Code:
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\yellowstrt4\Windows_NT6_BSOD_jcgriff2\011612-56628-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03250000 PsLoadedModuleList = 0xfffff800`03495670
Debug session time: Mon Jan 16 13:39:49.774 2012 (UTC - 7:00)
System Uptime: 0 days 0:02:18.444
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff800032de640, 0, 100039477}
Unable to load image ComcastSecureBackupShare.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ComcastSecureBackupShare.sys
*** ERROR: Module load completed but symbols could not be loaded for ComcastSecureBackupShare.sys
Probably caused by : ComcastSecureBackupShare.sys ( ComcastSecureBackupShare+fcf8 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800032de640, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000100039477, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObFastReferenceObject+10
fffff800`032de640 4c8b01 mov r8,qword ptr [rcx]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000100039477
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034ff100
0000000100039477
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88008bb77d0 -- (.trap 0xfffff88008bb77d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=0000000100039477
rdx=0000000009619000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032de640 rsp=fffff88008bb7960 rbp=fffff88008bb7bf8
r8=0000000000000000 r9=fffffa800b115060 r10=000000000000000f
r11=2c9000003146f921 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!ObFastReferenceObject+0x10:
fffff800`032de640 4c8b01 mov r8,qword ptr [rcx] ds:00000001`00039477=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003318588 to fffff800032ccc40
STACK_TEXT:
fffff880`08bb6f48 fffff800`03318588 : 00000000`0000001e ffffffff`c0000005 fffff800`032de640 00000000`00000000 : nt!KeBugCheckEx
fffff880`08bb6f50 fffff800`032cc2c2 : fffff880`08bb7728 00000000`00000038 fffff880`08bb77d0 fffff8a0`0464b0d0 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`08bb75f0 fffff800`032cae3a : 00000000`00000000 00000001`00039477 00000000`0961b000 00000000`00000038 : nt!KiExceptionDispatch+0xc2
fffff880`08bb77d0 fffff800`032de640 : 00000000`00000007 00000000`00000030 fffffa80`0ad7cf20 00000000`09619000 : nt!KiPageFault+0x23a
fffff880`08bb7960 fffff800`03338437 : 00000000`00000030 00000000`00000038 fffff8a0`0464b0c8 00000000`00000000 : nt!ObFastReferenceObject+0x10
fffff880`08bb7990 fffff800`032e3083 : fffff6fc`c0142a98 00000000`00000001 fffff880`00000008 fffffa80`0098f250 : nt! ?? ::FNODOBFM::`string'+0x2ab87
fffff880`08bb7b00 fffff800`032bbc1e : fffff980`2854a000 00000000`00000000 00000000`00000000 00000000`0000960a : nt!MmCheckCachedPageStates+0x4a3
fffff880`08bb7cb0 fffff800`035b6e10 : 00000000`00000000 00000000`0960a618 fffffa80`0c862320 fffff8a0`0ec7d000 : nt!CcFetchDataForRead+0x10e
fffff880`08bb7d10 fffff880`0129df08 : fffff880`00000001 00000000`00000005 fffffa80`000359e8 fffffa80`00010001 : nt!CcCopyRead+0x180
fffff880`08bb7dd0 fffff880`01135098 : fffffa80`0c862320 fffffa80`0cc17c78 00000004`0000000c fffffa80`0c862301 : Ntfs!NtfsCopyReadA+0x1a8
fffff880`08bb7fb0 fffff880`011388ba : fffff880`08bb8080 fffff8a0`0ec7d003 fffff8a0`0ec7d000 fffffa80`0c862300 : fltmgr!FltpPerformFastIoCall+0x88
fffff880`08bb8010 fffff880`01156630 : fffffa80`0c862320 00000000`00000000 fffff880`08bb82d0 00000000`00010000 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`08bb8050 fffff880`018c2cf8 : fffffa80`0cc17d68 fffffa80`07bafc40 fffffa80`07623c00 00000000`00000000 : fltmgr!FltpFastIoRead+0x1d0
fffff880`08bb80f0 fffffa80`0cc17d68 : fffffa80`07bafc40 fffffa80`07623c00 00000000`00000000 fffff880`00000000 : ComcastSecureBackupShare+0xfcf8
fffff880`08bb80f8 fffffa80`07bafc40 : fffffa80`07623c00 00000000`00000000 fffff880`00000000 fffff8a0`0ec7d000 : 0xfffffa80`0cc17d68
fffff880`08bb8100 fffffa80`07623c00 : 00000000`00000000 fffff880`00000000 fffff8a0`0ec7d000 fffff880`08bb82d0 : 0xfffffa80`07bafc40
fffff880`08bb8108 00000000`00000000 : fffff880`00000000 fffff8a0`0ec7d000 fffff880`08bb82d0 fffffa80`07623c00 : 0xfffffa80`07623c00
STACK_COMMAND: kb
FOLLOWUP_IP:
ComcastSecureBackupShare+fcf8
fffff880`018c2cf8 ?? ???
SYMBOL_STACK_INDEX: d
SYMBOL_NAME: ComcastSecureBackupShare+fcf8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ComcastSecureBackupShare
IMAGE_NAME: ComcastSecureBackupShare.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4cd87bff
FAILURE_BUCKET_ID: X64_0x1E_c0000005_ComcastSecureBackupShare+fcf8
BUCKET_ID: X64_0x1E_c0000005_ComcastSecureBackupShare+fcf8
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\yellowstrt4\Windows_NT6_BSOD_jcgriff2\011612-59295-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03211000 PsLoadedModuleList = 0xfffff800`03456670
Debug session time: Mon Jan 16 14:12:21.250 2012 (UTC - 7:00)
System Uptime: 0 days 0:11:31.903
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800b5f0aa8, fffff8800b5f0300, fffff800032c123c}
Unable to load image ComcastSecureBackupShare.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ComcastSecureBackupShare.sys
*** ERROR: Module load completed but symbols could not be loaded for ComcastSecureBackupShare.sys
Probably caused by : Ntfs.sys ( Ntfs!NtfsReadMftRecord+b2 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800b5f0aa8
Arg3: fffff8800b5f0300
Arg4: fffff800032c123c
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800b5f0aa8 -- (.exr 0xfffff8800b5f0aa8)
ExceptionAddress: fffff800032c123c (nt!MiUpdateWsleHash+0x000000000000013c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800b5f0300 -- (.cxr 0xfffff8800b5f0300)
rax=0000058000000000 rbx=fffff8800357d001 rcx=0000000000000080
rdx=000fffffffffffff rsi=fffff780c0000000 rdi=003ff7814000d5f4
rip=fffff800032c123c rsp=fffff8800b5f0ce0 rbp=0000007ffffffff8
r8=fffffa8003e65e90 r9=ffffffff00000000 r10=fffff6fbc0a00068
r11=fffff8800b5f0cb0 r12=0000000000000000 r13=fffff800034c3ac0
r14=000000000000a4f3 r15=000000000000a4f4
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!MiUpdateWsleHash+0x13c:
fffff800`032c123c 44893f mov dword ptr [rdi],r15d ds:002b:003ff781`4000d5f4=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: VSSVC.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c0100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsReadMftRecord+b2
fffff880`012f31e2 84c0 test al,al
FAULTING_IP:
nt!MiUpdateWsleHash+13c
fffff800`032c123c 44893f mov dword ptr [rdi],r15d
BUGCHECK_STR: 0x24
TRAP_FRAME: fffff8800b5f11b0 -- (.trap 0xfffff8800b5f11b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80066f23f0 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff9800357dc00 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000358a687 rsp=fffff8800b5f1340 rbp=0000000000000080
r8=000000000000000f r9=0000000000cfdc00 r10=0000000000000c00
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!CcMapData+0x117:
fffff800`0358a687 0fb602 movzx eax,byte ptr [rdx] ds:fffff980`0357dc00=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032c2988 to fffff800032c123c
STACK_TEXT:
fffff880`0b5f0ce0 fffff800`032c2988 : fffffa80`00000028 fffffa80`0418cad0 fffff6fc`4001abe8 fffff800`00000000 : nt!MiUpdateWsleHash+0x13c
fffff880`0b5f0d50 fffff800`032a0dc2 : 00000000`00000000 fffff980`0357d001 fffff780`c0000000 fffffa80`0542e920 : nt!MiSwapWslEntries+0x2f8
fffff880`0b5f0db0 fffff800`032ace4d : 00000000`0000a4f3 00000001`5d98f921 fffff780`c0000000 fffff800`034c3ac0 : nt!MiUpdateWsle+0xd2
fffff880`0b5f0e20 fffff800`032ac53f : 4f300001`5d98f921 00000001`5d98f921 00000000`00000000 fffff800`034c3ac0 : nt!MiCompleteProtoPteFault+0x2cd
fffff880`0b5f0eb0 fffff800`032ab053 : f8a00040`67e80400 fffff980`0357dc00 fffff6fc`c001abe8 fffff800`034c3ac0 : nt!MiResolveProtoPteFault+0x1cf
fffff880`0b5f0f40 fffff800`0329b9db : fffffa80`0ad3c000 fffffa80`08676600 fffffa80`0ad3e010 fffffa80`0d565070 : nt!MiDispatchFault+0x1c3
fffff880`0b5f1050 fffff800`0328bd6e : 00000000`00000000 fffff980`0357dc00 00000000`00000000 00000000`0000000e : nt!MmAccessFault+0xe1b
fffff880`0b5f11b0 fffff800`0358a687 : 00000000`00000001 00000000`00cfdc00 fffff880`0b5f1408 fffff880`0b5f1400 : nt!KiPageFault+0x16e
fffff880`0b5f1340 fffff880`012f31e2 : 00000000`00002400 fffffa80`066f23f0 00000000`00000000 00000000`0000000e : nt!CcMapData+0x117
fffff880`0b5f1400 fffff880`012eed5c : fffffa80`0c672990 fffffa80`07b8e180 fffff8a0`02b41018 fffffa80`0c193501 : Ntfs!NtfsReadMftRecord+0xb2
fffff880`0b5f14b0 fffff880`012fcc58 : fffff880`0b5f1658 fffff8a0`02b41140 fffff880`0b5f1960 00000001`00000000 : Ntfs!NtfsLookupInFileRecord+0x6c
fffff880`0b5f1540 fffff880`012c1520 : fffffa80`0c672990 fffff8a0`02b41100 00000000`00000000 00000000`00000001 : Ntfs!NtfsWriteFileSizes+0xa8
fffff880`0b5f16a0 fffff880`012c9fad : fffffa80`0c672990 fffffa80`07b8e180 ffffffff`ffffff01 00000000`00000000 : Ntfs!NtfsFlushVolume+0x304
fffff880`0b5f17d0 fffff880`012ca6b4 : fffffa80`0c672990 fffffa80`0a1287d0 fffffa80`0c701690 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`0b5f18b0 fffff880`01115bcf : fffffa80`0a128bb8 fffffa80`0a1287d0 fffffa80`0c672990 fffff880`0b5f18d8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`0b5f1920 fffff880`011146df : fffffa80`07694aa0 00000000`00000000 fffffa80`07694a00 fffffa80`0a1287d0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0b5f19b0 fffff880`016046e5 : fffffa80`0a128700 00000000`000007ff 00000000`00000000 00000000`00000454 : fltmgr!FltpDispatch+0xcf
fffff880`0b5f1a10 fffffa80`0a128700 : 00000000`000007ff 00000000`00000000 00000000`00000454 00000000`00f8002e : ComcastSecureBackupShare+0x46e5
fffff880`0b5f1a18 00000000`000007ff : 00000000`00000000 00000000`00000454 00000000`00f8002e fffff8a0`147cb3d0 : 0xfffffa80`0a128700
fffff880`0b5f1a20 00000000`00000000 : 00000000`00000454 00000000`00f8002e fffff8a0`147cb3d0 00000000`00000000 : 0x7ff
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: Ntfs!NtfsReadMftRecord+b2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff8800b5f0300 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsReadMftRecord+b2
BUCKET_ID: X64_0x24_Ntfs!NtfsReadMftRecord+b2
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\yellowstrt4\Windows_NT6_BSOD_jcgriff2\011712-50294-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0325a000 PsLoadedModuleList = 0xfffff800`0349f670
Debug session time: Tue Jan 17 15:58:22.750 2012 (UTC - 7:00)
System Uptime: 0 days 0:11:54.420
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff800c1e9cd10, 0, fffff960000da200, 5}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!RFONTOBJ::bMatchRealization+c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff800c1e9cd10, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff960000da200, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003509100
fffff800c1e9cd10
FAULTING_IP:
win32k!RFONTOBJ::bMatchRealization+c
fffff960`000da200 49394270 cmp qword ptr [r10+70h],rax
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: spotify.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800882ea10 -- (.trap 0xfffff8800882ea10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c01bb4d0 rbx=0000000000000000 rcx=fffff8800882ee20
rdx=fffff8800882ece0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000da200 rsp=fffff8800882eba0 rbp=fffff8800882ecd0
r8=0000000010018000 r9=0000000000000000 r10=fffff800c1e9cca0
r11=fffffa80081a8b60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
win32k!RFONTOBJ::bMatchRealization+0xc:
fffff960`000da200 49394270 cmp qword ptr [r10+70h],rax ds:fffff800`c1e9cd10=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032813bf to fffff800032d6c40
STACK_TEXT:
fffff880`0882e8a8 fffff800`032813bf : 00000000`00000050 fffff800`c1e9cd10 00000000`00000000 fffff880`0882ea10 : nt!KeBugCheckEx
fffff880`0882e8b0 fffff800`032d4d6e : 00000000`00000000 fffff800`c1e9cd10 fffff900`c0082100 fffffa80`0a9b1030 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`0882ea10 fffff960`000da200 : 00000000`00000001 fffff880`0882ecf0 fffff900`c2afeaf0 fffff960`001198ef : nt!KiPageFault+0x16e
fffff880`0882eba0 fffff960`000d9f26 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff900`c01bb4d0 : win32k!RFONTOBJ::bMatchRealization+0xc
fffff880`0882ebd0 fffff960`000d9c3a : fffff900`c2afeaf0 fffff880`0882ece0 fffff880`10018000 fffff880`00000000 : win32k!RFONTOBJ::bFindRFONT+0xc6
fffff880`0882ec60 fffff960`00092b89 : 00000000`10018000 fffff900`00000000 fffff880`00000000 fffff880`00000004 : win32k!RFONTOBJ::bInit+0x4c6
fffff880`0882ed80 fffff960`002676a2 : 00000000`00000000 fffff880`00000101 fffff880`00000345 00000000`00000000 : win32k!GreExtTextOutWLocked+0x7e5
fffff880`0882f1a0 fffff960`000dddc7 : 00000000`00000001 fffff960`0025c6dc fffff880`00ffffff fffff900`00ffffff : win32k!GreBatchTextOut+0x26a
fffff880`0882f240 fffff800`032d5ddc : fffffa80`081a8b60 00000000`00010000 00000000`00000020 fffff900`00000003 : win32k!NtGdiFlushUserBatch+0x377
fffff880`0882f4a0 00000000`75432e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceGdiTebAccess+0x25
00000000`0008d3b8 fffff800`032ce210 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75432e09
fffff880`0882f880 fffff900`c080bb30 : 00000000`00000000 00000058`000010bc fffff800`032e082b 00000000`000004e3 : nt!KiCallUserMode
fffff880`0882f888 00000000`00000000 : 00000058`000010bc fffff800`032e082b 00000000`000004e3 fffff880`0882fdb0 : 0xfffff900`c080bb30
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!RFONTOBJ::bMatchRealization+c
fffff960`000da200 49394270 cmp qword ptr [r10+70h],rax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!RFONTOBJ::bMatchRealization+c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ecdcd5a
FAILURE_BUCKET_ID: X64_0x50_win32k!RFONTOBJ::bMatchRealization+c
BUCKET_ID: X64_0x50_win32k!RFONTOBJ::bMatchRealization+c
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\yellowstrt4\Windows_NT6_BSOD_jcgriff2\011712-54257-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03214000 PsLoadedModuleList = 0xfffff800`03459670
Debug session time: Tue Jan 17 16:02:14.609 2012 (UTC - 7:00)
System Uptime: 0 days 0:02:50.279
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff880023a81c8, e, 0, fffff800032b0692}
Probably caused by : amdppm.sys ( amdppm!C1Halt+2 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff880023a81c8, memory referenced
Arg2: 000000000000000e, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800032b0692, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c3100
fffff880023a81c8
CURRENT_IRQL: e
FAULTING_IP:
nt!KiIpiProcessRequests+b2
fffff800`032b0692 488b0411 mov rax,qword ptr [rcx+rdx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff8800318c890 -- (.trap 0xfffff8800318c890)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800318ca40 rbx=0000000000000000 rcx=ffffffffff21b788
rdx=fffff8800318ca40 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032b0692 rsp=fffff8800318ca20 rbp=fffff80003406e80
r8=fffff8800316efc0 r9=0000000048a92f27 r10=fffff88003168e00
r11=fffffa80066d7c88 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!KiIpiProcessRequests+0xb2:
fffff800`032b0692 488b0411 mov rax,qword ptr [rcx+rdx] ds:0030:fffff880`023a81c8=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032901e9 to fffff80003290c40
STACK_TEXT:
fffff880`0318c748 fffff800`032901e9 : 00000000`0000000a fffff880`023a81c8 00000000`0000000e 00000000`00000000 : nt!KeBugCheckEx
fffff880`0318c750 fffff800`0328ee60 : 00000000`00000010 00000000`00000000 fffffa80`09bf6270 f880023a`81c80105 : nt!KiBugCheckDispatch+0x69
fffff880`0318c890 fffff800`032b0692 : fffff880`0316efc0 fffffa80`09bd6000 00000000`00000000 fffffa80`09bde418 : nt!KiPageFault+0x260
fffff880`0318ca20 fffff800`0329b83a : 00000000`00000000 fffff880`0318cb80 00000000`00000001 fffffa80`093ce560 : nt!KiIpiProcessRequests+0xb2
fffff880`0318cb00 fffff880`051737f2 : fffff800`0329a4a9 fffffa80`06717890 fffffa80`09401dd8 fffff880`0316efc0 : nt!KiIpiInterrupt+0x12a
fffff880`0318cc98 fffff800`0329a4a9 : fffffa80`06717890 fffffa80`09401dd8 fffff880`0316efc0 00000000`00000002 : amdppm!C1Halt+0x2
fffff880`0318cca0 fffff800`0328893c : fffff880`03164180 fffff880`00000000 00000000`00000000 fffff880`052c4588 : nt!PoIdle+0x52a
fffff880`0318cd80 00000000`00000000 : fffff880`0318d000 fffff880`03187000 fffff880`0318cd40 00000000`00000000 : nt!KiIdleLoop+0x2c
STACK_COMMAND: kb
FOLLOWUP_IP:
amdppm!C1Halt+2
fffff880`051737f2 c3 ret
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: amdppm!C1Halt+2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: amdppm
IMAGE_NAME: amdppm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc0fd
FAILURE_BUCKET_ID: X64_0xA_amdppm!C1Halt+2
BUCKET_ID: X64_0xA_amdppm!C1Halt+2
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\yellowstrt4\Windows_NT6_BSOD_jcgriff2\011712-40404-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03216000 PsLoadedModuleList = 0xfffff800`0345b670
Debug session time: Tue Jan 17 16:28:00.546 2012 (UTC - 7:00)
System Uptime: 0 days 0:03:49.873
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 34, {50853, fffff88007ce4458, fffff88007ce3cb0, fffff800032a4640}
Probably caused by : ntkrnlmp.exe ( nt!ObFastReferenceObject+10 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CACHE_MANAGER (34)
See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050853
Arg2: fffff88007ce4458
Arg3: fffff88007ce3cb0
Arg4: fffff800032a4640
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88007ce4458 -- (.exr 0xfffff88007ce4458)
ExceptionAddress: fffff800032a4640 (nt!ObFastReferenceObject+0x0000000000000010)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000003628
Attempt to read from address 0000000000003628
CONTEXT: fffff88007ce3cb0 -- (.cxr 0xfffff88007ce3cb0)
rax=0000000000000010 rbx=0000000000000058 rcx=0000000000003628
rdx=000000000005a000 rsi=fffff8a00dffa2d8 rdi=0000000000003628
rip=fffff800032a4640 rsp=fffff88007ce4690 rbp=fffff88007ce4958
r8=0000000000000000 r9=fffffa8008b8f720 r10=000000000000000f
r11=448000000b717921 r12=fffffa8007ee2070 r13=fffffa800080a330
r14=0000000fffffffff r15=00000000000035e8
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!ObFastReferenceObject+0x10:
fffff800`032a4640 4c8b01 mov r8,qword ptr [rcx] ds:002b:00000000`00003628=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000003628
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034c5100
0000000000003628
FOLLOWUP_IP:
nt!ObFastReferenceObject+10
fffff800`032a4640 4c8b01 mov r8,qword ptr [rcx]
FAULTING_IP:
nt!ObFastReferenceObject+10
fffff800`032a4640 4c8b01 mov r8,qword ptr [rcx]
BUGCHECK_STR: 0x34
LAST_CONTROL_TRANSFER: from fffff800032fe437 to fffff800032a4640
STACK_TEXT:
fffff880`07ce4690 fffff800`032fe437 : 00000000`00000050 00000000`00000058 fffff8a0`0dffa2d0 fffff800`032959e5 : nt!ObFastReferenceObject+0x10
fffff880`07ce46c0 fffff800`032a8fa0 : fffff6fc`c011e700 00000000`00000001 fffff880`00000010 fffffa80`008b4820 : nt! ?? ::FNODOBFM::`string'+0x2ab87
fffff880`07ce4830 fffff800`03281c1e : fffff980`23cc0000 00000000`00030000 fffffa80`00000000 fffffa80`07ee2001 : nt!MmCheckCachedPageStates+0x3c0
fffff880`07ce49e0 fffff800`034f75a5 : 00000000`00000000 00000000`c00000d8 fffffa80`07ee2070 fffffa80`04e961f0 : nt!CcFetchDataForRead+0x10e
fffff880`07ce4a40 fffff800`0323edfc : fffffa80`07ee2070 00000000`00040000 00000000`00040000 fffffa80`08b8f720 : nt!CcMapAndCopyFromCache+0xc5
fffff880`07ce4ad0 fffff800`032d898e : fffffa80`07ee2070 00000000`00000000 00000000`00000005 fffff880`011f2201 : nt!CcPerformReadAhead+0x3b8
fffff880`07ce4c00 fffff800`0329d001 : fffffa80`015b7620 fffff800`03433201 fffff800`034948d0 00000000`00000005 : nt!CcWorkerThread+0x21e
fffff880`07ce4cb0 fffff800`0352dfee : 00000000`335cb78a fffffa80`08b8f720 00000000`00000080 fffffa80`01597b30 : nt!ExpWorkerThread+0x111
fffff880`07ce4d40 fffff800`032845e6 : fffff800`03408e80 fffffa80`08b8f720 fffffa80`06745060 fffff880`0122fcb0 : nt!PspSystemThreadStartup+0x5a
fffff880`07ce4d80 00000000`00000000 : fffff880`07ce5000 fffff880`07cdf000 fffff880`07ce46e0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ObFastReferenceObject+10
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88007ce3cb0 ; kb
FAILURE_BUCKET_ID: X64_0x34_nt!ObFastReferenceObject+10
BUCKET_ID: X64_0x34_nt!ObFastReferenceObject+10
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\yellowstrt4\Windows_NT6_BSOD_jcgriff2\011712-34304-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0324e000 PsLoadedModuleList = 0xfffff800`03493670
Debug session time: Tue Jan 17 17:45:18.021 2012 (UTC - 7:00)
System Uptime: 0 days 0:02:00.737
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff860001da7d0, 8, fffff860001da7d0, 5}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+44791 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff860001da7d0, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff860001da7d0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fd100
fffff860001da7d0
FAULTING_IP:
+6539656139376439
fffff860`001da7d0 ?? ???
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800896f5c0 -- (.trap 0xfffff8800896f5c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c0776770 rbx=0000000000000000 rcx=fffffa8006623e60
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff860001da7d0 rsp=fffff8800896f750 rbp=0000000000000005
r8=0000000000000005 r9=00000000000001e4 r10=0000000000000034
r11=fffff900c1f3a280 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
fffff860`001da7d0 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032753bf to fffff800032cac40
STACK_TEXT:
fffff880`0896f458 fffff800`032753bf : 00000000`00000050 fffff860`001da7d0 00000000`00000008 fffff880`0896f5c0 : nt!KeBugCheckEx
fffff880`0896f460 fffff800`032c8d6e : 00000000`00000008 fffff860`001da7d0 00000000`00040200 fffff880`0896f928 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`0896f5c0 fffff860`001da7d0 : 00000000`00000000 00000000`360801e4 fffff900`c1f3a280 fffff960`00275330 : nt!KiPageFault+0x16e
fffff880`0896f750 00000000`00000000 : 00000000`360801e4 fffff900`c1f3a280 fffff960`00275330 00000000`00000f04 : 0xfffff860`001da7d0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+44791
fffff800`032753bf cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+44791
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+44791
BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+44791
Followup: MachineOwner
---------