Author Topic: tracing AFINETK.SYS  (Read 400 times)

Lars

  • Hero Member
  • *****
  • Thank You
  • -Given: 1
  • -Receive: 76
  • Posts: 816
  • Karma: +23/-0
    • View Profile
tracing AFINETK.SYS
« on: November 14, 2020, 01:38:14 pm »
Fortunately, OS/2 provides some low level tools that allow tracing of arbitrary binaries, even if you don't have the source code.
I have now set up tracing for AFINETK.SYS for one of the more common traps that happens at EIP=xxxxx382.

What I can say is that the stack (I mean SS:ESP, not the TCPIP Stack) is being overwritten which leads to addresses to ethernet frames (where the frames memory is located in the MAC driver calling into AFINETK.SYS) being overwritten which eventually leads to a trap when accessing that address.
I am not yet clear of what driver is overwriting the stack: it's either AFINETK.SYS itself or the MAC driver that calls into AFINETK.SYS and that passes over that buffer address.
As I am currently working on FXWRAP.SYS, I'll try to add some logic to prevent the MAC from receiving interrupts during the time it calls into the protocol driver (AFINETK.SYS being the target, with FXWRAP.SYS being the "man in the middle"). Let's see if that reduces or eliminates the traps (when FXWRAP.SYS is active, if it is not, it will unfortunately be bypassed).
If it does, then that would be proof that the MAC driver is running into problems passing over ethernet frames during interrupt time and a new (frame receive) interrupt occuring while it is being busy doing that.