Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\013011-20560-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`01e1a000 PsLoadedModuleList = 0xfffff800`02057e50
Debug session time: Sun Jan 30 11:46:18.404 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:50.982
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000096, fffff80001e660fa, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+1ba )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000096, The exception code that was not handled
Arg2: fffff80001e660fa, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION} Privileged instruction.
FAULTING_IP:
nt!KeStackAttachProcess+1ba
fffff800`01e660fa 0f22d8 mov cr3,rax
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000096 - {EXCEPTION} Privileged instruction.
BUGCHECK_STR: 0x1E_c0000096
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff880074433f8 -- (.exr 0xfffff880074433f8)
ExceptionAddress: fffff80001e660fa (nt!KeStackAttachProcess+0x00000000000001ba)
ExceptionCode: c0000096
ExceptionFlags: 00000000
NumberParameters: 0
TRAP_FRAME: fffff880074434a0 -- (.trap 0xfffff880074434a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80021c8780 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001e660fa rsp=fffff88007443630 rbp=fffff880074437a0
r8=0000000000000000 r9=fffffa8002154840 r10=0000000000000001
r11=fffff8000208ab60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x1ba:
fffff800`01e660fa 0f22d8 mov cr3,rax
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001ec4a39 to fffff80001e8a740
STACK_TEXT:
fffff880`07442c28 fffff800`01ec4a39 : 00000000`0000001e ffffffff`c0000096 fffff800`01e660fa 00000000`00000000 : nt!KeBugCheckEx
fffff880`07442c30 fffff800`01e89d82 : fffff880`074433f8 fffffa80`05773b60 fffff880`074434a0 fffff880`080d0730 : nt!KiDispatchException+0x1b9
fffff880`074432c0 fffff800`01e8868a : fffff880`07443c00 fffffa80`02154840 fffffa80`0239c850 fffff8a0`02a1cc50 : nt!KiExceptionDispatch+0xc2
fffff880`074434a0 fffff800`01e660fa : fffff880`07443648 fffff880`07443a28 fffff880`074437b8 fffffa80`0327aac6 : nt!KiGeneralProtectionFault+0x10a
fffff880`07443630 fffffa80`03277a93 : fffff880`074437b0 00000000`00000204 00000000`00000000 fffffa80`00000000 : nt!KeStackAttachProcess+0x1ba
fffff880`074436b0 fffff880`074437b0 : 00000000`00000204 00000000`00000000 fffffa80`00000000 00000000`00000000 : 0xfffffa80`03277a93
fffff880`074436b8 00000000`00000204 : 00000000`00000000 fffffa80`00000000 00000000`00000000 00000000`00000204 : 0xfffff880`074437b0
fffff880`074436c0 00000000`00000000 : fffffa80`00000000 00000000`00000000 00000000`00000204 00000000`00000000 : 0x204
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+1ba
fffff800`01e660fa 0f22d8 mov cr3,rax
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!KeStackAttachProcess+1ba
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1E_c0000096_nt!KeStackAttachProcess+1ba
BUCKET_ID: X64_0x1E_c0000096_nt!KeStackAttachProcess+1ba
Followup: MachineOwner
---------