Kernel base = 0xfffff800`02a0e000 PsLoadedModuleList = 0xfffff800`02c4be50
Debug session time: Mon Sep 6 12:46:58.341 2010 (GMT-4)
System Uptime: 0 days 3:27:39.713
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {5003, fffff70001080000, b43b, bf6100016872}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29fd7 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 000000000000b43b
Arg4: 0000bf6100016872
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_5003
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002aefa08 to fffff80002a7ff00
STACK_TEXT:
fffff880`094d99c8 fffff800`02aefa08 : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`0000b43b : nt!KeBugCheckEx
fffff880`094d99d0 fffff800`02a9a1a6 : 00000000`00000001 00000000`0d28a000 fffff880`094d9c20 fffff680`00069450 : nt! ?? ::FNODOBFM::`string'+0x29fd7
fffff880`094d9ac0 fffff800`02a7dfee : 00000000`00000001 00000000`0d289ffc 00000000`0f340d01 00000000`0014b568 : nt!MmAccessFault+0x5c6
fffff880`094d9c20 00000000`705f872e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0014b420 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x705f872e
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+29fd7
fffff800`02aefa08 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+29fd7
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+29fd7
BUCKET_ID: X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+29fd7
Followup: MachineOwner
---------
System Uptime: 0 days 0:19:49.556
Unable to load image Unknown_Module_c66878db`85fff86d, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Unknown_Module_c66878db`85fff86d
*** ERROR: Module load completed but symbols could not be loaded for Unknown_Module_c66878db`85fff86d
Debugger can not determine kernel base address
Loading Kernel Symbols
.
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7E, {ffffffffc0000005, fffff80002a84b5c, fffff8800338dfd8, fffff8800338d830}
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002a84b5c, The address that the exception occurred at
Arg3: fffff8800338dfd8, Exception Record Address
Arg4: fffff8800338d830, Context Record Address
Debugging Details:
------------------
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
+5dfa952f01ecdf90
fffff800`02a84b5c 0fb742c0 movzx eax,word ptr [rdx-40h]
EXCEPTION_RECORD: fffff8800338dfd8 -- (.exr 0xfffff8800338dfd8)
Cannot read Exception record @ fffff8800338dfd8
CONTEXT: fffff8800338d830 -- (.cxr 0xfffff8800338d830)
Unable to read context, Win32 error 0n30
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x7E
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002ae5a3a to fffff880045859c2
STACK_TEXT:
fffff800`041e6c98 fffff800`02ae5a3a : 00000000`0023c380 fffffa80`043558a8 fffff800`02c5ec40 00000000`00000001 : 0xfffff880`045859c2
fffff800`041e6ca0 00000000`0023c380 : fffffa80`043558a8 fffff800`02c5ec40 00000000`00000001 fffff800`02c50e80 : 0xfffff800`02ae5a3a
fffff800`041e6ca8 fffffa80`043558a8 : fffff800`02c5ec40 00000000`00000001 fffff800`02c50e80 fffff800`02ae3697 : 0x23c380
fffff800`041e6cb0 fffff800`02c5ec40 : 00000000`00000001 fffff800`02c50e80 fffff800`02ae3697 00000000`a6381606 : 0xfffffa80`043558a8
fffff800`041e6cb8 00000000`00000001 : fffff800`02c50e80 fffff800`02ae3697 00000000`a6381606 00000000`a63815fa : 0xfffff800`02c5ec40
fffff800`041e6cc0 fffff800`02c50e80 : fffff800`02ae3697 00000000`a6381606 00000000`a63815fa 00000000`a6381606 : 0x1
fffff800`041e6cc8 fffff800`02ae3697 : 00000000`a6381606 00000000`a63815fa 00000000`a6381606 00000000`000000dd : 0xfffff800`02c50e80
fffff800`041e6cd0 00000000`a6381606 : 00000000`a63815fa 00000000`a6381606 00000000`000000dd fffffa80`04355810 : 0xfffff800`02ae3697
fffff800`041e6cd8 00000000`a63815fa : 00000000`a6381606 00000000`000000dd fffffa80`04355810 400000c2`400000c1 : 0xa6381606
fffff800`041e6ce0 00000000`a6381606 : 00000000`000000dd fffffa80`04355810 400000c2`400000c1 00000009`400000c3 : 0xa63815fa
fffff800`041e6ce8 00000000`000000dd : fffffa80`04355810 400000c2`400000c1 00000009`400000c3 00000000`a0d3b1bf : 0xa6381606
fffff800`041e6cf0 fffffa80`04355810 : 400000c2`400000c1 00000009`400000c3 00000000`a0d3b1bf fffff800`041e0080 : 0xdd
fffff800`041e6cf8 400000c2`400000c1 : 00000009`400000c3 00000000`a0d3b1bf fffff800`041e0080 fffffa80`024b89e0 : 0xfffffa80`04355810
fffff800`041e6d00 00000009`400000c3 : 00000000`a0d3b1bf fffff800`041e0080 fffffa80`024b89e0 00000000`00000000 : 0x400000c2`400000c1
fffff800`041e6d08 00000000`a0d3b1bf : fffff800`041e0080 fffffa80`024b89e0 00000000`00000000 00000298`89153075 : 0x9`400000c3
fffff800`041e6d10 fffff800`041e0080 : fffffa80`024b89e0 00000000`00000000 00000298`89153075 00000298`891538af : 0xa0d3b1bf
fffff800`041e6d18 fffffa80`024b89e0 : 00000000`00000000 00000298`89153075 00000298`891538af fffff800`02c5ec40 : 0xfffff800`041e0080
fffff800`041e6d20 00000000`00000000 : 00000298`89153075 00000298`891538af fffff800`02c5ec40 fffff800`041e0080 : 0xfffffa80`024b89e0
STACK_COMMAND: kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: CORRUPT_MODULELIST
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\Downloads\A-Rar\090710-21996-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*[url=http://msdl.microsoft.com/download/symbols]Symbol information[/url]
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5c000 PsLoadedModuleList = 0xfffff800`02c99e50
Debug session time: Tue Sep 7 00:06:35.906 2010 (GMT-4)
System Uptime: 0 days 0:06:59.841
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002dc6ac1, fffff8800622bab0, 0}
Probably caused by : ntkrnlmp.exe ( nt!ObpWaitForMultipleObjects+186 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002dc6ac1, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800622bab0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObpWaitForMultipleObjects+186
fffff800`02dc6ac1 488b4a20 mov rcx,qword ptr [rdx+20h]
CONTEXT: fffff8800622bab0 -- (.cxr 0xfffff8800622bab0)
rax=0000000000000000 rbx=fffff8a000fefb00 rcx=fffff80002a5c000
rdx=0000000000000000 rsi=000000000000003a rdi=fffffa800597f010
rip=fffff80002dc6ac1 rsp=fffff8800622c490 rbp=fffff8800622cca0
r8=0000000000000008 r9=fffff8a001010000 r10=fffffa800565c6d0
r11=fffffffffffffd80 r12=fffff8800622cb68 r13=fffff8a000e43400
r14=0000000000000039 r15=0000000000000040
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObpWaitForMultipleObjects+0x186:
fffff800`02dc6ac1 488b4a20 mov rcx,qword ptr [rdx+20h] ds:002b:00000000`00000020=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002dc6ac1
STACK_TEXT:
fffff880`0622c490 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpWaitForMultipleObjects+0x186
FOLLOWUP_IP:
nt!ObpWaitForMultipleObjects+186
fffff800`02dc6ac1 488b4a20 mov rcx,qword ptr [rdx+20h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ObpWaitForMultipleObjects+186
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
STACK_COMMAND: .cxr 0xfffff8800622bab0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ObpWaitForMultipleObjects+186
BUCKET_ID: X64_0x3B_nt!ObpWaitForMultipleObjects+186
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\Downloads\A-Rar\090710-22323-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*[url=http://msdl.microsoft.com/download/symbols]Symbol information[/url]
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5a000 PsLoadedModuleList = 0xfffff800`02c97e50
Debug session time: Mon Sep 6 23:09:26.537 2010 (GMT-4)
System Uptime: 0 days 0:18:00.472
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff80002b132d4, fffff880009a99d8, fffff880009a9230}
Probably caused by : memory_corruption ( nt!MmZeroPageThread+823 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002b132d4, The address that the exception occurred at
Arg3: fffff880009a99d8, Exception Record Address
Arg4: fffff880009a9230, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MmZeroPageThread+823
fffff800`02b132d4 4d8b3f mov r15,qword ptr [r15]
EXCEPTION_RECORD: fffff880009a99d8 -- (.exr 0xfffff880009a99d8)
ExceptionAddress: fffff80002b132d4 (nt!MmZeroPageThread+0x0000000000000823)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880009a9230 -- (.cxr 0xfffff880009a9230)
rax=0000000000000000 rbx=fa80044b716004c0 rcx=fffff880009a9ba8
rdx=0000000000000001 rsi=000000000009340d rdi=0000000000000002
rip=fffff80002b132d4 rsp=fffff880009a9c10 rbp=0000000000000000
r8=fffffa8000e06670 r9=0000000000000000 r10=fffff80002d04400
r11=fffff880009a9be0 r12=0000000000000000 r13=0000000000000000
r14=0000058000000000 r15=fa80044b716004c0
iopl=0 nv up ei ng nz ac pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010293
nt!MmZeroPageThread+0x823:
fffff800`02b132d4 4d8b3f mov r15,qword ptr [r15] ds:002b:fa80044b`716004c0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d020e0
ffffffffffffffff
FOLLOWUP_IP:
nt!MmZeroPageThread+823
fffff800`02b132d4 4d8b3f mov r15,qword ptr [r15]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff80002d6f166 to fffff80002b132d4
STACK_TEXT:
fffff880`009a9c10 fffff800`02d6f166 : fffffa80`024b93b0 00000000`00000080 fffffa80`024b9890 fffff800`02aaa479 : nt!MmZeroPageThread+0x823
fffff880`009a9d40 fffff800`02aaa486 : fffff800`02c44e80 fffffa80`024b93b0 fffff800`02c52c40 00060b01`30025003 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a99b0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MmZeroPageThread+823
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
STACK_COMMAND: .cxr 0xfffff880009a9230 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x7E_nt!MmZeroPageThread+823
BUCKET_ID: X64_0x7E_nt!MmZeroPageThread+823
Followup: MachineOwner
---------