Escape From The Troubles : Debugginghttp://blogs.technet.com/escape/archive/tags/Debugging/default.aspxTags: Debuggingen-USCommunityServer 2.1 SP1 (Build: 61025.2)Bugcheck BAD_POOL_HEADER (19)http://blogs.technet.com/escape/archive/2009/06/12/bugcheck-bad-pool-header-19.aspxFri, 12 Jun 2009 10:10:00 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3253816escapetrouble0http://blogs.technet.com/escape/comments/3253816.aspxhttp://blogs.technet.com/escape/commentrss.aspx?PostID=3253816<P>Buggy kernel mode 드라이버에 의해서 블루스크린 Bugcheck BAD_POOL_HEADER (19) 가 발생한 사례입니다.&nbsp;이 오류는 커널 모드 드라이버에서 자신이 할당 받은 pool 블록보다 더 많은 데이터를 write하여 next pool 블록의 헤더가 손상된 경우입니다. User mode에서 heap 메모리 손상과 마찬가지로 Kernel mode에서 pool 메모리의 손상은 메모리가 손상된 시점에 시스템이 crash되지 않고, ExFreePool 등이 실행될 때, 메모리 손상을 감지하고 시스템이 crash 됩니다.</P> <P>kd&gt; !analyze -v<BR>*******************************************************************************<BR>*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<BR>*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Bugcheck Analysis&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<BR>*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<BR>*******************************************************************************</P> <P>BAD_POOL_HEADER (19)<BR>The pool is already corrupt at the time of the current request.<BR>This may or may not be due to the caller.<BR>The internal pool links must be walked to figure out a possible cause of<BR>the problem, and then special pool applied to the suspect tags or the driver<BR>verifier to a suspect driver.<BR>Arguments:<BR>Arg1: 00000020, a pool block header size is corrupt.<BR>Arg2: 82fd27c8, The pool entry we were looking for within the page.<BR>Arg3: 82fd27f0, The next pool entry.<BR>Arg4: 0a050008, (reserved)</P> <P>kd&gt; kbL<BR>ChildEBP RetAddr&nbsp; Args to Child&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <BR>f8ae3540 80532f7e 00000003 82fe72b0 82fd27c8 nt!KiBugCheckDebugBreak+0x19<BR>f8ae3920 8053356e 00000019 00000020 82fd27c8 nt!KeBugCheck2+0x574<BR>f8ae3940 8054b9c1 00000019 00000020 82fd27c8 nt!KeBugCheckEx+0x1b<BR>f8ae3990 8054b339 82fd27d0 00000000 f8ae39c0 nt!ExFreePoolWithTag+0x2be<BR>f8ae39a0 f894a743 82fd27d0 0000001b 82fd27d0 nt!ExFreePool+0xf<BR>f8ae39c0 f894c01f f894d860 82fe72b0 82e8b2e8 Wolf!WolfEventMessageA+0xa3<BR>...<BR>00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16</P> <P>kd&gt; !pool 82fd27c8 2<BR>Pool page 82fd27c8 region is Nonpaged pool<BR>*82fd27c8 size:&nbsp;&nbsp; 28 previous size:&nbsp;&nbsp; 40&nbsp; (Allocated) *None<BR>&nbsp;&nbsp;Pooltag None : call to ExAllocatePool<BR>82fd27f0 is not a valid small pool allocation, checking large pool...</P> <P>kd&gt; dc 82fd27c8<BR>82fd27c8&nbsp; 0a050008 656e6f4e 006f0057 0066006c&nbsp; ....NoneW.o.l.f.<BR>82fd27d8&nbsp; 00730020 00610074 00740072 00640065&nbsp;&nbsp; .s.t.a.r.t.e.d.<BR>82fd27e8&nbsp; 00740020 0020006f 00640061 00200064&nbsp;&nbsp; .t.o. .a.d.d. .</P> <P>kd&gt; dc 82fd27f0<BR>82fd27f0&nbsp; 00640061 00200064 00650064 00690076&nbsp; a.d.d. .d.e.v.i.<BR>82fd2800&nbsp; 00650063 00000000 00000000 00000000&nbsp; c.e.............</P> <P>Pool buffer overrun</P> <P>kd&gt; dt nt!_POOL_HEADER 82fd27c8<BR>&nbsp;&nbsp; +0x000 PreviousSize&nbsp;&nbsp;&nbsp;&nbsp; : 0y000001000 (0x8)<BR>&nbsp;&nbsp; +0x000 PoolIndex&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0y0000000 (0)<BR>&nbsp;&nbsp; +0x002 BlockSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0y000000101 (0x5)<BR>&nbsp;&nbsp; +0x002 PoolType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0y0000101 (0x5)<BR>&nbsp;&nbsp; +0x000 Ulong1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0xa050008<BR>&nbsp;&nbsp; +0x004 ProcessBilled&nbsp;&nbsp;&nbsp; : 0x656e6f4e _EPROCESS<BR>&nbsp;&nbsp; +0x004 PoolTag&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x656e6f4e<BR>&nbsp;&nbsp; +0x004 AllocatorBackTraceIndex : 0x6f4e<BR>&nbsp;&nbsp; +0x006 PoolTagHash&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x656e</P> <P>kd&gt; dt nt!_POOL_HEADER 82fd27f0<BR>&nbsp;&nbsp; +0x000 PreviousSize&nbsp;&nbsp;&nbsp;&nbsp; : 0y001100001 (0x61)&nbsp;=&gt; It should be 0x5<BR>&nbsp;&nbsp; +0x000 PoolIndex&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0y0000000 (0)<BR>&nbsp;&nbsp; +0x002 BlockSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0y001100100 (0x64)<BR>&nbsp;&nbsp; +0x002 PoolType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0y0000000 (0)<BR>&nbsp;&nbsp; +0x000 Ulong1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x640061<BR>&nbsp;&nbsp; +0x004 ProcessBilled&nbsp;&nbsp;&nbsp; : 0x00200064 _EPROCESS<BR>&nbsp;&nbsp; +0x004 PoolTag&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x200064<BR>&nbsp;&nbsp; +0x004 AllocatorBackTraceIndex : 0x64<BR>&nbsp;&nbsp; +0x006 PoolTagHash&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x20<BR></P> <P>대부분의 경우, pool buffer overrun이 발생한&nbsp;pool block을&nbsp;사용한 드라이버가&nbsp;문제를 일으킨 것으로 판단할 수 있습니다.&nbsp;따라서 위&nbsp;crash에서는 Wolf 드라이버가 pool buffer overrun을 유발시켰다고&nbsp;결론을 내릴 수 있습니다.&nbsp;좀 더 정확하게 pool block이 손상된 바로 그 시점을 잡아내기 위해서는 special pool 기능을 이용할 수 있습니다. 디버깅을 위하여 Special pool 을 활성화시키는 방법은&nbsp;아래 KB 문서에 자세히 설명되어 있습니다.</P> <P>How to use the special pool feature to isolate pool damage (<A href="http://support.microsoft.com/?id=188831">http://support.microsoft.com/?id=188831</A>)&nbsp;</P><img src="http://blogs.technet.com/aggbug.aspx?PostID=3253816" width="1" height="1">Debugging