Code:
-
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [K:\Kingston\BSODDmpFiles\Gizmo73O\Windows_NT6_BSOD_jcgriff2\020312-25942-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`03255000 PsLoadedModuleList = 0xfffff800`03492e70
Debug session time: Fri Feb 3 11:03:23.611 2012 (GMT-7)
System Uptime: 0 days 1:53:38.000
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 34, {50830, fffff880031937c8, fffff88003193030, fffff800032b7c94}
Probably caused by : ntkrnlmp.exe ( nt!CcGetVirtualAddressIfMapped+7c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CACHE_MANAGER (34)
See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050830
Arg2: fffff880031937c8
Arg3: fffff88003193030
Arg4: fffff800032b7c94
Debugging Details:
------------------
EXCEPTION_RECORD: fffff880031937c8 -- (.exr 0xfffff880031937c8)
ExceptionAddress: fffff800032b7c94 (nt!CcGetVirtualAddressIfMapped+0x000000000000007c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000021
Attempt to write to address 0000000000000021
CONTEXT: fffff88003193030 -- (.cxr 0xfffff88003193030)
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000006
rdx=ffffffff00180000 rsi=0000000000000000 rdi=fffffa8005958010
rip=fffff800032b7c94 rsp=fffff88003193a00 rbp=fffffa8005958010
r8=fffff88003193ad0 r9=fffff88003193a90 r10=0000000000000000
r11=0000000000000011 r12=fffff88003193ad0 r13=ffffffff00180000
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!CcGetVirtualAddressIfMapped+0x7c:
fffff800`032b7c94 f0410fc14310 lock xadd dword ptr [r11+10h],eax ds:002b:00000000`00000021=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000021
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fd0e0
0000000000000021
FOLLOWUP_IP:
nt!CcGetVirtualAddressIfMapped+7c
fffff800`032b7c94 f0410fc14310 lock xadd dword ptr [r11+10h],eax
FAULTING_IP:
nt!CcGetVirtualAddressIfMapped+7c
fffff800`032b7c94 f0410fc14310 lock xadd dword ptr [r11+10h],eax
BUGCHECK_STR: 0x34
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff800032b1071 to fffff800032b7c94
STACK_TEXT:
fffff880`03193a00 fffff800`032b1071 : 00000000`00000000 fffff880`03193c58 00000000`ffe81000 fffffa80`05958010 : nt!CcGetVirtualAddressIfMapped+0x7c
fffff880`03193a50 fffff800`032b880b : fffffa80`057e70c8 fffff800`00000001 00000000`00000001 fffff800`00001000 : nt!CcFlushCache+0x541
fffff880`03193b50 fffff800`032b93ec : fffff880`03193c00 fffff880`03193c58 00000000`00000000 fffff800`00000000 : nt!CcWriteBehind+0x1eb
fffff880`03193c00 fffff800`032d27e1 : fffffa80`052213d0 fffff880`012dab40 fffff800`034cc160 00000000`00000002 : nt!CcWorkerThread+0x1c8
fffff880`03193cb0 fffff800`035656fa : 00bee8c7`8b104d8b fffffa80`05232680 00000000`00000080 fffffa80`0520b5a0 : nt!ExpWorkerThread+0x111
fffff880`03193d40 fffff800`032a3b46 : fffff880`02f64180 fffffa80`05232680 fffff880`02f6efc0 10244489`661c468b : nt!PspSystemThreadStartup+0x5a
fffff880`03193d80 00000000`00000000 : fffff880`03194000 fffff880`0318e000 fffff880`03193620 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!CcGetVirtualAddressIfMapped+7c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
STACK_COMMAND: .cxr 0xfffff88003193030 ; kb
FAILURE_BUCKET_ID: X64_0x34_nt!CcGetVirtualAddressIfMapped+7c
BUCKET_ID: X64_0x34_nt!CcGetVirtualAddressIfMapped+7c
Followup: MachineOwner
---------
-
Loading Dump File [K:\Kingston\BSODDmpFiles\Gizmo73O\Windows_NT6_BSOD_jcgriff2\013112-33009-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`0324f000 PsLoadedModuleList = 0xfffff800`0348ce70
Debug session time: Tue Jan 31 10:40:03.486 2012 (GMT-7)
System Uptime: 0 days 2:09:41.891
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1, 2, 1, fffff800032b08e0}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000001, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800032b08e0, address which referenced memory
Debugging Details:
------------------
WORKER_ROUTINE:
+0
00000000`00000001 ?? ???
WORK_ITEM: fffff800032b08e0
CURRENT_IRQL: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: svchost.exe
TRAP_FRAME: fffff8800aa79780 -- (.trap 0xfffff8800aa79780)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000084a6c121 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000084a6c000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032b08e0 rsp=fffff8800aa79910 rbp=fffffa8007785620
r8=fffff8a00edfc560 r9=0000000000000000 r10=0000058000000000
r11=00000000c0000434 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!MiWaitForInPageComplete+0x660:
fffff800`032b08e0 488901 mov qword ptr [rcx],rax ds:00000000`00000001=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032beb29 to fffff800032bf5c0
STACK_TEXT:
fffff880`0aa79638 fffff800`032beb29 : 00000000`0000000a 00000000`00000001 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0aa79640 fffff800`032bd7a0 : 00000000`00000038 fffffa80`018df440 00000000`00000002 fffff800`033b1934 : nt!KiBugCheckDispatch+0x69
fffff880`0aa79780 fffff800`032b08e0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`055fd400 : nt!KiPageFault+0x260
fffff880`0aa79910 fffff800`032b13fb : fffffa80`07785620 00000000`00000001 fffffa80`056a5c28 fffff800`0358d09b : nt!MiWaitForInPageComplete+0x660
fffff880`0aa799f0 fffff800`032da70b : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00020bea`00000000 : nt!MiIssueHardFault+0x28b
fffff880`0aa79ac0 fffff800`032bd6ae : 00000000`00000008 00000000`0403b2a0 00000000`0553ec01 00000000`01ec85d8 : nt!MmAccessFault+0x14bb
fffff880`0aa79c20 00000000`5d0c3d46 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0553e640 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x5d0c3d46
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiPageFault+260
fffff800`032bd7a0 440f20c0 mov rax,cr8
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiPageFault+260
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44
FAILURE_BUCKET_ID: X64_0xA_nt!KiPageFault+260
BUCKET_ID: X64_0xA_nt!KiPageFault+260
Followup: MachineOwner
---------
-
Loading Dump File [K:\Kingston\BSODDmpFiles\Gizmo73O\Windows_NT6_BSOD_jcgriff2\012612-44085-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`0321b000 PsLoadedModuleList = 0xfffff800`03458e70
Debug session time: Thu Jan 26 05:30:25.106 2012 (GMT-7)
System Uptime: 2 days 19:26:41.511
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d89854a6d6, b3b7465eead178dc, fffff8000333c020, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89854a6d6, Reserved
Arg2: b3b7465eead178dc, Reserved
Arg3: fffff8000333c020, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
------------------
BUGCHECK_STR: 0x109
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff8000328b5c0
STACK_TEXT:
fffff880`031bd5d8 00000000`00000000 : 00000000`00000109 a3a039d8`9854a6d6 b3b7465e`ead178dc fffff800`0333c020 : nt!KeBugCheckEx
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8000333c04e - nt!KeAcquireInStackQueuedSpinLockForDpc+2e
[ 90:b0 ]
1 error : !nt (fffff8000333c04e)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
-
Loading Dump File [K:\Kingston\BSODDmpFiles\Gizmo73O\Windows_NT6_BSOD_jcgriff2\012211-55551-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0305b000 PsLoadedModuleList = 0xfffff800`03298e50
Debug session time: Sat Jan 22 16:56:03.288 2011 (GMT-7)
System Uptime: 0 days 0:00:16.068
Loading Kernel Symbols
.............................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 6B, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!Phase1InitializationDiscard+133d )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PROCESS1_INITIALIZATION_FAILED (6b)
Arguments:
Arg1: 0000000000000000, Indicates the NT status code that caused the failure.
Arg2: 0000000000000000, (reserved)
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x6B
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800035fcd8d to fffff800030cb710
STACK_TEXT:
fffff880`009a9b38 fffff800`035fcd8d : 00000000`00000000 00000000`00000000 fffff800`008127c0 fffff800`008127c0 : nt!KeBugCheck
fffff880`009a9b40 fffff800`0354d8c9 : 0f545342`533f8124 fffffa80`03a12b60 00000000`00000080 fffffa80`03a110b0 : nt!Phase1InitializationDiscard+0x133d
fffff880`009a9d10 fffff800`0336fc06 : 48747063`41b84100 00000000`00000080 448948f0`8b48fffe fffff800`030a9c19 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`030a9c26 : fffff800`03245e80 fffffa80`03a12b60 fffff800`03253c40 8bfffee6`c115ffd2 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!Phase1InitializationDiscard+133d
fffff800`035fcd8d cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!Phase1InitializationDiscard+133d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x6B_nt!Phase1InitializationDiscard+133d
BUCKET_ID: X64_0x6B_nt!Phase1InitializationDiscard+133d
Followup: MachineOwner
---------