Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030811-32734-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a66000 PsLoadedModuleList = 0xfffff800`02ca3e50
Debug session time: Tue Mar 8 10:05:31.077 2011 (UTC - 5:00)
System Uptime: 0 days 0:00:57.983
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {dc, 2, 1, fffff80002ab2055}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000000dc, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ab2055, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0e0e0
00000000000000dc
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeStackAttachProcess+115
fffff800`02ab2055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff88002dc08b0 -- (.trap 0xfffff88002dc08b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=fffffa80018fe0a0
rdx=fffff88002dc0b98 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ab2055 rsp=fffff88002dc0a40 rbp=fffff88002dc0b98
r8=fffffa80018fe090 r9=0000000000000130 r10=fffff80002a66000
r11=fffffa80018fe040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x115:
fffff800`02ab2055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax ds:6dd0:00000000`000000dc=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ad5ca9 to fffff80002ad6740
STACK_TEXT:
fffff880`02dc0768 fffff800`02ad5ca9 : 00000000`0000000a 00000000`000000dc 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02dc0770 fffff800`02ad4920 : 00000000`00000225 fffffa80`018fe040 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`02dc08b0 fffff800`02ab2055 : 00000000`00000000 fffffa80`018fe040 fffffa80`018fe040 fffff800`02dab223 : nt!KiPageFault+0x260
fffff880`02dc0a40 fffffa80`027d4a90 : fffff880`02dc0bc0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeStackAttachProcess+0x115
fffff880`02dc0ac0 fffff880`02dc0bc0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`027d4a90
fffff880`02dc0ac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`02dc0bc0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+115
fffff800`02ab2055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeStackAttachProcess+115
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030811-17375-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a68000 PsLoadedModuleList = 0xfffff800`02ca5e50
Debug session time: Tue Mar 8 10:56:07.420 2011 (UTC - 5:00)
System Uptime: 0 days 0:06:05.327
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80002dd072a, 1, 18}
Probably caused by : ntkrnlmp.exe ( nt!ObpCreateHandle+29a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002dd072a, The address that the exception occurred at
Arg3: 0000000000000001, Parameter 0 of the exception
Arg4: 0000000000000018, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObpCreateHandle+29a
fffff800`02dd072a f0480fba6f1800 lock bts qword ptr [rdi+18h],0
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000018
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d100e0
0000000000000018
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: msseces.exe
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff88002fc72a8 -- (.exr 0xfffff88002fc72a8)
ExceptionAddress: fffff80002dd072a (nt!ObpCreateHandle+0x000000000000029a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000018
Attempt to write to address 0000000000000018
TRAP_FRAME: fffff88002fc7350 -- (.trap 0xfffff88002fc7350)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8001901b60
rdx=00000000000f001f rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002dd072a rsp=fffff88002fc74e0 rbp=0000000000000000
r8=fffff8a003a22bb0 r9=00000000000000e8 r10=0000000000000000
r11=fffff8a003a22b60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po nc
nt!ObpCreateHandle+0x29a:
fffff800`02dd072a f0480fba6f1800 lock bts qword ptr [rdi+18h],0 ds:00000000`00000018=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002b12a39 to fffff80002ad8740
STACK_TEXT:
fffff880`02fc6ad8 fffff800`02b12a39 : 00000000`0000001e ffffffff`c0000005 fffff800`02dd072a 00000000`00000001 : nt!KeBugCheckEx
fffff880`02fc6ae0 fffff800`02ad7d82 : fffff880`02fc72a8 00000000`00000000 fffff880`02fc7350 fffffa80`01901b60 : nt!KiDispatchException+0x1b9
fffff880`02fc7170 fffff800`02ad68fa : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`02fc7350 fffff800`02dd072a : 00000000`00000000 fffff880`02fc7530 fffffa80`01bfd060 fffff8a0`03a22bb0 : nt!KiPageFault+0x23a
fffff880`02fc74e0 fffff800`02dc922c : 00000000`00000000 fffff8a0`03a22bb0 00000000`000f001f fffff8a0`03ce0500 : nt!ObpCreateHandle+0x29a
fffff880`02fc75f0 fffff800`02dc90a0 : fffffa80`01c24310 fffff880`02fc79a0 fffffa80`01c7c780 00000000`08000000 : nt!ObInsertObjectEx+0xec
fffff880`02fc7830 fffff800`02ad7993 : fffffa80`01901b60 fffff880`02fc7ad8 fffff880`02fc78c8 fffffa80`01b946f0 : nt!NtCreateSection+0x1ef
fffff880`02fc78b0 fffff800`02ad3f30 : fffffa80`027f2b66 fffff880`02fc7bc0 00000000`00000000 fffffa80`027f7260 : nt!KiSystemServiceCopyEnd+0x13
fffff880`02fc7ab8 fffffa80`027f2b66 : fffff880`02fc7bc0 00000000`00000000 fffffa80`027f7260 fffffa80`027fb5b0 : nt!KiServiceLinkage
fffff880`02fc7ac0 fffff880`02fc7bc0 : 00000000`00000000 fffffa80`027f7260 fffffa80`027fb5b0 fffffa80`00000002 : 0xfffffa80`027f2b66
fffff880`02fc7ac8 00000000`00000000 : fffffa80`027f7260 fffffa80`027fb5b0 fffffa80`00000002 00000000`08000000 : 0xfffff880`02fc7bc0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObpCreateHandle+29a
fffff800`02dd072a f0480fba6f1800 lock bts qword ptr [rdi+18h],0
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!ObpCreateHandle+29a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!ObpCreateHandle+29a
BUCKET_ID: X64_0x1E_c0000005_nt!ObpCreateHandle+29a
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030811-18906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a13000 PsLoadedModuleList = 0xfffff800`02c50e50
Debug session time: Tue Mar 8 10:58:21.941 2011 (UTC - 5:00)
System Uptime: 0 days 0:00:50.847
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {600dd, 2, 1, fffff80002a5f055}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000600dd, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a5f055, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cbb0e0
00000000000600dd
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeStackAttachProcess+115
fffff800`02a5f055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff88002fb98b0 -- (.trap 0xfffff88002fb98b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=fffffa80019026e0
rdx=fffff88002fb9b98 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a5f055 rsp=fffff88002fb9a40 rbp=fffff88002fb9b98
r8=fffffa80019026d0 r9=0000000000000130 r10=fffff80002a13000
r11=fffffa8001902680 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x115:
fffff800`02a5f055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax ds:74e0:00000000`000000dc=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002a82ca9 to fffff80002a83740
STACK_TEXT:
fffff880`02fb9768 fffff800`02a82ca9 : 00000000`0000000a 00000000`000600dd 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02fb9770 fffff800`02a81920 : 00000000`00000225 fffffa80`01902680 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`02fb98b0 fffff800`02a5f055 : 00000000`00000000 fffffa80`01902680 fffffa80`01902680 fffff800`02d58223 : nt!KiPageFault+0x260
fffff880`02fb9a40 fffffa80`027d7a90 : fffff880`02fb9bc0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeStackAttachProcess+0x115
fffff880`02fb9ac0 fffff880`02fb9bc0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`027d7a90
fffff880`02fb9ac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`02fb9bc0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+115
fffff800`02a5f055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeStackAttachProcess+115
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030811-16984-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a54000 PsLoadedModuleList = 0xfffff800`02c91e50
Debug session time: Tue Mar 8 09:52:37.227 2011 (UTC - 5:00)
System Uptime: 0 days 0:18:59.118
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {dc, 2, 1, fffff80002aa0055}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000000dc, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002aa0055, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cfc0e0
00000000000000dc
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeStackAttachProcess+115
fffff800`02aa0055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff88002fdc8b0 -- (.trap 0xfffff88002fdc8b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=fffffa80018ffbc0
rdx=fffff88002fdcb98 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002aa0055 rsp=fffff88002fdca40 rbp=fffff88002fdcb98
r8=fffffa80018ffbb0 r9=0000000000000130 r10=fffff80002a54000
r11=fffffa80018ffb60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x115:
fffff800`02aa0055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax ds:3010:00000000`000000dc=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ac3ca9 to fffff80002ac4740
STACK_TEXT:
fffff880`02fdc768 fffff800`02ac3ca9 : 00000000`0000000a 00000000`000000dc 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02fdc770 fffff800`02ac2920 : 00000000`00000225 fffffa80`018ffb60 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`02fdc8b0 fffff800`02aa0055 : 00000000`00000000 fffffa80`018ffb60 fffffa80`018ffb60 fffff800`02d99223 : nt!KiPageFault+0x260
fffff880`02fdca40 fffffa80`027d3a90 : fffff880`02fdcbc0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeStackAttachProcess+0x115
fffff880`02fdcac0 fffff880`02fdcbc0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`027d3a90
fffff880`02fdcac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`02fdcbc0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+115
fffff800`02aa0055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeStackAttachProcess+115
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030811-20578-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a63000 PsLoadedModuleList = 0xfffff800`02ca0e50
Debug session time: Tue Mar 8 09:03:38.121 2011 (UTC - 5:00)
System Uptime: 0 days 12:32:06.027
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80002ab05a1, 0, ffffffffffffffff}
Probably caused by : ntkrnlmp.exe ( nt!KiApcInterrupt+1f1 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002ab05a1, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!KiApcInterrupt+1f1
fffff800`02ab05a1 48cf iretq
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0b0e0
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: wermgr.exe
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff88001f254b8 -- (.exr 0xfffff88001f254b8)
ExceptionAddress: fffff80002ab05a1 (nt!KiApcInterrupt+0x00000000000001f1)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000008
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff88001f25560 -- (.trap 0xfffff88001f25560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000000000eb
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ab05a1 rsp=fffff88001f256f8 rbp=fffffa80027f86eb
r8=fffff88001f25798 r9=0000000000000004 r10=0000000000000000
r11=0000000000000200 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na pe nc
nt!KiApcInterrupt+0x1f1:
fffff800`02ab05a1 48cf iretq
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002b0da39 to fffff80002ad3740
STACK_TEXT:
fffff880`01f24ce8 fffff800`02b0da39 : 00000000`0000001e ffffffff`c0000005 fffff800`02ab05a1 00000000`00000000 : nt!KeBugCheckEx
fffff880`01f24cf0 fffff800`02ad2d82 : fffff880`01f254b8 00000000`00000057 fffff880`01f25560 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`01f25380 fffff800`02ad168a : 00000000`00000001 fffffa80`027f8650 fffffa80`027f991a 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`01f25560 fffff800`02ab05a1 : fffffa80`027f1140 00000000`00000000 00000000`00000200 00000001`01f25720 : nt!KiGeneralProtectionFault+0x10a
fffff880`01f256f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiApcInterrupt+0x1f1
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiApcInterrupt+1f1
fffff800`02ab05a1 48cf iretq
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!KiApcInterrupt+1f1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!KiApcInterrupt+1f1
BUCKET_ID: X64_0x1E_c0000005_nt!KiApcInterrupt+1f1
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030811-20953-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a09000 PsLoadedModuleList = 0xfffff800`02c46e50
Debug session time: Tue Mar 8 10:48:32.871 2011 (UTC - 5:00)
System Uptime: 0 days 0:22:57.777
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {fffff880035b06f0, 2, 0, fffff88000c5dc50}
Probably caused by : ataport.SYS ( ataport!IdeLogCrbActive+bc )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff880035b06f0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88000c5dc50, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb10e0
fffff880035b06f0
CURRENT_IRQL: 2
FAULTING_IP:
ataport!IdeLogCrbActive+bc
fffff880`00c5dc50 f30f6f4148 movdqu xmm0,xmmword ptr [rcx+48h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: svchost.exe
TRAP_FRAME: fffff88002f227c0 -- (.trap 0xfffff88002f227c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800525e2c0 rbx=0000000000000000 rcx=fffff880035b06a0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88000c5dc50 rsp=fffff88002f22950 rbp=0000000000000001
r8=0000000000000000 r9=0000000000000000 r10=fffffa80055430b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ataport!IdeLogCrbActive+0xbc:
fffff880`00c5dc50 f30f6f4148 movdqu xmm0,xmmword ptr [rcx+48h] ds:2430:fffff880`035b06e8=????????????????????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002a78ca9 to fffff80002a79740
STACK_TEXT:
fffff880`02f22678 fffff800`02a78ca9 : 00000000`0000000a fffff880`035b06f0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02f22680 fffff800`02a77920 : 00000000`00000000 fffffa80`022a5860 00000000`00000000 ffffeddf`93255140 : nt!KiBugCheckDispatch+0x69
fffff880`02f227c0 fffff880`00c5dc50 : fffffa80`037af1b0 00000000`00000000 fffffa80`022a27d0 00000000`00000001 : nt!KiPageFault+0x260
fffff880`02f22950 fffff880`00c67c71 : 00000000`00000000 fffffa80`018231a0 fffffa80`05543010 00000000`00000000 : ataport!IdeLogCrbActive+0xbc
fffff880`02f22980 fffff800`02fe962f : 00000000`00000000 fffffa80`055430b0 fffffa80`01825ea0 fffff880`04a32cfe : ataport!IdeStartIoCallBack+0xc9
fffff880`02f22af0 fffff880`00fba0d3 : fffffa80`05543010 fffff880`00fba12c 00000000`00000000 fffff880`049fc8b0 : hal!HalBuildScatterGatherList+0x203
fffff880`02f22b60 fffff880`00c67b3b : fffffa80`05543010 fffffa80`022a27d0 fffffa80`018231a0 fffffa80`05543010 : PCIIDEX!BmSetup+0x6b
fffff880`02f22bc0 fffff880`00c667eb : fffffa80`01824500 fffffa80`022a27d0 fffffa80`01824500 fffffa80`018231a0 : ataport!IdeDispatchChannelRequest+0xef
fffff880`02f22bf0 fffff880`00c6631e : 00000000`00000001 fffffa80`05543010 00000000`00000001 fffffa80`05543010 : ataport!IdeStartChannelRequest+0x113
fffff880`02f22c70 fffff880`00c68582 : fffffa80`018a3480 00000000`00000000 fffffa80`022a27d0 fffffa80`0269f010 : ataport!IdeStartNextDeviceRequest+0x18e
fffff880`02f22d10 fffff880`00c680ec : fffffa80`018231a0 00000000`00000000 fffffa80`018231a0 fffffa80`0269f010 : ataport!IdeProcessCompletedRequests+0x26a
fffff880`02f22e40 fffff800`02a84bfc : fffff880`009e7180 fffffa80`00015871 fffffa80`01823050 fffffa80`01823118 : ataport!IdePortCompletionDpc+0x1a8
fffff880`02f22f00 fffff800`02a7f865 : 00000000`00000000 fffffa80`0323d790 00000000`00000000 fffff880`00c67f44 : nt!KiRetireDpcList+0x1bc
fffff880`02f22fb0 fffff800`02a7f67c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`063bc420 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue
STACK_COMMAND: kb
FOLLOWUP_IP:
ataport!IdeLogCrbActive+bc
fffff880`00c5dc50 f30f6f4148 movdqu xmm0,xmmword ptr [rcx+48h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ataport!IdeLogCrbActive+bc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ataport
IMAGE_NAME: ataport.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc118
FAILURE_BUCKET_ID: X64_0xD1_ataport!IdeLogCrbActive+bc
BUCKET_ID: X64_0xD1_ataport!IdeLogCrbActive+bc
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\030811-35390-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a65000 PsLoadedModuleList = 0xfffff800`02ca2e50
Debug session time: Tue Mar 8 10:24:39.410 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:02.316
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1000dc, 2, 1, fffff80002ab1055}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000001000dc, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ab1055, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0d0e0
00000000001000dc
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeStackAttachProcess+115
fffff800`02ab1055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff88002fb98b0 -- (.trap 0xfffff88002fb98b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=fffffa80019026e0
rdx=fffff88002fb9b98 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ab1055 rsp=fffff88002fb9a40 rbp=fffff88002fb9b98
r8=fffffa80019026d0 r9=0000000000000130 r10=fffff80002a65000
r11=fffffa8001902680 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x115:
fffff800`02ab1055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax ds:1dd0:00000000`000000dc=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ad4ca9 to fffff80002ad5740
STACK_TEXT:
fffff880`02fb9768 fffff800`02ad4ca9 : 00000000`0000000a 00000000`001000dc 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02fb9770 fffff800`02ad3920 : 00000000`00000225 fffffa80`01902680 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`02fb98b0 fffff800`02ab1055 : 00000000`00000000 fffffa80`01902680 fffffa80`01902680 fffff800`02daa223 : nt!KiPageFault+0x260
fffff880`02fb9a40 fffffa80`027f2a90 : fffff880`02fb9bc0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeStackAttachProcess+0x115
fffff880`02fb9ac0 fffff880`02fb9bc0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`027f2a90
fffff880`02fb9ac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`02fb9bc0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+115
fffff800`02ab1055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeStackAttachProcess+115
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
Followup: MachineOwner
---------