BSOD 0x0000007e on Inspiron 5150 XP SP3 RRS feed

  • Question

  • I'm ready to admit defeat.

    Receiving 0x0000007e on all boot types, Safe mode, normal, last known, etc. No minidumps or memory.dmp created. I have extensively tested the hard drive and the memory, verified signatures on drivers, checked for malware, etc. A repair install succeeds, but results in the same BSOD upon first boot.

    At this point I have attached a debugger, and still cannot find the root cause. Each time the BSOD occurs I have renamed the probable driver, and tried again. The first few were Avast anti-virus related, but now it references signed Microsoft drivers. One thing I have noted -- argument 2 does not change and always references the same address. Memtest has run without issue for 72 hours, so I do not believe it is RAM.

    I have a kernel debugger attached and await any help! An analysis is below:

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.

    Using 1394 for debugging
    Checking 1394 debug driver version.
    Opened \\.\DBG1394_INSTANCE00
    Timer Resolution set to 976 usec.
    Waiting to reconnect...
    Connected to Windows XP 2600 x86 compatible target at (Wed Jun 22 16:30:33.117 2011 (UTC - 4:00)), ptr64 FALSE
    Kernel Debugger connection established.
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 UP Free x86 compatible
    Built by: 2600.xpsp.080413-2111
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
    System Uptime: not available

    *** Fatal System Error: 0x0000007e

    Break instruction exception - code 80000003 (first chance)

    A fatal system error has occurred.
    Debugger entered on first try; Bugcheck callbacks have not been invoked.

    A fatal system error has occurred.

    Connected to Windows XP 2600 x86 compatible target at (Wed Jun 22 16:30:47.414 2011 (UTC - 4:00)), ptr64 FALSE
    Loading Kernel Symbols
    Loading User Symbols

    Loading unloaded module list
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    Use !analyze -v to get detailed debugging information.

    BugCheck 7E, {c0000005, 806edcc1, f8955734, f8955430}

    Probably caused by : Fips.SYS ( Fips!_NULL_IMPORT_DESCRIPTOR+84 )

    Followup: MachineOwner

    804e3592 cc              int     3
    kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arg1: c0000005, The exception code that was not handled
    Arg2: 806edcc1, The address that the exception occurred at
    Arg3: f8955734, Exception Record Address
    Arg4: f8955430, Context Record Address

    Debugging Details:

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    806edcc1 0000            add     byte ptr [eax],al

    EXCEPTION_RECORD:  f8955734 -- (.exr 0xfffffffff8955734)
    ExceptionAddress: 806edcc1
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000001
       Parameter[1]: 000000d8
    Attempt to write to address 000000d8

    CONTEXT:  f8955430 -- (.cxr 0xfffffffff8955430)
    eax=000000d8 ebx=804d7000 ecx=0000bb40 edx=80561bc0 esi=00000000 edi=00034000
    eip=806edcc1 esp=f89557fc ebp=f89557fc iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    806edcc1 0000            add     byte ptr [eax],al          ds:0023:000000d8=??
    Resetting default scope

    PROCESS_NAME:  System

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".



    WRITE_ADDRESS:  000000d8

    f8740164 c00374          rol     byte ptr [ebx],74h

    806edcc1 0000            add     byte ptr [eax],al



    LAST_CONTROL_TRANSFER:  from 00000000 to 806edcc1


    STACK_ADDR_RAW_STACK_SYMBOL: fffffffff8955074

    STACK_COMMAND:  dds FFFFFFFFF8955074-0x20 ; kb

    f8955054  f895525c
    f8955058  804fe585 nt!MiCleanSection+0x6bd
    f895505c  e14b6d60
    f8955060  00000001
    f8955064  00000000
    f8955068  00000000
    f895506c  00000000
    f8955070  f8740164 Fips!_NULL_IMPORT_DESCRIPTOR+0x84
    f8955074  f8736000 Fips!MACBytes <PERF> (Fips+0x0)
    f8955078  805a4558 nt!MiSnapThunk+0x6f
    f895507c  82146008
    f8955080  f87403c2 Fips!_NULL_IMPORT_DESCRIPTOR+0x2e2
    f8955084  000000ff
    f8955088  f8740164 Fips!_NULL_IMPORT_DESCRIPTOR+0x84
    f895508c  f873d770 Fips!_imp__ExDeleteResourceLite
    f8955090  805a46ca nt!MiSnapThunk+0x385
    f8955094  8212a908
    f8955098  00000000
    f895509c  f8736000 Fips!MACBytes <PERF> (Fips+0x0)
    f89550a0  f8955208
    f89550a4  f873d770 Fips!_imp__ExDeleteResourceLite
    f89550a8  804f1d8e nt!MiRemoveMappedView+0x253
    f89550ac  8212a8d8
    f89550b0  823ca830
    f89550b4  80686120 nt!$$VProc_ImageExportDirectory+0x2ea0
    f89550b8  00000000
    f89550bc  00000047
    f89550c0  f87403d6 Fips!_NULL_IMPORT_DESCRIPTOR+0x2f6
    f89550c4  00000000
    f89550c8  00000000
    f89550cc  00000000
    f89550d0  00040100


    FOLLOWUP_NAME:  MachineOwner






    Followup: MachineOwner

    Wednesday, June 22, 2011 8:47 PM

All replies

  • I don't doubt that will work, Ubuntu and WinPE CDs run fine on it. But, the value of this computer is in the already installed software.

    It just seems like something that could be solved if I knew more.

    Thursday, June 23, 2011 11:16 AM