Code:
Microsoft ® Windows Debugger Version 6.7.0005.0
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\Owner\Desktop\Copy_of_Mini071408_02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\windows\system32
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Jul 14 16:35:11.453 2008 (GMT+1)
System Uptime: 0 days 0:01:02.414
Loading Kernel Symbols
................................................................................
..................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {c1084af0, 0, 8050538f, 0}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiLocateAndReserveWsle+51 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: c1084af0, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8050538f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: c1084af0
FAULTING_IP:
nt!MiLocateAndReserveWsle+51
8050538f 8b0c81 mov ecx,dword ptr [ecx+eax*4]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: opera.exe
LAST_CONTROL_TRANSFER: from 80512f34 to 8050538f
STACK_TEXT:
a9f32bd8 80512f34 c0883cfc 80000000 00000000 nt!MiLocateAndReserveWsle+0x51
a9f32bf0 805140a3 6795c000 c033cae0 81a8d588 nt!MiAddValidPageToWorkingSet+0x84
a9f32c18 80515798 6795c000 81a8d588 897e7020 nt!MiResolveDemandZeroFault+0x1f3
a9f32c5c 80515985 00000001 6795c000 c033cae0 nt!MiResolveProtoPteFault+0x16e
a9f32ce0 8051fef4 e2e8b920 6795c000 c033cae0 nt!MiDispatchFault+0xf1
a9f32d4c 80543908 00000001 6795c000 00000001 nt!MmAccessFault+0x1116
a9f32d4c 68023359 00000001 6795c000 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
ffffccac 00000000 00000000 00000000 00000000 0x68023359
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiLocateAndReserveWsle+51
8050538f 8b0c81 mov ecx,dword ptr [ecx+eax*4]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiLocateAndReserveWsle+51
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 45e5484a
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x50_nt!MiLocateAndReserveWsle+51
BUCKET_ID: 0x50_nt!MiLocateAndReserveWsle+51
Followup: MachineOwner
---------
3: kd> lmvm nt
start end module name
804d7000 806e2000 nt # (pdb symbols) c:\symbols\ntkrpamp.pdb\176A183ABE1E46FEBCEFCCE79427EF8F1\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: c:\symbols\ntkrpamp.exe\45E5484A20b000\ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Feb 28 09:15:54 2007 (45E5484A)
CheckSum: 001FB950
ImageSize: 0020B000
File version: 5.1.2600.3093
Product version: 5.1.2600.3093
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0415.04b0
CompanyName: Microsoft Corporation
ProductName: System operacyjny Microsoft® Windows®
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.3093
FileVersion: 5.1.2600.3093 (xpsp_sp2_qfe.070227-2300)
Code:
Loading Dump File [C:\Documents and Settings\Owner\Desktop\Copy_of_Mini071408_01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\windows\system32
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Jul 14 16:33:34.015 2008 (GMT+1)
System Uptime: 0 days 0:00:33.968
Loading Kernel Symbols
................................................................................
.......................
Loading User Symbols
Loading unloaded module list
..
Unable to load image ati3duag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ati3duag.dll
*** ERROR: Module load completed but symbols could not be loaded for ati3duag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, bf38776a, ba13724c, 0}
Probably caused by : ati3duag.dll ( ati3duag+1f876a )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf38776a, The address that the exception occurred at
Arg3: ba13724c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
ati3duag+1f876a
bf38776a 8b94b98b0c903b mov edx,dword ptr [ecx+edi*4+3B900C8Bh]
TRAP_FRAME: ba13724c -- (.trap 0xffffffffba13724c)
ErrCode = 00000000
eax=e1706058 ebx=00000003 ecx=e1706068 edx=e170466c esi=e170601c edi=00000002
eip=bf38776a esp=ba1372c0 ebp=00000000 iopl=3 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00213246
ati3duag+0x1f876a:
bf38776a 8b94b98b0c903b mov edx,dword ptr [ecx+edi*4+3B900C8Bh] ds:0023:1d006cfb=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: csrss.exe
LAST_CONTROL_TRANSFER: from 00000000 to bf38776a
STACK_TEXT:
00000000 00000000 00000000 00000000 00000000 ati3duag+0x1f876a
STACK_COMMAND: kb
FOLLOWUP_IP:
ati3duag+1f876a
bf38776a 8b94b98b0c903b mov edx,dword ptr [ecx+edi*4+3B900C8Bh]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: ati3duag+1f876a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ati3duag
IMAGE_NAME: ati3duag.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4844b372
FAILURE_BUCKET_ID: 0x8E_ati3duag+1f876a
BUCKET_ID: 0x8E_ati3duag+1f876a
Followup: MachineOwner
---------
3: kd> lmvm ati3duag
start end module name
bf18f000 bf4e5940 ati3duag T (no symbols)
Loaded symbol image file: ati3duag.dll
Image path: ati3duag.dll
Image name: ati3duag.dll
Timestamp: Tue Jun 03 03:58:58 2008 (4844B372)
CheckSum: 003628BB
ImageSize: 00356940
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
