Code:
-
Loading Dump File [C:\Users\Mike\Documents\Kingston\BSODDmpFiles\staticx57\Windows_NT6_BSOD_jcgriff2\021712-27970-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0345e000 PsLoadedModuleList = 0xfffff800`036a3670
Debug session time: Fri Feb 17 15:14:36.694 2012 (GMT-7)
System Uptime: 0 days 0:01:01.553
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c000001d, fffff960000c7a69, fffff8800d116060, 0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff960000c7a69, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800d116060, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
win32k!hbmSelectBitmap+249
fffff960`000c7a69 48 ???
CONTEXT: fffff8800d116060 -- (.cxr 0xfffff8800d116060)
rax=fffff900c1d709e0 rbx=fffff900c0000400 rcx=fffff900c0000840
rdx=fffff900c0000840 rsi=fffffa8012bd7d10 rdi=fffff900c2a00000
rip=fffff960000c7a69 rsp=fffff8800d116a40 rbp=0000000000000001
r8=fffff900c0000400 r9=fffff900c00bf010 r10=0000000000000001
r11=0000000000000000 r12=fffff900c1d70630 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!hbmSelectBitmap+0x249:
fffff960`000c7a69 48 ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x3B
PROCESS_NAME: LogonUI.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800034d9ed3 to fffff960000c7a69
STACK_TEXT:
fffff880`0d116a40 fffff800`034d9ed3 : fffffa80`12db3690 fffff880`0d116b60 00000000`0185000f fffff900`c06df6e0 : win32k!hbmSelectBitmap+0x249
fffff880`0d116ae0 000007fe`fff21c4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000bf3c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fff21c4a
CHKIMG_EXTENSION: !chkimg -lo 50 -db !win32k
8 errors : !win32k (fffff960000c7a42-fffff960000c7a7a)
fffff960000c7a40 24 50 *45 48 08 0f 48 3b 3d 93 *41 21 00 0f 84 97 $PEH..H;=.A!....
fffff960000c7a50 00 00 *37 f6 47 70 10 74 10 48 *36 4c 24 58 45 33 ..7.Gp.t.H6L$XE3
fffff960000c7a60 c0 48 *33 d7 e8 d7 d2 17 00 48 *37 cf e8 ab e1 15 .H3......H7.....
fffff960000c7a70 00 83 *45 a0 00 00 00 ff 75 30 *36 0f ba 27 17 73 ..E.....u06..'.s
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
STACK_COMMAND: .cxr 0xfffff8800d116060 ; kb
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Documents\Kingston\BSODDmpFiles\staticx57\Windows_NT6_BSOD_jcgriff2\021712-30279-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03402000 PsLoadedModuleList = 0xfffff800`03647670
Debug session time: Fri Feb 17 07:57:42.289 2012 (GMT-7)
System Uptime: 0 days 0:54:24.147
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {24, 2, 1, fffff88001cab850}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000024, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88001cab850, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b1100
0000000000000024
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!IppFindInterfaceByIndex+0
fffff880`01cab850 48894024 mov qword ptr [rax+24h],rax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xD1
PROCESS_NAME: svchost.exe
TRAP_FRAME: fffff8800ae46260 -- (.trap 0xfffff8800ae46260)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8010237b40
rdx=000000000000000d rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001cab850 rsp=fffff8800ae463f8 rbp=fffffa8010237b40
r8=fffff8800ae46450 r9=0000000000000000 r10=fffffa80131b7020
r11=fffffa801033d3a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
tcpip!IppFindInterfaceByIndex:
fffff880`01cab850 48894024 mov qword ptr [rax+24h],rax ds:bd70:00000000`00000024=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000347e1e9 to fffff8000347ec40
STACK_TEXT:
fffff880`0ae46118 fffff800`0347e1e9 : 00000000`0000000a 00000000`00000024 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0ae46120 fffff800`0347ce60 : fffffa80`13213010 00000000`00000000 00000000`00000000 fffffa80`12422370 : nt!KiBugCheckDispatch+0x69
fffff880`0ae46260 fffff880`01cab850 : fffff880`01d29ee8 fffff880`0ae46510 00000000`00000000 fffffa80`12422370 : nt!KiPageFault+0x260
fffff880`0ae463f8 fffff880`01d29ee8 : fffff880`0ae46510 00000000`00000000 fffffa80`12422370 fffffa80`12422370 : tcpip!IppFindInterfaceByIndex
fffff880`0ae46400 fffff880`01cdf5b8 : fffff880`0ae46510 00000000`00000000 00000000`00000004 00000000`00000000 : tcpip! ?? ::FNODOBFM::`string'+0x32899
fffff880`0ae464f0 fffff880`01cde8f7 : 00000000`00000000 00000000`00000000 00000000`0000001f 00000000`0000001f : tcpip!InetSetSessionInformationAf+0xe8
fffff880`0ae465c0 fffff880`01cde43b : fffffa80`0d24be30 fffff880`019b6c70 fffffa80`13213010 fffff6fb`40000088 : tcpip!UdpSetSockOptEndpoint+0x2b7
fffff880`0ae466e0 fffff880`019cf034 : 00000000`00000000 00000000`00000000 00000000`00000001 00000980`00000000 : tcpip!UdpTlProviderIoControlEndpoint+0xbb
fffff880`0ae46740 fffff880`019b688d : fffffa80`11841aa0 fffff880`0ae46b60 fffffa80`13104c60 fffff880`0ae46b60 : afd! ?? ::GFJBLGFE::`string'+0xa1d0
fffff880`0ae467b0 fffff800`03799a97 : fffffa80`13104c60 00000000`00000000 fffffa80`13015bc0 fffffa80`13015bc0 : afd!AfdTliIoControl+0x8bd
fffff880`0ae468d0 fffff800`0379a2f6 : fffff683`ff7e7600 00000000`000000cc 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0ae46a00 fffff800`0347ded3 : fffff880`0ae46b60 0000007f`ffffffff fffff880`0ae46ab8 00000980`00000000 : nt!NtDeviceIoControlFile+0x56
fffff880`0ae46a70 00000000`776a138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0227dd08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776a138a
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -db !tcpip
8 errors : !tcpip (fffff88001cab842-fffff88001cab87a)
fffff88001cab840 83 ca *40 eb ec 90 90 90 90 90 *40 90 90 90 90 90 ..@.......@.....
fffff88001cab850 48 89 *40 24 08 48 89 74 24 10 *40 48 83 ec 20 8b H.@$.H.t$.@H.. .
fffff88001cab860 da 48 *40 f1 44 0f 20 c7 b8 02 *40 00 00 44 0f 22 .H@.D. ...@..D."
fffff88001cab870 c0 48 *40 c1 78 e8 26 a9 04 00 *40 d3 48 8b ce e8 .H@.x.&...@.H...
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
Followup: memory_corruption
---------
-
Loading Dump File [C:\Users\Mike\Documents\Kingston\BSODDmpFiles\staticx57\Windows_NT6_BSOD_jcgriff2\021712-31730-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03460000 PsLoadedModuleList = 0xfffff800`036a5670
Debug session time: Fri Feb 17 07:02:10.947 2012 (GMT-7)
System Uptime: 0 days 0:04:58.806
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {3, fffffa800d006cc0, 39003200430046, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a53 )
Followup: Pool_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa800d006cc0, the pool entry being checked.
Arg3: 0039003200430046, the read back flink freelist value (should be the same as 2).
Arg4: 0000000000000000, the read back blink freelist value (should be the same as 2).
Debugging Details:
------------------
BUGCHECK_STR: 0x19_3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LOCK_ADDRESS: fffff800036dbb80 -- (!locks fffff800036dbb80)
Resource @ nt!PiEngineLock (0xfffff800036dbb80) Available
WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
1 total locks
PNP_TRIAGE:
Lock address : 0xfffff800036dbb80
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0
LAST_CONTROL_TRANSFER: from fffff8000360a4b3 to fffff800034dcc40
STACK_TEXT:
fffff880`09ca5718 fffff800`0360a4b3 : 00000000`00000019 00000000`00000003 fffffa80`0d006cc0 00390032`00430046 : nt!KeBugCheckEx
fffff880`09ca5720 fffff800`03748e1d : 0000007f`00000004 fffff880`09ca5920 00000000`00000001 00000000`00000000 : nt!ExDeferredFreePool+0xa53
fffff880`09ca5810 fffff800`0374884e : 00000000`00000002 00000000`00000001 fffff880`09ca59e0 00000000`00000000 : nt!IopAllocateBuffer+0x21
fffff880`09ca5840 fffff800`037492a1 : 00000000`00000002 00000000`00000000 fffff880`09ca5a40 00000000`00000001 : nt!IopGetDeviceInterfaces+0xc2
fffff880`09ca59b0 fffff800`0374856d : 00000000`00000002 00000000`00000000 00000000`00000000 fffff8a0`02cfdb00 : nt!PiGetInterfaceDeviceList+0x41
fffff880`09ca5a10 fffff800`037a16dc : fffff8a0`02cfdb00 fffff800`00008000 fffff880`09ca5b01 fffff800`039a7da0 : nt!PiControlGetInterfaceDeviceList+0x111
fffff880`09ca5a90 fffff800`034dbed3 : fffffa80`122ec060 00000000`0054e8e0 fffff880`09ca5b60 00000000`0054e968 : nt!NtPlugPlayControl+0x100
fffff880`09ca5ae0 00000000`774b236a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0054e8a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774b236a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+a53
fffff800`0360a4b3 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExDeferredFreePool+a53
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a53
BUCKET_ID: X64_0x19_3_nt!ExDeferredFreePool+a53
Followup: Pool_corruption
---------
-
Loading Dump File [C:\Users\Mike\Documents\Kingston\BSODDmpFiles\staticx57\Windows_NT6_BSOD_jcgriff2\021712-31231-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0341c000 PsLoadedModuleList = 0xfffff800`03661670
Debug session time: Fri Feb 17 06:55:51.130 2012 (GMT-7)
System Uptime: 0 days 0:29:51.988
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d89f21d7bb, b3b7465ef19fa779, fffff80003a0d5f4, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89f21d7bb, Reserved
Arg2: b3b7465ef19fa779, Reserved
Arg3: fffff80003a0d5f4, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
------------------
BUGCHECK_STR: 0x109
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80003498c40
STACK_TEXT:
fffff880`035cb498 00000000`00000000 : 00000000`00000109 a3a039d8`9f21d7bb b3b7465e`f19fa779 fffff800`03a0d5f4 : nt!KeBugCheckEx
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -db !hal
8 errors : !hal (fffff80003a0d6c2-fffff80003a0d6fa)
fffff80003a0d6c0 00 00 *bd ea 0c e8 ba 3c 00 00 *d2 0f 49 8b d6 ff .......<....I...
fffff80003a0d6d0 15 cb *8b 01 00 41 ba 01 00 00 *d2 41 3a f4 0f 85 .....A.....A:...
fffff80003a0d6e0 0a 01 *8b 00 48 8b 57 f8 48 8d *00 24 78 45 33 c9 ....H.W.H..$xE3.
fffff80003a0d6f0 48 89 *00 24 38 44 88 54 24 30 *33 8b c6 48 8b cd H..$8D.T$03..H..
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
Followup: memory_corruption
---------