Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032111-12906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82c17000 PsLoadedModuleList = 0x82d56570
Debug session time: Mon Mar 21 02:37:45.713 2011 (UTC - 4:00)
System Uptime: 0 days 0:27:51.557
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 82d2ef03, 926f7b54, 0}
Probably caused by : win32k.sys ( win32k!XDCOBJ::bCleanDC+24d )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82d2ef03, The address that the exception occurred at
Arg3: 926f7b54, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExFreePoolWithTag+466
82d2ef03 0fb74ffa movzx ecx,word ptr [edi-6]
TRAP_FRAME: 926f7b54 -- (.trap 0xffffffff926f7b54)
ErrCode = 00000000
eax=00000000 ebx=926f7cfc ecx=00008400 edx=00000001 esi=00008400 edi=00008400
eip=82d2ef03 esp=926f7bc8 ebp=926f7c24 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExFreePoolWithTag+0x466:
82d2ef03 0fb74ffa movzx ecx,word ptr [edi-6] ds:0023:000083fa=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 9711e637 to 82d2ef03
STACK_TEXT:
926f7c24 9711e637 00008400 00000000 054a0d6e nt!ExFreePoolWithTag+0x466
926f7ca0 9711e1e8 00000000 054a0d12 00000000 win32k!XDCOBJ::bCleanDC+0x24d
926f7cdc 9711df62 926f7cfc 00000000 00000000 win32k!bDeleteDCInternalWorker+0x1b
926f7d08 970ffc29 0301082c 00000000 00000000 win32k!bDeleteDCInternal+0x30
926f7d28 82c4c79a 0301082c 0022e658 77cc64f4 win32k!NtGdiDeleteObjectApp+0xa0
926f7d28 77cc64f4 0301082c 0022e658 77cc64f4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0022e658 00000000 00000000 00000000 00000000 0x77cc64f4
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!XDCOBJ::bCleanDC+24d
9711e637 8b03 mov eax,dword ptr [ebx]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: win32k!XDCOBJ::bCleanDC+24d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c7dbbb5
FAILURE_BUCKET_ID: 0x8E_win32k!XDCOBJ::bCleanDC+24d
BUCKET_ID: 0x8E_win32k!XDCOBJ::bCleanDC+24d
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032111-12359-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82c03000 PsLoadedModuleList = 0x82d42570
Debug session time: Sun Mar 20 11:36:25.262 2011 (UTC - 4:00)
System Uptime: 0 days 0:19:47.090
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.....
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: a127e7d0
Arg3: a127e3b0
Arg4: 8bcd2629
Debugging Details:
------------------
EXCEPTION_RECORD: a127e7d0 -- (.exr 0xffffffffa127e7d0)
ExceptionAddress: 8bcd2629 (Ntfs!NtfsFcbTableCompare+0x00000015)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000210
Attempt to read from address 00000210
CONTEXT: a127e3b0 -- (.cxr 0xffffffffa127e3b0)
eax=000a0000 ebx=99ec6600 ecx=00000210 edx=0000d975 esi=00000200 edi=860ea3e8
eip=8bcd2629 esp=a127e898 ebp=a127e8b0 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
Ntfs!NtfsFcbTableCompare+0x15:
8bcd2629 8b31 mov esi,dword ptr [ecx] ds:0023:00000210=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: WerFault.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000210
READ_ADDRESS: GetPointerFromAddress: unable to read from 82d62700
Unable to read MiSystemVaType memory at 82d420c0
00000210
FOLLOWUP_IP:
Ntfs!NtfsFcbTableCompare+15
8bcd2629 8b31 mov esi,dword ptr [ecx]
FAULTING_IP:
Ntfs!NtfsFcbTableCompare+15
8bcd2629 8b31 mov esi,dword ptr [ecx]
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 82c884e0 to 8bcd2629
STACK_TEXT:
a127e8b0 82c884e0 860ea3e8 a127e914 00000210 Ntfs!NtfsFcbTableCompare+0x15
a127e8c8 82c8852a a127e914 a127e900 860ea0d8 nt!FindNodeOrParent+0x20
a127e8e0 82c88560 860ea3e8 a127e914 a127e900 nt!RtlLookupElementGenericTableFullAvl+0x16
a127e8f8 8bccda5e 860ea3e8 a127e914 8d58ad08 nt!RtlLookupElementGenericTableAvl+0x18
a127e994 8bcba8cc 8597e798 99ec6600 8d58ad08 Ntfs!NtfsRetrieveOtherFileName+0x131
a127eb98 8bcd8783 8597e798 8739e4b0 860ea0d8 Ntfs!NtfsQueryDirectory+0xc74
a127ebcc 8bcd84fa 8597e798 99ec6600 2ae156a1 Ntfs!NtfsCommonDirectoryControl+0x21d
a127ec34 82c31f44 860ea020 8739e4b0 8739e4b0 Ntfs!NtfsFsdDirectoryControl+0xf7
a127ec4c 8bb6320c 860b2cd0 8739e4b0 00000000 nt!IofCallDriver+0x63
a127ec70 8bb633cb a127ec90 860b2cd0 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
a127eca8 82c31f44 860b2cd0 8739e4b0 8739e4b0 fltmgr!FltpDispatch+0xc5
a127ecc0 82e07307 00000140 0019dc20 82e59adf nt!IofCallDriver+0x63
a127ece0 82e59b3a 860b2cd0 874d4e28 00000001 nt!IopSynchronousServiceTail+0x1f8
a127ed00 82c3879a 00000140 00000000 00000000 nt!NtQueryDirectoryFile+0x5b
a127ed00 77d364f4 00000140 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0019dc5c 00000000 00000000 00000000 00000000 0x77d364f4
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFcbTableCompare+15
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf45
STACK_COMMAND: .cxr 0xffffffffa127e3b0 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsFcbTableCompare+15
BUCKET_ID: 0x24_Ntfs!NtfsFcbTableCompare+15
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032111-11875-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82c08000 PsLoadedModuleList = 0x82d47570
Debug session time: Sun Mar 20 22:45:35.250 2011 (UTC - 4:00)
System Uptime: 0 days 0:57:20.078
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.....
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: 91779a7c
Arg3: 91779660
Arg4: 8bcd0ca1
Debugging Details:
------------------
EXCEPTION_RECORD: 91779a7c -- (.exr 0xffffffff91779a7c)
ExceptionAddress: 8bcd0ca1 (Ntfs!NtfsLookupHashEntry+0x00000042)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00008e08
Attempt to read from address 00008e08
CONTEXT: 91779660 -- (.cxr 0xffffffff91779660)
eax=00008e00 ebx=00000703 ecx=9cf0b000 edx=860eab48 esi=22995f03 edi=00000001
eip=8bcd0ca1 esp=91779b44 ebp=91779b4c iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
Ntfs!NtfsLookupHashEntry+0x42:
8bcd0ca1 397008 cmp dword ptr [eax+8],esi ds:0023:00008e08=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: WerFault.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00008e08
READ_ADDRESS: GetPointerFromAddress: unable to read from 82d67700
Unable to read MiSystemVaType memory at 82d470c0
00008e08
FOLLOWUP_IP:
Ntfs!NtfsLookupHashEntry+42
8bcd0ca1 397008 cmp dword ptr [eax+8],esi
FAULTING_IP:
Ntfs!NtfsLookupHashEntry+42
8bcd0ca1 397008 cmp dword ptr [eax+8],esi
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from 8bcb7af0 to 8bcd0ca1
STACK_TEXT:
91779b4c 8bcb7af0 860eab48 22995f03 00000000 Ntfs!NtfsLookupHashEntry+0x42
91779ba4 8bcb865b 854323d8 860eab48 8d5056e0 Ntfs!NtfsFindPrefixHashEntry+0x158
91779c00 8bcbac5c 854323d8 853cb008 8d5056e0 Ntfs!NtfsFindStartingNode+0x7b6
91779cdc 8bc41210 854323d8 853cb008 9173d884 Ntfs!NtfsCommonCreate+0x65f
91779d1c 82c65056 9173d81c 00000000 ffffffff Ntfs!NtfsCommonCreateCallout+0x20
91779d1c 82c6514d 9173d81c 00000000 ffffffff nt!KiSwapKernelStackAndExit+0x15a
9173d780 00000000 00000000 00000000 00000000 nt!KiSwitchKernelStackAndCallout+0x31
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsLookupHashEntry+42
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf45
STACK_COMMAND: .cxr 0xffffffff91779660 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsLookupHashEntry+42
BUCKET_ID: 0x24_Ntfs!NtfsLookupHashEntry+42
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032111-21390-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82c1e000 PsLoadedModuleList = 0x82d5d570
Debug session time: Mon Mar 21 02:49:32.443 2011 (UTC - 4:00)
System Uptime: 0 days 0:11:30.255
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 82d35f03, a0b6eb54, 0}
Probably caused by : win32k.sys ( win32k!XDCOBJ::bCleanDC+24d )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82d35f03, The address that the exception occurred at
Arg3: a0b6eb54, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExFreePoolWithTag+466
82d35f03 0fb74ffa movzx ecx,word ptr [edi-6]
TRAP_FRAME: a0b6eb54 -- (.trap 0xffffffffa0b6eb54)
ErrCode = 00000000
eax=00000000 ebx=a0b6ecfc ecx=00008a00 edx=00000001 esi=00008a00 edi=00008a00
eip=82d35f03 esp=a0b6ebc8 ebp=a0b6ec24 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExFreePoolWithTag+0x466:
82d35f03 0fb74ffa movzx ecx,word ptr [edi-6] ds:0023:000089fa=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 969de637 to 82d35f03
STACK_TEXT:
a0b6ec24 969de637 00008a00 00000000 36079cd5 nt!ExFreePoolWithTag+0x466
a0b6eca0 969de1e8 00000000 36079ca9 00000000 win32k!XDCOBJ::bCleanDC+0x24d
a0b6ecdc 969ddf62 a0b6ecfc 00000000 00000000 win32k!bDeleteDCInternalWorker+0x1b
a0b6ed08 969bfc29 04010722 00000000 00000000 win32k!bDeleteDCInternal+0x30
a0b6ed28 82c5379a 04010722 044bf4e8 77d164f4 win32k!NtGdiDeleteObjectApp+0xa0
a0b6ed28 77d164f4 04010722 044bf4e8 77d164f4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
044bf4e8 00000000 00000000 00000000 00000000 0x77d164f4
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!XDCOBJ::bCleanDC+24d
969de637 8b03 mov eax,dword ptr [ebx]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: win32k!XDCOBJ::bCleanDC+24d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c7dbbb5
FAILURE_BUCKET_ID: 0x8E_win32k!XDCOBJ::bCleanDC+24d
BUCKET_ID: 0x8E_win32k!XDCOBJ::bCleanDC+24d
Followup: MachineOwner
---------