kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 804de9a4, The address that the exception occurred at Arg3: b849ecf0, Trap Frame Arg4: 00000000 Debugging Details: ------------------ ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* FAULTING_MODULE: 804d7000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 0 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgeführt werden. FAULTING_IP: nt!ZwYieldExecution+d30 804de9a4 fa cli TRAP_FRAME: b849ecf0 -- (.trap ffffffffb849ecf0) ErrCode = 00000000 eax=00be0000 ebx=b849edcc ecx=00000001 edx=7634de0f esi=f8afa008 edi=f8afa3f0 eip=804de9a4 esp=b849ed64 ebp=b849ed64 iopl=0 nv up ei ng nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 nt!ZwYieldExecution+0xd30: 804de9a4 fa cli Resetting default scope CUSTOMER_CRASH_COUNT: 5 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x8E CLI_FAULT_INSTR: nt!ZwYieldExecution+d30 804de9a4 fa cli LAST_CONTROL_TRANSFER: from f8a6e194 to 804de9a4 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. b849ed64 f8a6e194 badb0d00 7634de0f b849ed64 nt!ZwYieldExecution+0xd30 b849ed88 bf800b52 bf824275 00120000 00400000 0xf8a6e194 bf824247 c8e856ec 8bfffdc8 c985084d 03b22374 win32k+0xb52 bf82424b 8bfffdc8 c985084d 03b22374 01265ae8 0xc8e856ec bf82424f c985084d 03b22374 01265ae8 74c08500 0x8bfffdc8 bf824253 03b22374 01265ae8 74c08500 6ce850da 0xc985084d bf824257 01265ae8 74c08500 6ce850da 85ffffff 0x3b22374 bf82425b 74c08500 6ce850da 85ffffff 8bd074c0 0x1265ae8 bf82425f 6ce850da 85ffffff 8bd074c0 c8d1e830 0x74c08500 bf824263 85ffffff 8bd074c0 c8d1e830 c68bfffd 0x6ce850da bf824267 8bd074c0 c8d1e830 c68bfffd 04c25d5e 0x85ffffff bf82426b c8d1e830 c68bfffd 04c25d5e ebc03300 0x8bd074c0 bf82426f c68bfffd 04c25d5e ebc03300 909090e4 0xc8d1e830 bf824273 04c25d5e ebc03300 909090e4 ff8b9090 0xc68bfffd bf824277 ebc03300 909090e4 ff8b9090 8bec8b55 0x4c25d5e bf82427b 909090e4 ff8b9090 8bec8b55 4d8b0845 0xebc03300 bf82427f ff8b9090 8bec8b55 4d8b0845 0108290c 0x909090e4 bf824283 8bec8b55 4d8b0845 0108290c 4d8b0848 0xff8b9090 bf824287 4d8b0845 0108290c 4d8b0848 04482910 0x8bec8b55 bf82428b 0108290c 4d8b0848 04482910 330c4801 0x4d8b0845 bf82428f 4d8b0848 04482910 330c4801 c25d40c0 0x108290c bf824293 04482910 330c4801 c25d40c0 c033000c 0x4d8b0848 bf824297 330c4801 c25d40c0 c033000c 8b3deb40 0x4482910 bf82429b c25d40c0 c033000c 8b3deb40 9a91f815 0x330c4801 bf82429f c033000c 8b3deb40 9a91f815 ac8203bf 0xc25d40c0 bf8242a3 8b3deb40 9a91f815 ac8203bf eb000008 0xc033000c bf8242a7 9a91f815 ac8203bf eb000008 02c5f640 0x8b3deb40 bf8242ab ac8203bf eb000008 02c5f640 40404174 0x9a91f815 bf8242af eb000008 02c5f640 40404174 026a3deb 0xac8203bf bf8242b3 02c5f640 40404174 026a3deb 9021eb58 0xeb000008 bf8242b7 40404174 026a3deb 9021eb58 90909090 0x2c5f640 bf8242bb 026a3deb 9021eb58 90909090 8b55ff8b 0x40404174 bf8242bf 9021eb58 90909090 8b55ff8b 0c4d8bec 0x26a3deb bf8242c3 90909090 8b55ff8b 0c4d8bec 4539c033 0x9021eb58 bf8242c7 8b55ff8b 0c4d8bec 4539c033 f61e7410 0x90909090 bf8242cb 0c4d8bec 4539c033 f61e7410 e27501c5 0x8b55ff8b bf8242cf 4539c033 f61e7410 e27501c5 0000c1f7 0xc4d8bec bf8242d3 f61e7410 e27501c5 0000c1f7 be750002 0x4539c033 bf8242d7 e27501c5 0000c1f7 be750002 c00a45f6 0xf61e7410 bf8242db 00000000 be750002 c00a45f6 c1f61575 0xe27501c5 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt 804de8ea - nt!ZwYieldExecution+c76 [ 05:06 ] 1 error : !nt (804de8ea) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption MEMORY_CORRUPTOR: ONE_BYTE FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE Followup: memory_corruption ---------