Krischan

New Member
Joined
Dec 1, 2015
Messages
1
Hi guys,
my wifes computer came down with a buttload of bluescreens over evening and we have no idea, why.
I got a memory dump and tried to use the debugger but I'm not really getting anything useful (for my knowhow level) of it.
Maybe one of you guys can do it?:
Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E1, {fffff800041d54b0, 2, fffffa800f85de00, fffffa800f85de00}

Probably caused by : ntkrnlmp.exe ( nt!IopProcessWorkItem+0 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)
Arguments:
Arg1: fffff800041d54b0, address of worker routine (do ln on this to find guilty driver)
Arg2: 0000000000000002, IRQL returned at (should have been 0, but isn't).
Arg3: fffffa800f85de00, workitem parameter
Arg4: fffffa800f85de00, workitem address

Debugging Details:
------------------


FAULTING_IP:
nt!IopProcessWorkItem+0
fffff800`041d54b0 fff3            push    rbx

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xE1

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80003f678fe to fffff80003edbc40

STACK_TEXT: 
fffff880`035bdb68 fffff800`03f678fe : 00000000`000000e1 fffff800`041d54b0 00000000`00000002 fffffa80`0f85de00 : nt!KeBugCheckEx
fffff880`035bdb70 fffff800`04175b86 : 00000000`00000000 fffffa80`0c79d040 00000000`00000080 fffffa80`0c7625d0 : nt! ?? ::FNODOBFM::`string'+0x57bc6
fffff880`035bdc00 fffff800`03ecd0e6 : fffff880`03389180 fffffa80`0c79d040 fffff880`033940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`035bdc40 00000000`00000000 : fffff880`035be000 fffff880`035b8000 fffff880`035bd8a0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP:
nt!IopProcessWorkItem+0
fffff800`041d54b0 fff3            push    rbx

SYMBOL_NAME:  nt!IopProcessWorkItem+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5625815c

FAILURE_BUCKET_ID:  X64_0xE1_nt!IopProcessWorkItem+0

BUCKET_ID:  X64_0xE1_nt!IopProcessWorkItem+0

Followup: MachineOwner
---------

4: kd> ln fffff800041d54b0
(fffff800`041d54b0)   nt!IopProcessWorkItem   |  (fffff800`041d54f8)   nt!NtWaitForMultipleObjects
Exact matches:
    nt!IopProcessWorkItem = <no type information>
4: kd> g
       ^ No runnable debuggees error in 'g'

as you can see, I found the information, to look for the parameter 1 there from some blog entry but i'm really not an expert and can't do anything about the output.
I'd be really glad for your help
 


Hi,
please read the thread found here and post the results:
Link Removed

Thread moved to correct section.
 


Back
Top