Windows Driver Kit: Driver Development Tools
Bug Check 0x5: INVALID_PROCESS_ATTACH_ATTEMPT
The INVALID_PROCESS_ATTACH_ATTEMPT bug check has a value of 0x00000005. This generally indicates that the thread was attached to a process in a situation where that is not allowed. For example, this bug check could occur if KeAttachProcess was called when the thread was already attached to a process (which is illegal), or if the thread returned from certain function calls in an attached state (which is invalid),
This bug check appears very infrequently.
Parameters
The following parameters are displayed on the blue screen.
| Parameter | Description |
|---|
| 1 | The pointer to the dispatcher object for the target process, or if the thread is already attached, the pointer to the object for the original process. |
| 2 | The pointer to the dispatcher object of the process that the current thread is currently attached to. |
| 3 | The value of the thread’s APC state index. |
| 4 | A non-zero value indicates that a DPC is running on the current processor. |
Comment
This bug check can occur if the driver calls the KeAttachProcess function and the thread is already attached to another process. It is better to use the KeStackAttachProcess function. If the current thread was already attached to another process, the KeStackAttachProcess function saves the current APC state before it attaches the current thread to the new process.