Enable special pool explanation 0x000000c5 blue screen

Baidu: 0x000000c5. There are 26600 results. However, in the vast majority of results, no one has given a reasonable solution to the right. In my opinion, if you want to completely solve the problem after the blue screen occurs, you should not "try" various solutions, but use WinDbg as a tool to find the culprit.

 

First, let's take a look at what is the common 0x000000c5 crash.

 

The bug check with a value of 0x000000c5 is actually driver_0000upted_expool. What does it mean? This indicates that the system attempts to access invalid memory at an excessively high IRQL level. In the blue screen information, four parameters should be included in the brackets after 0x000000c5. The first parameter indicates the referenced memory address, and the second parameter indicates the IRQL level at the time of reference, the third parameter is either 0 or 1, 0 indicates reading, 1 indicates writing, and the last parameter indicates an address that references the memory.

 

So what causes the error?

 

The general cause of this problem is that a driver must have damaged the system memory pool. If the driver is damaged by a allocation unit smaller than the size of a page, the 0x000000c5 error is triggered. If the driver is damaged by a large area, the driver_0000upted_mmpool error is triggered, the value is 0x000000D0.

 

What should I do?

 

My suggestion is that you must enable the special pool! If we do not enable the special pool, we cannot get the real culprit.In addition, we recommend that you use a special pool for direct and hidden errors of this error.. I have not saved the 0x000000c5 memory dump, but there is a 0x100000C5 driver_0000upted_expool. The stack result is shown below:

 

 

We can see that,0x7c90e514It does not get the correct resolution, and I can tell you that its address is not a real value, but WinDbg guessed it based on the memory context. In this exampleDds adb6ad48Command.DdsCommand, only one Microsoft Company'sWin32k. sysFile, which is clearly not the culprit. To enable us to identify this killer driver, we have to use a special pool.

 

What is a special pool? What is the principle?

 

A special pool is a special memory pool. Once enabled, it seems that the system is deployed with 7x24 monitoring, staring at the driver may be the culprit. I will briefly explain the principle. by enabling a special memory pool, all drivers tested will use a special memory pool for buffer requests that are slightly smaller than the size of a page, instead of using a general page feed or non-Page Swap memory pool. The buffer allocated from the special memory pool is clamped between two invalid pages. Therefore, the system detects the overflow of a buffer smaller than the size of a page because it causes a page error in the invalid page after the buffer, that is, pagefault. Then, when the system crashes again, the error should be DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (0x000000d6). In this way, the file that cannot be debugged will be converted to a debugable dump file, if you are lucky, you can see that Windbg directly points out the driver that caused the crash.

 

How to enable special pools?

 

1. Run"Verifier.exe", You will see the" Driver verification program manager "wizard;

2. Select the second item-"create custom settings (for use by program developers)", and then click "Next ";

3. Select the second item-"select a single setting from a complete list" and click "Next ";

4. select only the check box before the first item -- "special pool" to go to the next step;

5. Select the third item -- "automatically select all drivers installed on this computer" and click "finish ";

6. restart the system.

 

After the system is restarted, the special pool will take effect. Next, you need to wait for the system to crash again and a blue screen will appear. The memory dump file generated after the blue screen can be found to be really fierce.

 

The aboveVerifier.exeIn the system, it is also included in the Windows Driver Kit. If you cannot find out the cause by enabling the special pool, use Debugging Tools for WindowsGFlagsThe tool enables special pools using pool tags and then tries again.

 

 

References:

1. Debugging Help in Debugging Tools for Windows

2. MSDN-Windows Driver Kit