BSOD - Debugging a BSOD in Vista

ByLine
How to Debug a BSOD in Vista
Synopsis
This will show you step by step for how to do basic debugging of a BSOD (Blue Screen Of Death) in Vista.
How to Debug a BSOD in Vista


Note   Note
You might have been directed to Vox's BSOD troubleshooting via Vistax64 forums but STOP errors are caused by 4 key problems:

1. New hardware physically installed that is causing problems or its drivers are causing problems.
2. New software installed that is causing problems or its drivers/services may be causing Vista to STOP.
3. A virus infection could also be causing Vista to fall over.
4. Any system changes via the registry or services control panel that a user might have made or changes that could be made via the first 3 steps.
In essence, those are the roots of STOP errors, and most of them are related to poorly written drivers. So if you are getting any STOP errors, consult the above list, and if any of the steps stands out as a problem.



Debugging STOP errors is not too difficult. To begin, download the latest version - www.microsoft.com/whdc/devtools/debugging/.

Make sure you choose the right architecture for your system, whether x86 for 32-bit or x64 for 64-bit. Download and install the tool. It's a good idea to frequently check the website for new versions of the tool. Once installed you'll see this:

Debug 1.JPG
This is WinDbg running on an x64 system. The first thing you need to do is configure the symbol path, so open up File - Symbol File Path and enter the text you see in the following diagram:

Debug 2.JPG
You need an internet connection now, as WinDbg needs to download symbols to read any dump file you may import. Locate a .dmp file and then go to File - Open Crash Dump to locate a .dmp for analysis. Open it and wait for the symbols to download. While you are waiting now is a good time to adjust (as necessary) your dump settings. Open up system properties opening the start menu, right clicking Computer and selecting properties:

Properties.jpg
Accept the UAC prompt, which incidentally should always be turned on, and then select the settings part of Startup and Recovery:

Settings.JPG
It's up to you whether your PC/laptop should restart about a STOP error but I prefer to clear the box. You can also choose to overwrite an existing file or not and what size the dump should be. The following are my settings. Choose the options you want:

Symbols.JPG
As the symbols would have been downloaded by now, it's time to examine the results in more detail, so enter !analyze - v

If you can't open the .dmp file, close WinDbg, then right-click the shortcut and select run as administrator. It would also be good if you moved the dumps out of protected system locations to your user folder.

Once the symbols are downloaded, you don't need an internet connection. Check the C: drive for a symbolfiles folder. I've used an example .dmp file here. However, the same general steps apply, so use this as a template. This has a lot of detail regarding the crash as you can see from the following example in two screenshots:

System.JPG
Note for this example the symbol file couldn't be loaded for the FAULTING_IP field, but there is still plenty of information. Your dumps will vary.


The first thing to see in the first screenshot:


is the VIDEO_TDR FAILURE just under BugCheck Analysis. The debugger lists that it was the result of a time out along with arguments. This is a starting point and the debugger is usually correct. Always look at the info before Debugging Details for reference. More info is displayed below.

The BUGCHECK_STR field shows the exception code - in this case its 0x116.

The DEFAULT_BUCKET_ID shows the category of the error. In this case, its a graphics driver.

The PROCESS_NAME shows the name of the process that raised the exception - in this case it was System.

The STACT_TEXT shows a stack trace. The trace shows a single function call in the memory of a call stack, which is a set of stack frames representing the function calls for each thread, if you wanted to know. A new function call means a new stack frame. When the function returns the stack frame is ejected from the stack. Note any recurring faults - in this case dxgkrnl.

The STACK_COMMAND shows the command used to obtain STACK_TEXT. You can alter the command or repeat the stack display.

The second screenshot shows a trace of the faulting component. The FAILURE_BUCKET_ID is more specific and points to a driver file, as shown by the IMAGE_NAME. It also references the BUGCHECK_STR.

WindDbg.JPG
This information points to a problem with nvidia drivers. The next step would be to google the IMAGE_NAME along with BSOD to see what solutions are available, i.e. nvlddmkm.sys BSOD. For this, I would first uninstall the driver via device manager, then reboot into safe mode and run drive sweeper by guru3d. Then I would install fresh drivers in safe mode and then try windows once again. More drivers might need to be updated and there might be a hotfix for the dxgkrnl that was at fault.

As I've shown, debugging crash dump's isn't too difficult. However, I've barely scratched the surface and there is a lot more to know. I may be posting some advanced guides in the future, but this is enough to check your crash dumps and begin working on a solution. Post back any feedback at www.vistax64.com if you can.

v1.2



Related Tutorials


 
Last edited by a moderator:

Comments

Hello, my system started BSODing quite recently and now will not boot (except to the OS DVD).
My problem is that I cannot download this tool to my faulty PC but I could download it to my Laptop. Can I manually enter my stop codes into this debugger software to trouble shoot my problem? I noted the codes down on paper just in case.
 
You will need the .dmp files, not the stop codes. The easiest way to get the .dmp file is to download the Ubuntu live cd, then navigate to the .dmp file in your windows partition from the ubuntu live cd. Have you tried booting safe mode and the repair option on the vista dvd?
 
Hello, thanks for the response.

Yes I have tried the safe mode option but the PC will no longer boot into any mode. It just loops into a boot/crash/boot cycle. It gets as far as showing the mouse pointer but on a black screen.

It will boot into the repair utility from the DVD but none of the repair options can automatically fix my problem. The memory scan seems to work but after the second pass when it reboots it does not reboot to a page showing the results.

It is probably a hardware issue but without a bunch of spare parts available to swap in and out I am having a problem troubleshooting which componant is at fault. I have the Ubunto disc and when I have a free moment I will give it a go.

The manufacturer suggested I reformat the hard drive and start again but I have been told by others that this would cause more problems if I have a hardware fault.

All the data is backed up therefore that is not an issue.

Thanks again.
 
Hello, thanks for the response.

Yes I have tried the safe mode option but the PC will no longer boot into any mode. It just loops into a boot/crash/boot cycle. It gets as far as showing the mouse pointer but on a black screen.

It will boot into the repair utility from the DVD but none of the repair options can automatically fix my problem. The memory scan seems to work but after the second pass when it reboots it does not reboot to a page showing the results.

It is probably a hardware issue but without a bunch of spare parts available to swap in and out I am having a problem troubleshooting which componant is at fault. I have the Ubunto disc and when I have a free moment I will give it a go.

The manufacturer suggested I reformat the hard drive and start again but I have been told by others that this would cause more problems if I have a hardware fault.

All the data is backed up therefore that is not an issue.

Thanks again.
Use the Ubuntu live cd to navigate to the .dmp files, and debug them on another windows pc. That way, if it is a hardware fault, you can fix the offending part if you ever have to reformat the pc. Try this first before considering a complete reformat. Excellent that you back up your files.:D
 
Thanks for the reply.

Got an Ubuntu disc. The correct one, 32bit.

Tested the hard drive-ok.
Tested the RAM, two passes-no errors.

Tried to run Ubuntu from the CD and it crashes after a few seconds loading.

The disc worked fine on my XP laptop.

I am at a loss and am tempted to actual pay someone to fix it. :cry:

Any ideas would be greatly appreciated.
 
Thanks for the reply.

Got an Ubuntu disc. The correct one, 32bit.

Tested the hard drive-ok.
Tested the RAM, two passes-no errors.

Tried to run Ubuntu from the CD and it crashes after a few seconds loading.

The disc worked fine on my XP laptop.

I am at a loss and am tempted to actual pay someone to fix it. :cry:

Any ideas would be greatly appreciated.
Crash? What error messages?
 
When I say "crash", what I mean is it enters the Ubuntu start menu-black screen-beep-reboot cycle. It does not present a BSOD or 'stop' code.

My original BSOD was 0x00000124 if that helps.

From the Ubunto CD I can run the ram test and the HDD test but attemting to run the OS from the Ubuntu disc just causes it to loop the above cycle.

This is the same loop I get when I try to boot from my HDD OS.

If I boot from the Vista OS disc I can get to the repair utility and even a command prompt. I actually used the command prompt option to ensure that all my data files were copied (XCOPY) to a backup external HDD. Running MS DOS from the Vista disc makes me think that the problem lies with the graphics card, but without access to a spare I cannot verify this.

Thanks again for your help.
 
When I say "crash", what I mean is it enters the Ubuntu start menu-black screen-beep-reboot cycle. It does not present a BSOD or 'stop' code.

My original BSOD was 0x00000124 if that helps.

From the Ubunto CD I can run the ram test and the HDD test but attemting to run the OS from the Ubuntu disc just causes it to loop the above cycle.

This is the same loop I get when I try to boot from my HDD OS.

If I boot from the Vista OS disc I can get to the repair utility and even a command prompt. I actually used the command prompt option to ensure that all my data files were copied (XCOPY) to a backup external HDD. Running MS DOS from the Vista disc makes me think that the problem lies with the graphics card, but without access to a spare I cannot verify this.

Thanks again for your help.
You could try System Rescue cd, follow the instructions to mount your hard disk extract what you need. www.sysresccd.org/

Have you tried xcopying the .dmp files?
 
While trying to debug my errors i kept getting the same messages over and over again. Apparently the address i typed (And i typed it exactly, interchanging what i thought were Stars with Quotation marks when they didn't work) Doesn't work or has invalid symbols or something..

Anyways after clicking on some hyperlink i found in the debugger (Advanced analysis i think?) This is what i came up with

Code:
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*C:\symbolfiles*http://msdl.microsoft.com/download/symbols;SRV*C:\sumbolfiles*http.microsoft.com/downloads/symbols;SRV*C:\symbolfiles*http.microsoft.com/downloads/symbols
Executable search path is: 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe - 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2.286) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.16670.x86fre.lh_sp2rc.090130-1715
Machine Name:
Kernel base = 0x81a02000 PsLoadedModuleList = 0x81b19c70
Debug session time: Mon Dec 28 08:50:42.889 2009 (GMT-8)
System Uptime: 0 days 8:27:28.849
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe - 
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
Loading unloaded module list
.........
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for halmacpi.dll - 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {bfb01d2c, ff, 0, 81dc2347}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
Probably caused by : ntkrpamp.exe ( nt!Kei386EoiHelper+2951 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: bfb01d2c, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81dc2347, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 81a02000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4983cf0c

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 bfb01d2c 

CURRENT_IRQL:  0

FAULTING_IP: 
hal!KfRaiseIrql+121
81dc2347 c9              leave

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 81dc2347 to 81a3f669

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
9fb01cb4 81dc2347 badb0d00 00000000 8772fd78 nt!Kei386EoiHelper+0x2951
9fb01cc8 81a989d6 8772fd78 00000002 86f46030 hal!KfRaiseIrql+0x121
9fb01d18 81dc2347 00000008 00010046 00000006 nt!KeSetEvent+0x1e4
00000000 00000000 00000000 00000000 00000000 hal!KfRaiseIrql+0x121


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!Kei386EoiHelper+2951
81a3f669 833d840cb38100  cmp     dword ptr [nt!LpcPortObjectType+0x160 (81b30c84)],0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!Kei386EoiHelper+2951

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntkrpamp.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------
 
While trying to debug my errors i kept getting the same messages over and over again. Apparently the address i typed (And i typed it exactly, interchanging what i thought were Stars with Quotation marks when they didn't work) Doesn't work or has invalid symbols or something..

Anyways after clicking on some hyperlink i found in the debugger (Advanced analysis i think?) This is what i came up with

Code:
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*C:\symbolfiles*http://msdl.microsoft.com/download/symbols;SRV*C:\sumbolfiles*http.microsoft.com/downloads/symbols;SRV*C:\symbolfiles*http.microsoft.com/downloads/symbols
Executable search path is: 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe - 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2.286) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.16670.x86fre.lh_sp2rc.090130-1715
Machine Name:
Kernel base = 0x81a02000 PsLoadedModuleList = 0x81b19c70
Debug session time: Mon Dec 28 08:50:42.889 2009 (GMT-8)
System Uptime: 0 days 8:27:28.849
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe - 
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
Loading unloaded module list
.........
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for halmacpi.dll - 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {bfb01d2c, ff, 0, 81dc2347}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
Probably caused by : ntkrpamp.exe ( nt!Kei386EoiHelper+2951 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: bfb01d2c, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81dc2347, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 81a02000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4983cf0c

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 bfb01d2c 

CURRENT_IRQL:  0

FAULTING_IP: 
hal!KfRaiseIrql+121
81dc2347 c9              leave

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 81dc2347 to 81a3f669

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
9fb01cb4 81dc2347 badb0d00 00000000 8772fd78 nt!Kei386EoiHelper+0x2951
9fb01cc8 81a989d6 8772fd78 00000002 86f46030 hal!KfRaiseIrql+0x121
9fb01d18 81dc2347 00000008 00010046 00000006 nt!KeSetEvent+0x1e4
00000000 00000000 00000000 00000000 00000000 hal!KfRaiseIrql+0x121


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!Kei386EoiHelper+2951
81a3f669 833d840cb38100  cmp     dword ptr [nt!LpcPortObjectType+0x160 (81b30c84)],0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!Kei386EoiHelper+2951

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntkrpamp.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------
SRV*C:\symbolfiles*http://msdl.microsoft.com/download. The C needs to be uncapitalized, at least that is what worked for me.
 
Top