I have recently experienced two system crashes (BSODs) on two different systems which are running BoxCryptor 1.0.0.0 with the bundled Dokan library 0.6.0.
The first crash was a few weeks ago on my main desktop system running Windows 7 Ultimate 64bit SP1. Then a second crash on my Dell laptop which is also running Windows 7 Ultimate 64bit SP1. I was simply going up a directory level when browsing files in my BoxCryptor mapped drive. Running windbg against both crash dumps implicates the Dokan.sys as the probable cause. Details below :
BugCheck A, {0, 2, 1, fffff80002eb9a6e}
*** ERROR: Module load completed but symbols could not be loaded for dokan.sys
PEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`7efdf018Processing initial command '!analyze -v;r;kv;lmtn;.logclose'
). Type ".hh dbgerr001" for details
Probably caused by : dokan.sys ( dokan+3918 ) << !!
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002eb9a6e, address which referenced memory
WRITE_ADDRESS: 0000000000000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExDeleteResourceLite+ce
fffff800`02eb9a6e 488908 mov qword ptr [rax],rcx
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: Dropbox.exe
TRAP_FRAME: fffff88002f0f770 -- (.trap 0xfffff88002f0f770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8006bf4060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002eb9a6e rsp=fffff88002f0f900 rbp=0000000000000001
r8=0000000000000000 r9=0000000000000000 r10=fffff80002e5f000
r11=000000000000025d r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExDeleteResourceLite+0xce:
fffff800`02eb9a6e 488908 mov qword ptr [rax],rcx ds:a9f0:0000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002edb1e9 to fffff80002edbc40
STACK_TEXT:
fffff88002f0f628 fffff80002edb1e9 : 000000000000000a 0000000000000000 0000000000000002 0000000000000001 : nt!KeBugCheckEx
fffff88002f0f630 fffff80002ed9e60 : 00000000accb6867 fffff80002ede8a4 fffffa8000000001 fffffa8006a5f3c8 : nt!KiBugCheckDispatch+0x69
fffff88002f0f770 fffff80002eb9a6e : 0000000000000001 fffff880075192df fffffa800a646b00 fffff88007519272 : nt!KiPageFault+0x260
fffff88002f0f900 fffff8800750e918 : fffffa8009e9d570 0000000000000001 fffffa800988b342 fffffa800988b342 : nt!ExDeleteResourceLite+0xce
fffff88002f0f960 fffff8800750f581 : fffffa8006a5f230 fffffa80090965f0 00000000000000aa fffffa80098caa00 : dokan+0x3918
fffff88002f0f9a0 fffff800031d838e : fffffa80098d7880 fffffa80090965f0 fffffa800a99eb30 fffffa80098d7880 : dokan+0x4581
fffff88002f0fa50 fffff80002ee5af4 : fffffa8009e9d570 fffffa800a99eb30 fffffa8006718080 000000000922ee60 : nt!IopDeleteFile+0x11e
fffff88002f0fae0 fffff800031d2f44 : fffffa800a99eb30 0000000000000000 fffffa8006bf4060 0000000000000000 : nt!ObfDereferenceObject+0xd4
fffff88002f0fb40 fffff800031d34f4 : 00000000000005f0 fffffa800a99eb30 fffff8a0024cd600 00000000000005f0 : nt!ObpCloseHandleTableEntry+0xc4
fffff88002f0fbd0 fffff80002edaed3 : fffffa8006bf4060 fffff88002f0fca0 000000007ee70000 fffffa800a5a6060 : nt!ObpCloseHandle+0x94
fffff88002f0fc20 0000000077c7140a : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x13
000000000922e808 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x77c7140a
STACK_COMMAND: kb
FOLLOWUP_IP:
dokan+3918
fffff880`0750e918 488b4c2440 mov rcx,qword ptr [rsp+40h]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: dokan+3918 << !!
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dokan
IMAGE_NAME: dokan.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d2b0059
FAILURE_BUCKET_ID: X64_0xA_dokan+3918
BUCKET_ID: X64_0xA_dokan+3918
Followup: MachineOwner
As you can see in the windbg output dokan.sys was on the stack at the time of the crash so this is the most likely culprit unless it was passed bad data from Boxcryptor or Dropbox for example.
Can this be looked into please? as I doubt this will be the last time I run into this and if I am seeing it on two completely different systems then other people must be seeing this also I'm guessing.
Many thanks,
Richard.
