Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini021310-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Sat Feb 13 19:55:40.656 2010 (GMT+0)
System Uptime: 0 days 7:12:05.204
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 822ed709, f8a7ef2c, f8a7ec28}
Probably caused by : ntoskrnl.exe ( nt!$$VProc_ImageExportDirectory+56df )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 822ed709, The address that the exception occurred at
Arg3: f8a7ef2c, Exception Record Address
Arg4: f8a7ec28, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
+56df
822ed709 0fb74714 movzx eax,word ptr [edi+14h]
EXCEPTION_RECORD: f8a7ef2c -- (.exr 0xfffffffff8a7ef2c)
ExceptionAddress: 822ed709
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000014
Attempt to read from address 00000014
CONTEXT: f8a7ec28 -- (.cxr 0xfffffffff8a7ec28)
eax=00000000 ebx=00000000 ecx=83335388 edx=00000000 esi=00000000 edi=00000000
eip=822ed709 esp=f8a7eff4 ebp=f8a7f468 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210246
822ed709 0fb74714 movzx eax,word ptr [edi+14h] ds:0023:00000014=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000014
READ_ADDRESS: 00000014
FOLLOWUP_IP:
nt!$$VProc_ImageExportDirectory+56df
80686ddf ?? ???
FAILED_INSTRUCTION_ADDRESS:
+26b952f016bdfdc
822ed709 0fb74714 movzx eax,word ptr [edi+14h]
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 0069006e to 822ed709
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f8a7f468 0069006e ef5d0000 80686ddf f8a7fdcc 0x822ed709
f8a7f46c ef5d0000 80686ddf f8a7fdcc 00005fcc 0x69006e
f8a7f470 80686ddf f8a7fdcc 00005fcc 80682adc 0xef5d0000
f8a7f474 f8a7fdcc 00005fcc 80682adc 804d7000 nt!$$VProc_ImageExportDirectory+0x56df
f8a7f478 00000000 80682adc 804d7000 00770025 0xf8a7fdcc
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!$$VProc_ImageExportDirectory+56df
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711
STACK_COMMAND: .cxr 0xfffffffff8a7ec28 ; kb
FAILURE_BUCKET_ID: 0x7E_BAD_IP_nt!$$VProc_ImageExportDirectory+56df
BUCKET_ID: 0x7E_BAD_IP_nt!$$VProc_ImageExportDirectory+56df
Followup: MachineOwner
---------
hope this helps