Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidump(2).zip\070510-15896-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a18000 PsLoadedModuleList = 0xfffff800`02c55e50
Debug session time: Mon Jul 5 02:01:30.729 2010 (GMT-4)
System Uptime: 0 days 0:15:44.711
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002d7d94c, fffff88007accfb0, 0}
Probably caused by : ntkrnlmp.exe ( nt!ObReferenceObjectByHandleWithTag+10c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002d7d94c, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88007accfb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObReferenceObjectByHandleWithTag+10c
fffff800`02d7d94c 0fb64518 movzx eax,byte ptr [rbp+18h]
CONTEXT: fffff88007accfb0 -- (.cxr 0xfffff88007accfb0)
rax=fffffa8006f1e2c1 rbx=fffff8a006b05600 rcx=fffffa8006f1e2c0
rdx=0000000000000002 rsi=fffff8a00696b400 rdi=fffffa80037dd060
rip=fffff80002d7d94c rsp=fffff88007acd980 rbp=fffffffffffffff8
r8=fffff8a006b0c000 r9=0000000000000000 r10=fffff80002a9a7fc
r11=fffff88007acdba8 r12=0000000000000000 r13=0000000000000180
r14=0000000000000001 r15=fffffa8004b59b30
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!ObReferenceObjectByHandleWithTag+0x10c:
fffff800`02d7d94c 0fb64518 movzx eax,byte ptr [rbp+18h] ss:0018:00000000`00000010=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: RobloxApp.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002d7d94c
STACK_TEXT:
fffff880`07acd980 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObReferenceObjectByHandleWithTag+0x10c
FOLLOWUP_IP:
nt!ObReferenceObjectByHandleWithTag+10c
fffff800`02d7d94c 0fb64518 movzx eax,byte ptr [rbp+18h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ObReferenceObjectByHandleWithTag+10c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
STACK_COMMAND: .cxr 0xfffff88007accfb0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ObReferenceObjectByHandleWithTag+10c
BUCKET_ID: X64_0x3B_nt!ObReferenceObjectByHandleWithTag+10c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidump(2).zip\070510-15303-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a4a000 PsLoadedModuleList = 0xfffff800`02c87e50
Debug session time: Mon Jul 5 12:26:26.814 2010 (GMT-4)
System Uptime: 0 days 0:07:09.671
Loading Kernel Symbols
..................................................Unable to load image Unknown_Module_00000000`00000000, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Unable to add module at 00000000`00000000
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.
FAULTING_IP:
+5952952f019ada48
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff8800311b3a8 -- (.exr 0xfffff8800311b3a8)
ExceptionAddress: fffff80002ac59d2 (nt!KiProcessExpiredTimerList+0x0000000000000072)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff8800311b450 -- (.trap 0xfffff8800311b450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0a00a23a61ba5f92 rbx=0000000000000000 rcx=fffffa80063d2630
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ac59d2 rsp=fffff8800311b5e0 rbp=0000000000006b96
r8=fffff880009ea301 r9=0000000000000006 r10=0000000000000096
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KiProcessExpiredTimerList+0x72:
fffff800`02ac59d2 803818 cmp byte ptr [rax],18h ds:0a00a23a`61ba5f92=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ab232e to fffff80002aba5d0
STACK_TEXT:
fffff880`0311a498 fffff800`02ab232e : 00000000`00000000 fffffa80`0643d6b0 fffff880`0311ac10 fffff800`02ae7524 : nt!KeBugCheck
fffff880`0311a4a0 fffff800`02ae02ed : fffff800`02cc8b88 fffff800`02c01a40 fffff800`02a4a000 fffff880`0311b3a8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`0311a4d0 fffff800`02ae7950 : fffff800`02c09b24 fffff880`0311a548 fffff880`0311b3a8 fffff800`02a4a000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0311a500 fffff800`02af48df : fffff880`0311b3a8 fffff880`0311ac10 fffff880`00000000 fffff880`0311b608 : nt!RtlDispatchException+0x410
fffff880`0311abe0 fffff800`02ab9c42 : fffff880`0311b3a8 fffffa80`063c0250 fffff880`0311b450 00000000`00000006 : nt!KiDispatchException+0x16f
fffff880`0311b270 fffff800`02ab854a : 00000000`00000000 00000000`00000000 fffffa80`04b96000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0311b450 fffff800`02ac59d2 : fffffa80`063c0250 00000000`0000000b fffffa80`06e1ed50 00000000`00000001 : nt!KiGeneralProtectionFault+0x10a
fffff880`0311b5e0 fffff800`02ac657e : 00000001`001aaee0 fffff880`0311bc58 00000000`00006b96 fffff880`009eb848 : nt!KiProcessExpiredTimerList+0x72
fffff880`0311bc30 fffff800`02ac5d97 : 00000002`809bebc5 00000002`00006b96 00000002`809beb2e 00000000`00000096 : nt!KiTimerExpiration+0x1be
fffff880`0311bcd0 fffff800`02ac2dfa : fffff880`009e8180 fffff880`009f2f40 00000000`00000000 fffff880`100b62dc : nt!KiRetireDpcList+0x277
fffff880`0311bd80 00000000`00000000 : fffff880`0311c000 fffff880`03116000 fffff880`0311bd40 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiKernelCalloutExceptionHandler+e
fffff800`02ab232e 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiKernelCalloutExceptionHandler+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0x1E_nt!KiKernelCalloutExceptionHandler+e
BUCKET_ID: X64_0x1E_nt!KiKernelCalloutExceptionHandler+e
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidump(2).zip\070510-14757-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Mini Kernel Dump does not have process information
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a0a000 PsLoadedModuleList = 0xfffff800`02c47e50
Debug session time: Mon Jul 5 12:51:34.749 2010 (GMT-4)
System Uptime: 0 days 0:17:44.731
Loading Kernel Symbols
..................................................
Loading User Symbols
Loading unloaded module list
.Missing image name, possible paged-out or corrupt data.
..Missing image name, possible paged-out or corrupt data.
..Missing image name, possible paged-out or corrupt data.
..
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {180, 2, 0, fffff80002a825db}
Probably caused by : ntkrnlmp.exe ( nt!KiSearchForNewThread+26b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000180, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a825db, address which referenced memory
Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'CLASSPNP' and 'Unknown_Module_00000000`00000000' overlap
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb20e0
0000000000000180
CURRENT_IRQL: 0
FAULTING_IP:
nt!KiSearchForNewThread+26b
fffff800`02a825db 66453b9080010000 cmp r10w,word ptr [r8+180h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
EXCEPTION_RECORD: fffff880077fcb78 -- (.exr 0xfffff880077fcb78)
ExceptionAddress: 00000000734ee299
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000003e920030
Attempt to read from address 000000003e920030
LAST_CONTROL_TRANSFER: from fffff80002ab4a86 to fffff80002d1cc20
STACK_TEXT:
fffff880`077fc270 fffff800`02ab4a86 : fffff880`077fcb78 fffff880`077fc8e0 fffff880`077fcc20 00000000`05dd5410 : nt!DbgkForwardException+0x70
fffff880`077fc3b0 fffff800`02a79c42 : fffff880`077fcb78 00000000`00000000 fffff880`077fcc20 00000000`05dd5900 : nt!KiDispatchException+0x316
fffff880`077fca40 fffff800`02a787ba : 00000000`00000000 00000000`00000000 ffffffff`ffffd801 fffffa80`05ea9060 : nt!KiExceptionDispatch+0xc2
fffff880`077fcc20 00000000`734ee299 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`05dd53c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x734ee299
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!KiSearchForNewThread+26b
fffff800`02a825db 66453b9080010000 cmp r10w,word ptr [r8+180h]
SYMBOL_NAME: nt!KiSearchForNewThread+26b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0xA_nt!KiSearchForNewThread+26b
BUCKET_ID: X64_0xA_nt!KiSearchForNewThread+26b
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidump(2).zip\070510-14570-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a64000 PsLoadedModuleList = 0xfffff800`02ca1e50
Debug session time: Mon Jul 5 01:10:41.638 2010 (GMT-4)
System Uptime: 0 days 1:08:43.620
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, 80050031, 6f8, fffff80002ada88e}
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002ada88e
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: RobloxApp.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002ad3b69 to fffff80002ad4600
STACK_TEXT:
fffff800`041b6d28 fffff800`02ad3b69 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff800`041b6d30 fffff800`02ad2032 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`041b6e70 fffff800`02ada88e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`071a85d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SwapContext_PatchXSave+0x8b
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiDoubleFaultAbort+b2
fffff800`02ad2032 90 nop
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiDoubleFaultAbort+b2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidump(2).zip\070410-13852-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a5a000 PsLoadedModuleList = 0xfffff800`02c97e50
Debug session time: Sun Jul 4 20:24:09.473 2010 (GMT-4)
System Uptime: 0 days 7:37:39.331
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {ffffffffffffffff, 2, 8, ffffffffffffffff}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffffffffffffff, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: ffffffffffffffff, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d020e0
ffffffffffffffff
CURRENT_IRQL: 2
FAULTING_IP:
+5952952f01e6dd74
ffffffff`ffffffff ?? ???
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: RobloxApp.exe
TRAP_FRAME: fffff88006c95410 -- (.trap 0xfffff88006c95410)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000100000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=ffffffffffffffff rsp=fffff88006c955a0 rbp=fffff88006c95b00
r8=fffff88006c955e8 r9=0000000000010040 r10=000000000010001f
r11=fffff88006c95600 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
ffffffff`ffffffff ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ac9b69 to fffff80002aca600
FAILED_INSTRUCTION_ADDRESS:
+5952952f01e6dd74
ffffffff`ffffffff ?? ???
STACK_TEXT:
fffff880`06c952c8 fffff800`02ac9b69 : 00000000`0000000a ffffffff`ffffffff 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`06c952d0 fffff800`02ac87e0 : 00000000`00000000 fffff880`06c95d98 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`06c95410 ffffffff`ffffffff : fffffa80`04accb00 fffff880`06c96a60 fffff880`06c956a8 fffff800`02aa2d92 : nt!KiPageFault+0x260
fffff880`06c955a0 fffffa80`04accb00 : fffff880`06c96a60 fffff880`06c956a8 fffff800`02aa2d92 fffff800`02c52c40 : 0xffffffff`ffffffff
fffff880`06c955a8 fffff880`06c96a60 : fffff880`06c956a8 fffff800`02aa2d92 fffff800`02c52c40 fffff800`02b0483d : 0xfffffa80`04accb00
fffff880`06c955b0 fffff880`06c956a8 : fffff800`02aa2d92 fffff800`02c52c40 fffff800`02b0483d fffff880`06c95d98 : 0xfffff880`06c96a60
fffff880`06c955b8 fffff800`02aa2d92 : fffff800`02c52c40 fffff800`02b0483d fffff880`06c95d98 fffff880`06c95e40 : 0xfffff880`06c956a8
fffff880`06c955c0 fffff800`02d985ea : fffff880`06c95d30 fffff880`06c96c20 fffff880`00001f80 fffff880`06c95db0 : nt!RtlpLookupFunctionEntryForStackWalks+0x32
fffff880`06c95630 00000000`00000000 : 00000000`00000001 fffff880`06c95e00 fffff880`06c95c10 fffff880`100e3936 : nt!PspGetSetContextInternal+0x4fe
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiPageFault+260
fffff800`02ac87e0 440f20c0 mov rax,cr8
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiPageFault+260
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260
BUCKET_ID: X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260
Followup: MachineOwner
---------
0: kd> lmtsmn
start end module name
fffff880`03eae000 fffff880`03eec000 1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`01165000 fffff880`011bc000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`03b50000 fffff880`03bda000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`10bbf000 fffff880`10bd5000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`03cd8000 fffff880`03cef000 amdk8 amdk8.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`00e20000 fffff880`00e2b000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`00fa1000 fffff880`00faa000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00faa000 fffff880`00fd4000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`03a5f000 fffff880`03a66000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`03ca1000 fffff880`03cb2000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`05353000 fffff880`05371000 bowser bowser.sys Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00750000 fffff960`00777000 cdd cdd.dll unavailable (00000000)
fffff880`03a2c000 fffff880`03a56000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00d09000 fffff880`00dc9000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`00dc9000 fffff880`00df9000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00cab000 fffff880`00d09000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01200000 fffff880`01273000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`10baf000 fffff880`10bbf000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`04cb0000 fffff880`04cbe000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`03c00000 fffff880`03c83000 csc csc.sys Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`03c83000 fffff880`03ca1000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`03de4000 fffff880`03df3000 discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`00c62000 fffff880`00c78000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`04c88000 fffff880`04caa000 drmk drmk.sys Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`04cca000 fffff880`04cd3000 dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04cbe000 fffff880`04cca000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`04cd3000 fffff880`04ce6000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`04d43000 fffff880`04d4f000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0fe00000 fffff880`0fef4000 dxgkrnl dxgkrnl.sys Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`10b69000 fffff880`10baf000 dxgmms1 dxgmms1.sys Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`03df3000 fffff880`03e00000 fdc fdc.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`01349000 fffff880`0135d000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`03f7f000 fffff880`03f8a000 flpydisk flpydisk.sys Mon Jul 13 20:00:54 2009 (4A5BCAB6)
fffff880`012fd000 fffff880`01349000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`01411000 fffff880`0141b000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`013bb000 fffff880`013f5000 fvevol fvevol.sys Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`01600000 fffff880`0164a000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`02a11000 fffff800`02a5a000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`03eec000 fffff880`03f10000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`04d13000 fffff880`04d2c000 HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`04d2c000 fffff880`04d34080 HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`04d05000 fffff880`04d13000 hidusb hidusb.sys Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`05200000 fffff880`052c8000 HTTP HTTP.sys Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`0141b000 fffff880`01424000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`03e0f000 fffff880`03e2d000 i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`03f1b000 fffff880`03f2a000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`04d35000 fffff880`04d43000 kbdhid kbdhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bb5000 fffff800`00bbf000 kdcom kdcom.dll Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`03f2a000 fffff880`03f6d000 ks ks.sys Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`015db000 fffff880`015f5000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`017cd000 fffff880`017f8000 ksecpkg ksecpkg.sys Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`04caa000 fffff880`04caf200 ksthunk ksthunk.sys Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`04da1000 fffff880`04db6000 lltdio lltdio.sys Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04d5d000 fffff880`04d80000 luafv luafv.sys Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c8a000 fffff880`00c97000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`04d4f000 fffff880`04d5d000 monitor monitor.sys Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`03e2d000 fffff880`03e3c000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`00f87000 fffff880`00fa1000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`05371000 fffff880`05389000 mpsdrv mpsdrv.sys Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`05389000 fffff880`053b6000 mrxsmb mrxsmb.sys Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`0567c000 fffff880`056ca000 mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`056ca000 fffff880`056ed000 mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`03ac4000 fffff880`03acf000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`011bc000 fffff880`011c6000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`0135d000 fffff880`013bb000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`03dd9000 fffff880`03de4000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01662000 fffff880`01674000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`0167b000 fffff880`0176d000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`043a2000 fffff880`043ae000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`05328000 fffff880`0533b000 ndisuio ndisuio.sys Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`043ae000 fffff880`043dd000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03fe4000 fffff880`03ff9000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`03d21000 fffff880`03d30000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`03b0b000 fffff880`03b50000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`0176d000 fffff880`017cd000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`03acf000 fffff880`03ae0000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03dcd000 fffff880`03dd9000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02a5a000 fffff800`03036000 nt ntkrnlmp.exe Sat Feb 27 02:55:23 2010 (4B88CFEB)
fffff880`01438000 fffff880`015db000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`03a56000 fffff880`03a5f000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`10b67000 fffff880`10b68180 nvBridge nvBridge.kmd Mon Jun 07 18:07:11 2010 (4C0D6D8F)
fffff880`0fef9000 fffff880`10b66c80 nvlddmkm nvlddmkm.sys Mon Jun 07 18:16:55 2010 (4C0D6FD7)
fffff880`04241000 fffff880`043a1d00 nvmfdx64 nvmfdx64.sys Mon Jan 15 19:51:05 2007 (45AC2179)
fffff880`00fd4000 fffff880`00fff000 nvstor nvstor.sys Wed May 20 02:45:37 2009 (4A13A711)
fffff880`00e00000 fffff880`00e20000 nvstor64 nvstor64.sys Fri Dec 22 23:07:35 2006 (458CAB87)
fffff880`052d5000 fffff880`05328000 nwifi nwifi.sys Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`03cfb000 fffff880`03d21000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`03be3000 fffff880`03c00000 parport parport.sys Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`011d3000 fffff880`011e8000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00ee8000 fffff880`00f1b000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`01000000 fffff880`01007000 pciide pciide.sys Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00f77000 fffff880`00f87000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`01400000 fffff880`01411000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`056ed000 fffff880`05793000 peauth peauth.sys Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04c4b000 fffff880`04c88000 portcls portcls.sys Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c97000 fffff880`00cab000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`10bd5000 fffff880`10bf9000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`043dd000 fffff880`043f8000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`04200000 fffff880`04221000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`04221000 fffff880`0423b000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03d7c000 fffff880`03dcd000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`03f10000 fffff880`03f1b000 rdpbus rdpbus.sys Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`03aa9000 fffff880`03ab2000 RDPCDD RDPCDD.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`03ab2000 fffff880`03abb000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`03abb000 fffff880`03ac4000 rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`012bf000 fffff880`012f9000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`0533b000 fffff880`05353000 rspndr rspndr.sys Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04a0c000 fffff880`04c4a580 RTKVHD64 RTKVHD64.sys Fri Apr 30 05:05:58 2010 (4BDA9D76)
fffff880`01136000 fffff880`01165000 SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`05793000 fffff880`0579e000 secdrv secdrv.SYS Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`03cef000 fffff880`03cfb000 serenum serenum.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`03d30000 fffff880`03d4d000 serial serial.sys Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`0165a000 fffff880`01662000 spldr spldr.sys Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`01007000 fffff880`0112d000 sptd sptd.sys Sun Oct 11 16:55:14 2009 (4AD24632)
fffff880`05c50000 fffff880`05ce8000 srv srv.sys Tue Dec 08 03:32:55 2009 (4B1E0F37)
fffff880`05600000 fffff880`05669000 srv2 srv2.sys Mon Jul 13 19:25:02 2009 (4A5BC24E)
fffff880`0579e000 fffff880`057cb000 srvnet srvnet.sys Tue Dec 08 03:32:26 2009 (4B1E0F1A)
fffff880`00c00000 fffff880`00c62000 storport storport.sys Mon Jul 13 20:01:18 2009 (4A5BCACE)
fffff880`10bf9000 fffff880`10bfa480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01803000 fffff880`01a00000 tcpip tcpip.sys Mon Jul 13 19:25:34 2009 (4A5BC26E)
fffff880`057cb000 fffff880`057dd000 tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`03afe000 fffff880`03b0b000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`03ae0000 fffff880`03afe000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`03d68000 fffff880`03d7c000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`005f0000 fffff960`005fa000 TSDDD TSDDD.dll unavailable (00000000)
fffff880`03cb2000 fffff880`03cd8000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`03f6d000 fffff880`03f7f000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`04ce6000 fffff880`04d03000 usbccgp usbccgp.sys Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`04d03000 fffff880`04d04f00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`03e9d000 fffff880`03eae000 usbehci usbehci.sys Sat Oct 24 00:27:33 2009 (4AE28235)
fffff880`03f8a000 fffff880`03fe4000 usbhub usbhub.sys Sat Oct 24 00:28:24 2009 (4AE28268)
fffff880`03e3c000 fffff880`03e47000 usbohci usbohci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`03e47000 fffff880`03e9d000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`011c6000 fffff880`011d3000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`03a66000 fffff880`03a74000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`03a74000 fffff880`03a99000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`0164a000 fffff880`0165a000 vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`011e8000 fffff880`011fd000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00f1b000 fffff880`00f77000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01273000 fffff880`012bf000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`03d4d000 fffff880`03d68000 wanarp wanarp.sys Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`03a99000 fffff880`03aa9000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e35000 fffff880`00ed9000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ed9000 fffff880`00ee8000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`03bda000 fffff880`03be3000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000d0000 fffff960`003df000 win32k win32k.sys unavailable (00000000)
fffff880`0112d000 fffff880`01136000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`04d80000 fffff880`04da1000 WudfPf WudfPf.sys Mon Jul 13 20:05:37 2009 (4A5BCBD1)
Unloaded modules:
fffff880`05ce8000 fffff880`05d59000 spsys.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`01424000 fffff880`01432000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`00c78000 fffff880`00c84000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`015f5000 fffff880`015fe000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
fffff880`03a19000 fffff880`03a2c000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
There is one thing all of the dmps have in common - drivers. So let's start with drivers.