Intel Turbo Memory Drivers BUG!

Few weeks ago I bought two modules of Intel Turbo Memory (ITM) for my laptop Asus G2S-A1, installed it without any problems, then downloaded latest version(1.1.0.1010) of ITM drivers. And tried to install for a few minutes everything was looking ok, driver was successfully installed for first 1Gb ITM module and then Windows tried to install drivers for second ITM module(also 1Gb) . I was very angry when figured out that drivers was NOT designed for simultaneous work with two installed ITM modules. So how I figured it out. I started analization from crash dump( it can be found at c:\Windows\Minidump\Mini%DATE%-%CrashDumpNumber%.dmp, in my case it was Mini101807-01.dmp ), so I opened my dump with WinDbg( can be downloaded from microsoft web site, it’s free :)

And what I have found there, driver “Probably caused by : iaNvStor.sys ( iaNvStor+44e7 )” tried to access to unavailable memory, and memory access violation exception was occured at address iaNvStor+44e7 “BugCheck 1000007E, {c0000005, a6b494e7, 830e3830, 830e352c}”

Here is the detailed crash dump log:

FAULTING_MODULE: 81c00000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 46929a5f

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:

iaNvStor+44e7

a6b494e7 8b8664010000 mov eax,dword ptr [esi+164h]

EXCEPTION_RECORD: 830e3830 -- (.exr 0xffffffff830e3830)

ExceptionAddress: a6b494e7 (iaNvStor+0x000044e7)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 00000164

Attempt to read from address 00000164

CONTEXT: 830e352c -- (.cxr 0xffffffff830e352c)

eax=c0000035 ebx=00000000 ecx=0000bb40 edx=85065d00 esi=00000000 edi=c0000035

eip=a6b494e7 esp=830e38f8 ebp=000026b8 iopl=0 nv up ei ng nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286

iaNvStor+0x44e7:

a6b494e7 8b8664010000 mov eax,dword ptr [esi+164h] ds:0023:00000164=????????

Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 81c849f3 to a6b494e7

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

830e38f4 81c849f3 af7ef008 854705a8 8579d001 iaNvStor+0x44e7

830e38f8 af7ef008 854705a8 8579d001 00000000 nt+0x849f3

830e38fc 854705a8 8579d001 00000000 00000f98 0xaf7ef008

830e3900 8579d001 00000000 00000f98 af7ef008 0x854705a8

830e3904 00000000 00000f98 af7ef008 830e39b8 0x8579d001

FOLLOWUP_IP:

iaNvStor+44e7

a6b494e7 8b8664010000 mov eax,dword ptr [esi+164h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: iaNvStor+44e7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: iaNvStor

IMAGE_NAME: iaNvStor.sys

STACK_COMMAND: .cxr 0xffffffff830e352c ; kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

So two registers (EAX and EDI) contains some 0xC0000035 Kernel status code, such codes returned by Native APIs, so I searched the WDK( Windows Driver Kit ), this code means “STATUS_OBJECT_NAME_COLLISION”, then I understood that driver trying to create or register the device with the same same and looks like Intel developers didn’t handle this in driver. But it was only my theory, so I disassembled the driver and checked my theory.

As we can see on screenshot, driver trying to register the device in system and set some device state, and moves the result code to EDI register thats explains why we got that error code in EAX and EDI registers.

Weird thing why the ESI register is zero when we got that error, since ESI was not used anywhere in driver code, and there is the rule that EBX, EDI, ESI and EBP registers shouldn’t be changed if we calling some API.

I already reported about this bug, so let’s hope Intel will fix this issue, and will release the driver update for it. Otherwise at least they should mention about that at their site, that you can’t install more than one ITM module.

I hope you liked my post, sorry if something is unclear english isn’t my native language J

With best regards,

int0.