Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [I:\Desktop\Mini121608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\Program Files\Debugging Tools for Windows (x86)\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Tue Dec 16 05:49:42.307 2008 (GMT-5)
System Uptime: 5 days 23:24:36.616
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
.......................................................
Loading User Symbols
Loading unloaded module list
..............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {fffffffc, 1c, 0, 804e1446}
*** WARNING: Unable to verify timestamp for win32k.sys
Probably caused by : win32k.sys ( win32k!zzzSetWindowsHookEx+220 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffffc, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804e1446, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: fffffffc
CURRENT_IRQL: 1c
FAULTING_IP:
nt!KiTrap0B+177
804e1446 3b51fc cmp edx,dword ptr [ecx-4]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: csrss.exe
LAST_CONTROL_TRANSFER: from 804e14ca to 804e1446
STACK_TEXT:
b8cf1a04 804e14ca ffb3b4c0 ffffffff 0cd7d8be nt!KiTrap0B+0x177
b8cf1a20 804e5daa ffb3b4c0 ffffffff 00000000 nt!Dr_kitc_a+0x4b
b8cf1a50 804e623b 00000000 00000000 00000000 nt!NtSetTimer+0xbd
b8cf1a88 804e61f7 804e379a 00000001 00000000 nt!KiEspToTrapFrame+0x22
b8cf1aa8 bf800b6e 89a6fd08 00000001 bf8011e2 nt!KiRestoreProcessorControlState+0x9d
b8cf1ad4 bf89fcf9 00000022 006efff4 bf8010e7 win32k!PushW32ThreadLock <PERF> (win32k+0xb6e)
b8cf1d30 bf884705 b8d01490 00000002 b8cf1d54 win32k!zzzSetWindowsHookEx+0x220
b8cf1d40 bf80110a b8d01490 b8cf1d64 006efff4 win32k!xxxCreateWindowEx+0xf5d
b8cf1d54 804dd98f 00000000 00000022 00000000 win32k!HDXDrvEscape+0x77
b8cf1d68 badb0d00 006effec 00000000 00000000 nt!ZwQueryEvent+0x4
WARNING: Frame IP not in any known module. Following frames may be wrong.
b8cf1d80 00000000 00000000 00000000 00000000 0xbadb0d00
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!zzzSetWindowsHookEx+220
bf89fcf9 ?? ???
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: win32k!zzzSetWindowsHookEx+220
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48025f2a
FAILURE_BUCKET_ID: 0xA_win32k!zzzSetWindowsHookEx+220
BUCKET_ID: 0xA_win32k!zzzSetWindowsHookEx+220
Followup: MachineOwner
---------
