Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\041411-24148-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0x82c4c000 PsLoadedModuleList = 0x82d96850
Debug session time: Thu Apr 14 16:43:04.445 2011 (UTC - 4:00)
System Uptime: 0 days 0:01:48.162
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 82e79f3e, 8cd1b864, 0}
Probably caused by : ntkrpamp.exe ( nt!ExpAllocateHandleTableEntry+1f )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82e79f3e, The address that the exception occurred at
Arg3: 8cd1b864, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExpAllocateHandleTableEntry+1f
82e79f3e f00fba2800 lock bts dword ptr [eax],0
TRAP_FRAME: 8cd1b864 -- (.trap 0xffffffff8cd1b864)
ErrCode = 00000002
eax=0000000c ebx=00000000 ecx=0000000c edx=000f001f esi=00000000 edi=856f7020
eip=82e79f3e esp=8cd1b8d8 ebp=8cd1b8e8 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
nt!ExpAllocateHandleTableEntry+0x1f:
82e79f3e f00fba2800 lock bts dword ptr [eax],0 ds:0023:0000000c=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: iPodService.ex
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82e8ddf3 to 82e79f3e
STACK_TEXT:
8cd1b8e8 82e8ddf3 8cd1b908 8cd1b950 a322b988 nt!ExpAllocateHandleTableEntry+0x1f
8cd1b900 82e70c28 00000000 8cd1b950 a322b9a0 nt!ExCreateHandle+0x1a
8cd1b958 82e7123e 00000000 a322b9a0 000f001f nt!ObpCreateHandle+0x2a8
8cd1bafc 82e71165 00000000 000f001f 00000000 nt!ObInsertObjectEx+0xd0
8cd1bb18 82e7110a a322b9a0 00000000 000f001f nt!ObInsertObject+0x1e
8cd1bb84 82c8a1ea 8cd1bc98 000f001f 00000000 nt!NtCreateSection+0x1df
8cd1bb84 82c87df5 8cd1bc98 000f001f 00000000 nt!KiFastCallEntry+0x12a
8cd1bd00 82cc9aab 800004f8 00000000 856f7020 nt!ZwCreateSection+0x11
8cd1bd50 82e55f5e 00000001 a640c7f1 00000000 nt!ExpWorkerThread+0x10d
8cd1bd90 82cfd219 82cc999e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExpAllocateHandleTableEntry+1f
82e79f3e f00fba2800 lock bts dword ptr [eax],0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpAllocateHandleTableEntry+1f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78a09
FAILURE_BUCKET_ID: 0x8E_nt!ExpAllocateHandleTableEntry+1f
BUCKET_ID: 0x8E_nt!ExpAllocateHandleTableEntry+1f
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\041411-24180-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0x82c14000 PsLoadedModuleList = 0x82d5e850
Debug session time: Thu Apr 14 15:46:08.894 2011 (UTC - 4:00)
System Uptime: 0 days 0:02:08.736
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007F, {d, 0, 0, 0}
Probably caused by : ntkrpamp.exe ( nt!KiSwapProcess+7a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_d
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 82c979a4 to 82c8bdee
STACK_TEXT:
8cd1bbf0 82c979a4 87fae018 85661b98 856f7080 nt!KiSwapProcess+0x7a
8cd1bc0c 82cafe70 00000000 00000000 856f7190 nt!KiAttachProcess+0xd1
8cd1bc50 82c5063d badb0d00 8cd1bcc8 8c00bc88 nt!KeStackAttachProcess+0xbe
8cd1bd00 82c91aab 80000760 00000000 856f7020 nt!ZwOpenProcess+0x11
8cd1bd50 82e1df5e 00000001 a642d304 00000000 nt!ExpWorkerThread+0x10d
8cd1bd90 82cc5219 82c9199e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSwapProcess+7a
82c8bdee 0f00d0 lldt ax
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiSwapProcess+7a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78a09
FAILURE_BUCKET_ID: 0x7f_d_nt!KiSwapProcess+7a
BUCKET_ID: 0x7f_d_nt!KiSwapProcess+7a
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\041411-24164-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0x82c07000 PsLoadedModuleList = 0x82d51850
Debug session time: Thu Apr 14 16:36:58.809 2011 (UTC - 4:00)
System Uptime: 0 days 0:01:26.526
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 82e34f3e, 8cd13864, 0}
Probably caused by : ntkrpamp.exe ( nt!ExpAllocateHandleTableEntry+1f )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82e34f3e, The address that the exception occurred at
Arg3: 8cd13864, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ExpAllocateHandleTableEntry+1f
82e34f3e f00fba2800 lock bts dword ptr [eax],0
TRAP_FRAME: 8cd13864 -- (.trap 0xffffffff8cd13864)
ErrCode = 00000002
eax=0000000c ebx=00000000 ecx=0000000c edx=000f001f esi=00000000 edi=856f8798
eip=82e34f3e esp=8cd138d8 ebp=8cd138e8 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
nt!ExpAllocateHandleTableEntry+0x1f:
82e34f3e f00fba2800 lock bts dword ptr [eax],0 ds:0023:0000000c=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: msseces.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82e48df3 to 82e34f3e
STACK_TEXT:
8cd138e8 82e48df3 8cd13908 8cd13950 a804a268 nt!ExpAllocateHandleTableEntry+0x1f
8cd13900 82e2bc28 00000000 8cd13950 a804a280 nt!ExCreateHandle+0x1a
8cd13958 82e2c23e 00000000 a804a280 000f001f nt!ObpCreateHandle+0x2a8
8cd13afc 82e2c165 00000000 000f001f 00000000 nt!ObInsertObjectEx+0xd0
8cd13b18 82e2c10a a804a280 00000000 000f001f nt!ObInsertObject+0x1e
8cd13b84 82c451ea 8cd13c98 000f001f 00000000 nt!NtCreateSection+0x1df
8cd13b84 82c42df5 8cd13c98 000f001f 00000000 nt!KiFastCallEntry+0x12a
8cd13d00 82c84aab 800008a4 00000000 856f8798 nt!ZwCreateSection+0x11
8cd13d50 82e10f5e 00000001 a6492c12 00000000 nt!ExpWorkerThread+0x10d
8cd13d90 82cb8219 82c8499e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExpAllocateHandleTableEntry+1f
82e34f3e f00fba2800 lock bts dword ptr [eax],0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpAllocateHandleTableEntry+1f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78a09
FAILURE_BUCKET_ID: 0x8E_nt!ExpAllocateHandleTableEntry+1f
BUCKET_ID: 0x8E_nt!ExpAllocateHandleTableEntry+1f
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\041411-24273-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0x82c00000 PsLoadedModuleList = 0x82d4a850
Debug session time: Thu Apr 14 15:52:17.043 2011 (UTC - 4:00)
System Uptime: 0 days 0:01:36.760
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 82ca1cbd, 8cd17b50, 8cd17730}
Probably caused by : ntkrpamp.exe ( nt!RtlImageNtHeaderEx+4a )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82ca1cbd, The address that the exception occurred at
Arg3: 8cd17b50, Exception Record Address
Arg4: 8cd17730, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!RtlImageNtHeaderEx+4a
82ca1cbd 663902 cmp word ptr [edx],ax
EXCEPTION_RECORD: 8cd17b50 -- (.exr 0xffffffff8cd17b50)
ExceptionAddress: 82ca1cbd (nt!RtlImageNtHeaderEx+0x0000004a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 7ffa0000
Attempt to read from address 7ffa0000
CONTEXT: 8cd17730 -- (.cxr 0xffffffff8cd17730)
eax=00005a4d ebx=87f209dc ecx=00000000 edx=7ffa0000 esi=00000000 edi=8cd17c2c
eip=82ca1cbd esp=8cd17c18 ebp=8cd17c18 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!RtlImageNtHeaderEx+0x4a:
82ca1cbd 663902 cmp word ptr [edx],ax ds:0023:7ffa0000=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: msseces.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 7ffa0000
READ_ADDRESS: GetPointerFromAddress: unable to read from 82d6a718
Unable to read MiSystemVaType memory at 82d4a1a0
7ffa0000
FOLLOWUP_IP:
nt!RtlImageNtHeaderEx+4a
82ca1cbd 663902 cmp word ptr [edx],ax
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 82ca8a54 to 82ca1cbd
STACK_TEXT:
8cd17c18 82ca8a54 00000000 00000000 87f209a8 nt!RtlImageNtHeaderEx+0x4a
8cd17c50 82c3c63d 00000000 8cd17cc8 00000018 nt!RtlImageNtHeader+0x1a
8cd17d00 82c7daab 80000890 00000000 856f84c0 nt!ZwOpenProcess+0x11
8cd17d50 82e09f5e 00000001 a64eb7e2 00000000 nt!ExpWorkerThread+0x10d
8cd17d90 82cb1219 82c7d99e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!RtlImageNtHeaderEx+4a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce78a09
STACK_COMMAND: .cxr 0xffffffff8cd17730 ; kb
FAILURE_BUCKET_ID: 0x7E_nt!RtlImageNtHeaderEx+4a
BUCKET_ID: 0x7E_nt!RtlImageNtHeaderEx+4a
Followup: MachineOwner
---------