Windows 7 - Debugging WIN 7 Dmp File

mariusc83 · 10-26-2010

Please help me to understand this .dmp file on Windows 7 Enterprise 32 bit system. I encountered 2 blue screen errors followed by the system restart and when I tried to debug the .dmp file related with the error I've got the following details :

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\102610-17160-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82c03000 PsLoadedModuleList = 0x82d4b810
Debug session time: Tue Oct 26 10:17:11.535 2010 (UTC + 3:00)
System Uptime: 0 days 1:10:46.988
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {83ffffd0, 2, 1, 82c66baf}

Probably caused by : memory_corruption ( nt!MmZeroPageThread+2e1 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 83ffffd0, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82c66baf, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82d6b718
Unable to read MiSystemVaType memory at 82d4b160
83ffffd0

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmZeroPageThread+2e1
82c66baf f00fba2800 lock bts dword ptr [eax],0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: 80786c4c -- (.trap 0xffffffff80786c4c)
ErrCode = 00000002
eax=83ffffd0 ebx=83ffffd0 ecx=8587e502 edx=00000000 esi=83ffffc8 edi=fffffffe
eip=82c66baf esp=80786cc0 ebp=80786d44 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmZeroPageThread+0x2e1:
82c66baf f00fba2800 lock bts dword ptr [eax],0 ds:0023:83ffffd0=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 82c66baf to 82c497eb

STACK_TEXT:
80786c4c 82c66baf badb0d00 00000000 83018ba9 nt!KiTrap0E+0x2cf
80786d44 82d8e483 00000000 80786d90 82e1166d nt!MmZeroPageThread+0x2e1
80786d50 82e1166d 8080a508 aca7e244 00000000 nt!Phase1Initialization+0x14
80786d90 82cc30d9 82d8e46f 8080a508 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmZeroPageThread+2e1
82c66baf f00fba2800 lock bts dword ptr [eax],0

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmZeroPageThread+2e1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc007

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MmZeroPageThread+2e1

BUCKET_ID: 0xA_nt!MmZeroPageThread+2e1

Followup: MachineOwner
---------

3: kd> .trap 0xffffffff80786c4c
ErrCode = 00000002
eax=83ffffd0 ebx=83ffffd0 ecx=8587e502 edx=00000000 esi=83ffffc8 edi=fffffffe
eip=82c66baf esp=80786cc0 ebp=80786d44 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmZeroPageThread+0x2e1:
82c66baf f00fba2800 lock bts dword ptr [eax],0 ds:0023:83ffffd0=????????
3: kd> .trap 0xffffffff80786c4c
ErrCode = 00000002
eax=83ffffd0 ebx=83ffffd0 ecx=8587e502 edx=00000000 esi=83ffffc8 edi=fffffffe
eip=82c66baf esp=80786cc0 ebp=80786d44 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MmZeroPageThread+0x2e1:
82c66baf f00fba2800 lock bts dword ptr [eax],0 ds:0023:83ffffd0=????????

cybercore · 10-26-2010

Please follow the sticky thread "BSOD posting instructions" - we need your crash dumps for analysis.

Windows 7 - Debugging WIN 7 Dmp File

Debugging WIN 7 Dmp File problems?