Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Crash Dump decipher


  • Please log in to reply
1 reply to this topic

#1 Foxhunter42

Foxhunter42

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 16 June 2011 - 09:45 PM

This crash occurred last night when I clicked on a location in an MMORPG. The mouse is a Logitech G500 and the keyboard is a Logitech G510. As I've not read one of these dumps before, I'm looking for some help deciphering.



Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Foxhunter\Downloads\061611-45255-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`02c0f000 PsLoadedModuleList = 0xfffff800`02e54650
Debug session time: Thu Jun 16 01:00:14.685 2011 (UTC - 4:00)
System Uptime: 0 days 21:23:55.009
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffe48019fbd4a3, 1, fffff88001933246, 7}


Could not read faulting driver name
Probably caused by : hardware ( volsnap!VspWriteVolumePhase25+26 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffe48019fbd4a3, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff88001933246, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebe100
ffffe48019fbd4a3

FAULTING_IP:
volsnap!VspWriteVolumePhase25+26
fffff880`01933246 ff4c8bb3 dec dword ptr [rbx+rcx*4-4Dh]

MM_INTERNAL_CODE: 7

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

CURRENT_IRQL: 0

TRAP_FRAME: fffff880056b2a80 -- (.trap 0xfffff880056b2a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80057784d0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001933246 rsp=fffff880056b2c10 rbp=fffffa8004ce09a0
r8=0000000000001000 r9=fffff8800826d000 r10=0000000000001000
r11=0000fffffffff000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
volsnap!VspWriteVolumePhase25+0x26:
fffff880`01933246 ff4c8bb3 dec dword ptr [rbx+rcx*4-4Dh] ds:ffffea00`15de12f3=????????
Resetting default scope

MISALIGNED_IP:
volsnap!VspWriteVolumePhase25+26
fffff880`01933246 ff4c8bb3 dec dword ptr [rbx+rcx*4-4Dh]

LAST_CONTROL_TRANSFER: from fffff80002c39357 to fffff80002c8ed00

STACK_TEXT:
fffff880`056b2918 fffff800`02c39357 : 00000000`00000050 ffffe480`19fbd4a3 00000000`00000001 fffff880`056b2a80 : nt!KeBugCheckEx
fffff880`056b2920 fffff800`02c8ce2e : 00000000`00000001 ffffe480`19fbd4a3 fffffa80`04ce0900 fffffa80`041dc1b0 : nt! ?? ::FNODOBFM::`string'+0x44811
fffff880`056b2a80 fffff880`01933246 : fffff800`04137080 00000000`00000000 fffff880`0191a900 fffffa80`057784d0 : nt!KiPageFault+0x16e
fffff880`056b2c10 fffff880`01933acc : fffffa80`057784d0 fffffa80`04ce09a0 fffffa80`041dc1b0 fffffa80`05778528 : volsnap!VspWriteVolumePhase25+0x26
fffff880`056b2cd0 fffff880`0191a9ad : fffffa80`05778528 fffffa80`04ce09a0 fffffa80`04ce08f0 fffffa80`0469f448 : volsnap!VspWriteVolumePhase22+0x2c
fffff880`056b2d00 fffff800`02f2b32e : fffffa80`04d38b60 00000000`00000080 fffffa80`03ff6040 00000000`00000000 : volsnap!VspWorkerThread+0xad
fffff880`056b2d40 fffff800`02c80666 : fffff800`02e01e80 fffffa80`04d38b60 fffff800`02e0fcc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`056b2d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
volsnap!VspWriteVolumePhase25+26
fffff880`01933246 ff4c8bb3 dec dword ptr [rbx+rcx*4-4Dh]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: volsnap!VspWriteVolumePhase25+26

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: X64_IP_MISALIGNED_volsnap.sys

BUCKET_ID: X64_IP_MISALIGNED_volsnap.sys

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 Allan

Allan

  • BC Advisor
  • 8,602 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:02:28 PM

Posted 17 June 2011 - 06:55 AM

Download BlueScreenView:
http://www.nirsoft.net/utils/blue_screen_view.html
unzip downloaded file and double click on BlueScreenView.exe to run the program.
when scanning is done, go to EDIT - Select All
Go to FILE - SAVE Selected Items, and save the report as BSOD.txt
Open BSOD.txt in Notepad, copy all of the content, and paste it into your next reply




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users