Help with analysing minidump

Discussion in 'Software' started by oskan, Apr 9, 2009.

  1. oskan

    oskan Private E-2

    Hi!

    I've just successfully opened a minidump (with help from a guide I found here!) concerning problems with my computer restarting itself now and then. I would be very glad if someone helped me analysing it! Here it is:

    Loading Dump File [C:\Windows\Minidump\Mini040909-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612
    Machine Name:
    Kernel base = 0x8221d000 PsLoadedModuleList = 0x82334c70
    Debug session time: Thu Apr 9 17:21:34.156 2009 (GMT+2)
    System Uptime: 0 days 0:00:27.921
    Loading Kernel Symbols
    .................................................
    Loading User Symbols
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 606cf570, 8915a608, 0}

    Probably caused by : hardware

    Followup: MachineOwner
    ---------
    *** Possible invalid call from 8073af4f ( CI!PEAuthStore+0x6157f )
    *** Expected target 806cf570 ( CI!CSL+0x0 )

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 606cf570, The address that the exception occurred at
    Arg3: 8915a608, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instruktionen p 0x%08lx refererade till minnet p 0x%08lx. Det gick inte att utf ra en minnes tg rd. F ljande fel returnerades: The memory could not be %s.

    FAULTING_IP:
    +6c5d952f03bddadc
    606cf570 ?? ???

    TRAP_FRAME: 8915a608 -- (.trap 0xffffffff8915a608)
    ErrCode = 00000010
    eax=04000010 ebx=00000000 ecx=00000001 edx=04000010 esi=8915b134 edi=10000000
    eip=606cf570 esp=8915a67c ebp=8915b044 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210202
    606cf570 ?? ???
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: System

    CURRENT_IRQL: 0

    LOCK_ADDRESS: 823515e0 -- (!locks 823515e0)

    Resource @ nt!PiEngineLock (0x823515e0) Available

    WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


    WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

    1 total locks

    PNP_TRIAGE:
    Lock address : 0x823515e0
    Thread Count : 0
    Thread address: 0x00000000
    Thread wait : 0x0

    LAST_CONTROL_TRANSFER: from 8073af54 to 606cf570

    POSSIBLE_INVALID_CONTROL_TRANSFER: from 8073af4f to 806cf570

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    8915a678 8073af54 04000010 6a0fffff 000000a5 0x606cf570
    8915b044 80749714 88e0a570 00000005 02000000 CI!PEAuthStore+0x61584
    8915b064 8079b053 00000001 00000000 00000000 CI!PEAuthStoreParameter+0x74
    8915b0c8 8079b1ad 8915b1b4 8915b18c 86401058 CI!PECheckComponentLoadEx+0x1f7
    8915b140 80794c3a c0000428 8915b1b4 00000001 CI!PECheckComponentLoad+0xd0
    8915b164 807958fd c0000428 8915b1b4 00000001 CI!CipCallPeauth+0x5a
    8915b1cc 823b90f1 86401028 8d140000 00001040 CI!CiValidateImageHeader+0x157
    8915b1e8 823b9275 86401028 8d140000 00002000 nt!SeValidateImageHeader+0x4d
    8915b25c 8246240e 86401028 863d94d8 00000001 nt!MiValidateImageHeader+0x171
    8915b37c 824662d8 8915b3d0 00000008 8915b4e8 nt!MmCreateSection+0x763
    8915b3f0 82274a1a 8915b518 00000008 8915b4e8 nt!NtCreateSection+0x177
    8915b3f0 82272635 8915b518 00000008 8915b4e8 nt!KiFastCallEntry+0x12a
    8915b484 823afe3e 8915b518 00000008 8915b4e8 nt!ZwCreateSection+0x11
    8915b544 823aa093 80000120 82334c70 844832d8 nt!MmCheckSystemImage+0x52
    8915b58c 823b39b8 8915b67c 00000000 8915b5b0 nt!MiCreateSectionForDriver+0x8f
    8915b5b4 823af808 8915b620 8915b67c 00000000 nt!MiObtainSectionForDriver+0x96
    8915b630 823b0273 8915b67c 00000000 00000000 nt!MmLoadSystemImage+0x1c2
    8915b6b0 823afbe1 8d40a000 8915b728 00000000 nt!MiResolveImageReferences+0x237
    8915b730 8238bef5 8915b8b8 00000000 00000000 nt!MmLoadSystemImage+0x59b
    8915b924 823808c4 00000000 8915b900 8915b954 nt!IopLoadDriver+0x385
    8915b968 823ef33e 8c12b6d0 00000001 8c12b6bc nt!PipCallDriverAddDeviceQueryRoutine+0x309
    8915b9a0 823ef66e 00000001 8915ba98 823805bb nt!RtlpCallQueryRegistryRoutine+0x28e
    8915ba0c 8237fcbc 40000000 8000003c 8915ba40 nt!RtlQueryRegistryValues+0x31b
    8915baf0 8237f4b0 00000000 8915bd38 8234f530 nt!PipCallDriverAddDevice+0x2ff
    8915bcec 82228b23 8443d3a0 863d4430 8915bd38 nt!PipProcessDevNodeTree+0x15c
    8915bd44 82255445 00000000 00000000 844832d8 nt!PnpDeviceActionWorker+0x229
    8915bd7c 823f2b18 00000000 f8763036 00000000 nt!ExpWorkerThread+0xfd
    8915bdc0 8224ba2e 82255348 00000001 00000000 nt!PspSystemThreadStartup+0x9d
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND: .trap 0xffffffff8915a608 ; kb

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: hardware

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    BUCKET_ID: CPU_CALL_ERROR

    Followup: MachineOwner
    ---------
    *** Possible invalid call from 8073af4f ( CI!PEAuthStore+0x6157f )
    *** Expected target 806cf570 ( CI!CSL+0x0 )

    I've noticed that the problem is caused by "hardware" and because of the "BUCKET_ID" that says "CPU_CALL_ERROR" I suppose it is something that has to do with the processor? Please help me!

    / Oskar
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds