiceCopyEnd+0x28
  457. ntdll!NtQueryAttributesFile+0x14
  458.  
  459. [ffff9b88c1f1f080 EXCEL.EXE]
  460. 21e0.0001c4 ffff9b88bedb0080 00000bc READY nt!KxDispatchInterrupt+0x144
  461. nt!KiDpcInterrupt+0x2ee
  462. nt!KeContextToKframes+0x68
  463. nt!KiDispatchException+0x1a6
  464. nt!KiExceptionDispatch+0x12c
  465. nt!KiPageFault+0x443
  466. nt!ExpInterlockedPopEntrySListFault
  467. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  468. iMonFSDd!CommonPreCleanup+0x43
  469. iMonFSDd!FilterPreCleanup+0xe5
  470. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  471. FLTMGR!FltpPassThroughInternal+0xc7
  472. FLTMGR!FltpPassThrough+0x1d6
  473. FLTMGR!FltpDispatch+0x8b
  474. nt!IofCallDriver+0x55
  475. nt!IopCloseFile+0x17a
  476. nt!ObCloseHandleTableEntry+0x24c
  477. nt!NtClose+0xec
  478. nt!KiSystemServiceCopyEnd+0x28
  479. ntdll!NtClose+0x14
  480.  
  481. [ffff9b88c24f3080 dllhost.exe]
  482. 150c.00167c ffff9b88c1571080 00000d4 READY nt!KiSwapContext+0x76
  483. nt!KiQuantumEnd+0x398
  484. nt!KiDispatchInterruptContinue+0x16
  485. nt!KiDpcInterruptBypass+0x25
  486. nt!KiInterruptDispatchNoLockNoEtw+0xb1
  487. nt!KeContextFromKframes+0x2f1
  488. nt!KiDispatchException+0x127
  489. nt!KiExceptionDispatch+0x12c
  490. nt!KiPageFault+0x443
  491. nt!ExpInterlockedPopEntrySListFault
  492. iMonFSDd!ExAllocateFromNPagedLookasideList+0x29
  493. iMonFSDd!CreateIrpContext+0x9d
  494. iMonFSDd!FilterPreDisOwnCleanup+0x4e
  495. iMonFSDd!FilterPreCleanup+0x76
  496. FLTMGR!FltpPerformPreCallbacksWorker+0x36b
  497. FLTMGR!FltpPassThroughInternal+0xc7
  498. FLTMGR!FltpPassThrough+0x1d6
  499. FLTMGR!FltpDispatch+0x8b
  500. nt!IofCallDriver+0x55
  501. nt!IopCloseFile+0x17a
  502. nt!ObCloseHandleTableEntry+0x24c
  503. nt!ExSweepHandleTable+0xd5
  504. nt!ObKillProcess+0x35
  505. nt!PspRundownSingleProcess+0x204
  506. nt!PspExitThread+0x5f6
  507. nt!KiSchedulerApcTerminate+0x38
  508. nt!KiDeliverApc+0x487
  509. nt!KiInitiateUserApc+0x70
  510. nt!KiSystemServiceExit+0x9f
  511. ntdll!NtWaitForWorkViaWorkerFactory+0x14
  512.  
RAW Paste Data