Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\020511-24765-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c02000 PsLoadedModuleList = 0xfffff800`02e3fe50
Debug session time: Fri Feb 4 17:20:50.761 2011 (UTC - 5:00)
System Uptime: 0 days 0:07:39.074
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 19c64, 0, 19224}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000019c64, page frame number
Arg3: 0000000000000000, current page state
Arg4: 0000000000019224, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Installer.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002d0238c to fffff80002c72740
STACK_TEXT:
fffff880`0650ff98 fffff800`02d0238c : 00000000`0000004e 00000000`00000099 00000000`00019c64 00000000`00000000 : nt!KeBugCheckEx
fffff880`0650ffa0 fffff800`02ce49f7 : 00000000`00000000 fffff680`00052068 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0650ffe0 fffff800`02c46c23 : fffffa80`065ba930 fffff700`000127df 0000007f`fffffff8 fffff8a0`0306fdf0 : nt! ?? ::FNODOBFM::`string'+0x3223e
fffff880`06510070 fffff800`02c4568a : fffffa80`065ba930 fffffa80`00000069 fffff880`000117ac fffff800`00000006 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`06510920 fffff800`02f57dcf : fffff8a0`030be060 fffff880`06510c20 00000000`00000000 fffffa80`068f2b60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`06510970 fffff800`02f30635 : 00000000`c0000005 00000000`c0000001 00000000`7efa4000 fffffa80`0692c600 : nt!PspExitThread+0x92f
fffff880`06510a30 fffff800`02c4f1db : 00000000`00000100 fffffa80`068f2c20 00000000`00000001 fffff800`02c79b9d : nt!PsExitSpecialApc+0x1d
fffff880`06510a60 fffff800`02c4f620 : 00000000`00000000 fffff880`06510ae0 fffff800`02f3074c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`06510ae0 fffff800`02c71a37 : fffffa80`068f2b60 00000000`00000260 00000000`00000000 fffffa80`05b94600 : nt!KiInitiateUserApc+0x70
fffff880`06510c20 00000000`75312dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`031df0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75312dd9
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`02d0238c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\020411-20281-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c4b000 PsLoadedModuleList = 0xfffff800`02e88e50
Debug session time: Fri Feb 4 04:21:56.522 2011 (UTC - 5:00)
System Uptime: 0 days 0:12:29.131
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff900c207e000, 0, fffff96000134a7f, 0}
Could not read faulting driver name
Probably caused by : memory_corruption
Followup: memory_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c207e000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff96000134a7f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef30e0
fffff900c207e000
FAULTING_IP:
win32k!RestoreGammaRamp+53
fffff960`00134a7f 3b33 cmp esi,dword ptr [rbx]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x50
PROCESS_NAME: winlogon.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88009518970 -- (.trap 0xfffff88009518970)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000591
rdx=fffffa8006207b60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000134a7f rsp=fffff88009518b00 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=00000000000015f3
r11=fffffa8006207b60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po nc
win32k!RestoreGammaRamp+0x53:
fffff960`00134a7f 3b33 cmp esi,dword ptr [rbx] ds:00000000`00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002d3bf14 to fffff80002cbb740
STACK_TEXT:
fffff880`09518808 fffff800`02d3bf14 : 00000000`00000050 fffff900`c207e000 00000000`00000000 fffff880`09518970 : nt!KeBugCheckEx
fffff880`09518810 fffff800`02cb982e : 00000000`00000000 fffff900`c207e000 00000000`00000000 fffff960`00104da0 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`09518970 fffff960`00134a7f : fffff900`c207d9f8 00000000`00000000 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`09518b00 fffff960`00134e2e : fffff900`c207d3f0 ffffffff`d4010811 ffffffff`d4010811 ffffffff`d4010811 : win32k!RestoreGammaRamp+0x53
fffff880`09518b30 fffff960`0007ae13 : fffffa80`05eb4090 fffff880`09518ca0 00000000`00000000 fffffa80`05eb4090 : win32k!xxxSwitchDesktopWithFade+0x1c6
fffff880`09518bd0 fffff800`02cba993 : fffffa80`06207b60 00000000`ffbe8648 fffffa80`05eb4090 00000000`000001e0 : win32k!NtUserSwitchDesktop+0x103
fffff880`09518c20 00000000`77a2524a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`012ff978 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a2524a
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
fffff96000134a7a - win32k!RestoreGammaRamp+4e
[ c7:c3 ]
1 error : !win32k (fffff96000134a7a)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\020411-20171-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c08000 PsLoadedModuleList = 0xfffff800`02e45e50
Debug session time: Fri Feb 4 04:57:54.827 2011 (UTC - 5:00)
System Uptime: 0 days 0:35:05.467
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {3451, fffff6fc4001dc90, fffffa800630c8e0, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4e38d )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003451, The PTEs of an outswapped kernel thread stack are corrupt.
Arg2: fffff6fc4001dc90
Arg3: fffffa800630c8e0
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_3451
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cfd84f to fffff80002c78740
STACK_TEXT:
fffff880`0331db58 fffff800`02cfd84f : 00000000`0000001a 00000000`00003451 fffff6fc`4001dc90 fffffa80`0630c8e0 : nt!KeBugCheckEx
fffff880`0331db60 fffff800`02c6d1ec : fffffa80`0630c8e0 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4e38d
fffff880`0331dc70 fffff800`02c6d187 : 00000000`00000000 00000000`00000001 fffffa80`03bafb30 00000000`00000080 : nt!MmInPageKernelStack+0x40
fffff880`0331dcd0 fffff800`02c6ce2c : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`03bafb00 : nt!KiInSwapKernelStacks+0x1f
fffff880`0331dd00 fffff800`02f1cc06 : 0048804a`a0928130 00650064`006f0043 0074006e`00490020 00690072`00670065 : nt!KeSwapProcessOrStack+0x84
fffff880`0331dd40 fffff800`02c56c26 : fffff880`009e7180 fffffa80`03c50680 fffff880`009f1fc0 696d2e77`77772f2f : nt!PspSystemThreadStartup+0x5a
fffff880`0331dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4e38d
fffff800`02cfd84f cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4e38d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1a_3451_nt!_??_::FNODOBFM::_string_+4e38d
BUCKET_ID: X64_0x1a_3451_nt!_??_::FNODOBFM::_string_+4e38d
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003451, The PTEs of an outswapped kernel thread stack are corrupt.
Arg2: fffff6fc4001dc90
Arg3: fffffa800630c8e0
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_3451
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cfd84f to fffff80002c78740
STACK_TEXT:
fffff880`0331db58 fffff800`02cfd84f : 00000000`0000001a 00000000`00003451 fffff6fc`4001dc90 fffffa80`0630c8e0 : nt!KeBugCheckEx
fffff880`0331db60 fffff800`02c6d1ec : fffffa80`0630c8e0 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4e38d
fffff880`0331dc70 fffff800`02c6d187 : 00000000`00000000 00000000`00000001 fffffa80`03bafb30 00000000`00000080 : nt!MmInPageKernelStack+0x40
fffff880`0331dcd0 fffff800`02c6ce2c : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`03bafb00 : nt!KiInSwapKernelStacks+0x1f
fffff880`0331dd00 fffff800`02f1cc06 : 0048804a`a0928130 00650064`006f0043 0074006e`00490020 00690072`00670065 : nt!KeSwapProcessOrStack+0x84
fffff880`0331dd40 fffff800`02c56c26 : fffff880`009e7180 fffffa80`03c50680 fffff880`009f1fc0 696d2e77`77772f2f : nt!PspSystemThreadStartup+0x5a
fffff880`0331dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4e38d
fffff800`02cfd84f cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4e38d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1a_3451_nt!_??_::FNODOBFM::_string_+4e38d
BUCKET_ID: X64_0x1a_3451_nt!_??_::FNODOBFM::_string_+4e38d
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\020511-33484-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02014000 PsLoadedModuleList = 0xfffff800`02251e50
Debug session time: Fri Feb 4 17:43:45.109 2011 (UTC - 5:00)
System Uptime: 0 days 0:06:14.656
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
.............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, 6554d, 0, 6510d}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000006554d, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000006510d, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: Installer.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000211438c to fffff80002084740
STACK_TEXT:
fffff880`04914778 fffff800`0211438c : 00000000`0000004e 00000000`00000099 00000000`0006554d 00000000`00000000 : nt!KeBugCheckEx
fffff880`04914780 fffff800`020f66a9 : 00000000`00000000 fffff680`00060b38 00000000`00000000 00000000`000006f8 : nt!MiBadShareCount+0x4c
fffff880`049147c0 fffff800`020b5381 : 00000000`00000000 fffff680`00060ff8 fffffa80`065b06a0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x31ed3
fffff880`04914970 fffff800`020c60da : 00000000`00000000 00000000`0c28cfff fffffa80`00000000 fffffa80`065b06a0 : nt!MiDeleteVirtualAddresses+0x408
fffff880`04914b30 fffff800`02083993 : ffffffff`ffffffff 00000000`0008e310 00000000`0008e308 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`04914c20 00000000`7744ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e2d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7744ff3a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0211438c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
Followup: MachineOwner
---------