It depends. Your ability to use extensions is a bare minimum when you are dealing with a minidump, and it varies depending on the necessity.
In general, the output upto the second break point is good enough.
Yeah ok! Could you please walk me through this one? Or is it as easy as it seems? Looking at this is seems like it was caused by the PTC driver. (We use PTC software) Is it this?
Again forgetting the code! lol!
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\*******\Documents\New folder (2)\091114-11356-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: symsrv*symsrv.dll*c:\Windows\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`03452000 PsLoadedModuleList = 0xfffff800`036956d0
Debug session time: Thu Sep 11 07:13:19.667 2014 (UTC + 1:00)
System Uptime: 2 days 16:36:14.000
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
......
Unable to load image \SystemRoot\system32\DRIVERS\PtcVFsd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PtcVFsd.sys
*** ERROR: Module load completed but symbols could not be loaded for PtcVFsd.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff800034e6527, fffff88003377848, fffff880033770a0}
Probably caused by : PtcVFsd.sys ( PtcVFsd+93be )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800034e6527, The address that the exception occurred at
Arg3: fffff88003377848, Exception Record Address
Arg4: fffff880033770a0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExfReleaseRundownProtection+7
fffff800`034e6527 488b09 mov rcx,qword ptr [rcx]
EXCEPTION_RECORD: fffff88003377848 -- (.exr 0xfffff88003377848)
ExceptionAddress: fffff800034e6527 (nt!ExfReleaseRundownProtection+0x0000000000000007)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000008
Attempt to read from address 0000000000000008
CONTEXT: fffff880033770a0 -- (.cxr 0xfffff880033770a0)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000008
rdx=fffffa800ff4a860 rsi=fffffa800ff4a860 rdi=fffffa8013f70e40
rip=fffff800034e6527 rsp=fffff88003377a80 rbp=0000000000000001
r8=0000000000000008 r9=0000000000000005 r10=0000000000000000
r11=fffffa800ca99e58 r12=fffffa8013f70e48 r13=0000000000000001
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!ExfReleaseRundownProtection+0x7:
fffff800`034e6527 488b09 mov rcx,qword ptr [rcx] ds:002b:00000000`00000008=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000008
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036ff100
0000000000000008
FOLLOWUP_IP:
PtcVFsd+93be
fffff880`049c63be ?? ???
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff880049c63be to fffff800034e6527
STACK_TEXT:
fffff880`03377a80 fffff880`049c63be : 00000000`00000000 fffffa80`0f5c8510 fffffa80`00000000 00000000`00000001 : nt!ExfReleaseRundownProtection+0x7
fffff880`03377ab0 00000000`00000000 : fffffa80`0f5c8510 fffffa80`00000000 00000000`00000001 00000000`00000001 : PtcVFsd+0x93be
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: PtcVFsd+93be
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: PtcVFsd
IMAGE_NAME: PtcVFsd.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d432fd9
STACK_COMMAND: .cxr 0xfffff880033770a0 ; kb
FAILURE_BUCKET_ID: X64_0x7E_PtcVFsd+93be
BUCKET_ID: X64_0x7E_PtcVFsd+93be
Followup: MachineOwner
---------
