Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121810-21684-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02e9ae50
Debug session time: Sat Dec 18 02:05:46.259 2010 (UTC - 5:00)
System Uptime: 0 days 0:02:19.258
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {dc, 2, 1, fffff80002ca9055}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000000dc, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ca9055, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f050e0
00000000000000dc
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeStackAttachProcess+115
fffff800`02ca9055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff880029b64a0 -- (.trap 0xfffff880029b64a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=fffffa800837bbc0
rdx=fffff880029b67a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ca9055 rsp=fffff880029b6630 rbp=fffff880029b67a0
r8=fffffa800837bbb0 r9=fffff880029b6a80 r10=fffff80002c5d000
r11=fffffa800837bb60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x115:
fffff800`02ca9055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax ds:00000000`000000dc=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cccca9 to fffff80002ccd740
STACK_TEXT:
fffff880`029b6358 fffff800`02cccca9 : 00000000`0000000a 00000000`000000dc 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`029b6360 fffff800`02ccb920 : fffff880`029b6c00 fffffa80`0837bb60 fffffa80`086a1020 fffff8a0`01187ff0 : nt!KiBugCheckDispatch+0x69
fffff880`029b64a0 fffff800`02ca9055 : fffff880`029b6648 fffff880`029b6a28 fffff880`029b67b8 fffffa80`06beaac6 : nt!KiPageFault+0x260
fffff880`029b6630 fffffa80`06be7a93 : fffff880`029b67b0 00000000`0000029f 00000000`00440042 fffffa80`06bf00f0 : nt!KeStackAttachProcess+0x115
fffff880`029b66b0 fffff880`029b67b0 : 00000000`0000029f 00000000`00440042 fffffa80`06bf00f0 00000000`00000000 : 0xfffffa80`06be7a93
fffff880`029b66b8 00000000`0000029f : 00000000`00440042 fffffa80`06bf00f0 00000000`00000000 00000000`0000029f : 0xfffff880`029b67b0
fffff880`029b66c0 00000000`00440042 : fffffa80`06bf00f0 00000000`00000000 00000000`0000029f 00000000`00000000 : 0x29f
fffff880`029b66c8 fffffa80`06bf00f0 : 00000000`00000000 00000000`0000029f 00000000`00000000 00000000`00000000 : 0x440042
fffff880`029b66d0 00000000`00000000 : 00000000`0000029f 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`06bf00f0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+115
fffff800`02ca9055 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeStackAttachProcess+115
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121810-22339-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e86e50
Debug session time: Sat Dec 18 01:55:02.029 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:01.028
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 0, fffff80002cbd8b6}
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+226 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cbd8b6, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef10e0
0000000000000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeSetEvent+226
fffff800`02cbd8b6 488b09 mov rcx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff88007bb6810 -- (.trap 0xfffff88007bb6810)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88007c29918 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cbd8b6 rsp=fffff88007bb69a0 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000001 r10=0000000000000000
r11=fffffa80087d1b60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
nt!KeSetEvent+0x226:
fffff800`02cbd8b6 488b09 mov rcx,qword ptr [rcx] ds:e390:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cb8ca9 to fffff80002cb9740
STACK_TEXT:
fffff880`07bb66c8 fffff800`02cb8ca9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07bb66d0 fffff800`02cb7920 : fffffa80`087d1b60 fffff880`07c29910 00000000`000006e4 fffffa80`05535040 : nt!KiBugCheckDispatch+0x69
fffff880`07bb6810 fffff800`02cbd8b6 : fffffa80`00000001 00000000`00000000 fffff880`07c298d0 fffff880`07c298d0 : nt!KiPageFault+0x260
fffff880`07bb69a0 fffffa80`06bcb0fd : fffff880`00000000 fffffa80`00000000 fffffa80`00000000 ffffffff`80000688 : nt!KeSetEvent+0x226
fffff880`07bb6a10 fffff880`00000000 : fffffa80`00000000 fffffa80`00000000 ffffffff`80000688 00000000`00000000 : 0xfffffa80`06bcb0fd
fffff880`07bb6a18 fffffa80`00000000 : fffffa80`00000000 ffffffff`80000688 00000000`00000000 00000000`00000000 : 0xfffff880`00000000
fffff880`07bb6a20 fffffa80`00000000 : ffffffff`80000688 00000000`00000000 00000000`00000000 00000000`0000061c : 0xfffffa80`00000000
fffff880`07bb6a28 ffffffff`80000688 : 00000000`00000000 00000000`00000000 00000000`0000061c 00000000`00000000 : 0xfffffa80`00000000
fffff880`07bb6a30 00000000`00000000 : 00000000`00000000 00000000`0000061c 00000000`00000000 00000000`00000030 : 0xffffffff`80000688
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeSetEvent+226
fffff800`02cbd8b6 488b09 mov rcx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeSetEvent+226
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0xA_nt!KeSetEvent+226
BUCKET_ID: X64_0xA_nt!KeSetEvent+226
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121810-21902-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c4c000 PsLoadedModuleList = 0xfffff800`02e89e50
Debug session time: Sat Dec 18 02:21:23.236 2010 (UTC - 5:00)
System Uptime: 0 days 0:03:53.251
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000096, fffff80002c980fa, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+1ba )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000096, The exception code that was not handled
Arg2: fffff80002c980fa, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000096 - {
FAULTING_IP:
nt!KeStackAttachProcess+1ba
fffff800`02c980fa 0f22d8 mov cr3,rax
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000096 - {
BUGCHECK_STR: 0x1E_c0000096
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff8800337e3f8 -- (.exr 0xfffff8800337e3f8)
ExceptionAddress: fffff80002c980fa (nt!KeStackAttachProcess+0x00000000000001ba)
ExceptionCode: c0000096
ExceptionFlags: 00000000
NumberParameters: 0
TRAP_FRAME: fffff8800337e4a0 -- (.trap 0xfffff8800337e4a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8008670a30 rbx=0000000000000000 rcx=0000000000000004
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c980fa rsp=fffff8800337e630 rbp=fffff8800337e7a0
r8=0000000000000004 r9=fffffa8005534040 r10=0000000000000010
r11=fffff80002ebcb60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x1ba:
fffff800`02c980fa 0f22d8 mov cr3,rax
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cf6a39 to fffff80002cbc740
STACK_TEXT:
fffff880`0337dc28 fffff800`02cf6a39 : 00000000`0000001e ffffffff`c0000096 fffff800`02c980fa 00000000`00000000 : nt!KeBugCheckEx
fffff880`0337dc30 fffff800`02cbbd82 : fffff880`0337e3f8 fffffa80`0554fb60 fffff880`0337e4a0 fffffa80`08670a10 : nt!KiDispatchException+0x1b9
fffff880`0337e2c0 fffff800`02cba68a : 00000000`00000000 fffffa80`05534040 fffffa80`09056b20 fffff8a0`030f5940 : nt!KiExceptionDispatch+0xc2
fffff880`0337e4a0 fffff800`02c980fa : fffff880`0337e648 fffff880`0337ea28 fffff880`0337e7b8 fffffa80`06bebac6 : nt!KiGeneralProtectionFault+0x10a
fffff880`0337e630 fffffa80`06be8a93 : fffff880`0337e7b0 00000000`0000029f 00000000`00000000 fffffa80`00000000 : nt!KeStackAttachProcess+0x1ba
fffff880`0337e6b0 fffff880`0337e7b0 : 00000000`0000029f 00000000`00000000 fffffa80`00000000 00000000`00000000 : 0xfffffa80`06be8a93
fffff880`0337e6b8 00000000`0000029f : 00000000`00000000 fffffa80`00000000 00000000`00000000 00000000`0000029f : 0xfffff880`0337e7b0
fffff880`0337e6c0 00000000`00000000 : fffffa80`00000000 00000000`00000000 00000000`0000029f 00000000`00000000 : 0x29f
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+1ba
fffff800`02c980fa 0f22d8 mov cr3,rax
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!KeStackAttachProcess+1ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1E_c0000096_nt!KeStackAttachProcess+1ba
BUCKET_ID: X64_0x1E_c0000096_nt!KeStackAttachProcess+1ba
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121810-26894-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c0a000 PsLoadedModuleList = 0xfffff800`02e47e50
Debug session time: Sat Dec 18 02:37:14.408 2010 (UTC - 5:00)
System Uptime: 0 days 0:03:28.423
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80002c5a7e7, 0, 7fffffa0000}
Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002c5a7e7, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000007fffffa0000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!RtlImageNtHeaderEx+3f
fffff800`02c5a7e7 66390a cmp word ptr [rdx],cx
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 000007fffffa0000
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb20e0
000007fffffa0000
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff8800a8f1438 -- (.exr 0xfffff8800a8f1438)
ExceptionAddress: fffff80002c5a7e7 (nt!RtlImageNtHeaderEx+0x000000000000003f)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000007fffffa0000
Attempt to read from address 000007fffffa0000
TRAP_FRAME: fffff8800a8f14e0 -- (.trap 0xfffff8800a8f14e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c5a7e7 rsp=fffff8800a8f1678 rbp=fffff8800a8f17b0
r8=0000000000000000 r9=fffff8800a8f16b8 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!RtlImageNtHeaderEx+0x3f:
fffff800`02c5a7e7 66390a cmp word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cb4a39 to fffff80002c7a740
STACK_TEXT:
fffff880`0a8f0c68 fffff800`02cb4a39 : 00000000`0000001e ffffffff`c0000005 fffff800`02c5a7e7 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a8f0c70 fffff800`02c79d82 : fffff880`0a8f1438 fffff880`039f68d0 fffff880`0a8f14e0 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`0a8f1300 fffff800`02c788fa : 00000000`00000000 fffff880`039f68d0 fffffa80`07692000 fffff800`02f90d2e : nt!KiExceptionDispatch+0xc2
fffff880`0a8f14e0 fffff800`02c5a7e7 : fffff800`02c5a872 00000000`00000010 00000000`00000082 fffff880`0a8f16a8 : nt!KiPageFault+0x23a
fffff880`0a8f1678 fffff800`02c5a872 : 00000000`00000010 00000000`00000082 fffff880`0a8f16a8 fffffa80`0837ba60 : nt!RtlImageNtHeaderEx+0x3f
fffff880`0a8f1680 fffffa80`06be9bc6 : fffff880`0a8f17b0 00000000`00000000 fffffa80`06bee260 fffffa80`06bf2300 : nt!RtlImageNtHeader+0x1e
fffff880`0a8f16b0 fffff880`0a8f17b0 : 00000000`00000000 fffffa80`06bee260 fffffa80`06bf2300 00000000`00000000 : 0xfffffa80`06be9bc6
fffff880`0a8f16b8 00000000`00000000 : fffffa80`06bee260 fffffa80`06bf2300 00000000`00000000 00000000`00000000 : 0xfffff880`0a8f17b0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!RtlImageNtHeaderEx+3f
fffff800`02c5a7e7 66390a cmp word ptr [rdx],cx
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!RtlImageNtHeaderEx+3f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
BUCKET_ID: X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
Followup: MachineOwner
---------