Interesting kernel pointer value: 0xffffe001`9dec1980

Inspecting an IRP, I noticed the following:

kd> ?? _Irp->AssociatedIrp.SystemBuffer
void * 0xffffe001`9dec1980

Of course 9dec1980 is the date of John Lennon’s death. A few minutes of googling didn’t dredge up anything obvious relating this value to WDM. Is this a 0xdeadbeef variety of constant in use at Microsoft, or do I just have an overactive imagination?

Since I’m developing a DirectMusic driver, is this Windows’ way of warning me that my driver in imminent danger of assassination? /joke

Not a token bad value, it is a potentially valid pointer value

d

Bent from my phone


From: xxxxx@yahoo.commailto:xxxxx
Sent: ?5/?27/?2015 6:54 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] Interesting kernel pointer value: 0xffffe0019dec1980<br><br>Inspecting an IRP, I noticed the following:<br><br>kd&gt; ?? _Irp-&gt;AssociatedIrp.SystemBuffer<br>void * 0xffffe0019dec1980

Of course 9dec1980 is the date of John Lennon’s death. A few minutes of googling didn’t dredge up anything obvious relating this value to WDM. Is this a 0xdeadbeef variety of constant in use at Microsoft, or do I just have an overactive imagination?

Since I’m developing a DirectMusic driver, is this Windows’ way of warning me that my driver in imminent danger of assassination? /joke


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

> Of course 9dec1980 is the date of John Lennon’s death.

and

Since I’m developing a DirectMusic driver

Oh my God!

The post of the month :slight_smile: for sure :slight_smile:


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

> Oh my God! The post of the month :slight_smile: for sure :slight_smile:

Are you feeling jealous or what? You made your “record-breaking” posts on April 29, which means you are an “April nominee”. Today it is May 28. Therefore, if you want to kick the OP in the butt and get a May nomination instead of him you still have more than 3 days to go. Taking into consideration your “talents” in this particular domain, as well as your “expertize in the field”, I don’t think the OP may stand a slightest chance…

Anton Bassov

Uh oh. Somebody needs to take that stick from up their rear.

> Of course 9dec1980 is the date of John Lennon’s death.

It could have been just an incredible coincidence if we did not take into consideration the well-known fact that John Lennon was killed on Dec 8 and not on Dec 9 (according to Wikipedia, he was “pronounced dead on arrival at 11:07 pm.”) Never mind…

Anton Bassov

>> It could have been just an incredible coincidence if we did not take into

> consideration the well-known fact that John Lennon was killed on Dec 8 and not
> on Dec 9 (according to Wikipedia, he was “pronounced dead on arrival at 11:07
> pm.”) Never mind…

As I understand, Lennon’s time of death was after 11pm on the 8th in NYC, therefore it was already well into December 9th back at the Beatles’ home in Liverpool, or if you prefer Greenwich Mean Time. :stuck_out_tongue:

$insert_something_about_developing_drivers$

> As I understand, Lennon’s time of death was after 11pm on the 8th in NYC, therefore

it was already well into December 9th back at the Beatles’ home in Liverpool, or if you prefer >Greenwich Mean Time.

Well, I don’t know about you, but I prefer to rely upon the time coordinates of the system/place where events ACTUALLY occur…

$insert_something_about_developing_drivers$

OK, let me try…

Which time coordinates does your “DirectMusic driver” use when it deals with datastream that represents the Beatles music? Does it rely upon “Liverpool time” (i.e GMT or GMT+1, depending on the time of the year), or does it rely upon the system time that, in most cases, happens to be dependent on user’s current location?

Anton Bassov

With PortCls it seems there’s a IMasterClock pointer that is supplied to me whenever my miniport driver is supposed to instantiate a new stream, and I hang on to the clock reference to generate timestamps to attach to MIDI events. The timestamps seem to be LONGLONG 100ns integers of type REFERENCE_TIME, which per MSDN can either be relative to the start of playback or to some other baseline.

The really critical part here is the IMasterClock, which I think you’ll find supports my interpretation of the kernel easter egg… er… coincidence. Check out the reference on this:

http://goo.gl/ZjUuG2

>the kernel easter egg… er… coincidence.

Surely a coincidence, since the pointer looks valid and Irp->AssociatedIrp.SystemBuffer is also nearly (except blatant bugs) is valid.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

> The really critical part here is the IMasterClock, which I think you’ll find supports

my interpretation of the kernel easter egg… er… coincidence.

You cannot be saying it seriously, can you…

Anton Bassov

No, just having fun, and probably too much fun, since the term “easter egg” allegedly amounts to fighting words these days at MSFT.