Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\121510-22635-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0320f000 PsLoadedModuleList = 0xfffff800`03443eb0
Debug session time: Wed Dec 15 13:57:22.974 2010 (UTC - 5:00)
System Uptime: 0 days 9:32:57.800
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80003253cef, 0, 7fffffa0000}
Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80003253cef, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000007fffffa0000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!RtlImageNtHeaderEx+3f
fffff800`03253cef 66390a cmp word ptr [rdx],cx
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 000007fffffa0000
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034ae0e0
000007fffffa0000
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff880022e13f8 -- (.exr 0xfffff880022e13f8)
ExceptionAddress: fffff80003253cef (nt!RtlImageNtHeaderEx+0x000000000000003f)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000007fffffa0000
Attempt to read from address 000007fffffa0000
TRAP_FRAME: fffff880022e14a0 -- (.trap 0xfffff880022e14a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003253cef rsp=fffff880022e1638 rbp=fffff880022e1770
r8=0000000000000000 r9=fffff880022e1678 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!RtlImageNtHeaderEx+0x3f:
fffff800`03253cef 66390a cmp word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800032b6789 to fffff80003275580
STACK_TEXT:
fffff880`022e0c28 fffff800`032b6789 : 00000000`0000001e ffffffff`c0000005 fffff800`03253cef 00000000`00000000 : nt!KeBugCheckEx
fffff880`022e0c30 fffff800`03274bc2 : fffff880`022e13f8 fffff880`08f9f890 fffff880`022e14a0 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`022e12c0 fffff800`0327373a : 00000000`00000000 000007ff`fffa0000 fffffa80`076e5900 fffff880`08f9f890 : nt!KiExceptionDispatch+0xc2
fffff880`022e14a0 fffff800`03253cef : fffff800`03253d7e 00000000`00000010 00000000`00000082 fffff880`022e1668 : nt!KiPageFault+0x23a
fffff880`022e1638 fffff800`03253d7e : 00000000`00000010 00000000`00000082 fffff880`022e1668 fffffa80`0923a040 : nt!RtlImageNtHeaderEx+0x3f
fffff880`022e1640 fffffa80`04bb0bc6 : fffff880`022e1770 00000000`00000000 fffffa80`04bb5260 fffffa80`04bb9300 : nt!RtlImageNtHeader+0x1e
fffff880`022e1670 fffff880`022e1770 : 00000000`00000000 fffffa80`04bb5260 fffffa80`04bb9300 00000000`00000000 : 0xfffffa80`04bb0bc6
fffff880`022e1678 00000000`00000000 : fffffa80`04bb5260 fffffa80`04bb9300 00000000`00000000 00000000`00000000 : 0xfffff880`022e1770
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!RtlImageNtHeaderEx+3f
fffff800`03253cef 66390a cmp word ptr [rdx],cx
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!RtlImageNtHeaderEx+3f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c42e3
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
BUCKET_ID: X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f
Followup: MachineOwner
---------
