verifier.exe

[be_tnt]

Does someone know how to use the microsoft tool "verifier.exe" (maybe this is the french name of this tool ... it's helping to check drivers)?

 

[chessJunkie]

after searching 'verifier.exe' at http://support.microsoft.com
I came up with this
http://support.microsoft.com/default.aspx?scid=kb;en-us;244617

it was the first link that came up

 

[be_tnt]

Thanks Chess. But I have already got this info. I do not know if you read it but or me it's not really clear how verifier.exe could help me for drivers troubleshooting any help would be welcome :giddy:

 

[RealBlackStuff]

How about telling us, WHAT your REAL problem is?
These vague ramblings lead nowhere.

 

[be_tnt]

the complete story ....

OKi so let's go .. I hope it will not be toomuch info this time

Since few weeks now, I got sometimes the lovely windows blue screen. I tried to figure out what was the issue but the only thing I was able to find is that this is a driver isssue. I can not find which driver is causing me so many trouble.
Hereunder the kd command output:


Opened log file 'c:\debuglog1.txt'
0: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
0: kd> .reload
Loading Kernel Symbols
.................................................................................................................................
Loading unloaded module list
..........
Loading User Symbols
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00314516, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804e68c7, address which referenced memory

Debugging Details:
------------------

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: mssmbios!SMBIOS_DATA_OBJECT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: mssmbios!SMBIOS_DATA_OBJECT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: mssmbios!SMBIOS_DATA_OBJECT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: mssmbios!SMBIOS_DATA_OBJECT ***
*** ***
*************************************************************************

READ_ADDRESS: 00314516

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEventBoostPriority+30
804e68c7 66395016 cmp [eax+0x16],dx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 806ff98e to 804e68c7

TRAP_FRAME: f51084a4 -- (.trap fffffffff51084a4)
.trap fffffffff51084a4
ErrCode = 00000000
eax=00314500 ebx=00000000 ecx=8677be7c edx=00000000 esi=e1b3d2e8 edi=864e0da8
eip=804e68c7 esp=f5108518 ebp=f5108520 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KeSetEventBoostPriority+0x30:
804e68c7 66395016 cmp [eax+0x16],dx ds:0023:00314516=????
.trap
Resetting default scope

STACK_TEXT:
f5108520 806ff98e 8677be7c 00000000 0000000c nt!KeSetEventBoostPriority+0x30
f5108530 80574b49 00000000 e2fb81a8 00000000 hal!ExReleaseFastMutex+0x1a
f5108554 8056c797 00000000 e2fb81a8 e2fb81c0 nt!ObpReferenceDeviceMap+0xf8
f510856c 804e1957 e2fb81c0 00000000 000004a8 nt!ObpRemoveObjectRoutine+0xe7
f5108584 8056ea9e 863cab28 e1de52c0 864e0da8 nt!ObfDereferenceObject+0x4c
f510859c 8056e9bc e1de52c0 e2fb81c0 000004a8 nt!ObpCloseHandleTableEntry+0x155
f51085e4 8056ea06 000004a8 00000001 00000000 nt!ObpCloseHandle+0x87
f51085f8 804dd99f 000004a8 00d9ecdc 7c91eb94 nt!NtClose+0x1d
f51085f8 7c91eb94 000004a8 00d9ecdc 7c91eb94 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00d9ea24 00000000 00000000 00000000 00000000 0x7c91eb94


FOLLOWUP_IP:
nt!KeSetEventBoostPriority+30
804e68c7 66395016 cmp [eax+0x16],dx

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KeSetEventBoostPriority+30

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77

STACK_COMMAND: .trap fffffffff51084a4 ; kb

FAILURE_BUCKET_ID: 0xA_nt!KeSetEventBoostPriority+30

BUCKET_ID: 0xA_nt!KeSetEventBoostPriority+30

Followup: MachineOwner
---------

 

[be_tnt]

The complete story (2)

0: kd> r
eax=ffdff13c ebx=0000001c ecx=00000000 edx=40000000 esi=804e68c7 edi=00314516
eip=804e0aac esp=f510848c ebp=f51084a4 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x238:
804e0aac f7457000000200 test dword ptr [ebp+0x70],0x20000 ss:0010:f5108514=00010246
0: kd> kv
ChildEBP RetAddr Args to Child
f51084a4 804e68c7 badb0d00 00000000 e2fb81c0 nt!KiTrap0E+0x238 (FPO: [0,0] TrapFrame @ f51084a4)
f5108520 806ff98e 8677be7c 00000000 0000000c nt!KeSetEventBoostPriority+0x30 (FPO: [Non-Fpo])
f5108530 80574b49 00000000 e2fb81a8 00000000 hal!ExReleaseFastMutex+0x1a (FPO: [0,1,0])
f5108554 8056c797 00000000 e2fb81a8 e2fb81c0 nt!ObpReferenceDeviceMap+0xf8 (FPO: [Non-Fpo])
f510856c 804e1957 e2fb81c0 00000000 000004a8 nt!ObpRemoveObjectRoutine+0xe7 (FPO: [Non-Fpo])
f5108584 8056ea9e 863cab28 e1de52c0 864e0da8 nt!ObfDereferenceObject+0x4c (FPO: [0,0,0])
f510859c 8056e9bc e1de52c0 e2fb81c0 000004a8 nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
f51085e4 8056ea06 000004a8 00000001 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
f51085f8 804dd99f 000004a8 00d9ecdc 7c91eb94 nt!NtClose+0x1d (FPO: [Non-Fpo])
f51085f8 7c91eb94 000004a8 00d9ecdc 7c91eb94 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ f5108604)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00d9ea24 00000000 00000000 00000000 00000000 0x7c91eb94

0: kd> ln 314516
0: kd> .logclose
Closing open log file c:\debuglog1.txt

The commands I did were the followings:

kd -z <Minidump file>
kd> .logopen c:\debuglog1.txt
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload
kd> !analyze -v
kd> r
kd> kv
kd> ln <address>
kd> .logclose

 

[cpc2004]

Your windows crashes at IRQL x'1c' which is the clock level interrupt. This is the symptom of hardware problem.

My Statistical for IRQL x'1c'

CPU 4
RAM 1
M/B 1

One case at techspot is still open and awaiting for feedback. Base upon my record, 66.6% is related to faulty CPU.

 

[be_tnt]

Thx cpc2004.

Is there any tools I could use to check CPU/Memory/M&B?
BTW what's M/B?

 

[cpc2004]

No tools are reliable such as memtest.

The latest statistics of IRQL x'1c'
4 CPU
2 RAM
1 M/B

Refer the following case
https://www.techspot.com/vb/showthread.php?p=163666#post163666
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21222403.html
http://www.experts-exchhttps://www.techspot.com/vb/showthread.php?p=144841#post144841 (page 4)ange.com/Operating_Systems/WinNT/Q_21361736.html

 

[Justin]

This belongs in the windows forum

 

[cpc2004]

Thx cpc2004.

Is there any tools I could use to check CPU/Memory/M&B?
BTW what's M/B?

Refer the following case
https://www.techspot.com/vb/showthread.php?p=126919#post126919

Solution : cleaned the fingers and the recepticle connector and reinstalled the memory

 

[be_tnt]

Faulty memory

I have finally executed the latest version of Memtest (v1.60) and I got an error for test 7 (Random number sequence):
Failing address: 00030a620bc - 778.1Mb
Good: fa9d13f5
Bad: fa9d13e5
Err-bits: 00000010

I have 1 Go (2*512Mb) of memory. I will remove one and see if the problem still occurs. If not, I will know that the second one is the faulty one.
I would guess that there is no way to repair memory, right?

 

[cpc2004]

Reseat the memory to another memory slot or downclock the RAM. If it still does not work, replace the RAM.

 

[be_tnt]

euh ... could you please explaine "downclock"? (English is not my mother tongue and I do not know this one)

 

[cpc2004]

Downclock means lower clock frequency of the CPU.

 

[cpc2004]

Do you have any update of the problem?