API tools faq
paste
Guest User

alpinegoose

a guest
Dec 24th, 2013
267
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.09 KB | None | 0 0
raw download clone embed print report
  1. *******************************************************************************
  2. * *
  3. * Bugcheck Analysis *
  4. * *
  5. *******************************************************************************
  6.  
  7. MEMORY_MANAGEMENT (1a)
  8. # Any other values for parameter 1 must be individually examined.
  9. Arguments:
  10. Arg1: 0000000000000411, The subtype of the bugcheck.
  11. Arg2: fffff6fc00018d50
  12. Arg3: 1c200000031aa860
  13. Arg4: fffff6fc00008d51
  14.  
  15. Debugging Details:
  16. ------------------
  17.  
  18.  
  19. BUGCHECK_STR: 0x1a_411
  20.  
  21. CUSTOMER_CRASH_COUNT: 1
  22.  
  23. DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
  24.  
  25. PROCESS_NAME: svchost.exe
  26.  
  27. CURRENT_IRQL: 2
  28.  
  29. TRAP_FRAME: fffff88007628660 -- (.trap 0xfffff88007628660)
  30. NOTE: The trap frame does not contain all registers.
  31. Some register values may be zeroed or incorrect.
  32. rax=fffff88007628a84 rbx=0000000000000000 rcx=ffffffffffffffff
  33. rdx=fffff88007628a48 rsi=0000000000000000 rdi=0000000000000000
  34. rip=fffff800031aaa30 rsp=fffff880076287f8 rbp=fffff880076288f0
  35. r8=fffff88007628a58 r9=0000000000000104 r10=fffff800031aaa30
  36. r11=fffff80002e8fe38 r12=0000000000000000 r13=0000000000000000
  37. r14=0000000000000000 r15=0000000000000000
  38. iopl=0 nv up ei pl zr na po nc
  39. nt!NtProtectVirtualMemory:
  40. fffff800`031aaa30 48895c2408 mov qword ptr [rsp+8],rbx ss:0018:fffff880`07628800=ffffffffffffffff
  41. Resetting default scope
  42.  
  43. LAST_CONTROL_TRANSFER: from fffff80002e6cc4d to fffff80002e90bc0
  44.  
  45. STACK_TEXT:
  46. fffff880`07628308 fffff800`02e6cc4d : 00000000`0000001a 00000000`00000411 fffff6fc`00018d50 1c200000`031aa860 : nt!KeBugCheckEx
  47. fffff880`07628310 fffff800`02ec1281 : 1c200000`031aa860 fffff6fc`00018d50 0000007f`fffffff8 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x6071
  48. fffff880`07628360 fffff800`02eadc8f : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`030cb540 : nt!MiResolveTransitionFault+0x381
  49. fffff880`076283f0 fffff800`02e9dc3b : fffffa80`06c50b30 fffff680`00002000 fffffa80`06c50ec8 00000000`00000000 : nt!MiDispatchFault+0x95f
  50. fffff880`07628500 fffff800`02e8ecee : 00000000`00000008 fffff800`031aaa30 fffffa80`06c50b00 fffffa80`06c50620 : nt!MmAccessFault+0xe1b
  51. fffff880`07628660 fffff800`031aaa30 : fffff800`02e8fe53 ffffffff`ffffffff fffffa80`06c50620 fffffa80`00000000 : nt!KiPageFault+0x16e
  52. fffff880`076287f8 fffff800`02e8fe53 : ffffffff`ffffffff fffffa80`06c50620 fffffa80`00000000 fffff880`07628a28 : nt!NtProtectVirtualMemory
  53. fffff880`07628800 fffff800`02e8c410 : fffff800`0317e4c4 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
  54. fffff880`07628a08 fffff800`0317e4c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
  55. fffff880`07628a10 fffff800`0317c619 : 00000000`00008000 00000000`00080000 00000000`00000000 00000000`00001000 : nt!RtlCreateUserStack+0x1e4
  56. fffff880`07628b00 fffff800`0317c24a : fffffa80`06c50b30 fffff880`07629968 fffffa80`03983800 fffff880`07629550 : nt!PspAllocateThread+0x299
  57. fffff880`07628d20 fffff800`03180569 : fffff800`0309eb1c 00000000`00000000 fffff880`00000001 fffff880`07629550 : nt!PspCreateThread+0x1d2
  58. fffff880`07628fa0 fffff800`02e8fe53 : fffffa80`06c50620 00000000`00000001 00000000`00000008 fffff880`07629780 : nt!NtCreateThreadEx+0x25d
  59. fffff880`076296f0 fffff800`02e8c410 : fffff800`03182d88 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
  60. fffff880`076298f8 fffff800`03182d88 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
  61. fffff880`07629900 fffff800`02e83e62 : fffffa80`06bf4368 fffff880`07629bd0 00000000`00000003 fffff800`031713d8 : nt!RtlpCreateUserThreadEx+0x138
  62. fffff880`07629a20 fffff800`02e7c268 : 00000000`00000000 fffff880`07629bd0 fffff880`07629c00 00000000`00000001 : nt!ExpWorkerFactoryCreateThread+0x92
  63. fffff880`07629ae0 fffff800`02e7fd43 : 00000000`746c6600 00000000`00000003 fffff880`07629ca0 00000000`00000000 : nt!ExpWorkerFactoryCheckCreate+0x180
  64. fffff880`07629b60 fffff800`02e8fe53 : fffffa80`06c50620 fffffa80`00000000 00000000`00000040 00000000`00000000 : nt!NtSetInformationWorkerFactory+0x660
  65. fffff880`07629c20 00000000`773728fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
  66. 00000000`0018eca8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773728fa
  67.  
  68.  
  69. STACK_COMMAND: kb
  70.  
  71. FOLLOWUP_IP:
  72. nt! ?? ::FNODOBFM::`string'+6071
  73. fffff800`02e6cc4d cc int 3
  74.  
  75. SYMBOL_STACK_INDEX: 1
  76.  
  77. SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+6071
  78.  
  79. FOLLOWUP_NAME: MachineOwner
  80.  
  81. MODULE_NAME: nt
  82.  
  83. IMAGE_NAME: ntkrnlmp.exe
  84.  
  85. DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035
  86.  
  87. FAILURE_BUCKET_ID: X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6071
  88.  
  89. BUCKET_ID: X64_0x1a_411_nt!_??_::FNODOBFM::_string_+6071
  90.  
  91. Followup: MachineOwner
  92. ---------
  93.  
  94.  
  95. *******************************************************************************
  96. * *
  97. * Bugcheck Analysis *
  98. * *
  99. *******************************************************************************
  100.  
  101. IRQL_NOT_LESS_OR_EQUAL (a)
  102. An attempt was made to access a pageable (or completely invalid) address at an
  103. interrupt request level (IRQL) that is too high. This is usually
  104. caused by drivers using improper addresses.
  105. If a kernel debugger is available get the stack backtrace.
  106. Arguments:
  107. Arg1: fffffa7fff9fffd8, memory referenced
  108. Arg2: 0000000000000002, IRQL
  109. Arg3: 0000000000000001, bitfield :
  110. bit 0 : value 0 = read operation, 1 = write operation
  111. bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
  112. Arg4: fffff80002e885ce, address which referenced memory
  113.  
  114. Debugging Details:
  115. ------------------
  116.  
  117.  
  118. WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030af100
  119. fffffa7fff9fffd8
  120.  
  121. CURRENT_IRQL: 2
  122.  
  123. FAULTING_IP:
  124. nt!MiUnlinkPageFromLockedList+36e
  125. fffff800`02e885ce 49890cc0 mov qword ptr [r8+rax*8],rcx
  126.  
  127. CUSTOMER_CRASH_COUNT: 1
  128.  
  129. DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
  130.  
  131. BUGCHECK_STR: 0xA
  132.  
  133. PROCESS_NAME: MpCmdRun.exe
  134.  
  135. TRAP_FRAME: fffff880062b1860 -- (.trap 0xfffff880062b1860)
  136. NOTE: The trap frame does not contain all registers.
  137. Some register values may be zeroed or incorrect.
  138. rax=fffffa800421aab0 rbx=0000000000000000 rcx=000000000020db58
  139. rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
  140. rip=fffff80003153c38 rsp=fffff880062b19f8 rbp=fffff880062b1ca0
  141. r8=0000000000000000 r9=0000000000000001 r10=fffff880009e9660
  142. r11=fffff880062b1aa8 r12=0000000000000000 r13=0000000000000000
  143. r14=0000000000000000 r15=0000000000000000
  144. iopl=0 nv up ei pl zr na po nc
  145. nt!ObReferenceObjectByName:
  146. fffff800`03153c38 fff3 push rbx
  147. Resetting default scope
  148.  
  149. LAST_CONTROL_TRANSFER: from fffff80002e77169 to fffff80002e77bc0
  150.  
  151. STACK_TEXT:
  152. fffff880`062b1208 fffff800`02e77169 : 00000000`0000000a fffffa7f`ff9fffd8 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
  153. fffff880`062b1210 fffff800`02e75de0 : 00000000`80000000 fffff880`00000000 fffff880`062b1090 fffffa80`00093f90 : nt!KiBugCheckDispatch+0x69
  154. fffff880`062b1350 fffff800`02e885ce : 80000000`4350b963 fffffa80`00093f90 fffff800`030b22c0 00000000`00000000 : nt!KiPageFault+0x260
  155. fffff880`062b14e0 fffff800`02ea806b : fffffa80`00093f90 fffff800`030b2540 00000000`00000000 81400000`4350b882 : nt!MiUnlinkPageFromLockedList+0x36e
  156. fffff880`062b1560 fffff800`02e94c8f : 00000000`00000000 3b100000`03153860 00000000`00000000 fffff800`030b2540 : nt!MiResolveTransitionFault+0x16b
  157. fffff880`062b15f0 fffff800`02e84c3b : fffff6fc`50077ea8 00000000`00961000 ffff0800`00000000 00000000`00000000 : nt!MiDispatchFault+0x95f
  158. fffff880`062b1700 fffff800`02e75cee : 00000000`00000008 fffff800`03153c38 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xe1b
  159. fffff880`062b1860 fffff800`03153c38 : fffff800`031527b5 fffff880`062b1a90 fffff800`02e75dfd 00000000`00000008 : nt!KiPageFault+0x16e
  160. fffff880`062b19f8 fffff800`031527b5 : fffff880`062b1a90 fffff800`02e75dfd 00000000`00000008 fffff800`03158f48 : nt!ObReferenceObjectByName
  161. fffff880`062b1a00 fffff800`03159093 : fffff880`062b1b18 fffff880`062b1b08 00000000`00000000 00000000`00000001 : nt!AlpcpCreateClientPort+0x61
  162. fffff880`062b1ab0 fffff800`02e76e53 : 00000000`00440318 00000000`0020db58 00000000`0020db20 00000000`00000000 : nt!NtAlpcConnectPort+0x14b
  163. fffff880`062b1bb0 00000000`76ea19fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
  164. 00000000`0020da38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ea19fa
  165.  
  166.  
  167. STACK_COMMAND: kb
  168.  
  169. FOLLOWUP_IP:
  170. nt!MiUnlinkPageFromLockedList+36e
  171. fffff800`02e885ce 49890cc0 mov qword ptr [r8+rax*8],rcx
  172.  
  173. SYMBOL_STACK_INDEX: 3
  174.  
  175. SYMBOL_NAME: nt!MiUnlinkPageFromLockedList+36e
  176.  
  177. FOLLOWUP_NAME: MachineOwner
  178.  
  179. MODULE_NAME: nt
  180.  
  181. DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035
  182.  
  183. IMAGE_NAME: memory_corruption
  184.  
  185. FAILURE_BUCKET_ID: X64_0xA_nt!MiUnlinkPageFromLockedList+36e
  186.  
  187. BUCKET_ID: X64_0xA_nt!MiUnlinkPageFromLockedList+36e
  188.  
  189. Followup: MachineOwner
  190. ---------
  191.  
  192.  
  193. *******************************************************************************
  194. * *
  195. * Bugcheck Analysis *
  196. * *
  197. *******************************************************************************
  198.  
  199. SYSTEM_PTE_MISUSE (da)
  200. The stack trace identifies the guilty driver.
  201. Arguments:
  202. Arg1: 0000000000000504, Type of error.
  203. Arg2: fffff6fc40016c98
  204. Arg3: 0000000000000002
  205. Arg4: 0000000000002d93
  206.  
  207. Debugging Details:
  208. ------------------
  209.  
  210.  
  211. CUSTOMER_CRASH_COUNT: 1
  212.  
  213. DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
  214.  
  215. BUGCHECK_STR: 0xDA
  216.  
  217. PROCESS_NAME: System
  218.  
  219. CURRENT_IRQL: 2
  220.  
  221. LOCK_ADDRESS: fffff800030ccbe0 -- (!locks fffff800030ccbe0)
  222.  
  223. Resource @ nt!PiEngineLock (0xfffff800030ccbe0) Available
  224.  
  225. WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
  226.  
  227.  
  228. WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
  229.  
  230. 1 total locks
  231.  
  232. PNP_TRIAGE:
  233. Lock address : 0xfffff800030ccbe0
  234. Thread Count : 0
  235. Thread address: 0x0000000000000000
  236. Thread wait : 0x0
  237.  
  238. LAST_CONTROL_TRANSFER: from fffff80002f21fe4 to fffff80002ec8bc0
  239.  
  240. STACK_TEXT:
  241. fffff880`03361aa8 fffff800`02f21fe4 : 00000000`000000da 00000000`00000504 fffff6fc`40016c98 00000000`00000002 : nt!KeBugCheckEx
  242. fffff880`03361ab0 fffff800`02ee9589 : fffff800`0307dfc0 fffff800`0307e028 fffff6fc`4002b6a8 fffff8a0`03a77fb8 : nt! ?? ::FNODOBFM::`string'+0xb3fb
  243. fffff880`03361bc0 fffff800`02eaace4 : 00000000`000056d5 00000000`00000002 fffff6fc`4002b6a8 00003abb`00000dda : nt!MiInsertCachedPte+0x1c9
  244. fffff880`03361c10 fffff800`02fa1744 : fffffa80`038d5c70 00000000`00000000 00000000`00000001 fffff6fd`4001c809 : nt!MiReleaseSystemPtes+0x64
  245. fffff880`03361c50 fffff800`03263db8 : 00000000`00000000 00000000`0012f1ec 00000000`00000000 00000000`00000001 : nt!MiFindContiguousPages+0x12c4
  246. fffff880`03361d70 fffff800`032ada08 : 00000000`00000963 fffff8a0`03a94380 00000000`00000056 fffff880`033620e0 : nt!MiAllocateDriverPage+0x48
  247. fffff880`03361dd0 fffff800`032b050a : 00000000`00000000 00000000`00000000 fffff880`04044000 00000000`00080000 : nt!MiLoadImageSection+0x3d8
  248. fffff880`03361f20 fffff800`032a39ef : fffff880`03362080 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmLoadSystemImage+0x53a
  249. fffff880`03362040 fffff800`032b07f8 : fffff880`04039000 fffff880`03362218 00000000`00000000 fffff880`033621f8 : nt!MiResolveImageReferences+0x2ff
  250. fffff880`03362160 fffff800`032b2ead : fffff880`033622d8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmLoadSystemImage+0x828
  251. fffff880`03362280 fffff800`03347190 : 00000000`00000001 00000000`00000000 fffff880`20206f49 ffffffff`800001c4 : nt!IopLoadDriver+0x44d
  252. fffff880`03362550 fffff800`0318376e : 00000000`00000001 00000000`00000000 fffff8a0`03a90710 00000000`00000000 : nt!PipCallDriverAddDeviceQueryRoutine+0x390
  253. fffff880`03362650 fffff800`0318347e : ffffffff`800001c8 00000000`00000000 fffff880`03362860 fffff880`03362828 : nt!RtlpCallQueryRegistryRoutine+0x106
  254. fffff880`033626d0 fffff800`032b673c : fffffa80`04fd4610 00000000`00000000 00000000`c0000034 fffff880`03362828 : nt!RtlQueryRegistryValues+0x17e
  255. fffff880`033627a0 fffff800`032b7ed2 : fffffa80`05005b90 fffffa80`04fd4610 00000000`00000002 fffff8a0`0000004c : nt!PipCallDriverAddDevice+0x45c
  256. fffff880`03362950 fffff800`032b836c : fffff800`030ca500 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PipProcessDevNodeTree+0x2b2
  257. fffff880`03362bc0 fffff800`02fcb802 : 00000001`00000003 00000000`00000000 00000000`32706e50 00000000`00000084 : nt!PiProcessStartSystemDevices+0x7c
  258. fffff880`03362c10 fffff800`02ed2261 : fffff800`02fcb500 fffff800`0306e201 fffffa80`039fe600 00000000`00000000 : nt!PnpDeviceActionWorker+0x302
  259. fffff880`03362cb0 fffff800`031652ea : 00000000`00000000 fffffa80`039fe660 00000000`00000080 fffffa80`039e3840 : nt!ExpWorkerThread+0x111
  260. fffff880`03362d40 fffff800`02eb98e6 : fffff880`03164180 fffffa80`039fe660 fffff880`0316ef80 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
  261. fffff880`03362d80 00000000`00000000 : fffff880`03363000 fffff880`0335d000 fffff880`033604e0 00000000`00000000 : nt!KiStartSystemThread+0x16
  262.  
  263.  
  264. STACK_COMMAND: kb
  265.  
  266. FOLLOWUP_IP:
  267. nt! ?? ::FNODOBFM::`string'+b3fb
  268. fffff800`02f21fe4 cc int 3
  269.  
  270. SYMBOL_STACK_INDEX: 1
  271.  
  272. SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+b3fb
  273.  
  274. FOLLOWUP_NAME: MachineOwner
  275.  
  276. MODULE_NAME: nt
  277.  
  278. IMAGE_NAME: ntkrnlmp.exe
  279.  
  280. DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035
  281.  
  282. FAILURE_BUCKET_ID: X64_0xDA_nt!_??_::FNODOBFM::_string_+b3fb
  283.  
  284. BUCKET_ID: X64_0xDA_nt!_??_::FNODOBFM::_string_+b3fb
  285.  
  286. Followup: MachineOwner
  287. ---------
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!