Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021911-23212-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02c5f000 PsLoadedModuleList = 0xfffff800`02e9ce50
Debug session time: Sat Feb 19 08:30:21.429 2011 (UTC - 5:00)
System Uptime: 0 days 2:36:55.161
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {e9, 2, 1, fffff80002cd37b4}
Probably caused by : win32k.sys ( win32k!SetWakeBit+f8 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000000e9, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cd37b4, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f070e0
00000000000000e9
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeSetEvent+124
fffff800`02cd37b4 48894108 mov qword ptr [rcx+8],rax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: csrss.exe
TRAP_FRAME: fffff88002b2d870 -- (.trap 0xfffff88002b2d870)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8007859588 rbx=0000000000000000 rcx=00000000000000e1
rdx=fffffa8007d43160 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cd37b4 rsp=fffff88002b2da00 rbp=0000000000000000
r8=0000000000000000 r9=000000000000000a r10=fffff80002c5f000
r11=fffff88002b2d9d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po nc
nt!KeSetEvent+0x124:
fffff800`02cd37b4 48894108 mov qword ptr [rcx+8],rax ds:00000000`000000e9=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cceca9 to fffff80002ccf740
STACK_TEXT:
fffff880`02b2d728 fffff800`02cceca9 : 00000000`0000000a 00000000`000000e9 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02b2d730 fffff800`02ccd920 : 00000000`00000004 fffffa80`07859580 fffffa80`06581660 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02b2d870 fffff800`02cd37b4 : fffffa80`075ff1b0 00000000`00000000 00000000`00000000 00000000`00000002 : nt!KiPageFault+0x260
fffff880`02b2da00 fffff960`0018b57c : 00000000`00000000 fffff960`00000002 00000000`00000000 00000000`000000e1 : nt!KeSetEvent+0x124
fffff880`02b2da70 fffff960`00182f43 : fffff900`c01e7b20 00000000`00000001 00000000`00000004 fffff800`02cdb1e3 : win32k!SetWakeBit+0xf8
fffff880`02b2daa0 fffff960`00183964 : 00000000`00000000 fffff960`003a0a90 00000000`00000004 00000000`00000001 : win32k!TimersProc+0x157
fffff880`02b2daf0 fffff960`001146d4 : fffffa80`0000007b 00000000`0000000f fffff880`00000001 ffffffff`8000042c : win32k!RawInputThread+0x9b4
fffff880`02b2dbc0 fffff960`0019419a : fffffa80`00000002 fffff880`02b19f40 00000000`00000020 00000000`00000000 : win32k!xxxCreateSystemThreads+0x58
fffff880`02b2dbf0 fffff800`02cce993 : fffffa80`065815a0 00000000`00000004 000007ff`fffd3000 00000000`00000000 : win32k!NtUserCallNoParam+0x36
fffff880`02b2dc20 000007fe`fd853d5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0055f818 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fd853d5a
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!SetWakeBit+f8
fffff960`0018b57c 488b5c2430 mov rbx,qword ptr [rsp+30h]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: win32k!SetWakeBit+f8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d23ecb0
FAILURE_BUCKET_ID: X64_0xA_win32k!SetWakeBit+f8
BUCKET_ID: X64_0xA_win32k!SetWakeBit+f8
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021911-23275-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02c4f000 PsLoadedModuleList = 0xfffff800`02e8ce50
Debug session time: Sat Feb 19 12:15:06.777 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:12.510
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80002cd74c5, 0, 204000010}
Probably caused by : ntkrnlmp.exe ( nt!FsRtlLookupPerFileObjectContext+a5 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002cd74c5, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000204000010, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!FsRtlLookupPerFileObjectContext+a5
fffff800`02cd74c5 48395810 cmp qword ptr [rax+10h],rbx
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000204000010
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef70e0
0000000204000010
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: wmpnscfg.exe
CURRENT_IRQL: 1
EXCEPTION_RECORD: fffff88008b20ad8 -- (.exr 0xfffff88008b20ad8)
ExceptionAddress: fffff80002cd74c5 (nt!FsRtlLookupPerFileObjectContext+0x00000000000000a5)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000204000010
Attempt to read from address 0000000204000010
TRAP_FRAME: fffff88008b20b80 -- (.trap 0xfffff88008b20b80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000204000000 rbx=0000000000000000 rcx=fffffa80086822f8
rdx=fffffa8006128b20 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cd74c5 rsp=fffff88008b20d10 rbp=0000000000000000
r8=0000000000000000 r9=fffffa80069407b0 r10=fffffa80053bee20
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
nt!FsRtlLookupPerFileObjectContext+0xa5:
fffff800`02cd74c5 48395810 cmp qword ptr [rax+10h],rbx ds:00000002`04000010=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cf9a39 to fffff80002cbf740
STACK_TEXT:
fffff880`08b20308 fffff800`02cf9a39 : 00000000`0000001e ffffffff`c0000005 fffff800`02cd74c5 00000000`00000000 : nt!KeBugCheckEx
fffff880`08b20310 fffff800`02cbed82 : fffff880`08b20ad8 fffffa80`06128b20 fffff880`08b20b80 fffffa80`086822c0 : nt!KiDispatchException+0x1b9
fffff880`08b209a0 fffff800`02cbd8fa : 00000000`00000000 fffffa80`06128b20 fffffa80`0613c000 fffffa80`0648d010 : nt!KiExceptionDispatch+0xc2
fffff880`08b20b80 fffff800`02cd74c5 : fffff880`08b20db0 fffff880`00d9732e fffffa80`07961510 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`08b20d10 fffff880`00d96aaf : 00000000`00000000 fffff880`08b20e10 fffffa80`069407b0 fffff880`08b21038 : nt!FsRtlLookupPerFileObjectContext+0xa5
fffff880`08b20d50 fffff880`00d94922 : 00000000`00000000 fffff800`02dc92fa 00000000`00000000 00000000`00000000 : fltmgr!FltpGetStartingCallbackNode+0x3f
fffff880`08b20de0 fffff800`02cd6c21 : fffffa80`0781cae0 00000000`00000000 fffff880`08b20f18 fffff880`03eb3c18 : fltmgr!FltpPreFsFilterOperation+0xa2
fffff880`08b20e70 fffff800`02faf5e8 : fffff880`00d94710 00000000`00000000 fffffa80`063f4030 fffff880`00d94880 : nt!FsFilterPerformCallbacks+0xcd
fffff880`08b20ed0 fffff800`02cab923 : fffff880`08b21260 fffff880`08b21200 fffffa80`08682cd0 fffff880`02fd3180 : nt!FsRtlAcquireFileForCcFlushEx+0xd0
fffff880`08b21170 fffff800`02ca242c : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmFlushSection+0x1c3
fffff880`08b21230 fffff800`02fb849a : 00000000`00000000 00000000`00000006 00000000`01000000 00000000`00000000 : nt!MiFlushDataSection+0x190
fffff880`08b212a0 fffff800`02fadd13 : fffff880`08b21500 00000000`00000000 fffff880`08b215a8 fffff880`08b214f8 : nt!MmCreateSection+0x2ce
fffff880`08b214b0 fffff800`0311c005 : fffff8a0`048216d8 00000000`00000000 00000000`00000001 00000002`00000000 : nt!NtCreateSection+0x162
fffff880`08b21530 fffff800`0311c3b7 : 00000000`00000010 fffff8a0`0b1e2d10 fffff880`08b216c0 00000000`0000002c : nt!PfSnGetSectionObject+0x2d5
fffff880`08b21620 fffff800`0311c7e7 : fffff880`08b21740 00000000`00000001 00000000`00000000 00000000`00000000 : nt!PfSnPrefetchSections+0x247
fffff880`08b21710 fffff800`0311cc0f : 00000023`5f6d76e4 fffffa80`08122b30 fffff8a0`0b101000 00000000`c00000ce : nt!PfSnPrefetchScenario+0x187
fffff880`08b21980 fffff800`02f146df : 00000000`00000000 00000000`fc0d39bf fffffa80`070c84f0 00000000`00000000 : nt!PfSnBeginAppLaunch+0x35f
fffff880`08b21a50 fffff800`02f8afec : fffffa80`07669b60 fffffa80`070c84f0 00000000`14050800 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x4fc30
fffff880`08b21a80 fffff800`02c9dd55 : fffff880`02f63180 00000000`00000000 fffff800`02f8aef0 fffffa80`07669b60 : nt!PspUserThreadStartup+0xfc
fffff880`08b21ae0 fffff800`02c9dcd7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThread+0x16
fffff880`08b21c20 00000000`76f72ca0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThreadReturn
00000000`0022f8e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f72ca0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!FsRtlLookupPerFileObjectContext+a5
fffff800`02cd74c5 48395810 cmp qword ptr [rax+10h],rbx
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!FsRtlLookupPerFileObjectContext+a5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!FsRtlLookupPerFileObjectContext+a5
BUCKET_ID: X64_0x1E_c0000005_nt!FsRtlLookupPerFileObjectContext+a5
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\a\Minidump\D M P\DMP\021911-22604-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e86e50
Debug session time: Sat Feb 19 15:31:56.648 2011 (UTC - 5:00)
System Uptime: 0 days 0:07:21.991
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1000e008a, 2, 1, fffff80002cc2624}
Probably caused by : ntkrnlmp.exe ( nt!KeReleaseMutant+274 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001000e008a, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc2624, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef10e0
00000001000e008a
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeReleaseMutant+274
fffff800`02cc2624 48894108 mov qword ptr [rcx+8],rax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: svchost.exe
TRAP_FRAME: fffff88006884960 -- (.trap 0xfffff88006884960)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8005d2fcf0 rbx=0000000000000000 rcx=00000001000e0082
rdx=fffffa8005d2fcf0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cc2624 rsp=fffff88006884af0 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=fffffa80053bc570
r11=00000000001f0001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!KeReleaseMutant+0x274:
fffff800`02cc2624 48894108 mov qword ptr [rcx+8],rax ds:47a0:00000001`000e008a=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cb8ca9 to fffff80002cb9740
STACK_TEXT:
fffff880`06884818 fffff800`02cb8ca9 : 00000000`0000000a 00000001`000e008a 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`06884820 fffff800`02cb7920 : 00000000`0f17ee00 fffffa80`05d2fcf0 fffff880`06884a80 fffffa80`07625060 : nt!KiBugCheckDispatch+0x69
fffff880`06884960 fffff800`02cc2624 : fffffa80`2079654b fffffa80`053d43c0 00000000`00000508 fffff800`02fccfd6 : nt!KiPageFault+0x260
fffff880`06884af0 fffff800`02fb1c5e : 00000000`00000000 00000000`00000001 fffffa80`053bc570 00000000`00000000 : nt!KeReleaseMutant+0x274
fffff880`06884ba0 fffff800`02cb8993 : fffffa80`07625060 fffff880`00000000 00000000`7ef8f000 fffffa80`05d2fcf0 : nt!NtReleaseMutant+0x86
fffff880`06884c20 00000000`74a12dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02ffe958 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74a12dd9
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeReleaseMutant+274
fffff800`02cc2624 48894108 mov qword ptr [rcx+8],rax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeReleaseMutant+274
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0xA_nt!KeReleaseMutant+274
BUCKET_ID: X64_0xA_nt!KeReleaseMutant+274
Followup: MachineOwner
---------