[list=1]
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\FruitdaleJake\Windows_NT6_BSOD_jcgriff2\030612-25147-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0365a000 PsLoadedModuleList = 0xfffff800`0389f670
Debug session time: Tue Mar 6 21:55:19.526 2012 (UTC - 7:00)
System Uptime: 0 days 0:04:14.743
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff800039c1961, fffff8800807edb0, 0}
Probably caused by : ntkrnlmp.exe ( nt!ObLogSecurityDescriptor+c2 )
Followup: MachineOwner
---------
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800039c1961, Address of the instruction which caused the bugcheck
Arg3: fffff8800807edb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObLogSecurityDescriptor+c2
fffff800`039c1961 8b4614 mov eax,dword ptr [rsi+14h]
CONTEXT: fffff8800807edb0 -- (.cxr 0xfffff8800807edb0)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000011
rdx=00000000805dc8eb rsi=fffdf8a00180a500 rdi=00000000805dc97d
rip=fffff800039c1961 rsp=fffff8800807f790 rbp=fffffa8005312b60
r8=0000000000000068 r9=fffff8a0036668a4 r10=fffff8a0036668a4
r11=0000000000000084 r12=fffff80003883090 r13=0000000000000000
r14=fffff80003883098 r15=fffff8a003666820
iopl=0 nv up ei ng nz ac pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010293
nt!ObLogSecurityDescriptor+0xc2:
fffff800`039c1961 8b4614 mov eax,dword ptr [rsi+14h] ds:002b:fffdf8a0`0180a514=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800039c1961
STACK_TEXT:
fffff880`0807f790 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObLogSecurityDescriptor+0xc2
FOLLOWUP_IP:
nt!ObLogSecurityDescriptor+c2
fffff800`039c1961 8b4614 mov eax,dword ptr [rsi+14h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ObLogSecurityDescriptor+c2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff8800807edb0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ObLogSecurityDescriptor+c2
BUCKET_ID: X64_0x3B_nt!ObLogSecurityDescriptor+c2
Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\FruitdaleJake\Windows_NT6_BSOD_jcgriff2\030612-16504-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03612000 PsLoadedModuleList = 0xfffff800`03857670
Debug session time: Tue Mar 6 21:19:49.513 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:02.370
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800c11cb28, fffff8800c11c380, fffff800036a4915}
Probably caused by : Ntfs.sys ( Ntfs!NtfsReadMftRecord+b2 )
Followup: MachineOwner
---------
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800c11cb28
Arg3: fffff8800c11c380
Arg4: fffff800036a4915
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800c11cb28 -- (.exr 0xfffff8800c11cb28)
ExceptionAddress: fffff800036a4915 (nt!CcGetVirtualAddress+0x0000000000000105)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800c11c380 -- (.cxr 0xfffff8800c11c380)
rax=000000000000003d rbx=000000000000000e rcx=0000000000000012
rdx=0000000009300000 rsi=ff00fa80039d6ee0 rdi=0000000000000001
rip=fffff800036a4915 rsp=fffff8800c11cd60 rbp=fffffa80049b0e00
r8=0000000000000000 r9=0000000000f59800 r10=0000000000000800
r11=0000000000000001 r12=0000000000019800 r13=0000000000000001
r14=0000000000019800 r15=0000000000000001
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!CcGetVirtualAddress+0x105:
fffff800`036a4915 f00fc17e10 lock xadd dword ptr [rsi+10h],edi ds:002b:ff00fa80`039d6ef0=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: wmpnetwk.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800038c1100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsReadMftRecord+b2
fffff880`012fa1e2 84c0 test al,al
FAULTING_IP:
nt!CcGetVirtualAddress+105
fffff800`036a4915 f00fc17e10 lock xadd dword ptr [rsi+10h],edi
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff8000398b642 to fffff800036a4915
STACK_TEXT:
fffff880`0c11cd60 fffff800`0398b642 : fffff880`00000001 00000000`00f59800 fffff880`0c11ceb8 fffff880`0c11ceb0 : nt!CcGetVirtualAddress+0x105
fffff880`0c11cdf0 fffff880`012fa1e2 : fffffa80`04a9d200 fffff880`016d0160 00000000`000002db fffff880`0000000e : nt!CcMapData+0xd2
fffff880`0c11ceb0 fffff880`012f5d5c : fffffa80`061b0ce0 fffffa80`04aa9180 fffff8a0`029ef018 fffff8a0`0318cf01 : Ntfs!NtfsReadMftRecord+0xb2
fffff880`0c11cf60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsLookupInFileRecord+0x6c
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Ntfs!NtfsReadMftRecord+b2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff8800c11c380 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsReadMftRecord+b2
BUCKET_ID: X64_0x24_Ntfs!NtfsReadMftRecord+b2
Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\FruitdaleJake\Windows_NT6_BSOD_jcgriff2\030612-17955-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0341b000 PsLoadedModuleList = 0xfffff800`03660670
Debug session time: Tue Mar 6 16:43:14.409 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:57.627
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff880070996e8, fffff8800ad95650, 0}
Probably caused by : atikmpag.sys ( atikmpag+306e8 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880070996e8, Address of the instruction which caused the bugcheck
Arg3: fffff8800ad95650, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
atikmpag+306e8
fffff880`070996e8 ff5008 call qword ptr [rax+8]
CONTEXT: fffff8800ad95650 -- (.cxr 0xfffff8800ad95650)
rax=fffff8800706c030 rbx=fffffa8003a07040 rcx=fffffa8003a07040
rdx=fffff8800ad96050 rsi=fffff8800ad961d0 rdi=fffff8a00293a05c
rip=fffff880070996e8 rsp=fffff8800ad96030 rbp=00000000c0000001
r8=0000000000000000 r9=fffffa80054ab040 r10=0000000000000594
r11=fffff8800ad96050 r12=fffff8a00293a010 r13=0000000000000000
r14=fffffa80056046c0 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
atikmpag+0x306e8:
fffff880`070996e8 ff5008 call qword ptr [rax+8] ds:002b:fffff880`0706c038=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: sidebar.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880070996e8
STACK_TEXT:
fffff880`0ad96030 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atikmpag+0x306e8
FOLLOWUP_IP:
atikmpag+306e8
fffff880`070996e8 ff5008 call qword ptr [rax+8]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atikmpag+306e8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmpag
IMAGE_NAME: atikmpag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4edd79fe
STACK_COMMAND: .cxr 0xfffff8800ad95650 ; kb
FAILURE_BUCKET_ID: X64_0x3B_atikmpag+306e8
BUCKET_ID: X64_0x3B_atikmpag+306e8
Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\FruitdaleJake\Windows_NT6_BSOD_jcgriff2\030612-19593-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03400000 PsLoadedModuleList = 0xfffff800`03645670
Debug session time: Tue Mar 6 16:41:35.298 2012 (UTC - 7:00)
System Uptime: 0 days 0:03:32.516
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa0007310b80, 0, fffff8000357db2c, 7}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiEmptyPageAccessLog+dc )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa0007310b80, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000357db2c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036af100
fffffa0007310b80
FAULTING_IP:
nt!MiEmptyPageAccessLog+dc
fffff800`0357db2c 488b08 mov rcx,qword ptr [rax]
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: WerFault.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800c5907f0 -- (.trap 0xfffff8800c5907f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa0007310b80 rbx=0000000000000000 rcx=0000000000000010
rdx=fffff8a0038f42f8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000357db2c rsp=fffff8800c590980 rbp=0000000000000000
r8=fffffa8003f40001 r9=fffffa8003f7d048 r10=fffffa8007310b00
r11=fffffa80064f5a30 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiEmptyPageAccessLog+0xdc:
fffff800`0357db2c 488b08 mov rcx,qword ptr [rax] ds:fffffa00`07310b80=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003427347 to fffff8000347cc40
STACK_TEXT:
fffff880`0c590688 fffff800`03427347 : 00000000`00000050 fffffa00`07310b80 00000000`00000000 fffff880`0c5907f0 : nt!KeBugCheckEx
fffff880`0c590690 fffff800`0347ad6e : 00000000`00000000 fffffa00`07310b80 fffffa80`02424600 00000000`0065f001 : nt! ?? ::FNODOBFM::`string'+0x44711
fffff880`0c5907f0 fffff800`0357db2c : 00000000`00000000 fffffa80`07310b40 fffffa80`064f5a30 00000000`0065f000 : nt!KiPageFault+0x16e
fffff880`0c590980 fffff800`034f14d5 : fffffa80`03f43060 00000003`00000000 00000000`0065f001 fffffa00`07310b80 : nt!MiEmptyPageAccessLog+0xdc
fffff880`0c5909f0 fffff800`03794221 : fffffa80`068b0b50 00000000`00000000 fffffa80`07310b80 fffffa80`07310b80 : nt! ?? ::FNODOBFM::`string'+0x3b9a6
fffff880`0c590b10 fffff800`03794623 : 0000007f`00000000 00000000`01d40000 fffffa80`00000001 00000000`000ab701 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0c590bd0 fffff800`0347bed3 : 00000000`00000000 00000000`02398488 fffffa80`03f43060 00000000`0239847c : nt!NtUnmapViewOfSection+0x5f
fffff880`0c590c20 00000000`770c15ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000aabb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770c15ba
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiEmptyPageAccessLog+dc
fffff800`0357db2c 488b08 mov rcx,qword ptr [rax]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiEmptyPageAccessLog+dc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiEmptyPageAccessLog+dc
BUCKET_ID: X64_0x50_nt!MiEmptyPageAccessLog+dc
Followup: MachineOwner
---------
[/list]