Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Monthly Seminars at OSR Headquarters

East Coast USA
Windows Internals and SW Drivers, Dulles (Sterling) VA, 9 April 2018

Writing WDF Drivers I: Core Concepts, Manchester, NH, 7 May 2018

Kernel Debugging & Crash Analysis for Windows, Manchester, NH, 21 May 2018


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 2  
12 Jan 18 11:23
Nathan Kidd
xxxxxx@spicycrypto.ca
Join Date: 12 Oct 2017
Posts To This List: 7
LastError becomes ERROR_NO_MEMORY after (apparently successful) syscall?

On Win2012R2 I have a winlogon.exe thread that calls CreateWindowStation(). USERMODE: break at user32!NtUserCreateWindowStation USERMODE: !gle: 0 USERMODE: step over syscall for NtUserCreateWindowStation KERNMODE: break at win32k!NtUserCreateWindowStation KERNMODE: !gle: 0 KERNMODE: step out of win32k!NtUserCreateWindowStation KERNMODE: !gle: 0 USERMODE: break on instruction after syscall (ret) USERMODE: !gle: 8 (ERROR_NO_MEMORY) > LastErrorValue: (Win32) 0x8 (8) - Not enough storage is available to process this command. > LastStatusValue: (NTSTATUS) 0xc0000017 - {Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation. Can anyone give a pointer or otherwise shed light on how or where this error occurs? My goal is to figure out why the call fails, but I don't understand where it comes from. Thanks! -Nathan
  Message 2 of 2  
16 Jan 18 18:53
Nathan Kidd
xxxxxx@spicycrypto.ca
Join Date: 12 Oct 2017
Posts To This List: 7
LastError becomes ERROR_NO_MEMORY after (apparently successful) syscall?

On 12/01/18 11:22 AM, xxxxx@spicycrypto.ca wrote: > On Win2012R2 I have a winlogon.exe thread that calls CreateWindowStation(). > > USERMODE: break at user32!NtUserCreateWindowStation > USERMODE: !gle: 0 > USERMODE: step over syscall for NtUserCreateWindowStation > > KERNMODE: break at win32k!NtUserCreateWindowStation > KERNMODE: !gle: 0 > KERNMODE: step out of win32k!NtUserCreateWindowStation > KERNMODE: !gle: 0 <...excess quoted lines suppressed...> Answer: !gle isn't strictly reliable in kernel mode. Instead break on win32k!UserSetLastError and look at rcx. (Which, curiously, may cause !gle to return the expected error value.) -Nathan
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 06:23.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license