TechSpot

Debuggin minidump.dmp

By Prasanna1976
Jan 16, 2006
  1. Hi,

    I am trying to debug my minidump.dmp using using windbg. I am getting the following output.

    Microsoft (R) Windows Debugger Version 6.5.0003.7
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Memory Dump\Mini011606-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows 2000 Kernel Version 2195 (Service Pack 4) MP (4 procs) Free x86 compatible
    Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
    Debug session time: Mon Jan 16 15:54:02.484 2006 (GMT+0)
    System Uptime: not available
    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    .....................................................................................................
    Loading unloaded module list
    .....
    Loading User Symbols
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C2, {7, b8a, a2411620, a2411628}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    unable to get nt!MmSpecialPoolStart
    unable to get nt!MmSpecialPoolEnd
    unable to get MmPageSize - probably bad symbols
    unable to get nt!MmSpecialPoolStart
    unable to get nt!MmSpecialPoolEnd
    unable to get MmPageSize - probably bad symbols

    Followup: MachineOwner
    ---------

    Please advice me.
    I have attached the minidump here with as ZIP.
    My system is running win2000 server.
     
  2. peterdiva

    peterdiva TechSpot Ambassador Posts: 1,088

    Probably caused by X30blK.DLL.I couldn't find any info about this file.
     
  3. Prasanna1976

    Prasanna1976 TS Rookie Topic Starter

    Does following mean anything for you.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    X30blK+15f25
    a025bf25 8b510c mov edx,[ecx+0xc]

    EXCEPTION_PARAMETER1: 00000000

    EXCEPTION_PARAMETER2: 0000000c

    READ_ADDRESS: 0000000c

    DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

    BUGCHECK_STR: 0x1E

    EXCEPTION_RECORD: bba5725c -- (.exr ffffffffbba5725c)
    ExceptionAddress: a025bf25 (X30blK+0x00015f25)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 0000000c
    Attempt to read from address 0000000c

    LAST_CONTROL_TRANSFER: from a025be74 to a025bf25

    TRAP_FRAME: bba572b0 -- (.trap ffffffffbba572b0)
    ErrCode = 00000000
    eax=00000000 ebx=a23c3020 ecx=00000000 edx=00000000 esi=a24c7248 edi=a24c2018
    eip=a025bf25 esp=bba57324 ebp=bba5734c iopl=0 nv up ei ng nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
    X30blK+0x15f25:
    a025bf25 8b510c mov edx,[ecx+0xc] ds:0023:0000000c=????????
    Resetting default scope

    STACK_TEXT:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    bba5734c a025be74 a23c3020 a24c7248 a24c2018 X30blK+0x15f25
    bba577e4 a025c18a a23c3020 a24c7248 a23c3020 X30blK+0x15e74
    bba577fc a02573a1 a23c3020 a24c7248 00000002 X30blK+0x1618a
    bba57824 a0257163 a23c3020 a0267760 a24c7248 X30blK+0x113a1
    bba57864 8046e697 8046e1c2 a22e5d88 a2443018 X30blK+0x11163
    bba578a0 8046c419 bba578dc 869acb2c 869acac0 nt!ExFreePoolWithTag+0x447
    bba578bc 8046e697 00000001 8046e1c2 873787c0 nt!KiSwapThread+0x1c1
    bba578f4 a007ecdd 00000001 a243ef28 a24c7248 nt!ExFreePoolWithTag+0x447
    00000000 00000000 00000000 00000000 00000000 win32k!HeavyFreePool+0xb0


    FOLLOWUP_IP:
    X30blK+15f25
    a025bf25 8b510c mov edx,[ecx+0xc]

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: X30blK+15f25

    MODULE_NAME: X30blK

    IMAGE_NAME: X30blK.DLL

    DEBUG_FLR_IMAGE_TIMESTAMP: 3d442876

    STACK_COMMAND: .trap ffffffffbba572b0 ; kb

    FAILURE_BUCKET_ID: 0x1E_X30blK+15f25

    BUCKET_ID: 0x1E_X30blK+15f25

    Followup: MachineOwner
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...