Probably caused by : CI.dll ( CI!RSA32Alloc+14 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 8d339750
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
TRAP_FRAME: 8d395224 -- (.trap 0xffffffff8d395224)
ErrCode = 00000002
eax=91974000 ebx=8533e140 ecx=00000e92 edx=00000000 esi=91974000 edi=00001000
eip=82d7026e esp=8d395298 ebp=8d3952e0 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!ExAllocatePoolWithTag+0x6bd:
82d7026e 832600 and dword ptr [esi],0 ds:0023:91974000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 82cdc6f6 to 82c9705d
STACK_TEXT:
8d395024 82cdc6f6 82db9000 0000007a 00000002 nt!InterlockedPushListSList+0x1
8d395090 82ce43b3 0000007a 00000000 00000000 nt!MiRemoveAnyPage+0x514
8d3950b8 82cdea15 0000007a 00000000 00000000 nt!MiGetPage+0x28a
8d395100 82ce0ab9 00000001 91974000 8d395224 nt!MiResolveDemandZeroFault+0x121
8d395180 82cd6e96 91974000 00000000 82d84300 nt!MiDispatchFault+0x659
8d39520c 82c965d8 00000001 91974000 00000000 nt!MmAccessFault+0x157c
8d39520c 82d7026e 00000001 91974000 00000000 nt!KiTrap0E+0xdc
8d3952e0 83341743 00000001 0000060c 72634943 nt!ExAllocatePoolWithTag+0x6bd
8d3952f4 83348938 0000060c 8d3956f4 9196ea00 CI!RSA32Alloc+0x14
8d395354 833484b3 9196ea00 8d3954e4 8d3956f4 CI!Mod+0xc8
8d3953b0 83345f5f 8d3956f4 00000000 8c18bce8 CI!BenalohModExp+0x293
8d39546c 83301ae4 00000208 8d395904 8d3956f4 CI!BSafeEncPublicEx+0xdf
8d395b18 833012a2 00008004 8d395b90 00000014 CI!MinCryptVerifySignedHash+0xf0
8d395bec 83302942 9196db30 00000004 9196dab8 CI!MinCryptVerifyCertificateWithPolicy+0x320
8d395cbc 83302b51 91972008 00001b78 00000000 CI!MinCrypK_VerifySignedDataKModeEx+0x1fe
8d395d50 832ff306 91972000 00001b80 8d395f68 CI!MinCryptVerifySignedFileKMode+0x9a
8d395dfc 832fcee8 8d395ed8 91972000 00001b80 CI!MinCrypK_CheckSignedFile+0x35
8d395e58 832fdab0 87060310 8d395ed8 00008004 CI!CipFindFileHash+0xd6
8d395f34 832fdecf 87060310 920c0000 00039000 CI!CipValidateFileHash+0x1d4
8d395fac 82e2adc4 87060310 920c0000 00039000 CI!CiValidateImageHeader+0x171
8d395fc8 82e2ac32 87060310 920c0000 00039000 nt!SeValidateImageHeader+0x4d
8d395fcc 87060310 920c0000 00039000 00000001 nt!MiValidateImageHeader+0x1a4
WARNING: Frame IP not in any known module. Following frames may be wrong.
8d395fd0 920c0000 00039000 00000001 a091818d 0x87060310
8d395fd4 00039000 00000001 a091818d 86f54270 0x920c0000
8d395fd8 00000000 a091818d 86f54270 8d39607c 0x39000
STACK_COMMAND: kb
FOLLOWUP_IP:
CI!RSA32Alloc+14
83341743 5d pop ebp
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: CI!RSA32Alloc+14
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: CI
IMAGE_NAME: CI.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bdac8
FAILURE_BUCKET_ID: 0x7f_8_CI!RSA32Alloc+14
BUCKET_ID: 0x7f_8_CI!RSA32Alloc+14
Followup: MachineOwner
---------
3: kd> lm t n
start end module name
80bbd000 80bc5000 kdcom kdcom.dll Mon Jul 13 20:08:58 2009 (4A5BDAAA)
82c19000 82c50000 hal halmacpi.dll Mon Jul 13 18:11:03 2009 (4A5BBF07)
82c50000 83060000 nt ntkrpamp.exe Wed Jun 22 21:27:31 2011 (4E02A493)
83224000 8329c000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 20:06:41 2009 (4A5BDA21)
8329c000 832ad000 PSHED PSHED.dll Mon Jul 13 20:09:36 2009 (4A5BDAD0)
832ad000 832b5000 BOOTVID BOOTVID.dll Mon Jul 13 20:04:34 2009 (4A5BD9A2)
832b5000 832f7000 CLFS CLFS.SYS Mon Jul 13 18:11:10 2009 (4A5BBF0E)
832f7000 833a2000 CI CI.dll Mon Jul 13 20:09:28 2009 (4A5BDAC8)
833a2000 833c7000 ksecpkg ksecpkg.sys Thu Dec 10 22:04:22 2009 (4B21C4C6)
833c7000 833f4000 rdyboost rdyboost.sys Mon Jul 13 18:22:02 2009 (4A5BC19A)
8ae11000 8ae82000 Wdf01000 Wdf01000.sys Mon Jul 13 18:11:36 2009 (4A5BBF28)
8ae82000 8ae90000 WDFLDR WDFLDR.SYS Mon Jul 13 18:11:25 2009 (4A5BBF1D)
8ae90000 8aed8000 ACPI ACPI.sys Mon Jul 13 18:11:11 2009 (4A5BBF0F)
8aed8000 8aee1000 WMILIB WMILIB.SYS Mon Jul 13 18:11:22 2009 (4A5BBF1A)
8aee1000 8aee9000 msisadrv msisadrv.sys Mon Jul 13 18:11:09 2009 (4A5BBF0D)
8aee9000 8af13000 pci pci.sys Mon Jul 13 18:11:16 2009 (4A5BBF14)
8af13000 8af1e000 vdrvroot vdrvroot.sys Mon Jul 13 18:46:19 2009 (4A5BC74B)
8af1e000 8af2f000 partmgr partmgr.sys Mon Jul 13 18:11:35 2009 (4A5BBF27)
8af2f000 8af3f000 volmgr volmgr.sys Mon Jul 13 18:11:25 2009 (4A5BBF1D)
8af3f000 8af8a000 volmgrx volmgrx.sys Mon Jul 13 18:11:41 2009 (4A5BBF2D)
8af8a000 8afa0000 mountmgr mountmgr.sys Mon Jul 13 18:11:27 2009 (4A5BBF1F)
8afa0000 8afde000 NETIO NETIO.SYS Thu Apr 08 21:32:21 2010 (4BBE91B5)
8afde000 8aff5000 tdx tdx.sys Mon Jul 13 18:12:10 2009 (4A5BBF4A)
8b000000 8b00e000 Npfs Npfs.SYS Mon Jul 13 18:11:31 2009 (4A5BBF23)
8b019000 8b0f4000 iaStorV iaStorV.sys Fri Mar 05 15:26:21 2010 (4B9176FD)
8b0f4000 8b0fd000 amdxata amdxata.sys Fri Mar 19 11:19:01 2010 (4BA3A3F5)
8b0fd000 8b131000 fltmgr fltmgr.sys Mon Jul 13 18:11:13 2009 (4A5BBF11)
8b131000 8b142000 fileinfo fileinfo.sys Mon Jul 13 18:21:51 2009 (4A5BC18F)
8b142000 8b1f9000 ndis ndis.sys Mon Jul 13 18:12:24 2009 (4A5BBF58)
8b200000 8b20b000 TDI TDI.SYS Mon Jul 13 18:12:12 2009 (4A5BBF4C)
8b20b000 8b33a000 Ntfs Ntfs.sys Thu Mar 10 21:29:11 2011 (4D799707)
8b33a000 8b365000 msrpc msrpc.sys Mon Jul 13 18:11:59 2009 (4A5BBF3F)
8b365000 8b378000 ksecdd ksecdd.sys Mon Jul 13 18:11:56 2009 (4A5BBF3C)
8b378000 8b3d5000 cng cng.sys Mon Jul 13 18:32:55 2009 (4A5BC427)
8b3d5000 8b3e3000 pcw pcw.sys Mon Jul 13 18:11:10 2009 (4A5BBF0E)
8b3e3000 8b3ec000 Fs_Rec Fs_Rec.sys Mon Jul 13 18:11:14 2009 (4A5BBF12)
8b3ec000 8b3f7000 Msfs Msfs.SYS Mon Jul 13 18:11:26 2009 (4A5BBF1E)
8b400000 8b408000 rdpencdd rdpencdd.sys Mon Jul 13 19:01:39 2009 (4A5BCAE3)
8b408000 8b410000 rdprefmp rdprefmp.sys Mon Jul 13 19:01:41 2009 (4A5BCAE5)
8b419000 8b562000 tcpip tcpip.sys Mon Jun 20 22:25:01 2011 (4E000F0D)
8b562000 8b593000 fwpkclnt fwpkclnt.sys Mon Jul 13 18:12:03 2009 (4A5BBF43)
8b593000 8b5d2000 volsnap volsnap.sys Mon Jul 13 18:11:34 2009 (4A5BBF26)
8b5d2000 8b5da000 spldr spldr.sys Mon May 11 11:13:47 2009 (4A084EBB)
8b5da000 8b5ea000 mup mup.sys Mon Jul 13 18:14:14 2009 (4A5BBFC6)
8b5ea000 8b5f2000 mctkmdldr mctkmdldr.sys Tue Apr 13 05:50:47 2010 (4BC44C87)
8b5f2000 8b5fa000 hwpolicy hwpolicy.sys Mon Jul 13 18:11:01 2009 (4A5BBF05)
8b600000 8b608000 RDPCDD RDPCDD.sys Mon Jul 13 19:01:40 2009 (4A5BCAE4)
8b60f000 8b641000 fvevol fvevol.sys Fri Sep 25 21:24:21 2009 (4ABD7B55)
8b641000 8b652000 disk disk.sys Mon Jul 13 18:11:28 2009 (4A5BBF20)
8b652000 8b677000 CLASSPNP CLASSPNP.SYS Mon Jul 13 18:11:20 2009 (4A5BBF18)
8b677000 8b684000 crashdmp crashdmp.sys Mon Jul 13 18:45:50 2009 (4A5BC72E)
8b684000 8b75f000 dump_iaStorV dump_iaStorV.sys Fri Mar 05 15:26:21 2010 (4B9176FD)
8b75f000 8b770000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 18:12:47 2009 (4A5BBF6F)
8b770000 8b78f000 cdrom cdrom.sys Mon Jul 13 18:11:24 2009 (4A5BBF1C)
8b78f000 8b7b5800 MpFilter MpFilter.sys Wed Apr 06 13:25:55 2011 (4D9CB033)
8b7b6000 8b7bd000 Null Null.SYS Mon Jul 13 18:11:12 2009 (4A5BBF10)
8b7bd000 8b7c4000 Beep Beep.SYS Mon Jul 13 18:45:00 2009 (4A5BC6FC)
8b7c4000 8b7d0000 vga vga.sys Mon Jul 13 18:25:50 2009 (4A5BC27E)
8b7d0000 8b7f1000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 18:25:49 2009 (4A5BC27D)
8b7f1000 8b7fe000 watchdog watchdog.sys Mon Jul 13 18:24:10 2009 (4A5BC21A)
9042f000 90489000 afd afd.sys Sun Apr 24 21:35:37 2011 (4DB4DDF9)
90489000 904bb000 netbt netbt.sys Mon Jul 13 18:12:18 2009 (4A5BBF52)
904bb000 904c2000 wfplwf wfplwf.sys Mon Jul 13 18:53:51 2009 (4A5BC90F)
904c2000 904e1000 pacer pacer.sys Mon Jul 13 18:53:58 2009 (4A5BC916)
904e1000 904f2000 vwififlt vwififlt.sys Mon Jul 13 18:52:03 2009 (4A5BC8A3)
904f2000 90500000 netbios netbios.sys Mon Jul 13 18:53:54 2009 (4A5BC912)
90500000 90513000 wanarp wanarp.sys Mon Jul 13 18:55:02 2009 (4A5BC956)
90513000 90523000 termdd termdd.sys Mon Jul 13 19:01:35 2009 (4A5BCADF)
90523000 90564000 rdbss rdbss.sys Mon Jul 13 18:14:26 2009 (4A5BBFD2)
90564000 9056e000 nsiproxy nsiproxy.sys Mon Jul 13 18:12:08 2009 (4A5BBF48)
9056e000 90578000 mssmbios mssmbios.sys Mon Jul 13 18:19:25 2009 (4A5BC0FD)
90578000 9057d900 MpKsl75d84797 MpKsl75d84797.sys Tue Mar 30 21:06:14 2010 (4BB2AE16)
9057e000 9058a000 discache discache.sys Mon Jul 13 18:24:04 2009 (4A5BC214)
9058a000 905a2000 dfsc dfsc.sys Tue Apr 26 21:33:45 2011 (4DB78089)
905a2000 905b0000 blbdrive blbdrive.sys Mon Jul 13 18:23:04 2009 (4A5BC1D8)
905b0000 905d1000 tunnel tunnel.sys Mon Jul 13 18:54:03 2009 (4A5BC91B)
905d1000 905e3000 intelppm intelppm.sys Mon Jul 13 18:11:03 2009 (4A5BBF07)
93231000 93caedc0 nvlddmkm nvlddmkm.sys Fri Jul 09 16:15:14 2010 (4C379162)
93caf000 93cb0040 nvBridge nvBridge.kmd Fri Jul 09 16:10:11 2010 (4C379033)
93cb1000 93cf1000 mctkmd mctkmd.sys Wed May 26 06:18:29 2010 (4BFD0385)
93cf1000 93da8000 dxgkrnl dxgkrnl.sys Mon Nov 01 21:37:53 2010 (4CCF7981)
