Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\My Documents\Desktop\041412-31200-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Machine Name:
Kernel base = 0xfffff800`02017000 PsLoadedModuleList = 0xfffff800`0225b650
Debug session time: Sat Apr 14 09:20:19.546 2012 (UTC + 8:00)
System Uptime: 0 days 0:00:10.389
Loading Kernel Symbols
...............................................................
..............................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa800b601340, 0, fffff8000237d56a, 2}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!RtlpApplyAclToObject+1a )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800b601340, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000237d56a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800022c5100
fffffa800b601340
FAULTING_IP:
nt!RtlpApplyAclToObject+1a
fffff800`0237d56a 41803808 cmp byte ptr [r8],8
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff880023db1a0 -- (.trap 0xfffff880023db1a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000504d rbx=0000000000000000 rcx=fffffa800874acc4
rdx=00000000fd7ffbff rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000237d56a rsp=fffff880023db338 rbp=0000000000008004
r8=fffffa800b601340 r9=00000000000003c6 r10=fffffa8003d3064c
r11=fffffa800874acc4 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!RtlpApplyAclToObject+0x1a:
fffff800`0237d56a 41803808 cmp byte ptr [r8],8 ds:0001:fffffa80`0b601340=??
Resetting default scope
LOCK_ADDRESS: fffff80002291b60 -- (!locks fffff80002291b60)
Resource @ nt!PiEngineLock (0xfffff80002291b60) Available
WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
1 total locks
PNP_TRIAGE:
Lock address : 0xfffff80002291b60
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0
LAST_CONTROL_TRANSFER: from fffff8000203ec50 to fffff80002093c80
STACK_TEXT:
fffff880`023db038 fffff800`0203ec50 : 00000000`00000050 fffffa80`0b601340 00000000`00000000 fffff880`023db1a0 : nt!KeBugCheckEx
fffff880`023db040 fffff800`02091dae : 00000000`00000000 fffffa80`0b601340 fffff8a0`0031c400 fffff8a0`00715024 : nt! ?? ::FNODOBFM::`string'+0x43d76
fffff880`023db1a0 fffff800`0237d56a : fffff800`0232c16c 00000000`00000000 fffff8a0`00715024 00000000`00120010 : nt!KiPageFault+0x16e
fffff880`023db338 fffff800`0232c16c : 00000000`00000000 fffff8a0`00715024 00000000`00120010 00000000`000007ff : nt!RtlpApplyAclToObject+0x1a
fffff880`023db340 fffff800`022f5d6f : fffffa80`03d33b60 00000000`00000801 00000000`00000001 63536553`00000000 : nt!RtlpSetSecurityObject+0x378
fffff880`023db480 fffff800`0246bdb6 : fffff8a0`00206f70 fffffa80`03d3064c fffffa80`03d33b60 00000000`00000000 : nt!SeSetSecurityDescriptorInfo+0x33
fffff880`023db4d0 fffff800`0246c5b0 : fffff8a0`00206f70 fffffa80`07134050 fffff8a0`00715010 00000000`00000000 : nt!IopSetDeviceSecurityDescriptor+0xb6
fffff880`023db540 fffff800`023d2550 : fffffa80`07134050 fffff8a0`00715010 00000000`00000000 fffff880`023db6b8 : nt!IopSetDeviceSecurityDescriptors+0x50
fffff880`023db590 fffff800`0232ca46 : ffffffff`8000018c ffffffff`80000184 fffff880`023db6b8 fffff8a0`00715010 : nt! ?? ::NNGAKEGL::`string'+0x2754e
fffff880`023db650 fffff800`02473363 : fffff880`023db708 fffff880`00000004 00000000`00000002 fffff8a0`0070bcb0 : nt!ObSetSecurityObjectByPointer+0x5a
fffff880`023db6b0 fffff800`0247d773 : fffffa80`08747e20 fffffa80`08747e20 fffff8a0`003ff920 fffffa80`071358b0 : nt!PipChangeDeviceObjectFromRegistryProperties+0x2e3
fffff880`023db7a0 fffff800`0247ec32 : fffffa80`07133620 fffffa80`071358b0 00000000`00000002 fffffa80`07134050 : nt!PipCallDriverAddDevice+0x733
fffff880`023db950 fffff800`0247f0cc : fffff800`0228f400 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PipProcessDevNodeTree+0x2b2
fffff880`023dbbc0 fffff800`0218fee2 : 00000001`00000003 00000000`00000000 00000000`32706e50 00000000`00000084 : nt!PiProcessStartSystemDevices+0x7c
fffff880`023dbc10 fffff800`0209d361 : fffff800`0218fbe0 fffff800`02389701 fffffa80`03d33b00 ec6aa74c`c7c8b486 : nt!PnpDeviceActionWorker+0x302
fffff880`023dbcb0 fffff800`0232dfda : fbfffeff`fdf5eff9 fffffa80`03d33b60 00000000`00000080 fffffa80`03d2a040 : nt!ExpWorkerThread+0x111
fffff880`023dbd40 fffff800`020849c6 : fffff880`009b1180 fffffa80`03d33b60 fffff880`009bbf40 9a951e86`de9f4fbf : nt!PspSystemThreadStartup+0x5a
fffff880`023dbd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!RtlpApplyAclToObject+1a
fffff800`0237d56a 41803808 cmp byte ptr [r8],8
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!RtlpApplyAclToObject+1a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4f558b55
FAILURE_BUCKET_ID: X64_0x50_nt!RtlpApplyAclToObject+1a
BUCKET_ID: X64_0x50_nt!RtlpApplyAclToObject+1a
Followup: MachineOwner
---------
1: kd> lmvm nt
start end module name
fffff800`02017000 fffff800`025ff000 nt (pdb symbols) d:\symbols\ntkrnlmp.pdb\76FCE21B949E486090FD485BE42AF54A2\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: d:\symbols\ntoskrnl.exe\4F558B555e8000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Tue Mar 06 11:58:13 2012 (4F558B55)
CheckSum: 005553E5
ImageSize: 005E8000
File version: 6.1.7601.17790
Product version: 6.1.7601.17790
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7601.17790
FileVersion: 6.1.7601.17790 (win7sp1_gdr.120305-1505)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
1: kd> .trap 0xfffff880023db1a0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000504d rbx=0000000000000000 rcx=fffffa800874acc4
rdx=00000000fd7ffbff rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000237d56a rsp=fffff880023db338 rbp=0000000000008004
r8=fffffa800b601340 r9=00000000000003c6 r10=fffffa8003d3064c
r11=fffffa800874acc4 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!RtlpApplyAclToObject+0x1a:
fffff800`0237d56a 41803808 cmp byte ptr [r8],8 ds:0001:fffffa80`0b601340=??
Comments