Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\031311-15756-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x8283e000 PsLoadedModuleList = 0x82986810
Debug session time: Sun Mar 13 14:43:18.377 2011 (UTC - 5:00)
System Uptime: 0 days 0:06:00.313
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 828ae655, 91ee3b6c, 0}
Probably caused by : ntkrpamp.exe ( nt!_SEH_epilog4+0 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 828ae655, The address that the exception occurred at
Arg3: 91ee3b6c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!_SEH_epilog4+0
828ae655 8b4df0 mov ecx,dword ptr [ebp-10h]
TRAP_FRAME: 91ee3b6c -- (.trap 0xffffffff91ee3b6c)
ErrCode = 00000002
eax=00000102 ebx=00000000 ecx=82a70bca edx=00000000 esi=00000001 edi=00000001
eip=828ae655 esp=91ee3be0 ebp=91ee3d18 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!_SEH_epilog4:
828ae655 8b4df0 mov ecx,dword ptr [ebp-10h] ss:0010:91ee3d08=ffffffff
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 8288143a to 828ae655
STACK_TEXT:
91ee3d18 8288143a 00000001 0019f764 00000001 nt!_SEH_epilog4
91ee3d18 77d86344 00000001 0019f764 00000001 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0019f7b0 00000000 00000000 00000000 00000000 0x77d86344
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!_SEH_epilog4+0
828ae655 8b4df0 mov ecx,dword ptr [ebp-10h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!_SEH_epilog4+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc78ed4
FAILURE_BUCKET_ID: 0x8E_nt!_SEH_epilog4+0
BUCKET_ID: 0x8E_nt!_SEH_epilog4+0
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\031311-15896-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Mini Kernel Dump does not have process information
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000.
Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt, Win32 error 0n2
Unable to add module at 00000000
Debugger can not determine kernel base address
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x82846000 PsLoadedModuleList = 0x8298e810
Debug session time: Sun Mar 13 14:46:32.947 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:07.758
"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000.
Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt, Win32 error 0n2
Unable to add module at 00000000
Debugger can not determine kernel base address
Loading Kernel Symbols
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {c63b5773, 2, 1, 828b258f}
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c63b5773, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 828b258f, address which referenced memory
Debugging Details:
------------------
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
c63b5773
CURRENT_IRQL: 0
FAULTING_IP:
+3066363961666535
828b258f 0fbe7357 movsx esi,byte ptr [ebx+57h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 887424ac to 887423d7
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
8296cb24 887424ac 888fdda8 8296cbdc 00000000 0x887423d7
8296cb38 828b016d 888fe000 888fdfd0 5ad6bb70 0x887424ac
8296cb7c 828b0111 8296fd20 8296cca8 00000001 0x828b016d
8296cc68 828affce 8296fd20 8296cca8 00000000 0x828b0111
8296ccdc 828ae34e 000010f7 864bb608 82979280 0x828affce
8296cd20 828ae178 00000000 0000000e 00000000 0x828ae34e
8296cd24 00000000 0000000e 00000000 00000000 0x828ae178
STACK_COMMAND: kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: CORRUPT_MODULELIST
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\031311-24632-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x82809000 PsLoadedModuleList = 0x82951810
Debug session time: Sun Mar 13 10:33:36.665 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:13.600
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {80fdf8ec, 2, 0, 8287228c}
Probably caused by : ntkrpamp.exe ( nt!KiSignalThread+9d )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 80fdf8ec, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8287228c, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from 82971718
Unable to read MiSystemVaType memory at 82951160
80fdf8ec
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiSignalThread+9d
8287228c 8b8bcc030000 mov ecx,dword ptr [ebx+3CCh]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: 807dfa6c -- (.trap 0xffffffff807dfa6c)
ErrCode = 00000000
eax=00000000 ebx=80fdf520 ecx=861dcd01 edx=00000001 esi=861dcd48 edi=861dcc80
eip=8287228c esp=807dfae0 ebp=807dfae8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KiSignalThread+0x9d:
8287228c 8b8bcc030000 mov ecx,dword ptr [ebx+3CCh] ds:0023:80fdf8ec=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 8287228c to 8284f81b
STACK_TEXT:
807dfa6c 8287228c badb0d00 00000001 8e96d0b0 nt!KiTrap0E+0x2cf
807dfae8 82872162 80fdf520 00000001 861d5bf8 nt!KiSignalThread+0x9d
807dfb1c 82845a69 80fdf520 00000001 00000000 nt!KiTryUnwaitThread+0x60
807dfb3c 828733ad 80fdf520 807dfba4 861d5bf0 nt!KiSignalNotificationObject+0x36
807dfb80 8287309b 807c3120 00000001 807c4a80 nt!KiTimerWaitTest+0x1e6
807dfc68 82872fce 807c3120 807dfca8 00000000 nt!KiProcessExpiredTimerList+0x8b
807dfcdc 8287134e 0000126d 861dcd48 807c8800 nt!KiTimerExpiration+0x25c
807dfd20 82871178 00000000 0000000e 6d236c5c nt!KiRetireDpcList+0xcb
807dfd24 00000000 0000000e 6d236c5c 6e770057 nt!KiIdleLoop+0x38
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSignalThread+9d
8287228c 8b8bcc030000 mov ecx,dword ptr [ebx+3CCh]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiSignalThread+9d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc78ed4
FAILURE_BUCKET_ID: 0xA_nt!KiSignalThread+9d
BUCKET_ID: 0xA_nt!KiSignalThread+9d
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\031311-17815-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x82851000 PsLoadedModuleList = 0x82999810
Debug session time: Sun Mar 13 14:44:54.481 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:04.432
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {191c, 2, 1, 828db54d}
Probably caused by : cng.sys ( cng!GatherRandomKey+272 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000191c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 828db54d, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 829b9718
Unable to read MiSystemVaType memory at 82999160
0000191c
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiAcquireThreadStateLock+7f
828db54d 870a xchg ecx,dword ptr [edx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: 8a5232ac -- (.trap 0xffffffff8a5232ac)
ErrCode = 00000002
eax=0000191c ebx=ffffffff ecx=00000001 edx=0000191c esi=00000000 edi=86b9e498
eip=828db54d esp=8a523320 ebp=8a523334 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!KiAcquireThreadStateLock+0x7f:
828db54d 870a xchg ecx,dword ptr [edx] ds:0023:0000191c=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 828db54d to 8289781b
STACK_TEXT:
8a5232ac 828db54d badb0d00 0000191c 00000053 nt!KiTrap0E+0x2cf
8a523334 828f1829 8a523348 9bade6f8 9bade540 nt!KiAcquireThreadStateLock+0x7f
8a523358 82a8ed11 ab9a8c15 00000000 0001ff68 nt!KeQueryValuesThread+0x6c
8a5233f4 82a858a6 9bad3098 0001ff68 8a523844 nt!ExpGetProcessInformation+0x1ed
8a523874 82a8795c 00000005 00000000 00000000 nt!ExpQuerySystemInformation+0x1086
8a523890 8289443a 00000005 9bad3098 0001ff68 nt!NtQuerySystemInformation+0x76
8a523890 82892e09 00000005 9bad3098 0001ff68 nt!KiFastCallEntry+0x12a
8a523918 8859ffdf 00000005 9bad3098 0001ff68 nt!ZwQuerySystemInformation+0x11
8a523c78 8857d15e 00000000 00000000 8a523c98 cng!GatherRandomKey+0x272
8a523cdc 8857d1bf 00000000 8a523d00 82a71b2f cng!ReadExternalEntropyIntoPool+0x1a6
8a523ce8 82a71b2f 85665cb0 00000000 8586ca48 cng!scavengingWorkItemRoutine+0x15
8a523d00 828bf03b 8586ca48 00000000 84864d48 nt!IopProcessWorkItem+0x2d
8a523d50 82a5f9df 00000001 ab9a8271 00000000 nt!ExpWorkerThread+0x10d
8a523d90 829111d9 828bef2e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
cng!GatherRandomKey+272
8859ffdf 83fb20 cmp ebx,20h
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: cng!GatherRandomKey+272
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: cng
IMAGE_NAME: cng.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc427
FAILURE_BUCKET_ID: 0xA_cng!GatherRandomKey+272
BUCKET_ID: 0xA_cng!GatherRandomKey+272
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\031311-16551-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x8280f000 PsLoadedModuleList = 0x82957810
Debug session time: Sun Mar 13 15:16:30.008 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:14.944
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {191c, 2, 1, 8289954d}
Probably caused by : cng.sys ( cng!GatherRandomKey+272 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000191c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8289954d, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82977718
Unable to read MiSystemVaType memory at 82957160
0000191c
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiAcquireThreadStateLock+7f
8289954d 870a xchg ecx,dword ptr [edx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 828af829 to 8289954d
STACK_TEXT:
8a523334 828af829 8a523348 9b8f72b8 9b8f7100 nt!KiAcquireThreadStateLock+0x7f
8a523358 82a4cd11 ab9c171b 00000000 0001ff68 nt!KeQueryValuesThread+0x6c
8a5233f4 82a438a6 9b8ec098 0001ff68 8a523844 nt!ExpGetProcessInformation+0x1ed
8a523874 82a4595c 00000005 00000000 00000000 nt!ExpQuerySystemInformation+0x1086
8a523890 8285243a 00000005 9b8ec098 0001ff68 nt!NtQuerySystemInformation+0x76
8a523890 82850e09 00000005 9b8ec098 0001ff68 nt!KiFastCallEntry+0x12a
8a523918 885a7fdf 00000005 9b8ec098 0001ff68 nt!ZwQuerySystemInformation+0x11
8a523c78 8858515e 00000000 00000000 8a523c98 cng!GatherRandomKey+0x272
8a523cdc 885851bf 00000000 8a523d00 82a2fb2f cng!ReadExternalEntropyIntoPool+0x1a6
8a523ce8 82a2fb2f 85665cb0 00000000 8687e1a0 cng!scavengingWorkItemRoutine+0x15
8a523d00 8287d03b 8687e1a0 00000000 8484ad48 nt!IopProcessWorkItem+0x2d
8a523d50 82a1d9df 00000001 ab9c197f 00000000 nt!ExpWorkerThread+0x10d
8a523d90 828cf1d9 8287cf2e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
cng!GatherRandomKey+272
885a7fdf 83fb20 cmp ebx,20h
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: cng!GatherRandomKey+272
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: cng
IMAGE_NAME: cng.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc427
FAILURE_BUCKET_ID: 0xA_cng!GatherRandomKey+272
BUCKET_ID: 0xA_cng!GatherRandomKey+272
Followup: MachineOwner
---------
