locked
Bluescreen 0xa RRS feed

  • Question

  • Quit some time ago I receive a Bluescreen 0xa. The problem is that I can not read any information in the dump file from which driver this was caused.

    Maybe you can help me there, please.

     

    I can exclude a memory failure.

     

    0: kd> .restart /f

    Loading Dump File [C:\Windows\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*c:\symbols*;http://msdl.microsoft.com/download/symbols;C:/WINDOWS/Symbols;D:\Symbolx64chk*
    Executable search path is:
    Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
    Kernel base = 0xfffff800`01c08000 PsLoadedModuleList = 0xfffff800`01dcddb0
    Debug session time: Sun Nov 30 23:24:20.506 2008 (GMT+1)
    System Uptime: 0 days 12:21:50.858
    Loading Kernel Symbols
    .....................................................................................................................................................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 000007ff`fffdf018).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {fffffa800d53f010, 2, 1, fffff80001cb0c96}

    PEB is paged out (Peb.Ldr = 000007ff`fffdf018).  Type ".hh dbgerr001" for details
    PEB is paged out (Peb.Ldr = 000007ff`fffdf018).  Type ".hh dbgerr001" for details
    Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+99f6 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffffa800d53f010, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80001cb0c96, address which referenced memory

    Debugging Details:
    ------------------

    PEB is paged out (Peb.Ldr = 000007ff`fffdf018).  Type ".hh dbgerr001" for details
    PEB is paged out (Peb.Ldr = 000007ff`fffdf018).  Type ".hh dbgerr001" for details

    WRITE_ADDRESS:  fffffa800d53f010

    CURRENT_IRQL:  2

    FAULTING_IP:
    nt! ?? ::FNODOBFM::`string'+99f6
    fffff800`01cb0c96 4c0fb301        btr     qword ptr [rcx],r8

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  MSASCui.exe

    TRAP_FRAME:  fffffa600e3ba600 -- (.trap 0xfffffa600e3ba600)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa800953f000 rbx=000007fefead9000 rcx=fffffa800953f010
    rdx=0000000000000000 rsi=000007fefeaca001 rdi=000007fefeac7001
    rip=fffff80001cb0c96 rsp=fffffa600e3ba790 rbp=fffff6fb82200ff8
     r8=0000000020000000  r9=fffffa800a77ef00 r10=fffffa8003900600
    r11=fffffa600e3ba7b0 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po nc
    nt! ?? ::FNODOBFM::`string'+0x99f6:
    fffff800`01cb0c96 4c0fb301        btr     qword ptr [rcx],r8 ds:f000:f010=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80001c5d0ee to fffff80001c5d350

    STACK_TEXT: 
    fffffa60`0e3ba4b8 fffff800`01c5d0ee : 00000000`0000000a fffffa80`0d53f010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffffa60`0e3ba4c0 fffff800`01c5bfcb : 00000000`00000001 00000000`02479000 000007fe`fb20f000 fffffa80`077c33a0 : nt!KiBugCheckDispatch+0x6e
    fffffa60`0e3ba600 fffff800`01cb0c96 : 000007fe`fb0f9000 000007fe`fee55000 00000000`76f04000 00000000`76f08000 : nt!KiPageFault+0x20b
    fffffa60`0e3ba790 fffff800`01cb358a : 20000000`00000000 fffff6fb`82200ff8 fffff6fb`82201858 0000000f`ffffffff : nt! ?? ::FNODOBFM::`string'+0x99f6
    fffffa60`0e3ba7c0 fffff800`01c40564 : fffffa80`0a77ef00 00000000`00000000 fffff6fb`82200000 fffffa80`0a77ef00 : nt! ?? ::FNODOBFM::`string'+0xcba9
    fffffa60`0e3ba820 fffff800`01c410af : fffff800`01e94660 fffffa80`0a77ec10 fffffa80`0a77ec10 fffffa80`0a77ef00 : nt!MiDeleteAllHashMappings+0xe4
    fffffa60`0e3ba860 fffff800`01f038dc : fffff880`0a642060 fffff800`01e94660 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0xb7
    fffffa60`0e3ba8b0 fffff800`01e9467d : fffffa60`40010004 fffffa60`01b63101 000007ff`fffdb000 00000000`78457350 : nt!PspExitThread+0x4f8
    fffffa60`0e3ba970 fffff800`01c8756b : fffffa80`0a800528 fffff800`01c62f8a fffffa60`005eca60 fffff800`01c6872c : nt!PsExitSpecialApc+0x1d
    fffffa60`0e3ba9a0 fffff800`01c8b235 : fffffa60`0e3bac00 fffffa60`0e3baa40 fffff800`01e958a4 00000000`00000001 : nt!KiDeliverApc+0x3bb
    fffffa60`0e3baa40 fffff800`01c5ce9d : fffffa80`0a800470 fffffa60`0e3bbca0 00000000`00000001 00000000`00000000 : nt!KiInitiateUserApc+0x75
    fffffa60`0e3bab80 00000000`77055987 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0xa2
    00000000`028bfac0 fffff800`01c57170 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77055987
    fffffa60`0e3baf60 fffffa80`0a800528 : fffff800`01c62f8a 00000000`00000000 fffffa80`0997e9e0 fffffa80`0a800470 : nt!KiCallUserMode
    fffffa60`0e3baf68 fffff800`01c62f8a : 00000000`00000000 fffffa80`0997e9e0 fffffa80`0a800470 fffffa60`0e3bbdb0 : 0xfffffa80`0a800528
    fffffa60`0e3baf70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwapThread+0x2fa


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt! ?? ::FNODOBFM::`string'+99f6
    fffff800`01cb0c96 4c0fb301        btr     qword ptr [rcx],r8

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+99f6

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  48d1ba35

    FAILURE_BUCKET_ID:  X64_0xA_W_nt!_??_::FNODOBFM::_string_+99f6

    BUCKET_ID:  X64_0xA_W_nt!_??_::FNODOBFM::_string_+99f6

    Followup: MachineOwner
    ---------

     

    0: kd> .trap 0xfffffa600e3ba600
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa800953f000 rbx=000007fefead9000 rcx=fffffa800953f010
    rdx=0000000000000000 rsi=000007fefeaca001 rdi=000007fefeac7001
    rip=fffff80001cb0c96 rsp=fffffa600e3ba790 rbp=fffff6fb82200ff8
     r8=0000000020000000  r9=fffffa800a77ef00 r10=fffffa8003900600
    r11=fffffa600e3ba7b0 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po nc
    nt! ?? ::FNODOBFM::`string'+0x99f6:
    fffff800`01cb0c96 4c0fb301        btr     qword ptr [rcx],r8 ds:f000:f010=????????????????

    Sunday, December 7, 2008 12:31 PM

Answers

  • Hi,

     

    Debugging is beyond what we can do in the forum. I'd like to recommend that you contact Microsoft Customer Support Service (CSS) for assistance so that this problem can be resolved efficiently. To obtain the phone numbers for specific technology request please take a look at the web site listed below:

     

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

     

    If you are outside the US please see http://support.microsoft.com for regional support phone numbers.

     

    Hope it helps.

     

    Tuesday, December 9, 2008 8:40 AM
    Moderator