Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\022511-17550-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*e:\windbgsymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03849000 PsLoadedModuleList = 0xfffff800`03a86e50
Debug session time: Fri Feb 25 19:15:33.169 2011 (UTC - 5:00)
System Uptime: 0 days 0:21:24.355
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - .
FAULTING_IP:
+3839343061303633
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0
BUGCHECK_STR: 0x1E_0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff88002f8ca58 -- (.exr 0xfffff88002f8ca58)
ExceptionAddress: 0000f88003a75c61
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff88002f8cb00 -- (.trap 0xfffff88002f8cb00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000020 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000f88003a75c61 rsp=fffff88002f8cc98 rbp=0000000000000000
r8=fffffa80054e87a0 r9=fffff88003a792a4 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
0000f880`03a75c61 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800038b2c2e to fffff800038baed0
STACK_TEXT:
fffff880`02f8bb38 fffff800`038b2c2e : 00000000`00000000 fffff880`0ff2e9e9 fffff880`02f8c2b0 fffff800`038e7e28 : nt!KeBugCheck
fffff880`02f8bb40 fffff800`038e0bed : fffff800`03ac7f78 fffff800`03a061d0 fffff800`03849000 fffff880`02f8ca58 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02f8bb70 fffff800`038e8250 : fffff800`03a08b5c fffff880`02f8bbe8 fffff880`02f8ca58 fffff800`03849000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02f8bba0 fffff800`038f51b5 : fffff880`02f8ca58 fffff880`02f8c2b0 fffff880`00000000 00000000`00000001 : nt!RtlDispatchException+0x410
fffff880`02f8c280 fffff800`038ba542 : fffff880`02f8ca58 00000000`00000002 fffff880`02f8cb00 fffff880`02f64180 : nt!KiDispatchException+0x135
fffff880`02f8c920 fffff800`038b8e4a : 00000000`00000000 fffff880`02f8cb80 00000000`00000001 fffffa80`05515ee0 : nt!KiExceptionDispatch+0xc2
fffff880`02f8cb00 0000f880`03a75c61 : fffff800`038c8a3a 00000000`002b9a1c fffffa80`05515c68 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`02f8cc98 fffff800`038c8a3a : 00000000`002b9a1c fffffa80`05515c68 00000000`00000000 00000001`00000001 : 0xf880`03a75c61
fffff880`02f8cca0 fffff800`038c36cc : fffff880`02f64180 fffff880`00000002 00000000`00000002 fffff880`00000000 : nt!PoIdle+0x53a
fffff880`02f8cd80 00000000`00000000 : fffff880`02f8d000 fffff880`02f87000 fffff880`02f8cd40 00000000`00000000 : nt!KiIdleLoop+0x2c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiKernelCalloutExceptionHandler+e
fffff800`038b2c2e 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiKernelCalloutExceptionHandler+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1E_0_nt!KiKernelCalloutExceptionHandler+e
BUCKET_ID: X64_0x1E_0_nt!KiKernelCalloutExceptionHandler+e
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\022611-20155-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*e:\windbgsymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03867000 PsLoadedModuleList = 0xfffff800`03aa4e50
Debug session time: Sat Feb 26 15:52:45.332 2011 (UTC - 5:00)
System Uptime: 0 days 0:35:05.519
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - .
FAULTING_IP:
+3839343061303633
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0
BUGCHECK_STR: 0x1E_0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff88002f8ca58 -- (.exr 0xfffff88002f8ca58)
ExceptionAddress: 0000f88003de9c61
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff88002f8cb00 -- (.trap 0xfffff88002f8cb00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000020 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000f88003de9c61 rsp=fffff88002f8cc98 rbp=0000000000000000
r8=fffffa800471d8d0 r9=fffff88003ded2a4 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
0000f880`03de9c61 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800038d0c2e to fffff800038d8ed0
STACK_TEXT:
fffff880`02f8bb38 fffff800`038d0c2e : 00000000`0000003c 00000000`00000001 fffff880`02f8c2b0 fffff800`03905e28 : nt!KeBugCheck
fffff880`02f8bb40 fffff800`038febed : fffff800`03ae5f78 fffff800`03a241d0 fffff800`03867000 fffff880`02f8ca58 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02f8bb70 fffff800`03906250 : fffff800`03a26b5c fffff880`02f8bbe8 fffff880`02f8ca58 fffff800`03867000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02f8bba0 fffff800`039131b5 : fffff880`02f8ca58 fffff880`02f8c2b0 fffff880`00000000 00000000`00000001 : nt!RtlDispatchException+0x410
fffff880`02f8c280 fffff800`038d8542 : fffff880`02f8ca58 00000000`00000002 fffff880`02f8cb00 fffff880`02f64180 : nt!KiDispatchException+0x135
fffff880`02f8c920 fffff800`038d6e4a : fffffa80`050a7002 00000001`25da50c6 fffff880`02f8cb70 fffff880`02f8cb20 : nt!KiExceptionDispatch+0xc2
fffff880`02f8cb00 0000f880`03de9c61 : fffff800`038e6a3a 00000000`002b99f4 fffffa80`0545c8e8 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`02f8cc98 fffff800`038e6a3a : 00000000`002b99f4 fffffa80`0545c8e8 00000000`00000000 00000000`00000000 : 0xf880`03de9c61
fffff880`02f8cca0 fffff800`038e16cc : fffff880`02f64180 fffff880`00000002 00000000`00000002 fffff880`00000000 : nt!PoIdle+0x53a
fffff880`02f8cd80 00000000`00000000 : fffff880`02f8d000 fffff880`02f87000 fffff880`02f8cd40 00000000`00000000 : nt!KiIdleLoop+0x2c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiKernelCalloutExceptionHandler+e
fffff800`038d0c2e 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiKernelCalloutExceptionHandler+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1E_0_nt!KiKernelCalloutExceptionHandler+e
BUCKET_ID: X64_0x1E_0_nt!KiKernelCalloutExceptionHandler+e
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\022811-15865-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*e:\windbgsymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03859000 PsLoadedModuleList = 0xfffff800`03a96e50
Debug session time: Mon Feb 28 19:02:12.669 2011 (UTC - 5:00)
System Uptime: 0 days 0:57:53.245
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C4, {91, a, fffff88002f6efc0, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4944 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
the operating system. The only supported way to extend a kernel
mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 000000000000000a
Arg3: fffff88002f6efc0
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0xc4_91
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: a
EXCEPTION_RECORD: fffff88002f6cbf8 -- (.exr 0xfffff88002f6cbf8)
ExceptionAddress: 0000f800038c9504
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
TRAP_FRAME: fffff88002f6cca0 -- (.trap 0xfffff88002f6cca0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000002f64000 rbx=0000000000000000 rcx=00000000c0000101
rdx=00000000fffff880 rsi=0000000000000000 rdi=0000000000000000
rip=0000f800038c9504 rsp=fffff88002f6ce30 rbp=fffff88002f6ceb0
r8=0000f800038c8e3e r9=0000000000000000 r10=0000000000000000
r11=fffff88002f8b4a8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
0000f800`038c9504 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800039218fa to fffff800038caf00
STACK_TEXT:
fffff880`02f6b1c8 fffff800`039218fa : 00000000`000000c4 00000000`00000091 00000000`0000000a fffff880`02f6efc0 : nt!KeBugCheckEx
fffff880`02f6b1d0 fffff800`038f7e73 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4944
fffff880`02f6b210 fffff800`039051b5 : fffff880`02f6c0c8 fffff880`02f6be20 fffff880`02f6c170 fffff880`02f6c3b0 : nt!RtlDispatchException+0x33
fffff880`02f6b8f0 fffff800`038ca542 : fffff880`02f6c0c8 00000000`00000000 fffff880`02f6c170 00000000`00000001 : nt!KiDispatchException+0x135
fffff880`02f6bf90 fffff800`038c8e4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`02f6c170 fffff800`038c1e63 : fffff800`038a0210 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`02f6c308 fffff800`038a0210 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!memcpy+0x223
fffff880`02f6c310 fffff800`0389ff88 : fffff880`02f6c3b0 00000000`00000001 fffff880`02f6c3b0 fffff880`02f6cc00 : nt!KiOpFetchBytes+0x30
fffff880`02f6c340 fffff800`03905573 : fffff880`02f6cbf8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiOpDecode+0x68
fffff880`02f6c390 fffff800`03905170 : fffff880`02f6cbf8 fffff880`02f6cca0 fffff880`02f6cca0 00000000`00000000 : nt!KiPreprocessFault+0x53
fffff880`02f6c420 fffff800`038ca542 : fffff880`02f6cbf8 fffff880`02f8c318 fffff880`02f6cca0 fffff880`02f8c3c0 : nt!KiDispatchException+0xf0
fffff880`02f6cac0 fffff800`038c8e4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`02f6cca0 0000f800`038c9504 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`02f6ce30 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xf800`038c9504
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4944
fffff800`039218fa cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4944
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4944
BUCKET_ID: X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4944
Followup: MachineOwner
---------