Debugging Analysis:
Code:
[COLOR=Red]BugCheck 1E[/COLOR], {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Code:
fffff88002f8da08 -- ([COLOR=SeaGreen].exr 0xfffff88002f8da08[/COLOR])
ExceptionAddress: fffff80002e7b850 (nt!KiIdleLoop+0x0000000000000020)
ExceptionCode: [COLOR=Blue]c0000096[/COLOR]
ExceptionFlags: 00000000
NumberParameters: 0
Code:
2: kd> [COLOR=SeaGreen]!error c0000096[/COLOR]
Error code: (NTSTATUS) 0xc0000096 (3221225622) - {EXCEPTION} Privileged instruction.
Okay, the
nt!KiIdleLoop function call has executed a privileged instruction (Kernel Mode or Ring 0) in User Mode or Ring 3, which then resulted in the invalid operation code exception being raised and the exception handler interrupting the thread.
Code:
2: kd> [COLOR=SeaGreen]k[/COLOR]
Child-SP RetAddr Call Site
fffff880`02f8cae8 fffff800`02e7b57e nt!KeBugCheck
fffff880`02f8caf0 fffff800`02eae75d nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02f8cb20 fffff800`02ead535 [COLOR=Red]nt!RtlpExecuteHandlerForException[/COLOR]+0xd
fffff880`02f8cb50 fffff800`02ebe4e1 nt!RtlDispatchException+0x415
fffff880`02f8d230 fffff800`02e83202 nt!KiDispatchException+0x135
fffff880`02f8d8d0 fffff800`02e8135f nt!KiExceptionDispatch+0xc2
fffff880`02f8dab0 fffff800`02e7b850 [COLOR=Red]nt!KiInvalidOpcodeFault[/COLOR]+0x11f
fffff880`02f8dc40 00000000`00000000 [COLOR=Red]nt!KiIdleLoop[/COLOR]+0x20
Code:
2: kd> [COLOR=SeaGreen]r[/COLOR]
Last set context:
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e7b850 rsp=fffff88002f8dc40 rbp=0000000000000000
r8=fffffa800c6e1bb8 r9=0000000000000000 r10=fffffffffffffffb
r11=fffff88002f65101 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
[COLOR=Orange]iopl=0[/COLOR] nv up di pl zr na po nc
[COLOR=Red]cs=0010[/COLOR] ss=0018 ds=0000 es=0000 fs=0000 gs=0000 efl=00010046
nt!KiIdleLoop+0x20:
fffff800`02e7b850 440f22c1 [COLOR=Blue]mov[/COLOR] [COLOR=Red]cr8[/COLOR],[COLOR=Orange]rcx[/COLOR]
The last instruction which was called, was a simply copy some data from the
cr8 register to the
rcx register, this doesn't seem to be the problem. We need to disassemble the instruction to find more.
Code:
2: kd> [COLOR=SeaGreen]u nt!KiIdleLoop+0x20[/COLOR]
nt!KiIdleLoop+0x20:
fffff800`02e7b850 440f22c1 mov cr8,rcx
fffff800`02e7b854 488bcb mov rcx,rbx
fffff800`02e7b857 e884090100 call nt!PoIdle (fffff800`02e8c1e0)
fffff800`02e7b85c fb [COLOR=Blue]sti[/COLOR] <-- Problem may be here?
fffff800`02e7b85d b902000000 mov ecx,2
fffff800`02e7b862 440f22c1 mov cr8,rcx
fffff800`02e7b866 80630700 and byte ptr [rbx+7],0
fffff800`02e7b86a 803d41f9230000 cmp byte ptr [nt!HvlEnableIdleYield (fffff800`030bb1b2)],0
The IOPL (I/O Privilege Level has been set to 0), and therefore once this has been set, the
sti instruction can only be called from Ring 0. I believe this instruction sets interrupts to true.
I know, the
cs segment register contains the CPL (Current Privilege Level), which is supposedly the last two bits, but I'm not sure wherever this can be dumped properly. It was probably running at Ring 3, which would have caused the crash.
Code:
2: kd> [COLOR=SeaGreen].formats 0010[/COLOR]
Evaluate expression:
Hex: 00000000`00000010
Decimal: [COLOR=Red]16[/COLOR] <-- 16 bits
Octal: 0000000000000000000020
Binary: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00010000
Chars: ........
Time: Thu Jan 01 00:00:16 1970
Float: low 2.24208e-044 high 0
Double: 7.90505e-323
##############################################
##############################################
I looked through the raw stack, and noticed a few drivers:
Code:
2: kd> [COLOR=SeaGreen]lmvm athrx[/COLOR]
start end module name
fffff880`04c08000 fffff880`04fcf000 athrx T (no symbols)
Loaded symbol image file: athrx.sys
Image path: \SystemRoot\system32\DRIVERS\athrx.sys
Image name: athrx.sys
Timestamp: [COLOR=Red]Thu Oct 25 03:31:15 2012[/COLOR] (5088A473)
CheckSum: 003AF186
ImageSize: 003C7000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Your Atheros network adapter driver seems to be outdated and potentially causing problems, please update the driver from here -
ATHEROS drivers for Microsoft Windows (Atheros?????)
MSINFO32 seems to point to this model - Qualcomm Atheros AR946x Wireless Network Adapter
You may need to check your motherboard or model support page too.
Code:
2: kd> [COLOR=SeaGreen]lmvm iusb3xhc[/COLOR]
Browse full module list
start end module name
fffff880`0f000000 fffff880`0f0c3000 iusb3xhc T (no symbols)
Loaded symbol image file: iusb3xhc.sys
Image path: \SystemRoot\system32\DRIVERS\iusb3xhc.sys
Image name: iusb3xhc.sys
Timestamp: [COLOR=Red]Fri Mar 29 12:36:19 2013[/COLOR] (51558AC3)
CheckSum: 000C59AC
ImageSize: 000C3000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Your Intel(R) USB 3.0 eXtensible Host Controller Driver seems to be causing problems, check for updates or roll back to a previous driver. Check your motherboard or model support page too.
Code:
2: kd> [COLOR=SeaGreen]lmvm atikmdag[/COLOR]
start end module name
fffff880`0f0c5000 fffff880`0fdb2000 atikmdag T (no symbols)
Loaded symbol image file: atikmdag.sys
Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
Image name: atikmdag.sys
Timestamp: [COLOR=Red] Thu Nov 07 16:47:15 2013[/COLOR] (527BC413)
CheckSum: 00CA43A7
ImageSize: 00CED000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Your also seem to have updated to the Beta driver, and not the WHQL driver.
WHQL
Release Date: September 18th 2013
Version: 13.9
In Device Manager: 13.152
.