TechSpot

MiniDump texts comparison. Memory perhaps

By crystalfat
Jun 6, 2007
  1. Hi guys, i have a problem with a computer sporadically rebooting.

    The errors are different in the event viewer, however i took two of the minidumps to compare, it seems as though both problems occur around a certain memory block, can anyone shed any light on this for me please.

    thanks in advance

    chris

    minidump1

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 80573e2a, The address that the exception occurred at
    Arg3: eb8b3a98, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    nt!RtlpCoalesceFreeBlocks+2cd
    80573e2a 8b12 mov edx,dword ptr [edx]

    TRAP_FRAME: eb8b3a98 -- (.trap ffffffffeb8b3a98)
    .trap ffffffffeb8b3a98
    ErrCode = 00000000
    eax=000002b5 ebx=bc630000 ecx=bc640500 edx=00000000 esi=bc6404f8 edi=bc6404f0
    eip=80573e2a esp=eb8b3b0c ebp=eb8b3b18 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    nt!RtlpCoalesceFreeBlocks+0x2cd:
    80573e2a 8b12 mov edx,dword ptr [edx] ds:0023:00000000=????????
    .trap
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: fmstart.exe

    LAST_CONTROL_TRANSFER: from 80573f28 to 80573e2a

    STACK_TEXT:
    eb8b3b18 80573f28 bc630000 bc6404f0 eb8b3b80 nt!RtlpCoalesceFreeBlocks+0x2cd
    eb8b3ba0 bf80cc0e bc630000 00000000 bc6404f8 nt!RtlFreeHeap+0xa1
    eb8b3bb4 bf81fb6d bc630000 bc6404f8 eb8b3be0 win32k!Win32HeapFree+0x13
    eb8b3bc4 bf81fc34 82833b68 bc6404f8 e11c6648 win32k!ClassFree+0x1e
    eb8b3be0 bf8c0919 e11c6648 829f23b8 e11bc110 win32k!DestroyClass+0xb2
    eb8b3bf4 bf8209ea e11c65c0 828547d8 00000000 win32k!DestroyProcessesClasses+0x2b
    eb8b3c1c bf819e30 00000001 eb8b3c44 bf819ef4 win32k!xxxDestroyThreadInfo+0x21d
    eb8b3c28 bf819ef4 828547d8 00000001 00000000 win32k!UserThreadCallout+0x4b
    eb8b3c44 8056a0cf 828547d8 00000001 828545d0 win32k!W32pThreadCallout+0x3d
    eb8b3cf0 80584c64 40010004 eb8b3d4c 804e60e9 nt!PspExitThread+0x40b
    eb8b3cfc 804e60e9 828545d0 eb8b3d48 eb8b3d3c nt!PsExitSpecialApc+0x22
    eb8b3d4c 804de855 00000001 00000000 eb8b3d64 nt!KiDeliverApc+0x1af
    eb8b3d4c 7c90eb94 00000001 00000000 eb8b3d64 nt!KiServiceExit+0x58
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0012fe94 00000000 00000000 00000000 00000000 0x7c90eb94





    Minidump 2:

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8054b02d, The address that the exception occurred at
    Arg3: eb903844, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    nt!ExAllocatePoolWithTag+66c
    8054b02d 8b08 mov ecx,dword ptr [eax]

    TRAP_FRAME: eb903844 -- (.trap ffffffffeb903844)
    .trap ffffffffeb903844
    ErrCode = 00000000
    eax=0481023d ebx=82bef028 ecx=82bf1098 edx=00000001 esi=82bef410 edi=000001ff
    eip=8054b02d esp=eb9038b8 ebp=eb90390c iopl=0 ov up ei ng nz na pe cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a87
    nt!ExAllocatePoolWithTag+0x66c:
    8054b02d 8b08 mov ecx,dword ptr [eax] ds:0023:0481023d=????????
    .trap
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: csrss.exe

    LAST_CONTROL_TRANSFER: from 805647f7 to 8054b02d

    STACK_TEXT:
    eb90390c 805647f7 00000001 00000001 e56b6f54 nt!ExAllocatePoolWithTag+0x66c
    eb903930 8056495d 829da2c8 00000000 00000000 nt!ObpAllocateObject+0xc8
    eb903964 80575aed 00000000 82bed238 eb9039d8 nt!ObCreateObject+0x12a
    eb9039a8 80578cab e2193030 eb9039d8 7ffde200 nt!SepDuplicateToken+0xff
    eb903a60 804de7ec fffffffe 00020008 00000001 nt!NtOpenThreadTokenEx+0x17f
    eb903a60 804dd0f5 fffffffe 00020008 00000001 nt!KiFastCallEntry+0xf8
    eb903aec 805812b8 fffffffe 00020008 00000001 nt!ZwOpenThreadTokenEx+0x11
    eb903b7c 80581231 eb903ba8 80580df2 00f2fde6 nt!RtlFormatCurrentUserKeyPath+0x2f
    eb903bb4 80580c6d 02000000 eb903c0c 00000000 nt!RtlOpenCurrentUser+0x13
    eb903d14 80580dd7 80580df2 00f2fde6 00000001 nt!ExpGetCurrentUserUILanguage+0x2d
    eb903d58 804de7ec 00f2fde6 00f2fe80 7c90eb94 nt!NtQueryDefaultUILanguage+0x49
    eb903d58 7c90eb94 00f2fde6 00f2fe80 7c90eb94 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00f2fe80 00000000 00000000 00000000 00000000 0x7c90eb94
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    It is possible you have a ram problem.

    Go and read this thread HERE and see if it helps you to identify the culprit.

    If it doesn`t, attach 5 or 6 of your latest minidumps here.

    Regards Howard :wave: :wave:
     
  3. crystalfat

    crystalfat TS Rookie Topic Starter

    More dumps

    Seems to pass all tests, cheers for that, here are some more dumps.


    BAD_POOL_HEADER (19)
    The pool is already corrupt at the time of the current request.
    This may or may not be due to the caller.
    The internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    Arguments:
    Arg1: 00000020, a pool block header size is corrupt.
    Arg2: e2bd5938, The pool entry we were looking for within the page.
    Arg3: e2bd5980, The next pool entry.
    Arg4: 1c090205, (reserved)

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x19_20

    POOL_ADDRESS: e2bd5938

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: Skype.exe

    LAST_CONTROL_TRANSFER: from 8054b941 to 8053354e

    STACK_TEXT:
    eb72e4bc 8054b941 00000019 00000020 e2bd5938 nt!KeBugCheckEx+0x1b
    eb72e50c f7b52b97 e2bd5940 00000000 00000000 nt!ExFreePoolWithTag+0x2be
    eb72e520 f7b5402a e2bd5940 eb72e620 827b2bc8 Npfs!NpFreeClientSecurityContext+0x31
    eb72e564 f7b51c49 e2e10fb0 00000001 02d51b80 Npfs!NpWriteDataQueue+0x15a
    eb72e608 f7b52322 82933610 82522988 eb72e620 Npfs!NpTransceive+0x161
    eb72e62c f7b523e1 82933610 82522988 827b2dd8 Npfs!NpCommonFileSystemControl+0x1e0
    eb72e644 804e37f7 82933610 82522988 806ee2d0 Npfs!NpFsdFileSystemControl+0x19
    eb72e654 8056a148 825229f8 82463c00 82522988 nt!IopfCallDriver+0x31
    eb72e668 8057ad03 82933610 82522988 82463c00 nt!IopSynchronousServiceTail+0x60
    eb72e710 8057ad43 00000840 00000195 00000000 nt!IopXxxControlFile+0x611
    eb72e744 804de7ec 00000840 00000195 00000000 nt!NtFsControlFile+0x2a
    eb72e744 7c90eb94 00000840 00000195 00000000 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0012c4ec 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    Npfs!NpFreeClientSecurityContext+31
    f7b52b97 5e pop esi

    SYMBOL_STACK_INDEX: 2

    SYMBOL_NAME: Npfs!NpFreeClientSecurityContext+31

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: Npfs

    IMAGE_NAME: Npfs.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 41107b86

    FAILURE_BUCKET_ID: 0x19_20_Npfs!NpFreeClientSecurityContext+31

    BUCKET_ID: 0x19_20_Npfs!NpFreeClientSecurityContext+31





    dump 4


    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 00000000, page frame number
    Arg3: 00000000, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------


    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x4E

    PROCESS_NAME: explorer.exe

    LAST_CONTROL_TRANSFER: from 80520b02 to 8053354e

    STACK_TEXT:
    ebe7f6c4 80520b02 0000004e 00000099 00000000 nt!KeBugCheckEx+0x1b
    ebe7f6f8 805846bf 00580119 8286fda0 003ffffc nt!MiDeleteValidAddress+0x123
    ebe7f718 804ff36f 8286fda0 8286fed8 8286fda0 nt!MiDeleteAddressesInWorkingSet+0x65
    ebe7f750 805849a3 0086fda0 82ab7990 82ab7bd8 nt!MmCleanProcessAddressSpace+0x18f
    ebe7f7f8 8057b746 c0000005 82ab7990 00000000 nt!PspExitThread+0x680
    ebe7f818 80584828 82ab7990 c0000005 ebe7f854 nt!PspTerminateThreadByPointer+0x52
    ebe7f844 804de7ec 00000000 c0000005 00f4ffa0 nt!NtTerminateProcess+0x118
    ebe7f844 7c90eb94 00000000 c0000005 00f4ffa0 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00f4ffa0 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiDeleteValidAddress+123
    80520b02 00ff add bh,bh

    SYMBOL_STACK_INDEX: 1

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

    SYMBOL_NAME: nt!MiDeleteValidAddress+123

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: 0x4E_nt!MiDeleteValidAddress+123

    BUCKET_ID: 0x4E_nt!MiDeleteValidAddress+123

    Followup: MachineOwner
    ---------


    dump 5


    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: f000ef5d, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: bf8016da, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: f000ef5d

    FAULTING_IP:
    win32k!SetWakeBit+28
    bf8016da 66095806 or word ptr [eax+6],bx

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: csrss.exe

    LAST_CONTROL_TRANSFER: from bf801232 to bf8016da

    STACK_TEXT:
    ef00faac bf801232 00000000 00000010 804dcbe4 win32k!SetWakeBit+0x28
    ef00fad4 bf88dba7 00000022 006dfff4 bf801077 win32k!TimersProc+0xeb
    ef00fd30 bf8725df ef01f490 00000002 ef00fd54 win32k!RawInputThread+0x634
    ef00fd40 bf80109a ef01f490 ef00fd64 006dfff4 win32k!xxxCreateSystemThreads+0x60
    ef00fd54 804de7ec 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
    ef00fd54 7c90eb94 00000000 00000022 00000000 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00000000 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!SetWakeBit+28
    bf8016da 66095806 or word ptr [eax+6],bx

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: win32k!SetWakeBit+28

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 45f013f6

    FAILURE_BUCKET_ID: 0x50_W_win32k!SetWakeBit+28

    BUCKET_ID: 0x50_W_win32k!SetWakeBit+28


    dump 6


    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 80573e2a, The address that the exception occurred at
    Arg3: eb8b3a98, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    nt!RtlpCoalesceFreeBlocks+2cd
    80573e2a 8b12 mov edx,dword ptr [edx]

    TRAP_FRAME: eb8b3a98 -- (.trap ffffffffeb8b3a98)
    .trap ffffffffeb8b3a98
    ErrCode = 00000000
    eax=000002b5 ebx=bc630000 ecx=bc640500 edx=00000000 esi=bc6404f8 edi=bc6404f0
    eip=80573e2a esp=eb8b3b0c ebp=eb8b3b18 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    nt!RtlpCoalesceFreeBlocks+0x2cd:
    80573e2a 8b12 mov edx,dword ptr [edx] ds:0023:00000000=????????
    .trap
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: fmstart.exe

    LAST_CONTROL_TRANSFER: from 80573f28 to 80573e2a

    STACK_TEXT:
    eb8b3b18 80573f28 bc630000 bc6404f0 eb8b3b80 nt!RtlpCoalesceFreeBlocks+0x2cd
    eb8b3ba0 bf80cc0e bc630000 00000000 bc6404f8 nt!RtlFreeHeap+0xa1
    eb8b3bb4 bf81fb6d bc630000 bc6404f8 eb8b3be0 win32k!Win32HeapFree+0x13
    eb8b3bc4 bf81fc34 82833b68 bc6404f8 e11c6648 win32k!ClassFree+0x1e
    eb8b3be0 bf8c0919 e11c6648 829f23b8 e11bc110 win32k!DestroyClass+0xb2
    eb8b3bf4 bf8209ea e11c65c0 828547d8 00000000 win32k!DestroyProcessesClasses+0x2b
    eb8b3c1c bf819e30 00000001 eb8b3c44 bf819ef4 win32k!xxxDestroyThreadInfo+0x21d
    eb8b3c28 bf819ef4 828547d8 00000001 00000000 win32k!UserThreadCallout+0x4b
    eb8b3c44 8056a0cf 828547d8 00000001 828545d0 win32k!W32pThreadCallout+0x3d
    eb8b3cf0 80584c64 40010004 eb8b3d4c 804e60e9 nt!PspExitThread+0x40b
    eb8b3cfc 804e60e9 828545d0 eb8b3d48 eb8b3d3c nt!PsExitSpecialApc+0x22
    eb8b3d4c 804de855 00000001 00000000 eb8b3d64 nt!KiDeliverApc+0x1af
    eb8b3d4c 7c90eb94 00000001 00000000 eb8b3d64 nt!KiServiceExit+0x58
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0012fe94 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!Win32HeapFree+13
    bf80cc0e 0fb6c0 movzx eax,al

    SYMBOL_STACK_INDEX: 2

    SYMBOL_NAME: win32k!Win32HeapFree+13

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 45f013f6

    FAILURE_BUCKET_ID: 0x8E_win32k!Win32HeapFree+13

    BUCKET_ID: 0x8E_win32k!Win32HeapFree+13

    Followup: MachineOwner
     
  4. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Your fourth dump still points to Memory Corruption. How long did you run Memtest for, i.e. number of passes?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...