Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\Mini121510-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Dec 15 07:17:28.671 2010 (UTC - 5:00)
System Uptime: 0 days 3:10:18.410
Loading Kernel Symbols
...............................................................
.............................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {0, 2, 1, 805226e8}
Probably caused by : memory_corruption ( nt!MiRemovePageByColor+66 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805226e8, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 00000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRemovePageByColor+66
805226e8 ff08 dec dword ptr [eax]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: hl2.exe
LAST_CONTROL_TRANSFER: from 80522a80 to 805226e8
STACK_TEXT:
afe0fcb4 80522a80 00000001 00000003 c011c2d0 nt!MiRemovePageByColor+0x66
afe0fcd0 80514aff c06008e0 c011c2d0 00000000 nt!MiRemoveZeroPage+0x8a
afe0fce8 805205ad 2385aded c011c2d0 897fc2a0 nt!MiResolveDemandZeroFault+0xc5
afe0fd4c 80544578 00000001 2385aded 00000001 nt!MmAccessFault+0xbeb
afe0fd4c 7c910f86 00000001 2385aded 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012d710 00000000 00000000 00000000 00000000 0x7c910f86
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiRemovePageByColor+66
805226e8 ff08 dec dword ptr [eax]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiRemovePageByColor+66
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xA_nt!MiRemovePageByColor+66
BUCKET_ID: 0xA_nt!MiRemovePageByColor+66
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\Mini121510-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Dec 15 07:18:27.281 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:42.024
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, bf807ecc, afbcfa50, 0}
Probably caused by : win32k.sys ( win32k!RFONTOBJ::bInit+e0 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf807ecc, The address that the exception occurred at
Arg3: afbcfa50, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
win32k!RFONTOBJ::bInit+e0
bf807ecc 8b402c mov eax,dword ptr [eax+2Ch]
TRAP_FRAME: afbcfa50 -- (.trap 0xffffffffafbcfa50)
ErrCode = 00000000
eax=00000008 ebx=afbcfcc4 ecx=89d1862c edx=00000000 esi=affcfcd0 edi=00000000
eip=bf807ecc esp=afbcfac4 ebp=afbcfb24 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!RFONTOBJ::bInit+0xe0:
bf807ecc 8b402c mov eax,dword ptr [eax+2Ch] ds:0023:00000034=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: Skype.exe
LAST_CONTROL_TRANSFER: from bf80810b to bf807ecc
STACK_TEXT:
afbcfb24 bf80810b afbcfcd0 00000000 00000002 win32k!RFONTOBJ::bInit+0xe0
afbcfb3c bf86effd afbcfcd0 00000000 00000002 win32k!RFONTOBJ::vInit+0x16
afbcfcc8 bf86f973 e2bed9c8 afbcfd0c 00000009 win32k!GreGetTextExtentW+0x5b
afbcfd48 8054161c 0b0106c4 05cc92e0 00000009 win32k!NtGdiGetTextExtent+0xdf
afbcfd48 7c90e4f4 0b0106c4 05cc92e0 00000009 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012db60 00000000 00000000 00000000 00000000 0x7c90e4f4
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!RFONTOBJ::bInit+e0
bf807ecc 8b402c mov eax,dword ptr [eax+2Ch]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!RFONTOBJ::bInit+e0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48025f2a
FAILURE_BUCKET_ID: 0x8E_win32k!RFONTOBJ::bInit+e0
BUCKET_ID: 0x8E_win32k!RFONTOBJ::bInit+e0
Followup: MachineOwner
---------
