Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD involving win32k.sys


  • Please log in to reply
3 replies to this topic

#1 Dreamchaser_jc

Dreamchaser_jc

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is balmy
  • Local time:04:42 PM

Posted 03 January 2011 - 01:41 AM

Dear all,

I've gone through many reports involving the blue screen (including one on BC). Often, people recommend running a diagnostic test on the memory modules and pointing to the fact that it's time to change the memory. I'm running Windows XP Pro on a 2004 Toshiba laptop (Bios v1.40, final update) and to change anything inside would cost relatively more.

Used BlueScreenView and WinDbg to load my mini dumps. Some questions needing answers are:

  • Is 0x8e the same as 0x1000008e? BlueScreen View game me a Bug check code of 0x1000008e whilst only 0x8e appear in WinDbg.
  • Does the report indicate problem that is "memory" in nature?

If Q1 above is answered, I plan to apply this patch to see if the Stop error returns. Got hit with it twice (in 7 minutes) after restarting and restoring Chrome's tabs.

Debugging analysis report:
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf953e10, The address that the exception occurred at
Arg3: ab951c00, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
win32k!GreGetGlyphIndicesW+af
bf953e10 8b4004          mov     eax,dword ptr [eax+4]

TRAP_FRAME:  ab951c00 -- (.trap 0xffffffffab951c00)
Unable to read trap frame at ab951c00

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

LAST_CONTROL_TRANSFER:  from bf94b49d to bf953e10

STACK_TEXT:  
ab951c8c bf94b49d e1681008 e300d200 e167ed08 win32k!GreGetGlyphIndicesW+0xaf
ab951d28 bf94b519 19010dfc 0012ecb8 00000100 win32k!NtGdiGetGlyphIndicesWInternal+0xf2
ab951d48 804de7ec 19010dfc 0012ecb8 00000100 win32k!NtGdiGetGlyphIndicesW+0x1b
ab951d48 7c90e514 19010dfc 0012ecb8 00000100 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012ea28 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!GreGetGlyphIndicesW+af
bf953e10 8b4004          mov     eax,dword ptr [eax+4]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!GreGetGlyphIndicesW+af

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc6d6a2

FAILURE_BUCKET_ID:  0x8E_win32k!GreGetGlyphIndicesW+af

BUCKET_ID:  0x8E_win32k!GreGetGlyphIndicesW+af

Followup: MachineOwner
---------

The second is as follow:
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf8124fc, The address that the exception occurred at
Arg3: abeea878, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
win32k!ESTROBJ::vInit+43
bf8124fc f6410410        test    byte ptr [ecx+4],10h

TRAP_FRAME:  abeea878 -- (.trap 0xffffffffabeea878)
Unable to read trap frame at abeea878

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

LAST_CONTROL_TRANSFER:  from bf8118c5 to bf8124fc

STACK_TEXT:  
abeea900 bf8118c5 e1219cac 0000001e abeeabf0 win32k!ESTROBJ::vInit+0x43
abeeaba4 bf87eb72 abeeabf0 00000015 00000017 win32k!GreExtTextOutWLocked+0x666
abeeabe8 bf87f343 e11889c8 00000015 00000017 win32k!GreExtTextOutWInternal+0x6e
abeead38 804de7ec 2c010f20 00000015 00000017 win32k!NtGdiExtTextOutW+0x2b6
abeead38 7c90e514 2c010f20 00000015 00000017 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00127220 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!ESTROBJ::vInit+43
bf8124fc f6410410        test    byte ptr [ecx+4],10h

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!ESTROBJ::vInit+43

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc6d6a2

FAILURE_BUCKET_ID:  0x8E_win32k!ESTROBJ::vInit+43

BUCKET_ID:  0x8E_win32k!ESTROBJ::vInit+43

Followup: MachineOwner
---------


I couldn't make sense the technical stuff I read so do help me go over them. Thank you in advance.

Edited by Dreamchaser_jc, 03 January 2011 - 01:42 AM.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:12:42 AM

Posted 03 January 2011 - 12:45 PM

The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

The above type of error often indicates some infection.

I suggest, you create new topic in "Am I Infected?" forum.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#3 Dreamchaser_jc

Dreamchaser_jc
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is balmy
  • Local time:04:42 PM

Posted 03 January 2011 - 10:12 PM

Will do. Thanks.

#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:12:42 AM

Posted 03 January 2011 - 10:14 PM

You're very welcome Posted Image

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users