Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\Temp\Rar$DI00.500\110609-18673-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x81a44000 PsLoadedModuleList = 0x81b8c810
Debug session time: Fri Nov 6 03:20:08.563 2009 (GMT-5)
System Uptime: 0 days 4:53:41.219
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 81c96968, 8efd8b1c, 0}
Probably caused by : memory_corruption ( nt!MiMapViewOfDataSection+105 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 81c96968, The address that the exception occurred at
Arg3: 8efd8b1c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiMapViewOfDataSection+105
81c96968 8b4308 mov eax,dword ptr [ebx+8]
TRAP_FRAME: 8efd8b1c -- (.trap 0xffffffff8efd8b1c)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=8efd8c0c edx=00000000 esi=00000000 edi=00000000
eip=81c96968 esp=8efd8b90 ebp=8efd8be4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiMapViewOfDataSection+0x105:
81c96968 8b4308 mov eax,dword ptr [ebx+8] ds:0023:00000008=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: ehshell.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 81cb290c to 81c96968
STACK_TEXT:
8efd8be4 81cb290c 8467cef0 8423a440 8efd8ce4 nt!MiMapViewOfDataSection+0x105
8efd8c58 81cc31b1 8423a440 8efd8ce4 00000000 nt!MiMapViewOfSection+0x251
8efd8c88 81cc30dc 919a02a8 8423a440 8efd8ce4 nt!MmMapViewOfSection+0x2a
8efd8d04 81a8742a 0000035c ffffffff 1008fb18 nt!NtMapViewOfSection+0x204
8efd8d04 773164f4 0000035c ffffffff 1008fb18 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
1008fb04 00000000 00000000 00000000 00000000 0x773164f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiMapViewOfDataSection+105
81c96968 8b4308 mov eax,dword ptr [ebx+8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiMapViewOfDataSection+105
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc007
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x8E_nt!MiMapViewOfDataSection+105
BUCKET_ID: 0x8E_nt!MiMapViewOfDataSection+105
Followup: MachineOwner
---------
1: kd> .trap 0xffffffff8efd8b1c
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=8efd8c0c edx=00000000 esi=00000000 edi=00000000
eip=81c96968 esp=8efd8b90 ebp=8efd8be4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiMapViewOfDataSection+0x105:
81c96968 8b4308 mov eax,dword ptr [ebx+8] ds:0023:00000008=????????