Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032911-22900-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02e00000 PsLoadedModuleList = 0xfffff800`03045e90
Debug session time: Tue Mar 29 12:04:52.098 2011 (UTC - 4:00)
System Uptime: 0 days 2:04:14.674
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800b865a88, fffff8800b8652e0, fffff880016e1c73}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFcbTableCompare+3 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800b865a88
Arg3: fffff8800b8652e0
Arg4: fffff880016e1c73
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800b865a88 -- (.exr 0xfffff8800b865a88)
ExceptionAddress: fffff880016e1c73 (Ntfs!NtfsFcbTableCompare+0x0000000000000003)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800b8652e0 -- (.cxr 0xfffff8800b8652e0)
rax=006a000000013ac8 rbx=6d4d6956031c0404 rcx=fffffa8006e3b640
rdx=fffff8800b865dc0 rsi=fffff8800b865dc0 rdi=fffffa8006e3b640
rip=fffff880016e1c73 rsp=fffff8800b865cc8 rbp=fffff8800b865d90
r8=6d4d6956031c0424 r9=0000ffffffffffff r10=fffff8800168b180
r11=fffff8800b865e08 r12=fffff8800b865e64 r13=0000000000000000
r14=fffffa8006e3b180 r15=fffffa8006e3b180
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
Ntfs!NtfsFcbTableCompare+0x3:
fffff880`016e1c73 498b08 mov rcx,qword ptr [r8] ds:002b:6d4d6956`031c0424=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: wmpnetwk.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b10e8
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsFcbTableCompare+3
fffff880`016e1c73 498b08 mov rcx,qword ptr [r8]
FAULTING_IP:
Ntfs!NtfsFcbTableCompare+3
fffff880`016e1c73 498b08 mov rcx,qword ptr [r8]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff80002eaa5ed to fffff880016e1c73
STACK_TEXT:
fffff880`0b865cc8 fffff800`02eaa5ed : fffff880`0b865e08 fffffa80`068e2890 00000000`00000001 fffffa80`08503690 : Ntfs!NtfsFcbTableCompare+0x3
fffff880`0b865cd0 fffff800`02eaa665 : fffff880`0b865e40 fffffa80`09fd1b40 fffffa80`0a043e11 fffff880`0b865dc0 : nt!FindNodeOrParent+0x3d
fffff880`0b865d00 fffff880`016e01a9 : 006a0000`00013ac8 00000000`00000000 fffff880`0b8662b0 00000000`00000000 : nt!RtlLookupElementGenericTableFullAvl+0x15
fffff880`0b865d30 fffff880`016b1d8b : fffffa80`0a043e40 fffffa80`06e3b180 fffffa80`0a043e40 006a0000`00013ac8 : Ntfs!NtfsCreateFcb+0x79
fffff880`0b865e10 fffff880`016d6179 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsOpenFile+0x1cb
fffff880`0b866000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreate+0xc49
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFcbTableCompare+3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce792f9
STACK_COMMAND: .cxr 0xfffff8800b8652e0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3
BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032911-23478-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02e58000 PsLoadedModuleList = 0xfffff800`0309de90
Debug session time: Tue Mar 29 20:09:29.509 2011 (UTC - 4:00)
System Uptime: 0 days 4:13:00.086
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {411, fffff6fcc008ae00, 558000001ea7a900, fffff8a0042f8011}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+6061 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000411, The subtype of the bugcheck.
Arg2: fffff6fcc008ae00
Arg3: 558000001ea7a900
Arg4: fffff8a0042f8011
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_411
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 2
TRAP_FRAME: fffff8800ac0ccb0 -- (.trap 0xfffff8800ac0ccb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8003b31730 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff980115c0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031d4b87 rsp=fffff8800ac0ce40 rbp=fffff8a0042f5140
r8=000000000000000f r9=fffff8800ac0cf00 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!CcMapData+0x117:
fffff800`031d4b87 0fb602 movzx eax,byte ptr [rdx] ds:fffff980`115c0000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002eb52dd to fffff80002ed8640
STACK_TEXT:
fffff880`0ac0c958 fffff800`02eb52dd : 00000000`0000001a 00000000`00000411 fffff6fc`c008ae00 55800000`1ea7a900 : nt!KeBugCheckEx
fffff880`0ac0c960 fffff800`02f09a71 : 55800000`1ea7a900 fffff6fc`c008ae00 0000007f`fffffff8 fffff800`031cc8c0 : nt! ?? ::FNODOBFM::`string'+0x6061
fffff880`0ac0c9b0 fffff800`02ef625f : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`0305cdc0 : nt!MiResolveTransitionFault+0x381
fffff880`0ac0ca40 fffff800`02ee643b : fffff8a0`065ff010 fffff880`0149fddc 00000000`04000100 00000000`0000f000 : nt!MiDispatchFault+0x95f
fffff880`0ac0cb50 fffff800`02ed676e : 00000000`00000000 fffff980`115c0000 fffffa80`040fae00 00000000`0000000e : nt!MmAccessFault+0xe1b
fffff880`0ac0ccb0 fffff800`031d4b87 : fffffa80`00000001 00000000`00000000 fffff880`0ac0cf08 fffff880`0ac0cf00 : nt!KiPageFault+0x16e
fffff880`0ac0ce40 fffff880`014b4c85 : fffffa80`00040000 fffffa80`03b31730 fffff8a0`042f5140 fffff8a0`0000000e : nt!CcMapData+0x117
fffff880`0ac0cf00 fffff880`014b8db1 : fffff8a0`042f5140 00000000`00000000 fffff8a0`03e71750 fffffa80`040fae40 : Ntfs!FindFirstIndexEntry+0x1fa
fffff880`0ac0cf90 fffff880`014accf5 : fffffa80`040fae40 fffffa80`040fae40 fffff8a0`0234cd01 00000000`00000000 : Ntfs!NtfsFindIndexEntry+0x5d
fffff880`0ac0d000 fffff880`01415a3d : fffffa80`040fae40 fffffa80`08915010 fffff880`0ac0d3b0 fffff800`031e6f00 : Ntfs!NtfsCommonCreate+0x7c5
fffff880`0ac0d1e0 fffff800`02ee5078 : fffff880`0ac0d320 00000000`000007ff 00000000`00000001 fffff8a0`06581d00 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0ac0d210 fffff880`014161bf : fffff880`01415a20 fffff880`01415020 fffff880`0ac0d300 fffff880`014b6f00 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0ac0d2f0 fffff880`014af99c : 00000000`00000000 00000000`00000000 fffff880`0ac0d540 fffffa80`08915010 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0ac0d350 fffff880`01394bcf : fffffa80`04e0e030 fffffa80`08915010 00000000`00000000 fffffa80`04b14910 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0ac0d500 fffff880`013b42b9 : fffffa80`08915010 fffffa80`04cb3010 fffffa80`08915000 fffffa80`04b14910 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0ac0d590 fffff800`031d6495 : 00000000`00000045 fffffa80`085c17f8 fffff880`0ac0d9e0 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0ac0d640 fffff800`031d2d38 : fffffa80`04aba920 fffff800`00000000 fffffa80`085c1640 fffffa80`00000001 : nt!IopParseDevice+0x5a5
fffff880`0ac0d7d0 fffff800`031d3f56 : 00000000`00000000 fffffa80`085c1640 fffff880`0ac0d8d0 fffffa80`03b60f30 : nt!ObpLookupObjectName+0x588
fffff880`0ac0d8c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByName+0x306
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+6061
fffff800`02eb52dd cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+6061
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
FAILURE_BUCKET_ID: X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6061
BUCKET_ID: X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6061
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\032911-24788-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`030a7e90
Debug session time: Tue Mar 29 13:31:05.764 2011 (UTC - 4:00)
System Uptime: 0 days 1:25:05.966
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {3452, 6a818000, fffff700010833f0, ded0000069df9000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36103 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003452, The subtype of the bugcheck.
Arg2: 000000006a818000
Arg3: fffff700010833f0
Arg4: ded0000069df9000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_3452
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002f500b3 to fffff80002ee2640
STACK_TEXT:
fffff880`0b2bc028 fffff800`02f500b3 : 00000000`0000001a 00000000`00003452 00000000`6a818000 fffff700`010833f0 : nt!KeBugCheckEx
fffff880`0b2bc030 fffff800`02eb3f16 : fffffa80`07be4b30 fffffa80`00000000 fffff880`0000012e fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x36103
fffff880`0b2bc8e0 fffff800`031b809a : fffff8a0`0fa2ba30 fffff880`0b2bcc20 00000000`00000000 fffffa80`09626b60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0b2bc930 fffff800`0319d37d : 00000000`00000000 00000000`00000001 00000000`7efdb000 00000000`00000000 : nt!PspExitThread+0x56a
fffff880`0b2bca30 fffff800`02ed5dfa : 00000000`00000100 fffffa80`09626c20 00000000`00000001 fffff800`02ee7b9d : nt!PsExitSpecialApc+0x1d
fffff880`0b2bca60 fffff800`02ed6140 : 00000000`00000246 fffff880`0b2bcae0 fffff800`0319d2f0 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0b2bcae0 fffff800`02ee1977 : fffffa80`09626b60 00000000`00000168 fffff880`0b2bcbf8 fffffa80`07b74870 : nt!KiInitiateUserApc+0x70
fffff880`0b2bcc20 00000000`74a22e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0016e988 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74a22e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+36103
fffff800`02f500b3 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+36103
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
FAILURE_BUCKET_ID: X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+36103
BUCKET_ID: X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+36103
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\033011-21231-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02e58000 PsLoadedModuleList = 0xfffff800`0309de90
Debug session time: Wed Mar 30 10:28:13.690 2011 (UTC - 4:00)
System Uptime: 0 days 2:07:09.001
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {8, 80050031, 6f8, fffff80002ed6610}
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002ed6610
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: cssauth.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88003510fa0 -- (.trap 0xfffff88003510fa0)
Unable to read trap frame at fffff880`03510fa0
LAST_CONTROL_TRANSFER: from fffff80002ed7be9 to fffff80002ed8640
STACK_TEXT:
fffff880`03169ce8 fffff800`02ed7be9 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`03169cf0 fffff800`02ed60b2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03169e30 fffff800`02ed6610 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`03510fa0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x10
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiDoubleFaultAbort+b2
fffff800`02ed60b2 90 nop
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiDoubleFaultAbort+b2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
FAILURE_BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
Followup: MachineOwner
---------