Anyone willing to test something out for me?

Had a quick basic stab at faulting drivers in the most recent dmp file.

Code:

fffff880`067c5ad8  fffff880`010d6d06Unable to load image \SystemRoot\system32\DRIVERS\amd_xata.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for amd_xata.sys
*** ERROR: Module load completed but symbols could not be loaded for amd_xata.sys
 amd_xata+0x1d06

Offending driver:
http://www.carrona.org/drivers/drive...d=amd_xata.sys

Code:

fffff880`067c5240  fffff880`0105b830*** WARNING: Unable to verify timestamp for amd_sata.sys
*** ERROR: Module load completed but symbols could not be loaded for amd_sata.sys
 amd_sata+0x1830

Offending driver:
http://www.carrona.org/drivers/drive...d=amd_sata.sys

OK I feel fairly confident I might figured out the issue.

The debugger gives us a good lead here.

Code:

BugCheck 1000007E, {ffffffffc0000094, fffff960007a5577, fffff88004550638, fffff8800454fe90}

Probably caused by : cdd.dll ( cdd!PresentWorkerThread+20b )

Using !error we are presented with the NTSTATUS code. (NTSTATUS codes usually start with a c00000xxx).

Bonus link.

Code:

!error c0000094
Error code: (NTSTATUS) 0xc0000094 (3221225620) - {EXCEPTION}  Integer division by zero.

We can see a division by zero which is a no no. < This is what the author should be looking into,
where and why does it happen.

Where did it happen?
If we unassemble the previouse cdd.dll function by using the u we get more information.

Code:

u cdd!PresentWorkerThread+20b
cdd!PresentWorkerThread+0x20b:
fffff960`007a5577 48f7f1          div     rax,rcx
fffff960`007a557a 418bc8          mov     ecx,r8d
fffff960`007a557d 483bc1          cmp     rax,rcx
fffff960`007a5580 488987d8070000  mov     qword ptr [rdi+7D8h],rax
fffff960`007a5587 7f09            jg      cdd!PresentWorkerThread+0x226 (fffff960`007a5592)
fffff960`007a5589 4181f8400d0300  cmp     r8d,30D40h
fffff960`007a5590 760a            jbe     cdd!PresentWorkerThread+0x230 (fffff960`007a559c)
fffff960`007a5592 838f2008000010  or      dword ptr [rdi+820h],10h

Dumping the CPU registers gives us the following.

Code:

r
rax=0000000000989680 rbx=fffffa800ce16880 rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa8010856b30 rdi=fffff900c1e2c020
rip=fffff960007a5577 rsp=fffff88002b0d870 rbp=0000000000000080
 r8=0000000000026161  r9=fffff88002b0d950 r10=0000000000000000
r11=fffffa800ce16880 r12=0000000000000000 r13=0000000000000000
r14=0000000000000001 r15=fffff80003c01080
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
cdd!PresentWorkerThread+0x20b:
fffff960`007a5577 48f7f1          div     rax,rcx

We see that the division is between the rax and rcx when rcx is zero.

Upon a second look !analyze -v spits out what we need I took the long route .

Code:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000094, The exception code that was not handled
Arg2: fffff96000635577, The address that the exception occurred at
Arg3: fffff880067c5638, Exception Record Address
Arg4: fffff880067c4e90, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000094 - {EXCEPTION}  Integer division by zero.

FAULTING_IP: 
cdd!PresentWorkerThread+20b
fffff960`00635577 48f7f1          div     rax,rcx
 
EXCEPTION_RECORD:  fffff880067c5638 -- (.exr 0xfffff880067c5638)
ExceptionAddress: fffff96000635577 (cdd!PresentWorkerThread+0x000000000000020b)
   ExceptionCode: c0000094 (Integer divide-by-zero)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  fffff880067c4e90 -- (.cxr 0xfffff880067c4e90;r)
rax=0000000000989680 rbx=fffffa800d72bb50 rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa801082cb30 rdi=fffff900c0173020
rip=fffff96000635577 rsp=fffff880067c5870 rbp=0000000000000080
 r8=0000000000026161  r9=fffff880067c5950 r10=0000000000000000
r11=fffffa800d72bb50 r12=0000000000000000 r13=0000000000000000
r14=0000000000000001 r15=fffff80003c01080
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
cdd!PresentWorkerThread+0x20b:
fffff960`00635577 48f7f1          div     rax,rcx

First off, thank you both! :)


So in english....... jk I think I get what your saying.

Is it my computer in any way shape or form causing the issue? I don't think so but want to make sure. I am confident I have all the latest drivers. I am very OCDish about having everything up to date.

It is his program that is the issue correct? I am very confident that is correct but just panicked making sure its not my system in some way.

If I pointed the developer to this thread I think It might help. I am going to request this thread to be moved to the chillout forum so he will be able to see it.

andrew129260 said:

First off, thank you both! :)


So in english....... jk I think I get what your saying.

Is it my computer in any way shape or form causing the issue? I don't think so but want to make sure. I am confident I have all the latest drivers. I am very OCDish about having everything up to date.

It is his program that is the issue correct? I am very confident that is correct but just panicked making sure its not my system in some way.

If I pointed the developer to this thread I think It might help. I am going to request this thread to be moved to the chillout forum so he will be able to see it.

Hey, you can breath freely is not your machine nor is it anyone else's.
The best info we can give the author is look for a division by zero somewhere in his methods
Have him run it in debugging mode and look for them when closing the game / right after launching it.
I also noticed that the latest version is from 2008 which makes me think it wasn't built with Windows 7 in mind.

I have emailed the developer with the link to this thread. He is going to look into it. Appreciate everyone's assistance so far.

Sure, any time :).

Please keep us up to date with any developments.

Developer emailed me back:

Thanks for the info- I did a bit of trawling around regarding bsods in Cdd.dll and it see to be a common problem when running games and other things on win7. There are a few matches on the forum you mentioned too. It might be worth seeing if any of the things people are talking about seem familiar.

I have a couple of problems fixing this; the primary one is that the compiler that was used is extinct, also I don't have windows 7 (!). If I can come up with a way of replicating it the I'll let you know

Thanks for the update :).
Looks like a dead end, can you ask him what language/compiler he used?

YoYo155 said:

Thanks for the update :).
Looks like a dead end, can you ask him what language/compiler he used?

Sure thing.


I cant believe I did not think of this before:

I also am wondering if anyone is willing to test with me if compatibility mode would work. For like XP or something.

Do you think, coming from a bsod perspective that could help in anyway yoyo?