Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042711-26223-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c0c000 PsLoadedModuleList = 0xfffff800`02e49e50
Debug session time: Wed Apr 27 23:45:37.546 2011 (UTC - 4:00)
System Uptime: 0 days 7:21:49.685
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff880013e56cf, fffff88006a91ef0, 0}
Probably caused by : pcw.sys ( pcw!PcwpCompleteInFlightNotification+f7 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880013e56cf, Address of the instruction which caused the bugcheck
Arg3: fffff88006a91ef0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
pcw!PcwpCompleteInFlightNotification+f7
fffff880`013e56cf 48896a08 mov qword ptr [rdx+8],rbp
CONTEXT: fffff88006a91ef0 -- (.cxr 0xfffff88006a91ef0)
rax=0000000000000000 rbx=ffffffffffffffff rcx=fffff8a003a875a8
rdx=0061006dffffffa0 rsi=fffff8a002a87560 rdi=00000000033df760
rip=fffff880013e56cf rsp=fffff88006a928d0 rbp=fffff8a002a875a8
r8=0000000000000002 r9=fffff80002e0aa80 r10=fffff80002c0c000
r11=fffffa80041d1860 r12=fffff88006a92980 r13=0000000000000000
r14=00000000033df6f0 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
pcw!PcwpCompleteInFlightNotification+0xf7:
fffff880`013e56cf 48896a08 mov qword ptr [rdx+8],rbp ds:002b:0061006d`ffffffa8=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880013e56cf
STACK_TEXT:
fffff880`06a928d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : pcw!PcwpCompleteInFlightNotification+0xf7
FOLLOWUP_IP:
pcw!PcwpCompleteInFlightNotification+f7
fffff880`013e56cf 48896a08 mov qword ptr [rdx+8],rbp
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: pcw!PcwpCompleteInFlightNotification+f7
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: pcw
IMAGE_NAME: pcw.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc0ff
STACK_COMMAND: .cxr 0xfffff88006a91ef0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_pcw!PcwpCompleteInFlightNotification+f7
BUCKET_ID: X64_0x3B_pcw!PcwpCompleteInFlightNotification+f7
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042811-14976-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e4a000 PsLoadedModuleList = 0xfffff800`03087e50
Debug session time: Thu Apr 28 11:33:14.655 2011 (UTC - 4:00)
System Uptime: 0 days 11:46:49.184
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {5003, fffff70001080000, 26b, 26d010004d6}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21bc6 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 000000000000026b
Arg4: 0000026d010004d6
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_5003
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: CurseClient.ex
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002f24536 to fffff80002ebbf00
STACK_TEXT:
fffff880`075008c8 fffff800`02f24536 : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`0000026b : nt!KeBugCheckEx
fffff880`075008d0 fffff800`02eedffb : 00000000`94fcf867 fffff683`ff800150 fffffa80`01bef6d0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x21bc6
fffff880`07500920 fffff800`02ed8506 : 00000000`00000000 000007ff`0002a160 fffff683`ff7b2180 fffffa80`06045ec8 : nt!MiResolveTransitionFault+0x40b
fffff880`075009b0 fffff800`02ed5f23 : ffffffff`ffffffff 000007fe`f6430f30 00000000`00000000 00000000`00000000 : nt!MiDispatchFault+0x946
fffff880`07500ac0 fffff800`02eb9fee : 00000000`00000008 00000000`00000a20 ffffffff`ffb3b401 00000000`00000000 : nt!MmAccessFault+0x343
fffff880`07500c20 000007ff`0002a160 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`1f3fe118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff`0002a160
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+21bc6
fffff800`02f24536 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+21bc6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6
BUCKET_ID: X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042811-16941-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e61000 PsLoadedModuleList = 0xfffff800`0309ee50
Debug session time: Thu Apr 28 21:31:16.662 2011 (UTC - 4:00)
System Uptime: 0 days 5:29:03.192
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, a3c81, 2, a3c5c}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000a3c81, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000a3c5c, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002f6138c to fffff80002ed1740
STACK_TEXT:
fffff880`05bcb778 fffff800`02f6138c : 00000000`0000004e 00000000`00000099 00000000`000a3c81 00000000`00000002 : nt!KeBugCheckEx
fffff880`05bcb780 fffff800`02f436a9 : 00000000`00000000 fffff680`000357e0 00000000`00000000 fffff880`02f63180 : nt!MiBadShareCount+0x4c
fffff880`05bcb7c0 fffff800`02f02381 : 00000000`00000000 fffff680`00035ff8 fffffa80`05d1c8c0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x31ed3
fffff880`05bcb970 fffff800`02f130da : 00000000`00000000 00000000`06e72fff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x408
fffff880`05bcbb30 fffff800`02ed0993 : ffffffff`ffffffff 00000000`0366f1c0 00000000`0366f188 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`05bcbc20 00000000`776af89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0366f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776af89a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02f6138c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042811-19219-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e68000 PsLoadedModuleList = 0xfffff800`030a5e50
Debug session time: Thu Apr 28 14:59:47.255 2011 (UTC - 4:00)
System Uptime: 0 days 0:40:22.395
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff683ff7bdd28, 0, 0, fffff80002fdf305}
Probably caused by : memory_corruption ( nt!MiEmptyWorkingSet+1c5 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff683ff7bdd28, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002fdf305, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031100e0
fffff683ff7bdd28
CURRENT_IRQL: 0
FAULTING_IP:
nt!MiEmptyWorkingSet+1c5
fffff800`02fdf305 488b02 mov rax,qword ptr [rdx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: CurseClient.ex
TRAP_FRAME: fffff880087e14b0 -- (.trap 0xfffff880087e14b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000098000000000 rbx=0000000000000000 rcx=00000003ff7bdd28
rdx=fffff683ff7bdd28 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002fdf305 rsp=fffff880087e1640 rbp=0000000000000009
r8=0000000fffffffff r9=0000000000000001 r10=0000000000000000
r11=0000000000000013 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!MiEmptyWorkingSet+0x1c5:
fffff800`02fdf305 488b02 mov rax,qword ptr [rdx] ds:cc04:fffff683`ff7bdd28=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ed7ca9 to fffff80002ed8740
STACK_TEXT:
fffff880`087e1368 fffff800`02ed7ca9 : 00000000`0000000a fffff683`ff7bdd28 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`087e1370 fffff800`02ed6920 : 00000000`00000000 ffffffff`ffffffff 000007fe`f6ab0000 000007fe`efd83000 : nt!KiBugCheckDispatch+0x69
fffff880`087e14b0 fffff800`02fdf305 : 00000003`00000000 ffffffff`ffffffff 00000000`00000008 fffffa80`05af6ec8 : nt!KiPageFault+0x260
fffff880`087e1640 fffff800`031204bd : fffffa80`06536b60 00000000`00000001 ffffffff`ffffffff 00000000`00001080 : nt!MiEmptyWorkingSet+0x1c5
fffff880`087e16f0 fffff800`0332aa3d : 00000000`00000001 00000000`00000000 00000000`00000000 fffff8a0`019d6400 : nt!MmAdjustWorkingSetSizeEx+0xad
fffff880`087e1780 fffff800`0323250b : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`1ef8ddd0 : nt!PspSetQuotaLimits+0x32d
fffff880`087e18d0 fffff800`02ed7993 : fffffa80`06536b60 fffff880`087e1ca0 00000000`1aece280 00000000`1aece280 : nt! ?? ::NNGAKEGL::`string'+0x49690
fffff880`087e1c20 00000000`7768f87a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1ef8dd98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7768f87a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiEmptyWorkingSet+1c5
fffff800`02fdf305 488b02 mov rax,qword ptr [rdx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiEmptyWorkingSet+1c5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiEmptyWorkingSet+1c5
BUCKET_ID: X64_0xA_nt!MiEmptyWorkingSet+1c5
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042811-19952-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`0309fe50
Debug session time: Thu Apr 28 23:02:50.471 2011 (UTC - 4:00)
System Uptime: 0 days 0:15:14.016
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa8005c39950, 0, fffff80002eee39c, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ObReferenceObjectSafe+c )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8005c39950, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002eee39c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310a0e0
fffffa8005c39950
FAULTING_IP:
nt!ObReferenceObjectSafe+c
fffff800`02eee39c 498b02 mov rax,qword ptr [r10]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800754a7c0 -- (.trap 0xfffff8800754a7c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000ff rbx=0000000000000000 rcx=fffffa8005c39980
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002eee39c rsp=fffff8800754a950 rbp=fffff8a0089967e0
r8=fffff8800754aa18 r9=fffff8800754aa10 r10=fffffa8005c39950
r11=fffff8800754ab38 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!ObReferenceObjectSafe+0xc:
fffff800`02eee39c 498b02 mov rax,qword ptr [r10] ds:fffffa80`05c39950=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002f52f14 to fffff80002ed2740
STACK_TEXT:
fffff880`0754a658 fffff800`02f52f14 : 00000000`00000050 fffffa80`05c39950 00000000`00000000 fffff880`0754a7c0 : nt!KeBugCheckEx
fffff880`0754a660 fffff800`02ed082e : 00000000`00000000 fffffa80`065a45e0 fffff8a0`00e4c400 00000000`0000ff00 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`0754a7c0 fffff800`02eee39c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000008 : nt!KiPageFault+0x16e
fffff880`0754a950 fffff800`03176921 : 00000000`00000010 00000000`00010282 fffff880`0754a9a0 00000000`00000018 : nt!ObReferenceObjectSafe+0xc
fffff880`0754a980 fffff800`03175ee6 : 00000000`00000000 fffff880`0754aa30 fffff8a0`08d3b560 fffff800`03196c0e : nt!AlpcpReferenceAndLockTargetPortsAndCommunicationInfo+0x81
fffff880`0754a9c0 fffff800`03176617 : fffffa80`0542f890 00000000`00000008 fffffa80`0542f890 00000000`00010000 : nt!AlpcpDispatchCloseMessage+0x42
fffff880`0754aa10 fffff800`03177179 : fffff8a0`08d3b560 00000000`00000001 fffffa80`0542f890 00000000`00000018 : nt!AlpcpSendCloseMessage+0xdb
fffff880`0754aa90 fffff800`031cc724 : 00000000`00000000 fffffa80`0542f860 00000000`00000000 00000000`00000000 : nt!AlpcpClosePort+0x85
fffff880`0754aac0 fffff800`031e6341 : fffffa80`064b2b30 fffffa80`00000001 fffff8a0`00e4c4e0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`0754ab40 fffff800`031e6254 : 00000000`0000096c fffffa80`064b2b30 fffff8a0`00e4c4e0 00000000`0000096c : nt!ObpCloseHandleTableEntry+0xb1
fffff880`0754abd0 fffff800`02ed1993 : fffffa80`05987060 fffff880`0754aca0 00000000`00000001 00000000`002b0440 : nt!ObpCloseHandle+0x94
fffff880`0754ac20 00000000`76fdf7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`012cf8c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fdf7aa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObReferenceObjectSafe+c
fffff800`02eee39c 498b02 mov rax,qword ptr [r10]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!ObReferenceObjectSafe+c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x50_VRF_nt!ObReferenceObjectSafe+c
BUCKET_ID: X64_0x50_VRF_nt!ObReferenceObjectSafe+c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042811-23275-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`03052e50
Debug session time: Thu Apr 28 23:08:03.456 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:09.001
Loading Kernel Symbols
...............................................................
..................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff80002e7c634, fffff880031a05b8, fffff8800319fe20}
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+9e4a0 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e7c634, The address that the exception occurred at
Arg3: fffff880031a05b8, Exception Record Address
Arg4: fffff8800319fe20, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!memmove+204
fffff800`02e7c634 488b040a mov rax,qword ptr [rdx+rcx]
EXCEPTION_RECORD: fffff880031a05b8 -- (.exr 0xfffff880031a05b8)
ExceptionAddress: fffff80002e7c634 (nt!memmove+0x0000000000000204)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000001105d236c
Attempt to read from address 00000001105d236c
CONTEXT: fffff8800319fe20 -- (.cxr 0xfffff8800319fe20)
rax=fffff8a00023f930 rbx=0000000000000008 rcx=fffff8a00023f930
rdx=0000076110392a3c rsi=fffff8a00023f930 rdi=0000000000000008
rip=fffff80002e7c634 rsp=fffff880031a07f8 rbp=fffff880031a0bc0
r8=0000000000000008 r9=0000000000000001 r10=fffffa80034f3148
r11=fffff8a00023f930 r12=000000000000000a r13=fffff880031a0938
r14=00000001105d236c r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!memmove+0x204:
fffff800`02e7c634 488b040a mov rax,qword ptr [rdx+rcx] ds:002b:00000001`105d236c=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000001105d236c
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bd0e0
00000001105d236c
FOLLOWUP_IP:
nvlddmkm+9e4a0
fffff880`0fea04a0 ?? ???
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff8000317c252 to fffff80002e7c634
STACK_TEXT:
fffff880`031a07f8 fffff800`0317c252 : fffffa80`00000001 00000000`00000008 00000000`00000000 00000000`000007ff : nt!memmove+0x204
fffff880`031a0800 fffff800`0317c10b : fffffa80`052d7980 fffff880`031a0c70 00000000`00000001 fffff880`031a0c00 : nt!ObpCaptureObjectName+0x102
fffff880`031a0880 fffff800`0317f255 : fffffa80`034ffa30 fffffa80`035be200 00000000`0000006c 00000000`00000000 : nt!ObpCaptureObjectCreateInformation+0x279
fffff880`031a0900 fffff800`0311b7c2 : fffffa80`035a0680 fffff880`031a0a80 fffff880`031a0c00 00000000`00000000 : nt!ObCreateObject+0x75
fffff880`031a0970 fffff800`02e84993 : fffffa80`035a0680 00000000`c000009a 00000000`00000000 fffffa80`059bc000 : nt!NtCreateSymbolicLinkObject+0xbe
fffff880`031a0a00 fffff800`02e80f30 : fffff800`031f9706 00000000`000090de fffffa80`059fc270 fffff980`01598fa0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`031a0b98 fffff800`031f9706 : 00000000`000090de fffffa80`059fc270 fffff980`01598fa0 fffffa80`059fc270 : nt!KiServiceLinkage
fffff880`031a0ba0 fffff880`0fea04a0 : 00000000`00000000 fffffa80`059fc270 00000000`c000009a fffff800`032186a1 : nt!IoCreateSymbolicLink+0x46
fffff880`031a0c00 00000000`00000000 : fffffa80`059fc270 00000000`c000009a fffff800`032186a1 fffff980`00000100 : nvlddmkm+0x9e4a0
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: nvlddmkm+9e4a0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d9e7f64
STACK_COMMAND: .cxr 0xfffff8800319fe20 ; kb
FAILURE_BUCKET_ID: X64_0x7E_VRF_nvlddmkm+9e4a0
BUCKET_ID: X64_0x7E_VRF_nvlddmkm+9e4a0
Followup: MachineOwner
---------