BSOD + Driver Problem - atikmpag.sys - Windows 7 x64

Skemoso · Jun 1, 2015

driver problem atikmpag.sys

x BlueRobot · Jun 3, 2015

Code:

BugCheck 116, {fffffa800bf4d4e0, fffff880070a6408, 0, 2}

Probably caused by : atikmpag.sys ( atikmpag+7408 )

Code:

0: kd> dps fffffa800bf4d4e0
fffffa80`0bf4d4e0  00000000`52445476
fffffa80`0bf4d4e8  fffffa80`0cb08d28
fffffa80`0bf4d4f0  00000000`00000002
fffffa80`0bf4d4f8  00000000`00000086
fffffa80`0bf4d500  fffffa80`0bac5000
fffffa80`0bf4d508  fffffa80`07b2e620
fffffa80`0bf4d510  00000000`00000002
fffffa80`0bf4d518  00000000`00011754
fffffa80`0bf4d520  00000000`00000000
fffffa80`0bf4d528  00000000`ffffffff
fffffa80`0bf4d530  fffff880`070a6408 atikmpag+0x7408
fffffa80`0bf4d538  00000000`52445476
fffffa80`0bf4d540  00000000`0015d22d
fffffa80`0bf4d548  00000117`00000010
fffffa80`0bf4d550  00040000`00000002
fffffa80`0bf4d558  00002005`00000004

The second parameter of the bugcheck is a pointer into the device driver supposedly caused the crash. If you use the dps command on the first address, which is the TDR_RECOVERY_CONTEXT structure, then we'll notice that the same address listed in the second parameter is present.

If take it one step further, then we can disassemble the pointer, we find the following instruction sequence; notice that the address of the TDR_RECOVERY_CONTEXT is present again?

Code:

0: kd> u fffff880070a6408
atikmpag+0x7408:
fffff880`070a6408 4883ec28        sub     rsp,28h
fffff880`070a640c 4c8bd1          mov     r10,rcx
fffff880`070a640f 41b8010000c0    mov     r8d,0C0000001h
fffff880`070a6415 4885c9          test    rcx,rcx
fffff880`070a6418 7451            je      atikmpag+0x746b (fffff880`070a646b)
fffff880`070a641a 4885d2          test    rdx,rdx
fffff880`070a641d 744c            je      atikmpag+0x746b (fffff880`070a646b)
fffff880`070a641f 488b05bafe0300  mov     rax,qword ptr [atikmpag+0x472e0 (fffff880`070e62e0)]

I would advise you check for any driver updates:

Code:

0: kd> lmvm atikmpag
start             end                 module name
fffff880`0709f000 fffff880`070ee000   atikmpag T (no symbols)           
    Loaded symbol image file: atikmpag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
    Image name: atikmpag.sys
    Timestamp:        Mon Mar 28 16:09:10 2011 (4D90A496)
    CheckSum:         00052D9A
    ImageSize:        0004F000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Search

Search

BSOD + Driver Problem - atikmpag.sys - Windows 7 x64

Skemoso

New member

Attachments

x BlueRobot

Administrator