Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\041211-23150-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a5a000 PsLoadedModuleList = 0xfffff800`02c97e50
Debug session time: Tue Apr 12 23:23:27.253 2011 (UTC - 4:00)
System Uptime: 3 days 7:55:25.658
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
...................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {0, 2, 0, fffff880027da1e3}
Unable to load image \SystemRoot\System32\Drivers\pae_1394_x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for pae_1394_x64.sys
*** ERROR: Module load completed but symbols could not be loaded for pae_1394_x64.sys
Probably caused by : pae_1394_x64.sys ( pae_1394_x64+231e3 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff880027da1e3, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d020e0
0000000000000000
CURRENT_IRQL: 2
FAULTING_IP:
pae_1394_x64+231e3
fffff880`027da1e3 8b3490 mov esi,dword ptr [rax+rdx*4]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff88002d8c930 -- (.trap 0xfffff88002d8c930)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880027da1e3 rsp=fffff88002d8cac0 rbp=fffffa800923bce0
r8=0000000000000000 r9=0000000000000000 r10=fffff80002a5a000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
pae_1394_x64+0x231e3:
fffff880`027da1e3 8b3490 mov esi,dword ptr [rax+rdx*4] ds:c110:00000000`00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ac9ca9 to fffff80002aca740
STACK_TEXT:
fffff880`02d8c7e8 fffff800`02ac9ca9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02d8c7f0 fffff800`02ac8920 : 00000000`00000000 fffffa80`06d4d010 00000000`00000000 fffff880`043043a0 : nt!KiBugCheckDispatch+0x69
fffff880`02d8c930 fffff880`027da1e3 : fffffa80`06d4d010 fffffa80`076a64f0 fffffa80`0878de10 fffffa80`06e97880 : nt!KiPageFault+0x260
fffff880`02d8cac0 fffffa80`06d4d010 : fffffa80`076a64f0 fffffa80`0878de10 fffffa80`06e97880 fffffa80`06d4d010 : pae_1394_x64+0x231e3
fffff880`02d8cac8 fffffa80`076a64f0 : fffffa80`0878de10 fffffa80`06e97880 fffffa80`06d4d010 fffff880`027d69eb : 0xfffffa80`06d4d010
fffff880`02d8cad0 fffffa80`0878de10 : fffffa80`06e97880 fffffa80`06d4d010 fffff880`027d69eb fffffa80`076a64f0 : 0xfffffa80`076a64f0
fffff880`02d8cad8 fffffa80`06e97880 : fffffa80`06d4d010 fffff880`027d69eb fffffa80`076a64f0 00000000`00000000 : 0xfffffa80`0878de10
fffff880`02d8cae0 fffffa80`06d4d010 : fffff880`027d69eb fffffa80`076a64f0 00000000`00000000 00000000`00000001 : 0xfffffa80`06e97880
fffff880`02d8cae8 fffff880`027d69eb : fffffa80`076a64f0 00000000`00000000 00000000`00000001 fffffa80`09ad7530 : 0xfffffa80`06d4d010
fffff880`02d8caf0 fffffa80`076a64f0 : 00000000`00000000 00000000`00000001 fffffa80`09ad7530 fffff880`027d1f70 : pae_1394_x64+0x1f9eb
fffff880`02d8caf8 00000000`00000000 : 00000000`00000001 fffffa80`09ad7530 fffff880`027d1f70 fffffa80`091e4190 : 0xfffffa80`076a64f0
STACK_COMMAND: kb
FOLLOWUP_IP:
pae_1394_x64+231e3
fffff880`027da1e3 8b3490 mov esi,dword ptr [rax+rdx*4]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: pae_1394_x64+231e3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: pae_1394_x64
IMAGE_NAME: pae_1394_x64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4b4755ff
FAILURE_BUCKET_ID: X64_0xD1_pae_1394_x64+231e3
BUCKET_ID: X64_0xD1_pae_1394_x64+231e3
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\041411-19110-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a13000 PsLoadedModuleList = 0xfffff800`02c50e50
Debug session time: Thu Apr 14 18:39:13.059 2011 (UTC - 4:00)
System Uptime: 0 days 0:38:20.838
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002a7a863, fffff88006d290b0, 0}
Probably caused by : ntkrnlmp.exe ( nt!EtwpFindGuidEntryByGuid+73 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002a7a863, Address of the instruction which caused the bugcheck
Arg3: fffff88006d290b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!memcmp+93
fffff800`02a7a863 483b040a cmp rax,qword ptr [rdx+rcx]
CONTEXT: fffff88006d290b0 -- (.cxr 0xfffff88006d290b0)
rax=4e54f50884051b98 rbx=ffffffffffffffff rcx=fffff8a00716c5f0
rdx=0000075ff8e93a24 rsi=fffff80002c30380 rdi=0000000000000000
rip=fffff80002a7a863 rsp=fffff88006d29a88 rbp=0000000000000000
r8=0000000000000010 r9=0000000000000002 r10=4e54f50884051b98
r11=fffff8a00716c5f0 r12=fffff8a00716c5f0 r13=0000000000000000
r14=000000000000001a r15=fffff88006d29b60
iopl=0 nv up ei pl nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212
nt!memcmp+0x93:
fffff800`02a7a863 483b040a cmp rax,qword ptr [rdx+rcx] ds:002b:00000000`00000014=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002d2b9b7 to fffff80002a7a863
STACK_TEXT:
fffff880`06d29a88 fffff800`02d2b9b7 : fffff8a0`02048a90 fffff800`02a899a2 00000000`00000002 00000000`00000000 : nt!memcmp+0x93
fffff880`06d29a90 fffff800`02d2b4ae : 00000000`006fef58 fffff8a0`0716c5f0 00000000`00000000 fffff800`02aa459c : nt!EtwpFindGuidEntryByGuid+0x73
fffff880`06d29ad0 fffff800`02d2be6c : 00000000`00000000 00000000`000000a0 00000000`006fef58 00000000`00000000 : nt!EtwpRegisterUMGuid+0x66
fffff880`06d29b40 fffff800`02a82993 : fffffa80`098664d0 00000000`006fef38 fffff880`000000a0 fffff880`06d29c38 : nt!NtTraceControl+0x198
fffff880`06d29bb0 00000000`77600efa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`006fef18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77600efa
FOLLOWUP_IP:
nt!EtwpFindGuidEntryByGuid+73
fffff800`02d2b9b7 413bc5 cmp eax,r13d
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!EtwpFindGuidEntryByGuid+73
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
STACK_COMMAND: .cxr 0xfffff88006d290b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!EtwpFindGuidEntryByGuid+73
BUCKET_ID: X64_0x3B_nt!EtwpFindGuidEntryByGuid+73
Followup: MachineOwner
---------