EWF gives BSOD

  • Thread starter Thread starter Yaron Maor
  • Start date Start date
Y

Yaron Maor

Hi,

I've created a new build based on SP2. I used TAP on a WXPP-SP2 machine and
resolved all hardware related components I need.
the build runs fine and I get no errors.
when I later replace the standard NTLDR with the EWF NTLDR and add all the
EWF related components, I recieve a BSOD 0x7B
I configure the EWF to be RAM Registry based and I added the needed registry
values as described in the TD help.

what am I missing?

thanks in advanced,

YaronM
 
Yaron,
I later replace the standard NTLDR with the EWF NTLDR.
Click to expand...
You don't have to do this. RAM EWF do not have any connection to EWF NTLDR and you can use regular ntldr.
what am I missing?
Click to expand...
You must have accidentally deleted some registry value.

Like volsnap from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}.

Please give us export from offline registry of:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf

Also what happen if you remove ewf component?

Regards,
Slobodan
 
YaronM,

I wonder about [HKLM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}],"UpperFilters" of yours on the target.

Seems like the VolSnap and EWF are separated by a space characters. They should be two separate strings (replace 0x20 between the
words by 0x00).
 
Hi,

I've tried using the regular NTLDR (although TD complains about a the
dependency on EWF-NTLDR).
I also updated the UpperFilters to be on seperated strings.
still, I get BSOD 0x0000007B (0xF8876528, 0xC000000E, 0x0000000, 0x0000000)

thanks,

YaronM


KM said:
YaronM,

I wonder about
[HKLM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}],"UpperFilters"
of yours on the target.

Seems like the VolSnap and EWF are separated by a space characters. They
should be two separate strings (replace 0x20 between the
words by 0x00).

--
Regards,
KM, BSquare Corp.

Hi Slobodan,

I will try again using the standard NTLDR.
I attached a zip that contains exports of the Services\EWF and
Control\Class
from the offline registry hive.
at first look it seems fine but I must be missing something for sure.
If I remove the EWF components (EWF, EWF-API, EWF-Console tool, EWF
NTLDR)
the system boots normally without any problem.
the ewf TD settings are the default for protecting drive C: Disk-0,
Partition-1, IDE, RAM, Optimal.
I also added to the zip the component I created for the additional
EWF-RAM
registry keys.
just a thought, maybe I need to set that component a specific FBA-Phase
so
it won't be over-written?

Thanks for your help,

YaronM
Click to expand...
Click to expand...
 
Hi,

I've tried using Slobodan's EWF-Reg from SP1 instead of the new SP2 and it
works fine (no BSOD :)) )
I'm still unsure what causes my system to fail using the SP2 EWF..

thanks,

YaronM

Yaron Maor said:
Hi,

I've tried using the regular NTLDR (although TD complains about a the
dependency on EWF-NTLDR).
I also updated the UpperFilters to be on seperated strings.
still, I get BSOD 0x0000007B (0xF8876528, 0xC000000E, 0x0000000,
0x0000000)

thanks,

YaronM


KM said:
YaronM,

I wonder about
[HKLM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}],"UpperFilters"
of yours on the target.

Seems like the VolSnap and EWF are separated by a space characters. They
should be two separate strings (replace 0x20 between the
words by 0x00).

--
Regards,
KM, BSquare Corp.

Hi Slobodan,

I will try again using the standard NTLDR.
I attached a zip that contains exports of the Services\EWF and
Control\Class
from the offline registry hive.
at first look it seems fine but I must be missing something for sure.
If I remove the EWF components (EWF, EWF-API, EWF-Console tool, EWF
NTLDR)
the system boots normally without any problem.
the ewf TD settings are the default for protecting drive C: Disk-0,
Partition-1, IDE, RAM, Optimal.
I also added to the zip the component I created for the additional
EWF-RAM
registry keys.
just a thought, maybe I need to set that component a specific FBA-Phase
so
it won't be over-written?

Thanks for your help,

YaronM


Yaron,

I later replace the standard NTLDR with the EWF NTLDR.
You don't have to do this. RAM EWF do not have any connection to EWF
NTLDR
and you can use regular ntldr.

what am I missing?
You must have accidentally deleted some registry value.

Like volsnap from
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}.

Please give us export from offline registry of:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf

Also what happen if you remove ewf component?

Regards,
Slobodan


I've created a new build based on SP2. I used TAP on a WXPP-SP2
machine
and
resolved all hardware related components I need.
the build runs fine and I get no errors.
when I later replace the standard NTLDR with the EWF NTLDR and add
all
the
EWF related components, I recieve a BSOD 0x7B
I configure the EWF to be RAM Registry based and I added the needed
registry
values as described in the TD help.

what am I missing?

thanks in advanced,

YaronM
Click to expand...
Click to expand...
Click to expand...
 
Hi Yaron,

Interesting this is all that I can say.
Could you check date of ewf.sys that is copied to XPe image windows\system32\drivers ?
Also try overwriting it with SP2 ewf.sys in pre FBA image, and let us know if it works.

Regards,
Slobodan

YaronM said:
Hi,

I've tried using Slobodan's EWF-Reg from SP1 instead of the new SP2 and it
works fine (no BSOD :)) )
I'm still unsure what causes my system to fail using the SP2 EWF..

thanks,

YaronM

Yaron Maor said:
Hi,

I've tried using the regular NTLDR (although TD complains about a the
dependency on EWF-NTLDR).
I also updated the UpperFilters to be on seperated strings.
still, I get BSOD 0x0000007B (0xF8876528, 0xC000000E, 0x0000000,
0x0000000)

thanks,

YaronM


KM said:
YaronM,

I wonder about
[HKLM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}],"UpperFilters"
of yours on the target.

Seems like the VolSnap and EWF are separated by a space characters. They
should be two separate strings (replace 0x20 between the
words by 0x00).

--
Regards,
KM, BSquare Corp.


Hi Slobodan,

I will try again using the standard NTLDR.
I attached a zip that contains exports of the Services\EWF and
Control\Class
from the offline registry hive.
at first look it seems fine but I must be missing something for sure.
If I remove the EWF components (EWF, EWF-API, EWF-Console tool, EWF
NTLDR)
the system boots normally without any problem.
the ewf TD settings are the default for protecting drive C: Disk-0,
Partition-1, IDE, RAM, Optimal.
I also added to the zip the component I created for the additional
EWF-RAM
registry keys.
just a thought, maybe I need to set that component a specific FBA-Phase
so
it won't be over-written?

Thanks for your help,

YaronM


Yaron,

I later replace the standard NTLDR with the EWF NTLDR.
You don't have to do this. RAM EWF do not have any connection to EWF
NTLDR
and you can use regular ntldr.

what am I missing?
You must have accidentally deleted some registry value.

Like volsnap from
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}.

Please give us export from offline registry of:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf

Also what happen if you remove ewf component?

Regards,
Slobodan


I've created a new build based on SP2. I used TAP on a WXPP-SP2
machine
and
resolved all hardware related components I need.
the build runs fine and I get no errors.
when I later replace the standard NTLDR with the EWF NTLDR and add
all
the
EWF related components, I recieve a BSOD 0x7B
I configure the EWF to be RAM Registry based and I added the needed
registry
values as described in the TD help.

what am I missing?

thanks in advanced,

YaronM
Click to expand...
Click to expand...
Click to expand...
 
Hi Yaron. Thanks for posting about this issue. We're investigating issues
related to EWF, and we will post a reply to the newsgroup when we have a
solution. To help us investigate this, please submit a bug report at the
following page:
http://msdn.microsoft.com/embedded/community/community/feedback/feedxp/default.aspx -
please include as complete a description of your hardware and software
configuration as possible.

Thanks!

--
Matt Kellner ([email protected])
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no rights.
===============================
 
Back
Top