Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021211-19609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a5b000 PsLoadedModuleList = 0xfffff800`02c98e50
Debug session time: Sat Feb 12 14:48:47.786 2011 (UTC - 5:00)
System Uptime: 0 days 0:39:48.519
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800317e678, fffff8800317dee0, fffff80002a9c928}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteFcb+179 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800317e678
Arg3: fffff8800317dee0
Arg4: fffff80002a9c928
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800317e678 -- (.exr 0xfffff8800317e678)
ExceptionAddress: fffff80002a9c928 (nt!DeleteNodeFromTree+0x0000000000000128)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800317dee0 -- (.cxr 0xfffff8800317dee0)
rax=0080000000000000 rbx=0080000000000000 rcx=fffffa8004f01640
rdx=fffff8a00f91a220 rsi=fffffa800aa6bba0 rdi=fffff8a00f91a220
rip=fffff80002a9c928 rsp=fffff8800317e8b0 rbp=fffffa8004f01640
r8=0000000000005f5c r9=0000ffffffffffff r10=fffff88001275880
r11=fffffa800aa6bba0 r12=fffff8a00f8b15c0 r13=fffffa8004f01180
r14=fffff8800317e9a1 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!DeleteNodeFromTree+0x128:
fffff800`02a9c928 488b4008 mov rax,qword ptr [rax+8] ds:002b:00800000`00000008=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d030e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsDeleteFcb+179
fffff880`012aef69 4c8b1b mov r11,qword ptr [rbx]
FAULTING_IP:
nt!DeleteNodeFromTree+128
fffff800`02a9c928 488b4008 mov rax,qword ptr [rax+8]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff80002a9c9d9 to fffff80002a9c928
STACK_TEXT:
fffff880`0317e8b0 fffff800`02a9c9d9 : fffffa80`04f01640 fffff800`02c705a0 fffffa80`0aa6bba0 fffffa80`04f01180 : nt!DeleteNodeFromTree+0x128
fffff880`0317e8f0 fffff880`012aef69 : fffff880`0317e9b0 fffff800`02c705a0 fffff8a0`0f91a220 fffffa80`03eea3e0 : nt!RtlDeleteElementGenericTableAvl+0x39
fffff880`0317e920 fffff880`01221f6a : fffff800`02c705a0 fffff880`0317eb01 fffff880`0317e9a1 fffff8a0`0f8b15c0 : Ntfs!NtfsDeleteFcb+0x179
fffff880`0317e980 fffff880`012ac2cc : fffffa80`03eea3e0 fffffa80`04f01180 fffff8a0`0f8b15c0 fffff8a0`0f8b1958 : Ntfs!NtfsTeardownFromLcb+0x1ea
fffff880`0317ea10 fffff880`0122a882 : fffffa80`03eea3e0 fffffa80`03eea3e0 fffff8a0`0f8b15c0 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`0317ea90 fffff880`012c3813 : fffffa80`03eea3e0 fffff800`02c705a0 fffff8a0`0f8b15c0 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0317ead0 fffff880`0129d38f : fffffa80`03eea3e0 fffff8a0`0f8b16f0 fffff8a0`0f8b15c0 fffffa80`04f01180 : Ntfs!NtfsCommonClose+0x353
fffff880`0317eba0 fffff800`02ad8961 : 00000000`00000000 fffff800`02dc5900 fffffa80`039e3b01 ac38ac18`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0317ec70 fffff800`02d6e7c6 : aa30aa28`aa20aa18 fffffa80`039e3b60 00000000`00000080 fffffa80`039cd040 : nt!ExpWorkerThread+0x111
fffff880`0317ed00 fffff800`02aa9c26 : fffff880`02f63180 fffffa80`039e3b60 fffff880`02f6dfc0 ac28ac18`ac10ac08 : nt!PspSystemThreadStartup+0x5a
fffff880`0317ed40 00000000`00000000 : fffff880`0317f000 fffff880`03179000 fffff880`0317e9b0 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Ntfs!NtfsDeleteFcb+179
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff8800317dee0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteFcb+179
BUCKET_ID: X64_0x24_Ntfs!NtfsDeleteFcb+179
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021211-23228-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a5e000 PsLoadedModuleList = 0xfffff800`02c9be50
Debug session time: Sat Feb 12 14:05:22.271 2011 (UTC - 5:00)
System Uptime: 0 days 0:14:55.003
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 1, fffff80002abadb0}
Probably caused by : memory_corruption ( nt!MiComputeFlushRange+39c )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002abadb0, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d060e0
0000000000000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiComputeFlushRange+39c
fffff800`02abadb0 488908 mov qword ptr [rax],rcx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff88003193730 -- (.trap 0xfffff88003193730)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0004000000000000
rdx=0000000080000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002abadb0 rsp=fffff880031938c0 rbp=fffffa80046a6630
r8=0000000000000000 r9=fffff88002f63180 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiComputeFlushRange+0x39c:
fffff800`02abadb0 488908 mov qword ptr [rax],rcx ds:64b8:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002acdca9 to fffff80002ace740
STACK_TEXT:
fffff880`031935e8 fffff800`02acdca9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`031935f0 fffff800`02acc920 : 00000000`00000000 00000000`00000001 00000000`00000002 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03193730 fffff800`02abadb0 : 00000000`00000001 fffff880`049d939f fffff880`03193904 fffffa80`05be63f0 : nt!KiPageFault+0x260
fffff880`031938c0 fffff800`02aba7a9 : fffff880`00000000 fffff880`03193c18 00000000`00038000 fffff880`031939a0 : nt!MiComputeFlushRange+0x39c
fffff880`03193950 fffff800`02aba259 : 00000000`0000e021 00000000`00000000 00000000`00038000 00000000`00000000 : nt!MmFlushSection+0x49
fffff880`03193a10 fffff800`02ac194b : fffffa80`0443dca8 fffff800`00000001 00000000`00000001 fffff800`00038000 : nt!CcFlushCache+0x5e9
fffff880`03193b10 fffff800`02ac2520 : 00000000`00000000 fffff880`03193c18 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x1eb
fffff880`03193bc0 fffff800`02adb961 : fffffa80`03a01ee0 fffff880`0513f510 fffff800`02cd5140 fffff800`00000002 : nt!CcWorkerThread+0x1c8
fffff880`03193c70 fffff800`02d717c6 : 00000000`00000000 fffffa80`03a121a0 00000000`00000080 fffffa80`039e7040 : nt!ExpWorkerThread+0x111
fffff880`03193d00 fffff800`02aacc26 : fffff880`02f63180 fffffa80`03a121a0 fffff880`02f6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03193d40 00000000`00000000 : fffff880`03194000 fffff880`0318e000 fffff880`031939b0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiComputeFlushRange+39c
fffff800`02abadb0 488908 mov qword ptr [rax],rcx
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiComputeFlushRange+39c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiComputeFlushRange+39c
BUCKET_ID: X64_0xA_nt!MiComputeFlushRange+39c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021211-28657-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a08000 PsLoadedModuleList = 0xfffff800`02c45e50
Debug session time: Sat Feb 12 13:49:44.403 2011 (UTC - 5:00)
System Uptime: 0 days 0:48:30.151
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002a9cb10, fffff880072eff20, 0}
Probably caused by : memory_corruption ( nt!MiInsertNode+20 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002a9cb10, Address of the instruction which caused the bugcheck
Arg3: fffff880072eff20, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiInsertNode+20
fffff800`02a9cb10 493b4018 cmp rax,qword ptr [r8+18h]
CONTEXT: fffff880072eff20 -- (.cxr 0xfffff880072eff20)
rax=0000000000000230 rbx=ffffffffffffffff rcx=0080000000000000
rdx=0000000000000000 rsi=fffffa800647eb60 rdi=fffffa80061ec060
rip=fffff80002a9cb10 rsp=fffff880072f08f8 rbp=0000000000001000
r8=0080000000000000 r9=fffff80002a08000 r10=fffffa8003e027b0
r11=fffffa80061ec4a8 r12=fffffa8003e027b0 r13=fffffa80061ec060
r14=fffffa80061ec3f8 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!MiInsertNode+0x20:
fffff800`02a9cb10 493b4018 cmp rax,qword ptr [r8+18h] ds:002b:00800000`00000018=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002a9cb10
STACK_TEXT:
fffff880`072f08f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiInsertNode+0x20
FOLLOWUP_IP:
nt!MiInsertNode+20
fffff800`02a9cb10 493b4018 cmp rax,qword ptr [r8+18h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiInsertNode+20
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
STACK_COMMAND: .cxr 0xfffff880072eff20 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x3B_nt!MiInsertNode+20
BUCKET_ID: X64_0x3B_nt!MiInsertNode+20
Followup: MachineOwner
---------