TechSpot

bluescreen - using windbg - need help interpreting results

By ktpmm5
Oct 11, 2007
  1. I've had tons of bluescreens with error codes of Error code 1000000a, , parameter1 0001f23e, parameter2 000000ff, parameter3 00000000, parameter4 804e78e4. I've done all the troubleshooting recommended here with no luck. I"m now using windbg to look at the latest crash, but I don't understand what it is telling me. Can someone look at the results below and let me know what this means?


    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 000d14ff, memory referenced
    Arg2: 000000ff, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 804e78e4, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 000d14ff

    CURRENT_IRQL: ff

    FAULTING_IP:
    nt+108e4
    804e78e4 8b7e10 mov edi,dword ptr [esi+10h]

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: Idle

    LAST_CONTROL_TRANSFER: from 00000000 to 804e78e4

    STACK_TEXT:
    f78aed54 00000000 0000000e ffffffff fffeffff nt!PopProcessorIdle+0xb


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt+108e4
    804e78e4 8b7e10 mov edi,dword ptr [esi+10h]

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e54690

    SYMBOL_NAME: nt+108e4

    FAILURE_BUCKET_ID: 0xA_nt+108e4

    BUCKET_ID: 0xA_nt+108e4

    Followup: MachineOwner
    ---------

    1: kd> lmvm nt
    start end module name
    804d7000 806fd000 nt # (pdb symbols) c:\symbols\ntkrnlmp.pdb\7627B1ADA0F5436AAA5DB5B9B2C11FFF2\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Mapped memory image file: c:\symbols\ntkrnlmp.exe\45E54690226000\ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp: Wed Feb 28 04:08:32 2007 (45E54690)
    CheckSum: 0020DAE3
    ImageSize: 00226000
    File version: 5.1.2600.3093
    Product version: 5.1.2600.3093
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 1.0 App
    File date: 00000000.00000000
    Translations: 0415.04b0
    CompanyName: Microsoft Corporation
    ProductName: System operacyjny Microsoft® Windows®
    InternalName: ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion: 5.1.2600.3093
    FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
    FileDescription: Jądro i system NT
    LegalCopyright: © Microsoft Corporation. Wszelkie prawa zastrzeżone.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...