TechSpot

Help reading WinDbg dump file

By moe661
Jan 20, 2010
  1. Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [E:\Minidump\Mini010510-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is:
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_gdr.090804-1435
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
    Debug session time: Tue Jan 5 16:31:45.298 2010 (GMT-8)
    System Uptime: 0 days 5:24:14.551
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .....
    Loading User Symbols
    Loading unloaded module list
    ....................................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 24, {1902fe, b482e3ac, b482e0a8, 8052d2ef}

    Probably caused by : Ntfs.sys ( Ntfs!NtfsGetNextFcbTableEntry+17 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
    Arguments:
    Arg1: 001902fe
    Arg2: b482e3ac
    Arg3: b482e0a8
    Arg4: 8052d2ef

    Debugging Details:
    ------------------


    EXCEPTION_RECORD: b482e3ac -- (.exr 0xffffffffb482e3ac)
    ExceptionAddress: 8052d2ef (nt!RealSuccessor+0x00000013)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 00004004
    Attempt to read from address 00004004

    CONTEXT: b482e0a8 -- (.cxr 0xffffffffb482e0a8)
    eax=00004000 ebx=00000000 ecx=00004000 edx=00000000 esi=b482e4c8 edi=e62c0cc8
    eip=8052d2ef esp=b482e474 ebp=b482e474 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    nt!RealSuccessor+0x13:
    8052d2ef 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00004004=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: System

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    EXCEPTION_PARAMETER1: 00000000

    EXCEPTION_PARAMETER2: 00004004

    READ_ADDRESS: 00004004

    FOLLOWUP_IP:
    Ntfs!NtfsGetNextFcbTableEntry+17
    b9e62b09 85c0 test eax,eax

    FAULTING_IP:
    nt!RealSuccessor+13
    8052d2ef 8b4804 mov ecx,dword ptr [eax+4]

    BUGCHECK_STR: 0x24

    LAST_CONTROL_TRANSFER: from 8052dd1c to 8052d2ef

    STACK_TEXT:
    b482e474 8052dd1c e5d7e918 8af88260 b482e494 nt!RealSuccessor+0x13
    b482e484 b9e62b09 8af883c8 b482e4c8 b482e510 nt!RtlEnumerateGenericTableWithoutSplayingAvl+0x32
    b482e494 b9e62a6b 8af88100 b482e4c8 00000001 Ntfs!NtfsGetNextFcbTableEntry+0x17
    b482e510 b9e62d28 89245dc0 8af88100 00000001 Ntfs!NtfsFlushVolume+0x43d
    b482e5b0 b9e5003b 89245dc0 89d75368 b4820000 Ntfs!NtfsCommonVolumeOpen+0x341
    b482e68c 804ef19f 8af88020 89d75368 8a1f5d80 Ntfs!NtfsFsdCreate+0x14d
    b482e69c b9ede876 00000000 8aff7320 893840f0 nt!IopfCallDriver+0x31
    b482e6e8 804ef19f 8af96ac0 00000001 89d75368 sr!SrCreate+0x150
    b482e6f8 b9eeee9b 00000000 89d75368 89d7551c nt!IopfCallDriver+0x31
    b482e71c b9efb754 b482e73c 8ae692f8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
    b482e758 804ef19f 8ae692f8 89d75368 89d75368 fltmgr!FltpCreate+0x26a
    b482e768 b9eeee9b 00000000 89d75368 89d75540 nt!IopfCallDriver+0x31
    b482e78c b9efb754 b482e7ac 8a2266f0 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
    b482e7c8 804ef19f 8a2266f0 89d75368 89d75368 fltmgr!FltpCreate+0x26a
    b482e7d8 805831fa 8afb48e8 8acec0ac b482e970 nt!IopfCallDriver+0x31
    b482e8b8 805bf452 8afb4900 00000000 8acec008 nt!IopParseDevice+0xa12
    b482e930 805bb9de 00000000 b482e970 00000240 nt!ObpLookupObjectName+0x53c
    b482e984 80576033 00000000 00000000 82ecf000 nt!ObOpenObjectByName+0xea
    b482ea00 805769aa b482eba4 00100003 b482eb8c nt!IopCreateFile+0x407
    b482ea5c 805790b4 b482eba4 00100003 b482eb8c nt!IoCreateFile+0x8e
    b482ea9c 8054162c b482eba4 00100003 b482eb8c nt!NtCreateFile+0x30
    b482ea9c 80500031 b482eba4 00100003 b482eb8c nt!KiFastCallEntry+0xfc
    b482eb40 805c8113 b482eba4 00100003 b482eb8c nt!ZwCreateFile+0x11
    b482edac 805cff72 ba217ad0 00000000 00000000 nt!PopFlushVolumeWorker+0xe3
    b482eddc 805460ee 805c8030 ba217ad0 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    SYMBOL_STACK_INDEX: 2

    SYMBOL_NAME: Ntfs!NtfsGetNextFcbTableEntry+17

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: Ntfs

    IMAGE_NAME: Ntfs.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 48025be5

    STACK_COMMAND: .cxr 0xffffffffb482e0a8 ; kb

    FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsGetNextFcbTableEntry+17

    BUCKET_ID: 0x24_Ntfs!NtfsGetNextFcbTableEntry+17

    Followup: MachineOwner
    ---------

    0: kd> .cxr 0xffffffffb482e0a8
    eax=00004000 ebx=00000000 ecx=00004000 edx=00000000 esi=b482e4c8 edi=e62c0cc8
    eip=8052d2ef esp=b482e474 ebp=b482e474 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    nt!RealSuccessor+0x13:
    8052d2ef 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00004004=????????
    0: kd> .exr 0xffffffffb482e3ac
    ExceptionAddress: 8052d2ef (nt!RealSuccessor+0x00000013)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 00004004
    Attempt to read from address 00004004
     
  2. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    How old is your system? When did this error occur? Is this the only time you have received a BSOD?

    0x00000024: NTFS_FILE_SYSTEM
    A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. There may be a physical problem with the disk, or an Interrupt Request Packet (IRP) may be corrupted. Other common causes include heavy hard drive fragmentation, heavy file I/O, problems with some types of drive-mirroring software, or some antivirus software.

    1. Go to your Run box and run ChkDsk. Please note in stage 2 if it indicates it is recovering lost files.

    2. Do a harddrive diagnostics.

    3. Check your cable connections to see if they are firm between harddrive and motherboard.
     
  3. moe661

    moe661 TS Rookie Topic Starter

    1-Its a brand new system but with an old hard drive with windows xp. Running ddr3 ram and a quad core intel.

    2-check dsk recovering lost files showed up at 100% of stage 2 but didnt show any progress and went to stage 3

    3- cables are new and connected



     
  4. moe661

    moe661 TS Rookie Topic Starter

    did hard drive tests already all passed
     
  5. Archean

    Archean TechSpot Paladin Posts: 5,682   +86

    Did you reinstalled xp after shifting that old HDD to new system?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...