Hello. Requesting Memory Dump?

Discussion in 'Software' started by Faraway64d, Feb 8, 2009.

  1. Faraway64d

    Faraway64d Private E-2

    Hi, I am new to the forums.

    I am trying to learn how to use Microsoft Debugger to troubleshoot BSOD, but I am not getting the same results as everyone else (my results are below, Debugging tools keeps complaining about not being able to find symbols files, and I do not have the "probably caused by" line. Maybe it still tells me something useful, but I do not understand the syntax.)

    Is there anyone who could possibly upload a .dmp file for me to play with, just to make sure I am doing this right? Thanks.

    ................................................................
    ..............
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (e08.458): Access violation - code c0000005 (first/second chance not available)
    eax=05acffe0 ebx=053946f0 ecx=3e2ec632 edx=3e2ec632 esi=05acff98 edi=00000000
    eip=050ef515 esp=05acff64 ebp=05acff80 iopl=0 nv up ei pl nz na po nc
    cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
    *** WARNING: Unable to verify checksum for DXTDD.dll
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for DXTDD.dll -
    DXTDD!DDCreateClipper+0x2015:
    050ef515 8b11 mov edx,dword ptr [ecx] ds:002b:3e2ec632=????????
    0:000> !analyze -v
    *******************************************************************************
    * *
    * Exception Analysis *
    * *
    *******************************************************************************

    *** ERROR: Symbol file could not be found. Defaulted to export symbols for MSS32.DLL -
    *** WARNING: Unable to verify timestamp for guard32.dll
    *** ERROR: Module load completed but symbols could not be loaded for guard32.dll
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: kernel32!pNlsUserInfo ***
    *** ***
    *************************************************************************
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: kernel32!pNlsUserInfo ***
    *** ***
    *************************************************************************

    FAULTING_IP:
    DXTDD!DDCreateClipper+2015
    050ef515 8b11 mov edx,dword ptr [ecx]

    EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 050ef515 (DXTDD!DDCreateClipper+0x00002015)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 3e2ec632
    Attempt to read from address 3e2ec632

    DEFAULT_BUCKET_ID: INVALID_POINTER_WRITE

    PROCESS_NAME: F18.EXE

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    EXCEPTION_PARAMETER1: 00000000

    EXCEPTION_PARAMETER2: 3e2ec632

    READ_ADDRESS: 3e2ec632

    FOLLOWUP_IP:
    DXTDD!DDCreateClipper+2015
    050ef515 8b11 mov edx,dword ptr [ecx]

    FAULTING_THREAD: 00000458

    PRIMARY_PROBLEM_CLASS: INVALID_POINTER_WRITE

    BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_WRITE

    LAST_CONTROL_TRANSFER: from 050f75c7 to 050ef515

    STACK_TEXT:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    05acff80 050f75c7 3e2ec632 05acff98 00000000 DXTDD!DDCreateClipper+0x2015
    05acff90 0510397a 09614600 0013f474 3e2ec632 DXTDD!DDCreateClipper+0xa0c7
    00000000 00000000 00000000 00000000 00000000 DXTDD!DDEnumA+0x72ca


    STACK_COMMAND: ~0s; .ecxr ; kb

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: DXTDD!DDCreateClipper+2015

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: DXTDD

    IMAGE_NAME: DXTDD.dll

    DEBUG_FLR_IMAGE_TIMESTAMP: 43e3ca06

    FAILURE_BUCKET_ID: INVALID_POINTER_WRITE_c0000005_DXTDD.dll!DDCreateClipper

    BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_WRITE_DXTDD!DDCreateClipper+2015

    Followup: MachineOwner
     
  2. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

  3. Faraway64d

    Faraway64d Private E-2

    Thanks, I looked at all of the previous posts but unfortunately did not find an answer to my solution. I am trying to create batchfiles to automate the analysis, but without another memory dump file it is hard to tell if the issue is Windows, the minidump, or the bat. :(
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds