Code:
- Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032112-20560-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03050000 PsLoadedModuleList = 0xfffff800`03294650
Debug session time: Tue Mar 20 23:09:58.169 2012 (UTC - 6:00)
System Uptime: 0 days 11:22:46.792
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {5001, fffff70001080000, 574, 57e00fffffe}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+38efb )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005001, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000000574
Arg4: 0000057e00fffffe
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_5001
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: ncwmodulelist.
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8000313eae7 to fffff800030ccd40
STACK_TEXT:
fffff880`08dd69a8 fffff800`0313eae7 : 00000000`0000001a 00000000`00005001 fffff700`01080000 00000000`00000574 : nt!KeBugCheckEx
fffff880`08dd69b0 fffff800`030d9389 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x38efb
fffff880`08dd6ac0 fffff800`030cae6e : 00000000`00000000 00000000`004a0008 00000000`00b19901 00000000`00000000 : nt!MmAccessFault+0x359
fffff880`08dd6c20 00000000`7789a7fc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0012f430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7789a7fc
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+38efb
fffff800`0313eae7 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+38efb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2
FAILURE_BUCKET_ID: X64_0x1a_5001_nt!_??_::FNODOBFM::_string_+38efb
BUCKET_ID: X64_0x1a_5001_nt!_??_::FNODOBFM::_string_+38efb
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032012-25194-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0301c000 PsLoadedModuleList = 0xfffff800`03260650
Debug session time: Mon Mar 19 23:09:31.387 2012 (UTC - 6:00)
System Uptime: 0 days 0:13:01.010
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8800334f9f8, 1, fffff800033a7c8d, 1}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!AlpcpReceiveSynchronousReply+ed )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800334f9f8, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff800033a7c8d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ca100
fffff8800334f9f8
FAULTING_IP:
nt!AlpcpReceiveSynchronousReply+ed
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: services.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800734f7d0 -- (.trap 0xfffff8800734f7d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffdfff rbx=0000000000000000 rcx=fffff8a00322a708
rdx=fffffa8002884b60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033a7c8d rsp=fffff8800734f960 rbp=fffffa8002884b60
r8=fffffa8003541bb8 r9=0000000000000000 r10=fffffffffffffffd
r11=fffff880009e8180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!AlpcpReceiveSynchronousReply+0xed:
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000302ce64 to fffff80003098d40
STACK_TEXT:
fffff880`0734f668 fffff800`0302ce64 : 00000000`00000050 fffff880`0334f9f8 00000000`00000001 fffff880`0734f7d0 : nt!KeBugCheckEx
fffff880`0734f670 fffff800`03096e6e : 00000000`00000001 fffff880`0334f9f8 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x45792
fffff880`0734f7d0 fffff800`033a7c8d : 00000000`00000000 fffffa80`02884f20 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0734f960 fffff800`033a72e0 : 00000000`00000000 00000000`011e0340 00000000`00299dd8 00000000`00004801 : nt!AlpcpReceiveSynchronousReply+0xed
fffff880`0734f9c0 fffff800`033a50db : fffffa80`02708e60 fffffa80`00020000 00000000`011e0340 00000000`00299dd8 : nt!AlpcpProcessSynchronousRequest+0x33d
fffff880`0734fb00 fffff800`03097fd3 : fffffa80`02884b60 fffff880`0734fca0 00000000`0153e3a0 00000980`00000000 : nt!NtAlpcSendWaitReceivePort+0x1ab
fffff880`0734fbb0 00000000`77181b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0153e638 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77181b6a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!AlpcpReceiveSynchronousReply+ed
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!AlpcpReceiveSynchronousReply+ed
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2
FAILURE_BUCKET_ID: X64_0x50_nt!AlpcpReceiveSynchronousReply+ed
BUCKET_ID: X64_0x50_nt!AlpcpReceiveSynchronousReply+ed
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032012-34757-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0305e000 PsLoadedModuleList = 0xfffff800`032a2650
Debug session time: Mon Mar 19 22:28:57.349 2012 (UTC - 6:00)
System Uptime: 0 days 0:06:37.973
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff800030cbcbe, 0, ffffffffffffffff}
Probably caused by : fileinfo.sys ( fileinfo!FIPfFilePfLinkDereference+2b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800030cbcbe, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'WSDPrint' and 'WUDFRd.sys' overlap
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExfAcquirePushLockExclusive+1e
fffff800`030cbcbe 488b19 mov rbx,qword ptr [rcx]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330c100
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80003125a08 to fffff800030dad40
STACK_TEXT:
fffff880`03affb58 fffff800`03125a08 : 00000000`0000001e ffffffff`c0000005 fffff800`030cbcbe 00000000`00000000 : nt!KeBugCheckEx
fffff880`03affb60 fffff800`030da3c2 : fffff880`03b00338 fffffa80`0233be00 fffff880`03b003e0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x48d2d
fffff880`03b00200 fffff800`030d8cca : fffffa80`05356060 00000000`00000000 fffffa80`05621b10 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`03b003e0 fffff800`030cbcbe : fffffa80`021cfb30 fffff8a0`097e9860 fffffa80`021de660 fffffa80`05356060 : nt!KiGeneralProtectionFault+0x10a
fffff880`03b00570 fffff880`010cc973 : fffff8a0`00000000 fffff8a0`00000000 fffffa80`0233be00 fffff8a0`03fe4d10 : nt!ExfAcquirePushLockExclusive+0x1e
fffff880`03b005f0 fffff880`010cb8ec : fffff8a0`0ef1c4e0 fffffa80`023a4e60 fffffa80`0233be18 fffffa80`0233be18 : fileinfo!FIPfFilePfLinkDereference+0x2b
fffff880`03b00620 fffff880`010ca6b4 : fffff8a0`0efe4d10 00000000`00000000 fffff880`03b006b0 00000000`000007ff : fileinfo!FIPfFileOpenRemove+0x9c
fffff880`03b00660 fffff800`03448625 : fffffa80`0601a570 fffff8a0`0f000000 fffff880`03b00840 00000000`00000001 : fileinfo!FIPfInterfaceClose+0x90
fffff880`03b00690 fffff800`034f45e9 : fffff880`03b00780 fffff8a0`0f000000 fffff880`4c526650 fffff880`00000087 : nt!PfpOpenHandleClose+0x55
fffff880`03b006e0 fffff800`035372d3 : fffff8a0`0f003bc0 00000000`00000000 fffffa80`04c0b810 fffff880`03b00778 : nt!PfpReadSupportCleanup+0x49
fffff880`03b00710 fffff800`0353f27e : fffff8a0`00000000 fffff8a0`00000003 fffff8a0`0000013b fffff8a0`00000000 : nt!PfpPrefetchFilesTrickle+0x293
fffff880`03b00810 fffff800`0353fe17 : 00000000`00000000 fffff880`03b00ca0 fffff880`03b00a08 fffff8a0`04994060 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`03b00960 fffff800`0354c3ee : fffff880`03b00a08 fffff880`03b00c01 fffffa80`0552d430 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`03b009d0 fffff800`03550c1a : 00000000`00000000 00000000`0000004f 00000000`00000000 ffffffff`ffffff01 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`03b00ab0 fffff800`030d9fd3 : fffffa80`05621b10 00000000`00000000 00000000`00000001 00000000`0000ac96 : nt!NtSetSystemInformation+0xc8d
fffff880`03b00c20 00000000`76f02a0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02c7f4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f02a0a
STACK_COMMAND: kb
FOLLOWUP_IP:
fileinfo!FIPfFilePfLinkDereference+2b
fffff880`010cc973 83c9ff or ecx,0FFFFFFFFh
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: fileinfo!FIPfFilePfLinkDereference+2b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc481
FAILURE_BUCKET_ID: X64_0x1E_c0000005_fileinfo!FIPfFilePfLinkDereference+2b
BUCKET_ID: X64_0x1E_c0000005_fileinfo!FIPfFilePfLinkDereference+2b
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\020812-22401-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0304c000 PsLoadedModuleList = 0xfffff800`03291670
Debug session time: Tue Feb 7 22:59:17.902 2012 (UTC - 6:00)
System Uptime: 0 days 1:30:33.525
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffffa7fffffffd0, 2, 1, fffff800030d925c}
Probably caused by : memory_corruption ( nt!MiInsertPageInFreeOrZeroedList+54c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa7fffffffd0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030d925c, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032fb100
fffffa7fffffffd0
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiInsertPageInFreeOrZeroedList+54c
fffff800`030d925c 498930 mov qword ptr [r8],rsi
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff880009a9970 -- (.trap 0xfffff880009a9970)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=ffffffffffffffd0
rdx=ffffffffffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030d925c rsp=fffff880009a9b00 rbp=fffff880009a9b40
r8=fffffa7fffffffd0 r9=0000000000000000 r10=fffffa80020fd048
r11=fffff800032fe4c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiInsertPageInFreeOrZeroedList+0x54c:
fffff800`030d925c 498930 mov qword ptr [r8],rsi ds:fffffa7f`ffffffd0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030c81e9 to fffff800030c8c40
STACK_TEXT:
fffff880`009a9828 fffff800`030c81e9 : 00000000`0000000a fffffa7f`ffffffd0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`009a9830 fffff800`030c6e60 : fffff980`1aeb3000 fffff880`00e34fb0 00000000`00000000 fffffa80`01c20630 : nt!KiBugCheckDispatch+0x69
fffff880`009a9970 fffff800`030d925c : fffffa80`021b3710 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`009a9b00 fffff800`03090d6e : fffffa80`01c20630 00000000`00096021 00000000`00000002 00000000`00000000 : nt!MiInsertPageInFreeOrZeroedList+0x54c
fffff880`009a9c10 fffff800`03363fee : fffffa80`021b3650 00000000`00000080 fffffa80`021b3b30 fffff800`030ba5d9 : nt!MmZeroPageThread+0x8f5
fffff880`009a9d40 fffff800`030ba5e6 : fffff800`0323ee80 fffffa80`021b3650 fffff800`0324ccc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a99b0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiInsertPageInFreeOrZeroedList+54c
fffff800`030d925c 498930 mov qword ptr [r8],rsi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiInsertPageInFreeOrZeroedList+54c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiInsertPageInFreeOrZeroedList+54c
BUCKET_ID: X64_0xA_nt!MiInsertPageInFreeOrZeroedList+54c
Followup: MachineOwner
---------