1. Matthew Wieting

    Matthew Wieting New Member

    Joined:
    Feb 14, 2014
    Messages:
    2
    Likes Received:
    0
    Loading Dump File [C:\Users\Matt.INNOVA\Desktop\021314-14492-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path. *
    * Use .symfix to have the debugger choose a symbol path. *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (24 procs) Free x64
    Product: Server, suite: Enterprise TerminalServer SingleUserTS
    Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
    Machine Name:
    Kernel base = 0xfffff800`01806000 PsLoadedModuleList = 0xfffff800`01a4a670
    Debug session time: Thu Feb 13 00:42:27.103 2014 (UTC - 6:00)
    System Uptime: 82 days 6:40:21.262
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .............................
    Loading User Symbols
    Loading unloaded module list
    ..................................................
    ************* Symbol Loading Error Summary **************
    Module name Error
    ntoskrnl The system cannot find the file specified
    You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
    You should also verify that your symbol search path (.sympath) is correct.
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 1000007E, {ffffffff80000003, fffff80001827c56, fffff8800c81b628, fffff8800c81ae80}
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    Probably caused by : ntoskrnl.exe ( nt+21c56 )
    Followup: MachineOwner
    ---------
    12: kd> gh
    ^ No runnable debuggees error in 'gh'
    12: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffff80000003, The exception code that was not handled
    Arg2: fffff80001827c56, The address that the exception occurred at
    Arg3: fffff8800c81b628, Exception Record Address
    Arg4: fffff8800c81ae80, Context Record Address
    Debugging Details:
    ------------------
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Either you specified an unqualified symbol, or your debugger ***
    *** doesn't have full symbol information. Unqualified symbol ***
    *** resolution is turned off by default. Please either specify a ***
    *** fully qualified symbol module!symbolname, or enable resolution ***
    *** of unqualified symbols by typing ".symopt- 100". Note that ***
    *** enabling unqualified symbol resolution with network symbol ***
    *** server shares in the symbol path may cause the debugger to ***
    *** appear to hang for long periods of time when an incorrect ***
    *** symbol name is typed or the network symbol server is down. ***
    *** ***
    *** For some commands to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    ADDITIONAL_DEBUG_TEXT:
    You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
    MODULE_NAME: nt
    FAULTING_MODULE: fffff80001806000 nt
    DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be
    EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid
    FAULTING_IP:
    nt+21c56
    fffff800`01827c56 cc int 3
    EXCEPTION_RECORD: fffff8800c81b628 -- (.exr 0xfffff8800c81b628)
    ExceptionAddress: fffff80001827c56 (nt+0x0000000000021c56)
    ExceptionCode: 80000003 (Break instruction exception)
    ExceptionFlags: 00000000
    NumberParameters: 1
    Parameter[0]: 0000000000000000
    CONTEXT: fffff8800c81ae80 -- (.cxr 0xfffff8800c81ae80;r)
    rax=0000000000000001 rbx=fffffa8023dce3b0 rcx=401eea40d4f80000
    rdx=000000000000004e rsi=fffff8a0069c8200 rdi=fffff880022e2180
    rip=fffff80001827c56 rsp=fffff8800c81b860 rbp=0000000000000000
    r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
    r11=fffff8800c81b480 r12=0000000000000000 r13=fffff880022e2180
    r14=000000000009e341 r15=0000000000010224
    iopl=0 nv up di ng nz na pe nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000082
    nt+0x21c56:
    fffff800`01827c56 cc int 3
    Last set context:
    rax=0000000000000001 rbx=fffffa8023dce3b0 rcx=401eea40d4f80000
    rdx=000000000000004e rsi=fffff8a0069c8200 rdi=fffff880022e2180
    rip=fffff80001827c56 rsp=fffff8800c81b860 rbp=0000000000000000
    r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
    r11=fffff8800c81b480 r12=0000000000000000 r13=fffff880022e2180
    r14=000000000009e341 r15=0000000000010224
    iopl=0 nv up di ng nz na pe nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000082
    nt+0x21c56:
    fffff800`01827c56 cc int 3
    Resetting default scope
    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT_SERVER
    BUGCHECK_STR: 0x7E
    CURRENT_IRQL: 0
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80001827c56
    STACK_TEXT:
    fffff880`0c81b860 00000000`00000000 : fffffa80`0000001b fffff800`018c32c0 fffffa80`23dce3b0 fffff880`022e2180 : nt+0x21c56

    FOLLOWUP_IP:
    nt+21c56
    fffff800`01827c56 cc int 3
    SYMBOL_STACK_INDEX: 0
    SYMBOL_NAME: nt+21c56
    FOLLOWUP_NAME: MachineOwner
    IMAGE_NAME: ntoskrnl.exe
    STACK_COMMAND: .cxr 0xfffff8800c81ae80 ; kb
    BUCKET_ID: WRONG_SYMBOLS
    FAILURE_BUCKET_ID: WRONG_SYMBOLS
    ANALYSIS_SOURCE: KM
    FAILURE_ID_HASH_STRING: km:wrong_symbols
    FAILURE_ID_HASH: {70b057e8-2462-896f-28e7-ac72d4d365f8}
    Followup: MachineOwner
    ---------
    12: kd> .cxr 0xfffff8800c81ae80;r
    rax=0000000000000001 rbx=fffffa8023dce3b0 rcx=401eea40d4f80000
    rdx=000000000000004e rsi=fffff8a0069c8200 rdi=fffff880022e2180
    rip=fffff80001827c56 rsp=fffff8800c81b860 rbp=0000000000000000
    r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
    r11=fffff8800c81b480 r12=0000000000000000 r13=fffff880022e2180
    r14=000000000009e341 r15=0000000000010224
    iopl=0 nv up di ng nz na pe nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000082
    nt+0x21c56:
    fffff800`01827c56 cc int 3
    Last set context:
    rax=0000000000000001 rbx=fffffa8023dce3b0 rcx=401eea40d4f80000
    rdx=000000000000004e rsi=fffff8a0069c8200 rdi=fffff880022e2180
    rip=fffff80001827c56 rsp=fffff8800c81b860 rbp=0000000000000000
    r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
    r11=fffff8800c81b480 r12=0000000000000000 r13=fffff880022e2180
    r14=000000000009e341 r15=0000000000010224
    iopl=0 nv up di ng nz na pe nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000082
    nt+0x21c56:
    fffff800`01827c56 cc int 3
    12: kd> lmvm nt
    start end module name
    fffff800`01806000 fffff800`01dee000 nt T (no symbols)
    Loaded symbol image file: ntoskrnl.exe
    Image path: \SystemRoot\system32\ntoskrnl.exe
    Image name: ntoskrnl.exe
    Timestamp: Thu Aug 30 10:11:58 2012 (503F82BE)
    CheckSum: 00554126
    ImageSize: 005E8000
    Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
    12: kd> .cxr 0xfffff8800c81ae80;r
    rax=0000000000000001 rbx=fffffa8023dce3b0 rcx=401eea40d4f80000
    rdx=000000000000004e rsi=fffff8a0069c8200 rdi=fffff880022e2180
    rip=fffff80001827c56 rsp=fffff8800c81b860 rbp=0000000000000000
    r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
    r11=fffff8800c81b480 r12=0000000000000000 r13=fffff880022e2180
    r14=000000000009e341 r15=0000000000010224
    iopl=0 nv up di ng nz na pe nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000082
    nt+0x21c56:
    fffff800`01827c56 cc int 3
    Last set context:
    rax=0000000000000001 rbx=fffffa8023dce3b0 rcx=401eea40d4f80000
    rdx=000000000000004e rsi=fffff8a0069c8200 rdi=fffff880022e2180
    rip=fffff80001827c56 rsp=fffff8800c81b860 rbp=0000000000000000
    r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
    r11=fffff8800c81b480 r12=0000000000000000 r13=fffff880022e2180
    r14=000000000009e341 r15=0000000000010224
    iopl=0 nv up di ng nz na pe nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000082
    nt+0x21c56:
    fffff800`01827c56 cc int 3
     
  2. Matthew Wieting

    Matthew Wieting New Member

    Joined:
    Feb 14, 2014
    Messages:
    2
    Likes Received:
    0
    Here are the message on the server when it came back up.
     

    Attached Files:

  3. kemical

    kemical Windows Forum Admin
    Staff Member Premium Supporter Microsoft MVP

    Joined:
    Aug 28, 2007
    Messages:
    31,816
    Likes Received:
    1,563

Share This Page

Loading...