Code:
Loading Dump File [C:\Errors\SF_13-03-2013\031313-28890-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18044.amd64fre.win7sp1_gdr.130104-1431
Machine Name:
Kernel base = 0xfffff800`02a4a000 PsLoadedModuleList = 0xfffff800`02c8e670
Debug session time: Thu Mar 14 02:01:11.353 2013 (UTC + 5:30)
System Uptime: 0 days 0:40:12.916
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffaa005183850, 0, fffff80002d96322, 5}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!RtlpAddKnownAce+22 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffaa005183850, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002d96322, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf8100
fffffaa005183850
FAULTING_IP:
nt!RtlpAddKnownAce+22
fffff800`02d96322 0fb607 movzx eax,byte ptr [rdi]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800a6d0890 -- (.trap 0xfffff8800a6d0890)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8005183850 rbx=0000000000000000 rcx=fffff8a00f7e32b0
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d96322 rsp=fffff8800a6d0a20 rbp=fffff8a010c9b8c0
r8=0000000000000000 r9=00000000000f01ff r10=fffff8a00f7e32f0
r11=fffff8a00f7e32f8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!RtlpAddKnownAce+0x22:
fffff800`02d96322 0fb607 movzx eax,byte ptr [rdi] ds:0017:00000000`00000000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002b3c673 to fffff80002abfc40
STACK_TEXT:
fffff880`0a6d0728 fffff800`02b3c673 : 00000000`00000050 fffffaa0`05183850 00000000`00000000 fffff880`0a6d0890 : nt!KeBugCheckEx
fffff880`0a6d0730 fffff800`02abdd6e : 00000000`00000000 fffffaa0`05183850 00000000`00000000 fffff8a0`0f7e32b0 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`0a6d0890 fffff800`02d96322 : fffff8a0`0f7e32b0 00000000`00000002 fffff8a0`000015d0 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0a6d0a20 fffff800`02d965ae : fffff8a0`0f7e32b0 fffff880`0a6d0b20 fffff8a0`01f3c060 00000000`000f01ff : nt!RtlpAddKnownAce+0x22
fffff880`0a6d0a60 fffff800`02d95f7b : fffffa80`07905060 fffff880`0a6d0ca0 00000000`00000000 fffffa80`07b7f060 : nt!SepCreateImpersonationTokenDacl+0x146
fffff880`0a6d0ac0 fffff800`02d962f1 : fffffa80`07b7f060 fffff880`00000008 00000000`00000001 00000000`00000001 : nt!NtOpenThreadTokenEx+0x24b
fffff880`0a6d0be0 fffff800`02abeed3 : fffffa80`07b7f060 00000000`00000001 00000000`00000000 fffffa80`08591c50 : nt!NtOpenThreadToken+0x11
fffff880`0a6d0c20 00000000`773f155a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0210e778 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773f155a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!RtlpAddKnownAce+22
fffff800`02d96322 0fb607 movzx eax,byte ptr [rdi]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!RtlpAddKnownAce+22
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 50e79935
FAILURE_BUCKET_ID: X64_0x50_nt!RtlpAddKnownAce+22
BUCKET_ID: X64_0x50_nt!RtlpAddKnownAce+22
Followup: MachineOwner
---------
0: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.4, DMIVersion 36, Size=2015]
BiosVendor = Phoenix Technologies, LTD
BiosVersion = ASUS M2N4-SLI ACPI BIOS Revision 1205
BiosReleaseDate = 08/19/2008
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
SystemVersion = System Version
BaseBoardManufacturer = ASUSTeK Computer INC.
BaseBoardProduct = M2N4-SLI
BaseBoardVersion = 1.XX
-----------------------------------------------------------------------------------------------------
Loading Dump File [C:\Errors\SF_13-03-2013\031313-32687-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18044.amd64fre.win7sp1_gdr.130104-1431
Machine Name:
Kernel base = 0xfffff800`02a18000 PsLoadedModuleList = 0xfffff800`02c5c670
Debug session time: Thu Mar 14 01:20:11.512 2013 (UTC + 5:30)
System Uptime: 0 days 21:26:44.075
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffaa00954ffd0, 0, fffff80002aa216d, 5}
Could not read faulting driver name
Probably caused by : Npfs.SYS ( Npfs!NpFsdWrite+76 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffaa00954ffd0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002aa216d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc6100
fffffaa00954ffd0
FAULTING_IP:
nt!IopCompleteRequest+fd
fffff800`02aa216d 488b87b0000000 mov rax,qword ptr [rdi+0B0h]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: LCDClock.exe
CURRENT_IRQL: 1
IRP_ADDRESS: ffffffffffffff88
DEVICE_OBJECT: fffffa800c0b0898
TRAP_FRAME: fffff880035e8530 -- (.trap 0xfffff880035e8530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8009cf5bd1 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002aa216d rsp=fffff880035e86c0 rbp=0000000000000000
r8=fffffa8009cf5bd0 r9=0000000000000020 r10=fffff80002c0a760
r11=fffffa80077113b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!IopCompleteRequest+0xfd:
fffff800`02aa216d 488b87b0000000 mov rax,qword ptr [rdi+0B0h] ds:00000000`000000b0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002b0a673 to fffff80002a8dc40
STACK_TEXT:
fffff880`035e83c8 fffff800`02b0a673 : 00000000`00000050 fffffaa0`0954ffd0 00000000`00000000 fffff880`035e8530 : nt!KeBugCheckEx
fffff880`035e83d0 fffff800`02a8bd6e : 00000000`00000000 fffffaa0`0954ffd0 00000000`00000000 fffffa80`0b4931e0 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`035e8530 fffff800`02aa216d : 00000000`00000001 fffff800`02a90b8a 00000000`5246704e fffff800`02aadacd : nt!KiPageFault+0x16e
fffff880`035e86c0 fffff800`02a80657 : 00000000`00000000 00000000`00000000 fffffa80`16a13100 00000000`00000000 : nt!IopCompleteRequest+0xfd
fffff880`035e8790 fffff800`02ae78b0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`035e8810 fffff800`02a6e712 : fffff800`02c09e80 00000000`00000000 00000000`00000001 fffffa80`00000002 : nt! ?? ::FNODOBFM::`string'+0xcc36
fffff880`035e8880 fffff800`02a91ef3 : fffffa80`09539670 00000000`a000000c 00000000`00000000 fffffa80`05fca000 : nt!KeInsertQueueApc+0xa2
fffff880`035e88e0 fffff880`03ada16a : fffffa80`0c0b0850 00000000`03500002 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0xb63
fffff880`035e89d0 fffff800`02d99e0b : 00000000`00000001 fffffa80`0954ff20 00000000`00000000 fffffa80`0c0b0780 : Npfs!NpFsdWrite+0x76
fffff880`035e8a40 fffff800`02da4803 : fffffa80`0c0b0898 00000000`00000000 fffffa80`0954ff20 fffff800`02c09e80 : nt!IopSynchronousServiceTail+0xfb
fffff880`035e8ab0 fffff800`02a8ced3 : 00000000`00000001 00000000`00000000 000007fe`fcf248e0 00000001`8001c1c0 : nt!NtWriteFile+0x7e2
fffff880`035e8bb0 00000000`7737139a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`03bbfd48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7737139a
STACK_COMMAND: kb
FOLLOWUP_IP:
Npfs!NpFsdWrite+76
fffff880`03ada16a 488d442440 lea rax,[rsp+40h]
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: Npfs!NpFsdWrite+76
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Npfs
IMAGE_NAME: Npfs.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc114
FAILURE_BUCKET_ID: X64_0x50_Npfs!NpFsdWrite+76
BUCKET_ID: X64_0x50_Npfs!NpFsdWrite+76
Followup: MachineOwner
---------
-----------------------------------------------------------------------------------------------------------------
Loading Dump File [C:\Errors\SF_13-03-2013\022613-31140-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18044.amd64fre.win7sp1_gdr.130104-1431
Machine Name:
Kernel base = 0xfffff800`02a62000 PsLoadedModuleList = 0xfffff800`02ca6670
Debug session time: Wed Feb 27 06:41:08.694 2013 (UTC + 5:30)
System Uptime: 0 days 20:58:28.256
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck BE, {fffff88002c56488, 43200001464d0101, fffff80000ba2cd0, a}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4333b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff88002c56488, Virtual address for the attempted write.
Arg2: 43200001464d0101, PTE contents.
Arg3: fffff80000ba2cd0, (reserved)
Arg4: 000000000000000a, (reserved)
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: swkotor2.exe
CURRENT_IRQL: 2
TRAP_FRAME: fffff80000ba2cd0 -- (.trap 0xfffff80000ba2cd0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80112d5c30 rbx=0000000000000000 rcx=fffff88002c56488
rdx=0000000000000010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ae25ff rsp=fffff80000ba2e60 rbp=000000000049bd10
r8=fffffa80159d1ef0 r9=00000000000000c1 r10=0000000000000010
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!KiTimerExpiration+0xef:
fffff800`02ae25ff 488901 mov qword ptr [rcx],rax ds:fffff880`02c56488=4100000180c18148
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002b5420b to fffff80002ad7c40
STACK_TEXT:
fffff800`00ba2b68 fffff800`02b5420b : 00000000`000000be fffff880`02c56488 43200001`464d0101 fffff800`00ba2cd0 : nt!KeBugCheckEx
fffff800`00ba2b70 fffff800`02ad5d6e : fffff880`0499b3c8 fffffa80`0664a000 00000000`00000000 000000af`ce6da2a7 : nt! ?? ::FNODOBFM::`string'+0x4333b
fffff800`00ba2cd0 fffff800`02ae25ff : 000000af`ce6d3036 fffff800`00ba2e88 00000000`0049bd10 fffff800`02c56488 : nt!KiPageFault+0x16e
fffff800`00ba2e60 fffff800`02ae24b7 : fffffa80`06733dc1 fffff800`0049bd10 00000000`00000000 00000000`00000010 : nt!KiTimerExpiration+0xef
fffff800`00ba2f00 fffff800`02adae15 : 00000000`00000000 fffffa80`14e0fb50 00000000`00000000 fffff880`0167e800 : nt!KiRetireDpcList+0x277
fffff800`00ba2fb0 fffff800`02adac2c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`09f419e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4333b
fffff800`02b5420b cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4333b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 50e79935
FAILURE_BUCKET_ID: X64_0xBE_nt!_??_::FNODOBFM::_string_+4333b
BUCKET_ID: X64_0xBE_nt!_??_::FNODOBFM::_string_+4333b
Followup: MachineOwner
---------
-------------------------------------------------------------------------------------------------------------
BaseBoardManufacturer = ASUSTeK Computer INC.