Loading Dump File [C:\DUMPS\TabuIsMe\020311-22292-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e03000 PsLoadedModuleList = 0xfffff800`03040e50
Debug session time: Fri Feb 4 03:35:23.134 2011 (UTC + 0:00)
System Uptime: 0 days 8:31:55.866
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff880047151f9, fffff8800649b668, fffff8800649aed0}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880047151f9, The address that the exception occurred at
Arg3: fffff8800649b668, Exception Record Address
Arg4: fffff8800649aed0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
HTTP!UlLookupHeader+4c9
fffff880`047151f9 0000 add byte ptr [rax],al
EXCEPTION_RECORD: fffff8800649b668 -- (.exr 0xfffff8800649b668)
ExceptionAddress: fffff880047151f9 (HTTP!UlLookupHeader+0x00000000000004c9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000000000002
Attempt to write to address 0000000000000002
CONTEXT: fffff8800649aed0 -- (.cxr 0xfffff8800649aed0)
rax=0000000000000002 rbx=fffffa80082c3700 rcx=000000000000000a
rdx=fffff8800649b901 rsi=fffffa80082c3550 rdi=0000000000000008
rip=fffff880047151f9 rsp=fffff8800649b8a0 rbp=fffffa80082c3740
r8=fffffa80082c35a8 r9=0000000000000001 r10=0000000000000002
r11=fffffa80088620fa r12=0000000000000003 r13=0000000000000003
r14=fffffa80088620fa r15=fffff8800649ba68
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
HTTP!UlLookupHeader+0x4c9:
fffff880`047151f9 0000 add byte ptr [rax],al ds:002b:00000000`00000002=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000002
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ab0e0
0000000000000002
FOLLOWUP_IP:
HTTP!UlLookupHeader+4c9
fffff880`047151f9 0000 add byte ptr [rax],al
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: CODE_CORRUPTION
LAST_CONTROL_TRANSFER: from fffff880046f2b2c to fffff880047151f9
STACK_TEXT:
fffff880`0649b8a0 fffff880`046f2b2c : fffff880`0649bae8 fffffa80`088620fa 00000000`0000000a 00000000`00000003 : HTTP!UlLookupHeader+0x4c9
fffff880`0649b970 fffff880`046e3c4b : 00000000`00000015 fffffa80`00000003 00000000`00000177 fffff880`00000000 : HTTP! ?? ::NNGAKEGL::`string'+0x4399
fffff880`0649ba50 fffff880`04688e6d : fffffa80`082c3550 fffffa80`088620b3 fffffa80`05490012 fffff880`0649bbe0 : HTTP!UlParseHttp+0x4bc
fffff880`0649bb70 fffff880`0468838a : 00000000`00000000 00000000`00000000 fffffa80`07193580 00000000`00000000 : HTTP!UlpParseNextRequest+0x1ad
fffff880`0649bc50 fffff880`046d4289 : 00000000`00000000 fffffa80`082a9c40 00000000`00000000 00000000`00000003 : HTTP!UlpHandleRequest+0x10a
fffff880`0649bca0 fffff800`03117c06 : 00000000`05e1791e fffffa80`082c2b60 00000000`00000080 fffffa80`0518f840 : HTTP!UlpThreadPoolWorker+0x279
fffff880`0649bd40 fffff800`02e51c26 : fffff800`02fede80 fffffa80`082c2b60 fffff800`02ffbc40 fffff880`01250534 : nt!PspSystemThreadStartup+0x5a
fffff880`0649bd80 00000000`00000000 : fffff880`0649c000 fffff880`06496000 fffff880`0649b9f0 00000000`00000000 : nt!KxStartSystemThread+0x16
CHKIMG_EXTENSION: !chkimg -lo 50 -d !HTTP
fffff88004715178 - HTTP!UlLookupHeader+448
[ 00:0c ]
fffff8800471517a-fffff8800471517d 4 bytes - HTTP!UlLookupHeader+44a (+0x02)
[ 48 8d 53 20:00 00 c3 2c ]
fffff880047151f8-fffff880047151fd 6 bytes - HTTP!UlLookupHeader+4c8 (+0x7e)
[ 28 41 22 d9 66 41:0c 00 00 00 a6 4d ]
11 errors : !HTTP (fffff88004715178-fffff880047151fd)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
STACK_COMMAND: .cxr 0xfffff8800649aed0 ; kb
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE
BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE
Followup: memory_corruption
).
