Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\DOCUME~1\JK\LOCALS~1\Temp\Temporary Directory 3 for Windows_NT6_BSOD_jcgriff2 (1).zip\Windows_NT6_BSOD_jcgriff2\110310-22323-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e19000 PsLoadedModuleList = 0xfffff800`03056e50
Debug session time: Wed Nov 3 05:57:39.545 2010 (GMT-5)
System Uptime: 0 days 9:14:56.340
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff80002e8c8e9, fffff88002f2b9a8, fffff88002f2b210}
Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListResume16+4 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e8c8e9, The address that the exception occurred at
Arg3: fffff88002f2b9a8, Exception Record Address
Arg4: fffff88002f2b210, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!ExpInterlockedPopEntrySListResume16+4
fffff800`02e8c8e9 498b02 mov rax,qword ptr [r10]
EXCEPTION_RECORD: fffff88002f2b9a8 -- (.exr 0xfffff88002f2b9a8)
ExceptionAddress: fffff80002e8c8e9 (nt!ExpInterlockedPopEntrySListResume16+0x0000000000000004)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
CONTEXT: fffff88002f2b210 -- (.cxr 0xfffff88002f2b210)
rax=0000000000000002 rbx=0000000000000001 rcx=0000000000000000
rdx=0000000000000001 rsi=fffff8a000742010 rdi=fffff8a007c72130
rip=fffff80002e8c8e9 rsp=fffff88002f2bbe0 rbp=0000000000000001
r8=0000000001b04c2c r9=fffff8a000742010 r10=0000000000000000
r11=fffffa80015b8040 r12=000000003d4b1633 r13=0000000000000001
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!ExpInterlockedPopEntrySListResume16+0x4:
fffff800`02e8c8e9 498b02 mov rax,qword ptr [r10] ds:002b:00000000`00000000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c10e0
0000000000000000
FOLLOWUP_IP:
nt!ExpInterlockedPopEntrySListResume16+4
fffff800`02e8c8e9 498b02 mov rax,qword ptr [r10]
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff80002f2843b to fffff80002e8c8e9
STACK_TEXT:
fffff880`02f2bbe0 fffff800`02f2843b : fffffa80`015b8040 fffff800`0317c49d fffffa80`01620040 fffffa80`015b8040 : nt!ExpInterlockedPopEntrySListResume16+0x4
fffff880`02f2bbf0 fffff800`030f07ec : 00000000`00000000 fffff8a0`00742010 fffff800`0308ef20 00000000`00000001 : nt!CmpLockTableAdd+0x1b
fffff880`02f2bc30 fffff800`0317c9c4 : 00000000`00000000 00000000`00000001 fffff8a0`00742010 fffffa80`015b8040 : nt! ?? ::NNGAKEGL::`string'+0x10ba6
fffff880`02f2bc80 fffff800`02e96961 : fffff800`0317c8dc fffff800`0302e5f8 fffffa80`015b8040 00000000`00000000 : nt!CmpDelayDerefKCBWorker+0xe8
fffff880`02f2bcb0 fffff800`0312dc06 : 00000000`00000000 fffffa80`015b8040 00000000`00000080 fffffa80`0154a9e0 : nt!ExpWorkerThread+0x111
fffff880`02f2bd40 fffff800`02e67c26 : fffff880`02d63180 fffffa80`015b8040 fffff880`02d6df80 083e0b06`38090534 : nt!PspSystemThreadStartup+0x5a
fffff880`02f2bd80 00000000`00000000 : fffff880`02f2c000 fffff880`02f26000 fffff880`02f2b970 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpInterlockedPopEntrySListResume16+4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
STACK_COMMAND: .cxr 0xfffff88002f2b210 ; kb
FAILURE_BUCKET_ID: X64_0x7E_nt!ExpInterlockedPopEntrySListResume16+4
BUCKET_ID: X64_0x7E_nt!ExpInterlockedPopEntrySListResume16+4
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\DOCUME~1\JK\LOCALS~1\Temp\Temporary Directory 2 for Windows_NT6_BSOD_jcgriff2 (1).zip\Windows_NT6_BSOD_jcgriff2\110310-45833-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e04000 PsLoadedModuleList = 0xfffff800`03041e50
Debug session time: Wed Nov 3 16:28:36.760 2010 (GMT-5)
System Uptime: 0 days 6:16:04.305
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d893f6a69f, b3b7465ee6737905, fffff80002e6c8d0, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d893f6a69f, Reserved
Arg2: b3b7465ee6737905, Reserved
Arg3: fffff80002e6c8d0, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
------------------
BUGCHECK_STR: 0x109
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002e74740
STACK_TEXT:
fffff880`031325d8 00000000`00000000 : 00000000`00000109 a3a039d8`93f6a69f b3b7465e`e6737905 fffff800`02e6c8d0 : nt!KeBugCheckEx
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80002e6c8d6 - nt!ExInterlockedInsertHeadList+6
[ 49:4d ]
1 error : !nt (fffff80002e6c8d6)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
