Code:
-
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Mike\Documents\Kingston\BSODDmpFiles\Velosa\Windows_NT6_BSOD_jcgriff2\021812-17035-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82c4c000 PsLoadedModuleList = 0x82d954d0
Debug session time: Sat Feb 18 08:27:48.076 2012 (GMT-7)
System Uptime: 0 days 0:00:53.701
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
........
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 8b6c7ba4, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 82e75840, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82db5848
Unable to read MiSystemVaType memory at 82d94e20
8b6c7ba4
FAULTING_IP:
nt!ObpWaitForMultipleObjects+262
82e75840 8945dc mov dword ptr [ebp-24h],eax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: 9b6c78f0 -- (.trap 0xffffffff9b6c78f0)
ErrCode = 00000002
eax=0000001e ebx=872da538 ecx=00000000 edx=00000000 esi=0000001f edi=00000000
eip=82e75840 esp=9b6c7964 ebp=8b6c7bc8 iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!ObpWaitForMultipleObjects+0x262:
82e75840 8945dc mov dword ptr [ebp-24h],eax ss:0010:8b6c7ba4=504d4554
Resetting default scope
LAST_CONTROL_TRANSFER: from 82c8d408 to 82cda40f
STACK_TEXT:
9b6c78d8 82c8d408 00000001 8b6c7ba4 00000000 nt!MmAccessFault+0x106
9b6c78d8 82e75840 00000001 8b6c7ba4 00000000 nt!KiTrap0E+0xdc
9b6c7960 b63b416b 0000001f 0000001f 00000000 nt!ObpWaitForMultipleObjects+0x262
WARNING: Frame IP not in any known module. Following frames may be wrong.
9b6c7964 00000000 0000001f 00000000 872d64e8 0xb63b416b
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObpWaitForMultipleObjects+262
82e75840 8945dc mov dword ptr [ebp-24h],eax
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!ObpWaitForMultipleObjects+262
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ea76eb4
FAILURE_BUCKET_ID: 0x50_nt!ObpWaitForMultipleObjects+262
BUCKET_ID: 0x50_nt!ObpWaitForMultipleObjects+262
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Documents\Kingston\BSODDmpFiles\Velosa\Windows_NT6_BSOD_jcgriff2\021812-23150-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82c09000 PsLoadedModuleList = 0x82d524d0
Debug session time: Sat Feb 18 08:17:00.957 2012 (GMT-7)
System Uptime: 0 days 0:00:36.597
Loading Kernel Symbols
...............................................................
............................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 82c4410d, 939f7b34, 0}
Probably caused by : win32k.sys ( win32k!GreMaskBlt+110 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82c4410d, The address that the exception occurred at
Arg3: 939f7b34, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!__InterlockedDecrement+5
82c4410d f00fc101 lock xadd dword ptr [ecx],eax
TRAP_FRAME: 939f7b34 -- (.trap 0xffffffff939f7b34)
ErrCode = 00000002
eax=ffffffff ebx=00010006 ecx=000000a3 edx=00180910 esi=00000001 edi=00000000
eip=82c4410d esp=939f7ba8 ebp=939f7cf8 iopl=0 nv up ei pl nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010216
nt!__InterlockedDecrement+0x5:
82c4410d f00fc101 lock xadd dword ptr [ecx],eax ds:0023:000000a3=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: HelpPane.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 92086286 to 82c4410d
STACK_TEXT:
939f7ba4 92086286 0b010281 0016e6c4 92086944 nt!__InterlockedDecrement+0x5
939f7cf8 82c4721a 0b010281 00000003 00000003 win32k!GreMaskBlt+0x110
939f7cf8 778c7094 0b010281 00000003 00000003 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0016e6d0 00000000 00000000 00000000 00000000 0x778c7094
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!GreMaskBlt+110
92086286 8d8d48ffffff lea ecx,[ebp-0B8h]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: win32k!GreMaskBlt+110
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f10f803
FAILURE_BUCKET_ID: 0x8E_win32k!GreMaskBlt+110
BUCKET_ID: 0x8E_win32k!GreMaskBlt+110
Followup: MachineOwner
---------
-
Loading Dump File [C:\Users\Mike\Documents\Kingston\BSODDmpFiles\Velosa\Windows_NT6_BSOD_jcgriff2\021812-16099-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x8241a000 PsLoadedModuleList = 0x825634d0
Debug session time: Fri Feb 17 18:32:04.749 2012 (GMT-7)
System Uptime: 0 days 0:01:28.389
Loading Kernel Symbols
...............................................................
............................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 92732ece, 9189fc38, 0}
Probably caused by : win32k.sys ( win32k!TimersProc+75 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 92732ece, The address that the exception occurred at
Arg3: 9189fc38, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!TimersProc+75
92732ece 8b4628 mov eax,dword ptr [esi+28h]
TRAP_FRAME: 9189fc38 -- (.trap 0xffffffff9189fc38)
ErrCode = 00000000
eax=00ffffff ebx=00000010 ecx=000000eb edx=000000db esi=00fffff3 edi=00ffffff
eip=92732ece esp=9189fcac ebp=9189fcc8 iopl=0 nv up ei pl nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010203
win32k!TimersProc+0x75:
92732ece 8b4628 mov eax,dword ptr [esi+28h] ds:0023:0100001b=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 9267d3ea to 92732ece
STACK_TEXT:
9189fcc8 9267d3ea 00000004 0089f934 92743d62 win32k!TimersProc+0x75
9189fd04 9268d7b7 00000004 00000002 91873400 win32k!RawInputThread+0x61a
9189fd18 92743d7d 00000004 0089f934 9189fd34 win32k!xxxCreateSystemThreads+0x4a
9189fd28 8245821a 00000004 0089f974 77717094 win32k!NtUserCallNoParam+0x1b
9189fd28 77717094 00000004 0089f974 77717094 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0089f974 00000000 00000000 00000000 00000000 0x77717094
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!TimersProc+75
92732ece 8b4628 mov eax,dword ptr [esi+28h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!TimersProc+75
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f10f803
FAILURE_BUCKET_ID: 0x8E_win32k!TimersProc+75
BUCKET_ID: 0x8E_win32k!TimersProc+75
Followup: MachineOwner
---------