Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\041810-16520-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`03012000 PsLoadedModuleList = 0xfffff800`0324fe50
Debug session time: Sun Apr 18 15:03:11.553 2010 (GMT+2)
System Uptime: 0 days 0:00:49.317
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a0b6d6edce, 0, fffff80003363a0c, 5}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CmpDoCompareKeyName+2c )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a0b6d6edce, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80003363a0c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ba0e0
fffff8a0b6d6edce
FAULTING_IP:
nt!CmpDoCompareKeyName+2c
fffff800`03363a0c f6400220 test byte ptr [rax+2],20h
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff880021122e0 -- (.trap 0xfffff880021122e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a0b6d6edcc rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003363a0c rsp=fffff88002112470 rbp=0000000001000dc8
r8=fffff8a000847000 r9=fffff8a006b39024 r10=0000000000000001
r11=0000000000000047 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!CmpDoCompareKeyName+0x2c:
fffff800`03363a0c f6400220 test byte ptr [rax+2],20h ds:fffff8a0`b6d6edce=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003101801 to fffff80003082600
STACK_TEXT:
fffff880`02112178 fffff800`03101801 : 00000000`00000050 fffff8a0`b6d6edce 00000000`00000000 fffff880`021122e0 : nt!KeBugCheckEx
fffff880`02112180 fffff800`030806ee : 00000000`00000000 00000000`00000007 00000000`00000000 ffffe5bf`ef7c0c05 : nt! ?? ::FNODOBFM::`string'+0x40ecb
fffff880`021122e0 fffff800`03363a0c : fffff8a0`004de010 00000000`00000007 fffff8a0`00847000 fffff880`021126b0 : nt!KiPageFault+0x16e
fffff880`02112470 fffff800`033676a4 : 00000000`00000007 fffff8a0`004de010 fffff880`021125f0 fffff8a0`00096880 : nt!CmpDoCompareKeyName+0x2c
fffff880`021124b0 fffff800`03316232 : 00000000`00000007 fffff8a0`004de010 00000000`01dcb020 fffff8a0`06b39024 : nt!CmpCompareInIndex+0x1e5
fffff880`02112510 fffff800`0335aacd : 00000000`c0000034 fffff8a0`06c151dc fffff8a0`004de010 00000000`00000000 : nt!CmpFindSubKeyInRoot+0x72
fffff880`02112570 fffff800`0335d8ef : fffff8a0`ffffffff fffff880`02112b10 fffff880`021126b0 fffff880`00000000 : nt!CmpFindSubKeyByNameWithStatus+0x12d
fffff880`021125f0 fffff800`0337ca64 : fffff800`0335cae0 00000000`00000001 fffffa80`0510f010 00000000`00000001 : nt!CmpParseKey+0xe0f
fffff880`021128c0 fffff800`03381b76 : fffffa80`0510f010 fffff880`02112a40 00000000`00000040 fffffa80`039fe3c0 : nt!ObpLookupObjectName+0x585
fffff880`021129c0 fffff800`03360bec : fffffa80`05b03430 00000000`00000000 fffff8a0`01cbfa01 fffff880`02112aa8 : nt!ObOpenObjectByName+0x306
fffff880`02112a90 fffff800`03362d3b : 00000000`00b4d5f0 00000000`00020019 00000000`00b4d678 00000000`00000000 : nt!CmOpenKey+0x28a
fffff880`02112be0 fffff800`03081853 : fffffa80`05b03430 00000000`00000000 00000000`003458b0 00000000`00000004 : nt!NtOpenKeyEx+0xf
fffff880`02112c20 00000000`76e60e0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00b4d588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e60e0a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!CmpDoCompareKeyName+2c
fffff800`03363a0c f6400220 test byte ptr [rax+2],20h
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!CmpDoCompareKeyName+2c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb
FAILURE_BUCKET_ID: X64_0x50_nt!CmpDoCompareKeyName+2c
BUCKET_ID: X64_0x50_nt!CmpDoCompareKeyName+2c
Followup: MachineOwner
---------
1: kd> lmvm nt
start end module name
fffff800`03012000 fffff800`035ee000 nt (pdb symbols) c:\symbols\ntkrnlmp.pdb\7E9A3CAB626845DE8E10816E3080A3B72\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: c:\Symbols\ntoskrnl.exe\4B88CFEB5dc000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Sat Feb 27 08:55:23 2010 (4B88CFEB)
CheckSum: 00545094
ImageSize: 005DC000
File version: 6.1.7600.16539
Product version: 6.1.7600.16539
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7600.16539
FileVersion: 6.1.7600.16539 (win7_gdr.100226-1909)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.