1. #1

    Join Date
    Mar 2012
    Posts
    469

    Stopped-up IRPs (0x9F)

    This is a simple article for those unfamiliar with 0x9F crashdumps, aka DRIVER_POWER_STATE_FAILURE.

    9F bugchecks are particularly easy diagnose in most cases. Usually they involve a subcode of 3, which is a device object has been holding up an IRP for too long and things aren't moving forward. I could go into details about what an IRP is or a device object but I'll leave that for another scenario (I might explain here via request). If you want to dive into it, check out Chapter 7 of Windows Internals book, entitled, I/O System. It'll give you the beef on IRPs, IRQLs, etc. Anyways, let's take an example case:

    Code:
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_POWER_STATE_FAILURE (9f)
    A driver is causing an inconsistent power state.
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: fffffa800ba6c060, Physical Device Object of the stack
    Arg3: fffff80005cc23d8, Functional Device Object of the stack
    Arg4: fffffa800fa37b40, The blocked IRP
    
    Debugging Details:
    ------------------
    
    
    DRVPOWERSTATE_SUBCODE:  3
    
    IMAGE_NAME:  usbccgp.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4d8c0aea
    
    MODULE_NAME: usbccgp
    
    FAULTING_MODULE: fffff88008200000 usbccgp
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x9F
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  2
    
    STACK_TEXT:  
    fffff800`05cc2388 fffff800`030eacd2 : 00000000`0000009f 00000000`00000003 fffffa80`0ba6c060 fffff800`05cc23d8 : nt!KeBugCheckEx
    fffff800`05cc2390 fffff800`030885fc : fffff800`05cc24d8 fffff800`05cc24d8 00000000`00000000 00000000`00000009 : nt! ?? ::FNODOBFM::`string'+0x34a90
    fffff800`05cc2430 fffff800`03088496 : fffffa80`0b782148 fffffa80`0b782148 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
    fffff800`05cc24a0 fffff800`0308837e : 00000016`cc7d230b fffff800`05cc2b18 00000000`000993e8 fffff800`031f6f88 : nt!KiProcessExpiredTimerList+0xc6
    fffff800`05cc2af0 fffff800`03088167 : 00000004`e1eef2cb 00000004`000993e8 00000004`e1eef22f 00000000`000000e8 : nt!KiTimerExpiration+0x1be
    fffff800`05cc2b90 fffff800`0307496a : fffff800`031f2e80 fffff800`03200cc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    fffff800`05cc2c40 00000000`00000000 : fffff800`05cc3000 fffff800`05cbd000 fffff800`05cc2c00 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_NAME:  MachineOwner
    
    FAILURE_BUCKET_ID:  X64_0x9F_3_cxcir64_IMAGE_usbccgp.sys
    
    BUCKET_ID:  X64_0x9F_3_cxcir64_IMAGE_usbccgp.sys
    
    Followup: MachineOwner
    Ok, so right now the analysis engine blames usbccgp. This is an MS standard driver for USB, so we figure this is rather inaccurate. Instead, let's look at the IRP that it's complaining is being held up. Fortunately it retained the address of it as Arg 4 of the bugcheck, so take that and use the !irp extension to get the nitty gritty on it:

    Code:
    0: kd> !irp fffffa800fa37b40
    Irp is active with 8 stacks 6 is current (= 0xfffffa800fa37d78)
     No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
         cmd  flg cl Device   File     Completion-Context
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
                Args: 00000000 00000000 00000000 00000000
    >[ 16, 2]   0 e0 fffffa800ba6d060 00000000 fffff880082362ec-fffffa800ba6d1b0 Success Error Cancel 
              *** WARNING: Unable to verify timestamp for cxcir64.sys
    *** ERROR: Module load completed but symbols could not be loaded for cxcir64.sys
     \Driver\CXIR    HIDCLASS!HidpFdoPowerCompletion
                Args: 00014400 00000001 00000004 00000002
     [ 16, 2]   0 e1 fffffa800ba6d060 00000000 fffff80003069430-fffffa800f8bf870 Success Error Cancel pending
               \Driver\CXIR    nt!IopUnloadSafeCompletion
                Args: 00014400 00000001 00000004 00000002
     [  0, 0]   0  0 00000000 00000000 00000000-fffffa80079d9ce0    
    
                Args: 00000000 00000000 00000000 00000000
    Viola. So we see a third-party driver being suspect here. The carrot (>) symbol shows what was active at the time of the crash. To add, the symbols error actually helps us determine the exact driver name that is holding things up. In a kernel dump, you could also use !devobj on Arg 2 as well as !devstack on the same argument to get more info on it, but minidumps only have partial information and would not help us much.

    Also, for those perceptive, you'll realize our answer has also been given to us via the bucket ID in the !analyze -v output, despite the engine thinking it's usbccgp:

    Code:
    FAILURE_BUCKET_ID:  X64_0x9F_3_cxcir64_IMAGE_usbccgp.sys
    
    BUCKET_ID:  X64_0x9F_3_cxcir64_IMAGE_usbccgp.sys
    So there you go. Quite a quick one, eh? I'll explain a bit more on what is actually going on here if people are interested. Have fun!



    Bonus:


    for another far more interesting and exciting adventure into IRPs that are being held up for whatever reason, you wanna take a look at this thread that was the result of assistance offered by a Mr. Snrub and our good ole friend Cluberti. This is a very good example of how easy it is to run far off track from the real cause by not interpreting all the data available.

    It starts with a misconception that the drive is bad because there's an I/O error that is occurring during a paging operation. Commonly, it is accurate to say that this is caused by some sort of hardware failure, especially attributing it to a disk or disk controller problem. That's because an operation during a paging operation involves shoving stuff from memory into disk (specifically the paging file). However, Mr. Snrub catches that the subcode for the error is actually a resource exhaustion error. He and Cluberti then work together with the client to discover what resource is exhausted, and finds nonpaged pool being exhausted (note that this is dealing with Windows XP x86, which puts a restrictive hard limit on nonpaged pool, compared to its newer x64 brethren). Then they work through it to find what's filling up nonpaged pool, and ends up discovering that unfinished IRPs, a lot of them, are filling it up. This is where Cluberti comes in and starts diving through the IRPs to conclude that an outdated AV driver wasn't finishing its job, and therefore the IRPs waiting on it keeps piling up till there's no room left. It's definitely worth a read through the whole thing, and is just overall good solid debugging put to use.

    I want to finish by mentioning that this could not be possible through minidumps. You're lucky to even get a single IRP out a minidump let alone other information like memory allocations and whatnot. It is imperative that if you look through a minidump and find hints of something that needs further investigating, don't hesitate to ask for a kernel dump!

    Btw, for those who haven't already read Mark Russinovich's blog article on nonpaged pool and are too lazy to check my link on BSOD Method & Tips, it's available here.
    Last edited by Vir Gnarus; 06-14-2012 at 10:14 AM.
    zigzag3143, Shintaro, JMH and 5 others say thanks for this.


    • Ad Bot

      advertising
      Beep.

        
       

  2. #2
    AceInfinity's Avatar
    Join Date
    Feb 2012
    Location
    Canada
    Posts
    1,711

    Re: Stopped-up IRPs (0x9F)

    This was a useful example, so i'm just showing my respects towards you posting this :) Nice work.

    ~Ace
    \n\n

    Automation Programmer
    Development Site: aceinfinity.net

  3. #3

    Join Date
    Mar 2012
    Posts
    469

    Re: Stopped-up IRPs (0x9F)

    Thank you very much. I want to forewarn though that not all cases are as easy as this. There's obviously going to be some which a 3rd-party driver does not show up (or that it's not exactly the one causing the crashes) in the IRP stacks, in which case you most likely would need to start deep diving (which will most likely require a kernel dump at least). In the original thread that discussed on this article JC and others have noticed that the WER reports were actually more perceptive in figuring out a culprit driver than the analyze engine in Windbg. A prime example is from usasma, which reported:

    Quote Originally Posted by usasma View Post
    Got another one - blames ndisrd.sysin MSINFO32

    2/19/12 5:56 AM Windows Error Reporting Fault bucket X64_0x9F_3_DEINITIALIZE_IMAGE_ndisrd.sys, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 
P2: 
P3: 
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Minidump\021812-23384-01.dmp
C:\Users\Amit Palshikar\AppData\Local\Temp\WER-70418-0.sysdata.xml
C:\Users\Amit Palshikar\AppData\Local\Temp\WER36B8.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_0405032b

Analysis symbol: X64_0x9F_3_DEINITIALIZE_IMAGE_ndisrd.sys
Rechecking for solution: 0
Report Id: 021812-23384-01
Report Status: 0
    Blames the wireless drivers in the STOP 0x9F minidumps.

    Topic here: Sleep and hibernate stopped working on Windows 7 Pro 64-bit. How to - Microsoft Answers

    Here's the last of the 41 memory dumps (all STOP 0x9F with one lone STOP 0x1E blaming the kernel):
    Code:
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\021912-28064-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
    DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff800`00b9c500?
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
    Machine Name:
    Kernel base = 0xfffff800`03258000 PsLoadedModuleList = 0xfffff800`0349d670
    Debug session time: Sat Feb 18 08:17:39.005 2012 (UTC - 5:00)
    System Uptime: 0 days 0:21:42.238
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .......................................................
    Loading User Symbols
    Loading unloaded module list
    ..............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 9F, {3, fffffa8004903a10, fffff80000b9c518, fffffa8007618150}
    
    Probably caused by : pci.sys
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v;r;kv;lmtn;lmtsmn;.bugcheck;!sysinfo cpuinfo;!sysinfo machineid; !sysinfo cpuspeed; !sysinfo smbios; .logclose;q
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_POWER_STATE_FAILURE (9f)
    A driver is causing an inconsistent power state.
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: fffffa8004903a10, Physical Device Object of the stack
    Arg3: fffff80000b9c518, Functional Device Object of the stack
    Arg4: fffffa8007618150, The blocked IRP
    
    Debugging Details:
    ------------------
    
    
    DRVPOWERSTATE_SUBCODE:  3
    
    IMAGE_NAME:  pci.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7928f
    
    MODULE_NAME: pci
    
    FAULTING_MODULE: fffff88000d6d000 pci
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    BUGCHECK_STR:  0x9F
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  2
    
    STACK_TEXT:  
    fffff800`00b9c4c8 fffff800`03342cd2 : 00000000`0000009f 00000000`00000003 fffffa80`04903a10 fffff800`00b9c518 : nt!KeBugCheckEx
    fffff800`00b9c4d0 fffff800`032e05fc : fffff800`00b9c600 fffff800`00b9c600 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x34a90
    fffff800`00b9c570 fffff800`032e0496 : fffffa80`07264768 fffffa80`07264768 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
    fffff800`00b9c5e0 fffff800`032e037e : 00000003`0831d71d fffff800`00b9cc58 00000000`00014614 fffff800`0344d508 : nt!KiProcessExpiredTimerList+0xc6
    fffff800`00b9cc30 fffff800`032e0167 : 00000000`b586d9c7 00000000`00014614 00000000`b586d9d5 00000000`00000014 : nt!KiTimerExpiration+0x1be
    fffff800`00b9ccd0 fffff800`032cc96a : fffff800`0344ae80 fffff800`03458cc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_NAME:  MachineOwner
    
    FAILURE_BUCKET_ID:  X64_0x9F_3_NETwNs64_IMAGE_pci.sys
    
    BUCKET_ID:  X64_0x9F_3_NETwNs64_IMAGE_pci.sys
    
    Followup: MachineOwner
    ---------
    
    rax=fffff800034752b8 rbx=fffffa8007618150 rcx=000000000000009f
    rdx=0000000000000003 rsi=fffffa80040ab6b0 rdi=fffffa80040ab6b0
    rip=fffff800032d4c40 rsp=fffff80000b9c4c8 rbp=0000000000000002
     r8=fffffa8004903a10  r9=fffff80000b9c518 r10=0000000000000000
    r11=0000000000008000 r12=fffffa800416acf0 r13=0000000000000000
    r14=0000000000000001 r15=fffff8000347faf0
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
    nt!KeBugCheckEx:
    fffff800`032d4c40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff800`00b9c4d0=000000000000009f
    Child-SP          RetAddr           : Args to Child                                                           : Call Site
    fffff800`00b9c4c8 fffff800`03342cd2 : 00000000`0000009f 00000000`00000003 fffffa80`04903a10 fffff800`00b9c518 : nt!KeBugCheckEx
    fffff800`00b9c4d0 fffff800`032e05fc : fffff800`00b9c600 fffff800`00b9c600 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x34a90
    fffff800`00b9c570 fffff800`032e0496 : fffffa80`07264768 fffffa80`07264768 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
    fffff800`00b9c5e0 fffff800`032e037e : 00000003`0831d71d fffff800`00b9cc58 00000000`00014614 fffff800`0344d508 : nt!KiProcessExpiredTimerList+0xc6
    fffff800`00b9cc30 fffff800`032e0167 : 00000000`b586d9c7 00000000`00014614 00000000`b586d9d5 00000000`00000014 : nt!KiTimerExpiration+0x1be
    fffff800`00b9ccd0 fffff800`032cc96a : fffff800`0344ae80 fffff800`03458cc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a
    start             end                 module name
    fffff800`00bca000 fffff800`00bd4000   kdcom    kdcom.dll    Sat Feb 05 11:52:49 2011 (4D4D8061)
    fffff800`0320f000 fffff800`03258000   hal      hal.dll      Sat Nov 20 08:00:25 2010 (4CE7C669)
    fffff800`03258000 fffff800`03841000   nt       ntkrnlmp.exe Wed Jun 22 22:53:23 2011 (4E02AAA3)
    fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Sat Nov 20 04:20:43 2010 (4CE792EB)
    fffff880`00c5c000 fffff880`00c76000   mountmgr mountmgr.sys Sat Nov 20 04:19:21 2010 (4CE79299)
    fffff880`00c76000 fffff880`00ca5000   ndiswan  ndiswan.sys  Sat Nov 20 05:52:32 2010 (4CE7A870)
    fffff880`00cac000 fffff880`00cfb000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Nov 20 08:03:51 2010 (4CE7C737)
    fffff880`00cfb000 fffff880`00d0f000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
    fffff880`00d0f000 fffff880`00d6d000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`00d6d000 fffff880`00da0000   pci      pci.sys      Sat Nov 20 04:19:11 2010 (4CE7928F)
    fffff880`00da0000 fffff880`00db5000   partmgr  partmgr.sys  Sat Nov 20 04:20:00 2010 (4CE792C0)
    fffff880`00db5000 fffff880`00dc1000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
    fffff880`00dc1000 fffff880`00dd6000   volmgr   volmgr.sys   Sat Nov 20 04:19:28 2010 (4CE792A0)
    fffff880`00dd6000 fffff880`00de4000   psadd    psadd.sys    Wed Jul 01 22:17:26 2009 (4A4C18B6)
    fffff880`00de4000 fffff880`00df2000   Tvti2c   Tvti2c.sys   Thu Sep 24 07:56:38 2009 (4ABB5E76)
    fffff880`00e00000 fffff880`00ea4000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
    fffff880`00ea4000 fffff880`00eb3000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
    fffff880`00eb3000 fffff880`00ec0000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
    fffff880`00ec0000 fffff880`00ec9000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
    fffff880`00ecf000 fffff880`00f8f000   CI       CI.dll       Sat Nov 20 08:12:36 2010 (4CE7C944)
    fffff880`00f8f000 fffff880`00fe6000   ACPI     ACPI.sys     Sat Nov 20 04:19:16 2010 (4CE79294)
    fffff880`00fe6000 fffff880`00fef000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
    fffff880`00fef000 fffff880`00ff9000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
    fffff880`01000000 fffff880`01056000   USBPORT  USBPORT.SYS  Thu Mar 24 23:29:12 2011 (4D8C0C08)
    fffff880`01056000 fffff880`010a6000   AMPPAL   AMPPAL.sys   Mon Aug 08 10:32:06 2011 (4E3FF366)
    fffff880`010a6000 fffff880`010c7000   raspptp  raspptp.sys  Sat Nov 20 05:52:31 2010 (4CE7A86F)
    fffff880`010c9000 fffff880`01105000   vmbus    vmbus.sys    Sat Nov 20 04:57:29 2010 (4CE79B89)
    fffff880`01105000 fffff880`01119000   winhv    winhv.sys    Sat Nov 20 04:20:02 2010 (4CE792C2)
    fffff880`01119000 fffff880`0119c000   csc      csc.sys      Sat Nov 20 04:27:12 2010 (4CE79470)
    fffff880`0119c000 fffff880`011c2000   tunnel   tunnel.sys   Sat Nov 20 05:51:50 2010 (4CE7A846)
    fffff880`011c2000 fffff880`011e6000   rasl2tp  rasl2tp.sys  Sat Nov 20 05:52:34 2010 (4CE7A872)
    fffff880`011e6000 fffff880`01200000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
    fffff880`01200000 fffff880`0120f000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
    fffff880`0120f000 fffff880`0122d000   dfsc     dfsc.sys     Sat Nov 20 04:26:31 2010 (4CE79447)
    fffff880`0122d000 fffff880`0123e000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
    fffff880`0123e000 fffff880`01254000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
    fffff880`0125e000 fffff880`01466000   iaStor   iaStor.sys   Fri Jan 15 15:21:57 2010 (4B50CE65)
    fffff880`01466000 fffff880`01471000   amdxata  amdxata.sys  Fri Mar 19 12:18:18 2010 (4BA3A3CA)
    fffff880`01471000 fffff880`014bd000   fltmgr   fltmgr.sys   Sat Nov 20 04:19:24 2010 (4CE7929C)
    fffff880`014bd000 fffff880`014d1000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
    fffff880`014d1000 fffff880`0152f000   msrpc    msrpc.sys    Sat Nov 20 04:21:56 2010 (4CE79334)
    fffff880`0152f000 fffff880`015a1000   cng      cng.sys      Wed Nov 16 23:23:17 2011 (4EC48C35)
    fffff880`015a1000 fffff880`015f2000   rdbss    rdbss.sys    Sat Nov 20 04:27:51 2010 (4CE79497)
    fffff880`015f2000 fffff880`015fd000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
    fffff880`01600000 fffff880`0160a000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
    fffff880`0160a000 fffff880`01616000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
    fffff880`0161d000 fffff880`017c0000   Ntfs     Ntfs.sys     Thu Mar 10 22:39:39 2011 (4D79997B)
    fffff880`017c0000 fffff880`017db000   ksecdd   ksecdd.sys   Wed Nov 16 22:48:13 2011 (4EC483FD)
    fffff880`017db000 fffff880`017ec000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
    fffff880`017ec000 fffff880`017f7000   DzHDD64  DzHDD64.sys  Thu Oct 14 20:32:33 2010 (4CB7A121)
    fffff880`01800000 fffff880`0181d000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
    fffff880`0181d000 fffff880`01831000   termdd   termdd.sys   Sat Nov 20 06:03:40 2010 (4CE7AB0C)
    fffff880`01832000 fffff880`01925000   ndis     ndis.sys     Wed Dec 29 01:16:18 2010 (4D1AD232)
    fffff880`01925000 fffff880`01985000   NETIO    NETIO.SYS    Sat Nov 20 04:23:13 2010 (4CE79381)
    fffff880`01985000 fffff880`019b0000   ksecpkg  ksecpkg.sys  Wed Nov 16 23:23:44 2011 (4EC48C50)
    fffff880`019b0000 fffff880`019f5000   netbt    netbt.sys    Sat Nov 20 04:23:18 2010 (4CE79386)
    fffff880`019f5000 fffff880`01a00000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
    fffff880`01a00000 fffff880`01a12000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
    fffff880`01a12000 fffff880`01a1b000   hwpolicy hwpolicy.sys Sat Nov 20 04:18:54 2010 (4CE7927E)
    fffff880`01a1b000 fffff880`01a55000   fvevol   fvevol.sys   Sat Nov 20 04:24:06 2010 (4CE793B6)
    fffff880`01a55000 fffff880`01a6b000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`01a6b000 fffff880`01a9b000   CLASSPNP CLASSPNP.SYS Sat Nov 20 04:19:23 2010 (4CE7929B)
    fffff880`01aa9000 fffff880`01abf000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
    fffff880`01abf000 fffff880`01ada000   wanarp   wanarp.sys   Sat Nov 20 05:52:36 2010 (4CE7A874)
    fffff880`01ada000 fffff880`01cde000   tcpip    tcpip.sys    Wed Sep 28 23:43:04 2011 (4E83E948)
    fffff880`01cde000 fffff880`01d28000   fwpkclnt fwpkclnt.sys Sat Nov 20 04:21:37 2010 (4CE79321)
    fffff880`01d28000 fffff880`01d38000   vmstorfl vmstorfl.sys Sat Nov 20 04:57:30 2010 (4CE79B8A)
    fffff880`01d38000 fffff880`01d84000   volsnap  volsnap.sys  Sat Nov 20 04:20:08 2010 (4CE792C8)
    fffff880`01d84000 fffff880`01d8e000   ApsHM64  ApsHM64.sys  Tue Mar 29 05:55:16 2011 (4D91AC84)
    fffff880`01d8e000 fffff880`01d96000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
    fffff880`01d96000 fffff880`01dd0000   rdyboost rdyboost.sys Sat Nov 20 04:43:10 2010 (4CE7982E)
    fffff880`01dd0000 fffff880`01df6000   Apsx64   Apsx64.sys   Tue Mar 29 05:58:36 2011 (4D91AD4C)
    fffff880`01df6000 fffff880`01dfd000   smiifx64 smiifx64.sys Tue Sep 07 00:38:27 2010 (4C85C1C3)
    fffff880`02400000 fffff880`0247b000   btwavdt  btwavdt.sys  Tue Jan 12 16:43:04 2010 (4B4CECE8)
    fffff880`02492000 fffff880`0251e000   bthport  bthport.sys  Wed Apr 27 23:55:07 2011 (4DB8E51B)
    fffff880`0251e000 fffff880`0253b000   usbccgp  usbccgp.sys  Thu Mar 24 23:29:14 2011 (4D8C0C0A)
    fffff880`0253b000 fffff880`02563c80   5U877    5U877.sys    Mon May 23 02:33:31 2011 (4DD9FFBB)
    fffff880`02564000 fffff880`02574d00   STREAM   STREAM.SYS   Mon Jul 13 20:06:18 2009 (4A5BCBFA)
    fffff880`02575000 fffff880`02583000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
    fffff880`02583000 fffff880`025af000   rfcomm   rfcomm.sys   Mon Jul 13 20:06:56 2009 (4A5BCC20)
    fffff880`025af000 fffff880`025bf000   BthEnum  BthEnum.sys  Mon Jul 13 20:06:52 2009 (4A5BCC1C)
    fffff880`025bf000 fffff880`025df000   bthpan   bthpan.sys   Mon Jul 13 20:07:00 2009 (4A5BCC24)
    fffff880`02600000 fffff880`02653000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
    fffff880`02653000 fffff880`02666000   ndisuio  ndisuio.sys  Sat Nov 20 05:50:08 2010 (4CE7A7E0)
    fffff880`02666000 fffff880`0267e000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
    fffff880`0267e000 fffff880`02685000   TurboB   TurboB.sys   Tue Sep 29 20:25:28 2009 (4AC2A578)
    fffff880`026b1000 fffff880`02737000   btwaudio btwaudio.sys Tue Jan 12 16:44:18 2010 (4B4CED32)
    fffff880`02737000 fffff880`02743000   btwl2cap btwl2cap.sys Fri Apr 03 20:28:45 2009 (49D6A9BD)
    fffff880`02743000 fffff880`02746900   btwrchid btwrchid.sys Tue Jan 12 16:44:35 2010 (4B4CED43)
    fffff880`02747000 fffff880`02760000   HIDCLASS HIDCLASS.SYS Sat Nov 20 05:43:49 2010 (4CE7A665)
    fffff880`02760000 fffff880`02768080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
    fffff880`02769000 fffff880`0278c000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
    fffff880`0278c000 fffff880`027ad000   WudfPf   WudfPf.sys   Sat Nov 20 05:42:44 2010 (4CE7A624)
    fffff880`027ad000 fffff880`027c2000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
    fffff880`04200000 fffff880`04209000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
    fffff880`04209000 fffff880`0422f000   pacer    pacer.sys    Sat Nov 20 05:52:18 2010 (4CE7A862)
    fffff880`0422f000 fffff880`0423e000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
    fffff880`0423e000 fffff880`04446000   dump_iaStor dump_iaStor.sys Fri Jan 15 15:21:57 2010 (4B50CE65)
    fffff880`04486000 fffff880`044b7000   MpFilter MpFilter.sys Wed Apr 06 16:07:29 2011 (4D9CC801)
    fffff880`044b7000 fffff880`044c0000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
    fffff880`044c0000 fffff880`044c7000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
    fffff880`044c7000 fffff880`044d5000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
    fffff880`044d5000 fffff880`044fa000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
    fffff880`044fa000 fffff880`0450a000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
    fffff880`0450a000 fffff880`04513000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
    fffff880`04513000 fffff880`0451c000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
    fffff880`0451c000 fffff880`04525000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
    fffff880`04525000 fffff880`04530000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`04530000 fffff880`04541000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
    fffff880`04541000 fffff880`04563000   tdx      tdx.sys      Sat Nov 20 04:21:54 2010 (4CE79332)
    fffff880`04563000 fffff880`04570000   TDI      TDI.SYS      Sat Nov 20 04:22:06 2010 (4CE7933E)
    fffff880`04570000 fffff880`045f9000   afd      afd.sys      Tue Dec 27 22:59:20 2011 (4EFA9418)
    fffff880`045f9000 fffff880`04600000   Tppwr64v Tppwr64v.sys Thu Nov 18 22:36:29 2010 (4CE5F0BD)
    fffff880`04600000 fffff880`0460c000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
    fffff880`0460f000 fffff880`04703000   dxgkrnl  dxgkrnl.sys  Sat Nov 20 04:50:50 2010 (4CE799FA)
    fffff880`04703000 fffff880`04749000   dxgmms1  dxgmms1.sys  Sat Nov 20 04:49:53 2010 (4CE799C1)
    fffff880`04749000 fffff880`0475a000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
    fffff880`0475a000 fffff880`04766000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
    fffff880`04766000 fffff880`047b0000   e1k62x64 e1k62x64.sys Thu Jul 22 13:39:07 2010 (4C48823B)
    fffff880`047b0000 fffff880`047c1000   usbehci  usbehci.sys  Thu Mar 24 23:29:04 2011 (4D8C0C00)
    fffff880`047c1000 fffff880`047e5000   HDAudBus HDAudBus.sys Sat Nov 20 05:43:42 2010 (4CE7A65E)
    fffff880`047e5000 fffff880`047fb000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
    fffff880`04c00000 fffff880`04c0b000   ndisrd   ndisrd.sys   Fri Aug 28 10:48:38 2009 (4A97EE46)
    fffff880`04c0e000 fffff880`057b7c20   igdkmd64 igdkmd64.sys Sat May 21 14:21:49 2011 (4DD802BD)
    fffff880`057b8000 fffff880`057ded00   Impcd    Impcd.sys    Fri Feb 26 18:32:11 2010 (4B8859FB)
    fffff880`057df000 fffff880`057fa000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
    fffff880`05800000 fffff880`0582d000   mrxsmb   mrxsmb.sys   Tue Apr 26 22:40:38 2011 (4DB78226)
    fffff880`0582d000 fffff880`0587b000   mrxsmb10 mrxsmb10.sys Fri Jul 08 22:46:28 2011 (4E17C104)
    fffff880`0587b000 fffff880`0589f000   mrxsmb20 mrxsmb20.sys Tue Apr 26 22:39:37 2011 (4DB781E9)
    fffff880`0589f000 fffff880`058a3280   mdmxsdk  mdmxsdk.sys  Mon Jun 19 17:27:26 2006 (449716BE)
    fffff880`058c5000 fffff880`0598e000   HTTP     HTTP.sys     Sat Nov 20 04:24:30 2010 (4CE793CE)
    fffff880`0598e000 fffff880`059ac000   bowser   bowser.sys   Tue Feb 22 23:55:04 2011 (4D649328)
    fffff880`059ac000 fffff880`059c4000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
    fffff880`059c4000 fffff880`059ec000   mrxdav   mrxdav.sys   Sat Nov 20 04:26:42 2010 (4CE79452)
    fffff880`05a00000 fffff880`05a66000   SynTP    SynTP.sys    Fri Sep 30 20:13:52 2011 (4E865B40)
    fffff880`05a66000 fffff880`05a67f00   USBD     USBD.SYS     Thu Mar 24 23:28:59 2011 (4D8C0BFB)
    fffff880`05a68000 fffff880`05a77000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
    fffff880`05a77000 fffff880`05a86000   tpm      tpm.sys      Mon Jul 13 19:21:48 2009 (4A5BC18C)
    fffff880`05a88000 fffff880`0630e000   NETwNs64 NETwNs64.sys Wed Aug 03 20:28:26 2011 (4E39E7AA)
    fffff880`0630e000 fffff880`0631b000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
    fffff880`0631b000 fffff880`0633b000   sdbus    sdbus.sys    Sat Nov 20 04:37:42 2010 (4CE796E6)
    fffff880`0633b000 fffff880`06354000   rimspe64 rimspe64.sys Mon Oct 26 01:52:27 2009 (4AE5391B)
    fffff880`06354000 fffff880`06392000   1394ohci 1394ohci.sys Sat Nov 20 05:44:56 2010 (4CE7A6A8)
    fffff880`06392000 fffff880`063b0000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`063b0000 fffff880`063bf000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
    fffff880`063bf000 fffff880`063c3500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
    fffff880`063c4000 fffff880`063d1000   ibmpmdrv ibmpmdrv.sys Wed Jul 27 04:02:55 2011 (4E2FC62F)
    fffff880`063d1000 fffff880`063de000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
    fffff880`063de000 fffff880`063e7000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
    fffff880`063e7000 fffff880`063f7000   CompositeBus CompositeBus.sys Sat Nov 20 05:33:17 2010 (4CE7A3ED)
    fffff880`063f7000 fffff880`063f8480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
    fffff880`06800000 fffff880`068aa000   CHDRT64  CHDRT64.sys  Thu Aug 26 04:45:24 2010 (4C7629A4)
    fffff880`068c5000 fffff880`06908000   ks       ks.sys       Sat Nov 20 05:33:23 2010 (4CE7A3F3)
    fffff880`06908000 fffff880`06952000   sxuptp   sxuptp.sys   Fri May 08 00:13:37 2009 (4A03B171)
    fffff880`06952000 fffff880`06964000   umbus    umbus.sys    Sat Nov 20 05:44:37 2010 (4CE7A695)
    fffff880`06964000 fffff880`0697f000   ew_jubusenum ew_jubusenum.sys Sun Jan 30 05:19:33 2011 (4D453B35)
    fffff880`0697f000 fffff880`069d9000   usbhub   usbhub.sys   Thu Mar 24 23:29:25 2011 (4D8C0C15)
    fffff880`069d9000 fffff880`069ee000   NDProxy  NDProxy.SYS  Sat Nov 20 05:52:20 2010 (4CE7A864)
    fffff880`07e00000 fffff880`07e18000   BTHUSB   BTHUSB.sys   Wed Apr 27 23:54:56 2011 (4DB8E510)
    fffff880`07e5c000 fffff880`07e99000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
    fffff880`07e99000 fffff880`07ebb000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
    fffff880`07ebb000 fffff880`07ec0200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
    fffff880`07ec1000 fffff880`07f13000   CAXHWAZL CAXHWAZL.sys Tue Jun 30 16:01:14 2009 (4A4A6F0A)
    fffff880`07f13000 fffff880`07fde000   CAX_CNXT CAX_CNXT.sys Tue Jun 30 15:59:52 2009 (4A4A6EB8)
    fffff880`07fde000 fffff880`07fea000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
    fffff880`08000000 fffff880`08053000   IntcDAud IntcDAud.sys Fri Oct 15 04:28:17 2010 (4CB810A1)
    fffff880`08058000 fffff880`081cc000   CAX_DPV  CAX_DPV.sys  Tue Jun 30 16:05:11 2009 (4A4A6FF7)
    fffff880`081cc000 fffff880`081db000   modem    modem.sys    Mon Jul 13 20:10:48 2009 (4A5BCD08)
    fffff880`081db000 fffff880`081e9000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
    fffff880`081e9000 fffff880`081fc000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
    fffff880`09644000 fffff880`096ea000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
    fffff880`096ee000 fffff880`096f9000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
    fffff880`096f9000 fffff880`0972a000   srvnet   srvnet.sys   Thu Apr 28 23:05:35 2011 (4DBA2AFF)
    fffff880`0972a000 fffff880`0973c000   tcpipreg tcpipreg.sys Sat Nov 20 05:51:48 2010 (4CE7A844)
    fffff880`0973c000 fffff880`09744000   XAudio64 XAudio64.sys Wed Apr 29 14:21:07 2009 (49F89A93)
    fffff880`09744000 fffff880`097ad000   srv2     srv2.sys     Thu Apr 28 23:05:46 2011 (4DBA2B0A)
    fffff880`09c25000 fffff880`09cbd000   srv      srv.sys      Thu Apr 28 23:06:06 2011 (4DBA2B1E)
    fffff880`09cbd000 fffff880`09cd5000   NisDrvWFP NisDrvWFP.sys Wed Apr 06 16:08:53 2011 (4D9CC855)
    fffff880`09d46000 fffff880`09d7c000   fastfat  fastfat.SYS  Mon Jul 13 19:23:28 2009 (4A5BC1F0)
    fffff960`00040000 fffff960`00355000   win32k   win32k.sys   unavailable (00000000)
    fffff960`00400000 fffff960`0040a000   TSDDD    TSDDD.dll    unavailable (00000000)
    fffff960`00770000 fffff960`00797000   cdd      cdd.dll      unavailable (00000000)
    fffff960`00880000 fffff960`008e1000   ATMFD    ATMFD.DLL    unavailable (00000000)
    
    Unloaded modules:
    fffff880`09dad000 fffff880`09dc8000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`09dde000 fffff880`09df9000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`09d7c000 fffff880`09dad000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`09cd5000 fffff880`09d46000   spsys.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00071000
    fffff880`09dad000 fffff880`09dde000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`09d92000 fffff880`09dad000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`09d61000 fffff880`09d92000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`09d46000 fffff880`09d61000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`0445c000 fffff880`04486000   cdrom.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0002A000
    fffff880`096ec000 fffff880`096ee000   MSPCLOCK.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00002000
    fffff880`096ea000 fffff880`096ec000   MSPQM.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00002000
    fffff880`01a9b000 fffff880`01aa9000   crashdmp.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000E000
    fffff880`04241000 fffff880`04449000   dump_iaStor.
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00208000
    fffff880`04449000 fffff880`0445c000   dump_dumpfve
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00013000
    start             end                 module name
    fffff880`06354000 fffff880`06392000   1394ohci 1394ohci.sys Sat Nov 20 05:44:56 2010 (4CE7A6A8)
    fffff880`0253b000 fffff880`02563c80   5U877    5U877.sys    Mon May 23 02:33:31 2011 (4DD9FFBB)
    fffff880`00f8f000 fffff880`00fe6000   ACPI     ACPI.sys     Sat Nov 20 04:19:16 2010 (4CE79294)
    fffff880`04570000 fffff880`045f9000   afd      afd.sys      Tue Dec 27 22:59:20 2011 (4EFA9418)
    fffff880`047e5000 fffff880`047fb000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
    fffff880`01466000 fffff880`01471000   amdxata  amdxata.sys  Fri Mar 19 12:18:18 2010 (4BA3A3CA)
    fffff880`01056000 fffff880`010a6000   AMPPAL   AMPPAL.sys   Mon Aug 08 10:32:06 2011 (4E3FF366)
    fffff880`01d84000 fffff880`01d8e000   ApsHM64  ApsHM64.sys  Tue Mar 29 05:55:16 2011 (4D91AC84)
    fffff880`01dd0000 fffff880`01df6000   Apsx64   Apsx64.sys   Tue Mar 29 05:58:36 2011 (4D91AD4C)
    fffff960`00880000 fffff960`008e1000   ATMFD    ATMFD.DLL    unavailable (00000000)
    fffff880`00db5000 fffff880`00dc1000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
    fffff880`044c0000 fffff880`044c7000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
    fffff880`0122d000 fffff880`0123e000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
    fffff880`0598e000 fffff880`059ac000   bowser   bowser.sys   Tue Feb 22 23:55:04 2011 (4D649328)
    fffff880`025af000 fffff880`025bf000   BthEnum  BthEnum.sys  Mon Jul 13 20:06:52 2009 (4A5BCC1C)
    fffff880`025bf000 fffff880`025df000   bthpan   bthpan.sys   Mon Jul 13 20:07:00 2009 (4A5BCC24)
    fffff880`02492000 fffff880`0251e000   bthport  bthport.sys  Wed Apr 27 23:55:07 2011 (4DB8E51B)
    fffff880`07e00000 fffff880`07e18000   BTHUSB   BTHUSB.sys   Wed Apr 27 23:54:56 2011 (4DB8E510)
    fffff880`026b1000 fffff880`02737000   btwaudio btwaudio.sys Tue Jan 12 16:44:18 2010 (4B4CED32)
    fffff880`02400000 fffff880`0247b000   btwavdt  btwavdt.sys  Tue Jan 12 16:43:04 2010 (4B4CECE8)
    fffff880`02737000 fffff880`02743000   btwl2cap btwl2cap.sys Fri Apr 03 20:28:45 2009 (49D6A9BD)
    fffff880`02743000 fffff880`02746900   btwrchid btwrchid.sys Tue Jan 12 16:44:35 2010 (4B4CED43)
    fffff880`07f13000 fffff880`07fde000   CAX_CNXT CAX_CNXT.sys Tue Jun 30 15:59:52 2009 (4A4A6EB8)
    fffff880`08058000 fffff880`081cc000   CAX_DPV  CAX_DPV.sys  Tue Jun 30 16:05:11 2009 (4A4A6FF7)
    fffff880`07ec1000 fffff880`07f13000   CAXHWAZL CAXHWAZL.sys Tue Jun 30 16:01:14 2009 (4A4A6F0A)
    fffff960`00770000 fffff960`00797000   cdd      cdd.dll      unavailable (00000000)
    fffff880`06800000 fffff880`068aa000   CHDRT64  CHDRT64.sys  Thu Aug 26 04:45:24 2010 (4C7629A4)
    fffff880`00ecf000 fffff880`00f8f000   CI       CI.dll       Sat Nov 20 08:12:36 2010 (4CE7C944)
    fffff880`01a6b000 fffff880`01a9b000   CLASSPNP CLASSPNP.SYS Sat Nov 20 04:19:23 2010 (4CE7929B)
    fffff880`00d0f000 fffff880`00d6d000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`063bf000 fffff880`063c3500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
    fffff880`0152f000 fffff880`015a1000   cng      cng.sys      Wed Nov 16 23:23:17 2011 (4EC48C35)
    fffff880`00ec0000 fffff880`00ec9000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
    fffff880`063e7000 fffff880`063f7000   CompositeBus CompositeBus.sys Sat Nov 20 05:33:17 2010 (4CE7A3ED)
    fffff880`081db000 fffff880`081e9000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
    fffff880`01119000 fffff880`0119c000   csc      csc.sys      Sat Nov 20 04:27:12 2010 (4CE79470)
    fffff880`0120f000 fffff880`0122d000   dfsc     dfsc.sys     Sat Nov 20 04:26:31 2010 (4CE79447)
    fffff880`01200000 fffff880`0120f000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
    fffff880`01a55000 fffff880`01a6b000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`07e99000 fffff880`07ebb000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
    fffff880`081e9000 fffff880`081fc000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
    fffff880`0423e000 fffff880`04446000   dump_iaStor dump_iaStor.sys Fri Jan 15 15:21:57 2010 (4B50CE65)
    fffff880`07fde000 fffff880`07fea000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
    fffff880`0460f000 fffff880`04703000   dxgkrnl  dxgkrnl.sys  Sat Nov 20 04:50:50 2010 (4CE799FA)
    fffff880`04703000 fffff880`04749000   dxgmms1  dxgmms1.sys  Sat Nov 20 04:49:53 2010 (4CE799C1)
    fffff880`017ec000 fffff880`017f7000   DzHDD64  DzHDD64.sys  Thu Oct 14 20:32:33 2010 (4CB7A121)
    fffff880`04766000 fffff880`047b0000   e1k62x64 e1k62x64.sys Thu Jul 22 13:39:07 2010 (4C48823B)
    fffff880`06964000 fffff880`0697f000   ew_jubusenum ew_jubusenum.sys Sun Jan 30 05:19:33 2011 (4D453B35)
    fffff880`09d46000 fffff880`09d7c000   fastfat  fastfat.SYS  Mon Jul 13 19:23:28 2009 (4A5BC1F0)
    fffff880`014bd000 fffff880`014d1000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
    fffff880`01471000 fffff880`014bd000   fltmgr   fltmgr.sys   Sat Nov 20 04:19:24 2010 (4CE7929C)
    fffff880`01600000 fffff880`0160a000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
    fffff880`01a1b000 fffff880`01a55000   fvevol   fvevol.sys   Sat Nov 20 04:24:06 2010 (4CE793B6)
    fffff880`01cde000 fffff880`01d28000   fwpkclnt fwpkclnt.sys Sat Nov 20 04:21:37 2010 (4CE79321)
    fffff880`063d1000 fffff880`063de000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
    fffff800`0320f000 fffff800`03258000   hal      hal.dll      Sat Nov 20 08:00:25 2010 (4CE7C669)
    fffff880`047c1000 fffff880`047e5000   HDAudBus HDAudBus.sys Sat Nov 20 05:43:42 2010 (4CE7A65E)
    fffff880`04749000 fffff880`0475a000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
    fffff880`02747000 fffff880`02760000   HIDCLASS HIDCLASS.SYS Sat Nov 20 05:43:49 2010 (4CE7A665)
    fffff880`02760000 fffff880`02768080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
    fffff880`058c5000 fffff880`0598e000   HTTP     HTTP.sys     Sat Nov 20 04:24:30 2010 (4CE793CE)
    fffff880`01a12000 fffff880`01a1b000   hwpolicy hwpolicy.sys Sat Nov 20 04:18:54 2010 (4CE7927E)
    fffff880`06392000 fffff880`063b0000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
    fffff880`0125e000 fffff880`01466000   iaStor   iaStor.sys   Fri Jan 15 15:21:57 2010 (4B50CE65)
    fffff880`063c4000 fffff880`063d1000   ibmpmdrv ibmpmdrv.sys Wed Jul 27 04:02:55 2011 (4E2FC62F)
    fffff880`04c0e000 fffff880`057b7c20   igdkmd64 igdkmd64.sys Sat May 21 14:21:49 2011 (4DD802BD)
    fffff880`057b8000 fffff880`057ded00   Impcd    Impcd.sys    Fri Feb 26 18:32:11 2010 (4B8859FB)
    fffff880`08000000 fffff880`08053000   IntcDAud IntcDAud.sys Fri Oct 15 04:28:17 2010 (4CB810A1)
    fffff880`0123e000 fffff880`01254000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
    fffff880`063b0000 fffff880`063bf000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
    fffff800`00bca000 fffff800`00bd4000   kdcom    kdcom.dll    Sat Feb 05 11:52:49 2011 (4D4D8061)
    fffff880`068c5000 fffff880`06908000   ks       ks.sys       Sat Nov 20 05:33:23 2010 (4CE7A3F3)
    fffff880`017c0000 fffff880`017db000   ksecdd   ksecdd.sys   Wed Nov 16 22:48:13 2011 (4EC483FD)
    fffff880`01985000 fffff880`019b0000   ksecpkg  ksecpkg.sys  Wed Nov 16 23:23:44 2011 (4EC48C50)
    fffff880`07ebb000 fffff880`07ec0200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
    fffff880`027ad000 fffff880`027c2000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
    fffff880`02769000 fffff880`0278c000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
    fffff880`00cac000 fffff880`00cfb000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Nov 20 08:03:51 2010 (4CE7C737)
    fffff880`0589f000 fffff880`058a3280   mdmxsdk  mdmxsdk.sys  Mon Jun 19 17:27:26 2006 (449716BE)
    fffff880`081cc000 fffff880`081db000   modem    modem.sys    Mon Jul 13 20:10:48 2009 (4A5BCD08)
    fffff880`02575000 fffff880`02583000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
    fffff880`05a68000 fffff880`05a77000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
    fffff880`00c5c000 fffff880`00c76000   mountmgr mountmgr.sys Sat Nov 20 04:19:21 2010 (4CE79299)
    fffff880`04486000 fffff880`044b7000   MpFilter MpFilter.sys Wed Apr 06 16:07:29 2011 (4D9CC801)
    fffff880`059ac000 fffff880`059c4000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
    fffff880`059c4000 fffff880`059ec000   mrxdav   mrxdav.sys   Sat Nov 20 04:26:42 2010 (4CE79452)
    fffff880`05800000 fffff880`0582d000   mrxsmb   mrxsmb.sys   Tue Apr 26 22:40:38 2011 (4DB78226)
    fffff880`0582d000 fffff880`0587b000   mrxsmb10 mrxsmb10.sys Fri Jul 08 22:46:28 2011 (4E17C104)
    fffff880`0587b000 fffff880`0589f000   mrxsmb20 mrxsmb20.sys Tue Apr 26 22:39:37 2011 (4DB781E9)
    fffff880`04525000 fffff880`04530000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
    fffff880`00fef000 fffff880`00ff9000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
    fffff880`014d1000 fffff880`0152f000   msrpc    msrpc.sys    Sat Nov 20 04:21:56 2010 (4CE79334)
    fffff880`019f5000 fffff880`01a00000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
    fffff880`01a00000 fffff880`01a12000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
    fffff880`01832000 fffff880`01925000   ndis     ndis.sys     Wed Dec 29 01:16:18 2010 (4D1AD232)
    fffff880`04c00000 fffff880`04c0b000   ndisrd   ndisrd.sys   Fri Aug 28 10:48:38 2009 (4A97EE46)
    fffff880`04600000 fffff880`0460c000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
    fffff880`02653000 fffff880`02666000   ndisuio  ndisuio.sys  Sat Nov 20 05:50:08 2010 (4CE7A7E0)
    fffff880`00c76000 fffff880`00ca5000   ndiswan  ndiswan.sys  Sat Nov 20 05:52:32 2010 (4CE7A870)
    fffff880`069d9000 fffff880`069ee000   NDProxy  NDProxy.SYS  Sat Nov 20 05:52:20 2010 (4CE7A864)
    fffff880`0422f000 fffff880`0423e000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
    fffff880`019b0000 fffff880`019f5000   netbt    netbt.sys    Sat Nov 20 04:23:18 2010 (4CE79386)
    fffff880`01925000 fffff880`01985000   NETIO    NETIO.SYS    Sat Nov 20 04:23:13 2010 (4CE79381)
    fffff880`05a88000 fffff880`0630e000   NETwNs64 NETwNs64.sys Wed Aug 03 20:28:26 2011 (4E39E7AA)
    fffff880`09cbd000 fffff880`09cd5000   NisDrvWFP NisDrvWFP.sys Wed Apr 06 16:08:53 2011 (4D9CC855)
    fffff880`04530000 fffff880`04541000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
    fffff880`0160a000 fffff880`01616000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
    fffff800`03258000 fffff800`03841000   nt       ntkrnlmp.exe Wed Jun 22 22:53:23 2011 (4E02AAA3)
    fffff880`0161d000 fffff880`017c0000   Ntfs     Ntfs.sys     Thu Mar 10 22:39:39 2011 (4D79997B)
    fffff880`044b7000 fffff880`044c0000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
    fffff880`02600000 fffff880`02653000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
    fffff880`04209000 fffff880`0422f000   pacer    pacer.sys    Sat Nov 20 05:52:18 2010 (4CE7A862)
    fffff880`00da0000 fffff880`00db5000   partmgr  partmgr.sys  Sat Nov 20 04:20:00 2010 (4CE792C0)
    fffff880`00d6d000 fffff880`00da0000   pci      pci.sys      Sat Nov 20 04:19:11 2010 (4CE7928F)
    fffff880`017db000 fffff880`017ec000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
    fffff880`09644000 fffff880`096ea000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
    fffff880`07e5c000 fffff880`07e99000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
    fffff880`00dd6000 fffff880`00de4000   psadd    psadd.sys    Wed Jul 01 22:17:26 2009 (4A4C18B6)
    fffff880`00cfb000 fffff880`00d0f000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
    fffff880`011c2000 fffff880`011e6000   rasl2tp  rasl2tp.sys  Sat Nov 20 05:52:34 2010 (4CE7A872)
    fffff880`057df000 fffff880`057fa000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
    fffff880`010a6000 fffff880`010c7000   raspptp  raspptp.sys  Sat Nov 20 05:52:31 2010 (4CE7A86F)
    fffff880`011e6000 fffff880`01200000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
    fffff880`015a1000 fffff880`015f2000   rdbss    rdbss.sys    Sat Nov 20 04:27:51 2010 (4CE79497)
    fffff880`015f2000 fffff880`015fd000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
    fffff880`0450a000 fffff880`04513000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
    fffff880`04513000 fffff880`0451c000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
    fffff880`0451c000 fffff880`04525000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
    fffff880`01d96000 fffff880`01dd0000   rdyboost rdyboost.sys Sat Nov 20 04:43:10 2010 (4CE7982E)
    fffff880`02583000 fffff880`025af000   rfcomm   rfcomm.sys   Mon Jul 13 20:06:56 2009 (4A5BCC20)
    fffff880`0633b000 fffff880`06354000   rimspe64 rimspe64.sys Mon Oct 26 01:52:27 2009 (4AE5391B)
    fffff880`02666000 fffff880`0267e000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
    fffff880`0631b000 fffff880`0633b000   sdbus    sdbus.sys    Sat Nov 20 04:37:42 2010 (4CE796E6)
    fffff880`096ee000 fffff880`096f9000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
    fffff880`0475a000 fffff880`04766000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
    fffff880`01800000 fffff880`0181d000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
    fffff880`01df6000 fffff880`01dfd000   smiifx64 smiifx64.sys Tue Sep 07 00:38:27 2010 (4C85C1C3)
    fffff880`01d8e000 fffff880`01d96000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
    fffff880`09c25000 fffff880`09cbd000   srv      srv.sys      Thu Apr 28 23:06:06 2011 (4DBA2B1E)
    fffff880`09744000 fffff880`097ad000   srv2     srv2.sys     Thu Apr 28 23:05:46 2011 (4DBA2B0A)
    fffff880`096f9000 fffff880`0972a000   srvnet   srvnet.sys   Thu Apr 28 23:05:35 2011 (4DBA2AFF)
    fffff880`02564000 fffff880`02574d00   STREAM   STREAM.SYS   Mon Jul 13 20:06:18 2009 (4A5BCBFA)
    fffff880`063f7000 fffff880`063f8480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
    fffff880`06908000 fffff880`06952000   sxuptp   sxuptp.sys   Fri May 08 00:13:37 2009 (4A03B171)
    fffff880`05a00000 fffff880`05a66000   SynTP    SynTP.sys    Fri Sep 30 20:13:52 2011 (4E865B40)
    fffff880`01ada000 fffff880`01cde000   tcpip    tcpip.sys    Wed Sep 28 23:43:04 2011 (4E83E948)
    fffff880`0972a000 fffff880`0973c000   tcpipreg tcpipreg.sys Sat Nov 20 05:51:48 2010 (4CE7A844)
    fffff880`04563000 fffff880`04570000   TDI      TDI.SYS      Sat Nov 20 04:22:06 2010 (4CE7933E)
    fffff880`04541000 fffff880`04563000   tdx      tdx.sys      Sat Nov 20 04:21:54 2010 (4CE79332)
    fffff880`0181d000 fffff880`01831000   termdd   termdd.sys   Sat Nov 20 06:03:40 2010 (4CE7AB0C)
    fffff880`05a77000 fffff880`05a86000   tpm      tpm.sys      Mon Jul 13 19:21:48 2009 (4A5BC18C)
    fffff880`045f9000 fffff880`04600000   Tppwr64v Tppwr64v.sys Thu Nov 18 22:36:29 2010 (4CE5F0BD)
    fffff960`00400000 fffff960`0040a000   TSDDD    TSDDD.dll    unavailable (00000000)
    fffff880`0119c000 fffff880`011c2000   tunnel   tunnel.sys   Sat Nov 20 05:51:50 2010 (4CE7A846)
    fffff880`0267e000 fffff880`02685000   TurboB   TurboB.sys   Tue Sep 29 20:25:28 2009 (4AC2A578)
    fffff880`00de4000 fffff880`00df2000   Tvti2c   Tvti2c.sys   Thu Sep 24 07:56:38 2009 (4ABB5E76)
    fffff880`06952000 fffff880`06964000   umbus    umbus.sys    Sat Nov 20 05:44:37 2010 (4CE7A695)
    fffff880`0251e000 fffff880`0253b000   usbccgp  usbccgp.sys  Thu Mar 24 23:29:14 2011 (4D8C0C0A)
    fffff880`05a66000 fffff880`05a67f00   USBD     USBD.SYS     Thu Mar 24 23:28:59 2011 (4D8C0BFB)
    fffff880`047b0000 fffff880`047c1000   usbehci  usbehci.sys  Thu Mar 24 23:29:04 2011 (4D8C0C00)
    fffff880`0697f000 fffff880`069d9000   usbhub   usbhub.sys   Thu Mar 24 23:29:25 2011 (4D8C0C15)
    fffff880`01000000 fffff880`01056000   USBPORT  USBPORT.SYS  Thu Mar 24 23:29:12 2011 (4D8C0C08)
    fffff880`00eb3000 fffff880`00ec0000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
    fffff880`044c7000 fffff880`044d5000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
    fffff880`044d5000 fffff880`044fa000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
    fffff880`010c9000 fffff880`01105000   vmbus    vmbus.sys    Sat Nov 20 04:57:29 2010 (4CE79B89)
    fffff880`01d28000 fffff880`01d38000   vmstorfl vmstorfl.sys Sat Nov 20 04:57:30 2010 (4CE79B8A)
    fffff880`00dc1000 fffff880`00dd6000   volmgr   volmgr.sys   Sat Nov 20 04:19:28 2010 (4CE792A0)
    fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Sat Nov 20 04:20:43 2010 (4CE792EB)
    fffff880`01d38000 fffff880`01d84000   volsnap  volsnap.sys  Sat Nov 20 04:20:08 2010 (4CE792C8)
    fffff880`0630e000 fffff880`0631b000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
    fffff880`01aa9000 fffff880`01abf000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
    fffff880`01abf000 fffff880`01ada000   wanarp   wanarp.sys   Sat Nov 20 05:52:36 2010 (4CE7A874)
    fffff880`044fa000 fffff880`0450a000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
    fffff880`00e00000 fffff880`00ea4000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
    fffff880`00ea4000 fffff880`00eb3000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
    fffff880`04200000 fffff880`04209000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
    fffff960`00040000 fffff960`00355000   win32k   win32k.sys   unavailable (00000000)
    fffff880`01105000 fffff880`01119000   winhv    winhv.sys    Sat Nov 20 04:20:02 2010 (4CE792C2)
    fffff880`063de000 fffff880`063e7000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
    fffff880`00fe6000 fffff880`00fef000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
    fffff880`0278c000 fffff880`027ad000   WudfPf   WudfPf.sys   Sat Nov 20 05:42:44 2010 (4CE7A624)
    fffff880`0973c000 fffff880`09744000   XAudio64 XAudio64.sys Wed Apr 29 14:21:07 2009 (49F89A93)
    
    Unloaded modules:
    fffff880`09dad000 fffff880`09dc8000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`09dde000 fffff880`09df9000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`09d7c000 fffff880`09dad000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`09cd5000 fffff880`09d46000   spsys.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00071000
    fffff880`09dad000 fffff880`09dde000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`09d92000 fffff880`09dad000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`09d61000 fffff880`09d92000   WUDFRd.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00031000
    fffff880`09d46000 fffff880`09d61000   USBSTOR.SYS
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0001B000
    fffff880`0445c000 fffff880`04486000   cdrom.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0002A000
    fffff880`096ec000 fffff880`096ee000   MSPCLOCK.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00002000
    fffff880`096ea000 fffff880`096ec000   MSPQM.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00002000
    fffff880`01a9b000 fffff880`01aa9000   crashdmp.sys
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  0000E000
    fffff880`04241000 fffff880`04449000   dump_iaStor.
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00208000
    fffff880`04449000 fffff880`0445c000   dump_dumpfve
        Timestamp: unavailable (00000000)
        Checksum:  00000000
        ImageSize:  00013000
    Bugcheck code 0000009F
    Arguments 00000000`00000003 fffffa80`04903a10 fffff800`00b9c518 fffffa80`07618150
    sysinfo: could not find necessary interfaces.
    sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
    sysinfo: could not find necessary interfaces.
    sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
    sysinfo: could not find necessary interfaces.
    sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
    sysinfo: could not find necessary interfaces.
    sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
    Closing open log file C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\_99-dbug.txt
    
    
    Last edited by Vir Gnarus; 03-19-2012 at 10:20 AM.

  4. #4

    Join Date
    Mar 2012
    Posts
    469

    Re: Stopped-up IRPs (0x9F)

    Bump. I added a most delicious piece of bonus material that I found perusing the internets, made possible by none other than good ole Cluberti. I highly advise reading it, as it covers a lot on the necessity of going deeper to find a cause. Suffice to say, if they were stuck just looking at the minidump or the initial output given by the client, that person may have ended up replacing hardware without ever fixing the problem! That's why we're here to learn about forensic troubleshooting and debugging: to avoid going caveman on problems and discover and to instead fix em with pinpoint accuracy.

    Note: if anyone needs clarification on what is taking place in the thread I linked too, such as "why did Cluberti do this?" or "What does he mean by this?" I'd be happy to help. :)

  5. #5
    satrow's Avatar
    Join Date
    Apr 2012
    Location
    Cymru
    Posts
    734
    • specs System Specs
      • Motherboard:
        ASRock Z77E-ITX
      • CPU:
        E3-1230 V2 3.3GHz
      • Memory:
        16GB G.Skill DDR3 2400
      • Graphics:
        Asus GTX1060
      • Sound Card:
        Onboard
      • Hard Drives:
        3x250GB SSDs, 2x 2.5 1TB HDD JBOD
      • Power Supply:
        Seasonic 360W Gold
      • Case:
        BitFenix Prodigy Black
      • Cooling:
        Be Quiet Shadow Rock Topflow + 2x case fans
      • Display:
        Dell U2412M 1900x1200 x2 (sometimes x3)
      • Operating System:
        W7 x64 Pro

    Re: Stopped-up IRPs (0x9F)

    I'm not sure if it's of any use in a training scenario but here's one that was 'sorted' without any assistance from WER (wouldn't start), I almost called here for reinforcements by post #38/39, luckily the OP was pretty patient and kept track of what I was trying to do: http://forums.majorgeeks.com/showthread.php?t=258111
    Last edited by satrow; 05-25-2012 at 03:14 PM. Reason: URL fixing
    zigzag3143 says thanks for this.

  6. #6

    Join Date
    Mar 2012
    Posts
    469

    Re: Stopped-up IRPs (0x9F)

    Doesn't look like the link is working.

  7. #7
    satrow's Avatar
    Join Date
    Apr 2012
    Location
    Cymru
    Posts
    734
    • specs System Specs
      • Motherboard:
        ASRock Z77E-ITX
      • CPU:
        E3-1230 V2 3.3GHz
      • Memory:
        16GB G.Skill DDR3 2400
      • Graphics:
        Asus GTX1060
      • Sound Card:
        Onboard
      • Hard Drives:
        3x250GB SSDs, 2x 2.5 1TB HDD JBOD
      • Power Supply:
        Seasonic 360W Gold
      • Case:
        BitFenix Prodigy Black
      • Cooling:
        Be Quiet Shadow Rock Topflow + 2x case fans
      • Display:
        Dell U2412M 1900x1200 x2 (sometimes x3)
      • Operating System:
        W7 x64 Pro

    Re: Stopped-up IRPs (0x9F)

    Quote Originally Posted by Vir Gnarus View Post
    Doesn't look like the link is working.
    Fixed now.

  8. #8
    zigzag3143's Avatar
    Join Date
    Mar 2012
    Posts
    3,741
    • specs System Specs
      • Manufacturer:
        HP
      • Model Number:
        DV7
      • Cooling:
        Coolermaster U3 best in class
      • Operating System:
        Win 8 RTM

    Re: Stopped-up IRPs (0x9F)

    Thanks to all for clarifying something that has alluded me until now.

    MS-MVP Windows IT-PRO 2010-2017
    MCC-2013-2017
    Wankiya & Dyami
    Team ZigZag





  9. #9

    Re: Stopped-up IRPs (0x9F)

    Great post, thanks. 9F bugchecks are getting pretty popular, I see them a lot. This will definitely help will for future reference.

  10. #10

    Join Date
    Mar 2012
    Posts
    469

    Re: Stopped-up IRPs (0x9F)

    No prob, man. Yeah, it does seem there's more out there, which means more I/O related incidences.

    Btw, I went ahead and added a link to Mark Russinovich's article on nonpaged/paged pool at the end of the article, in case anyone's too lazy to check for it in my BSOD Method & Tips thread.

  11. #11

    Re: Stopped-up IRPs (0x9F)

    Quote Originally Posted by Vir Gnarus View Post
    This is a simple article for those unfamiliar with 0x9F crashdumps, aka DRIVER_POWER_STATE_FAILURE.
    This was a brilliant article in diagnosing the root cause of this fault. I was able to help a friend, from a provided minidump and sysdata file, find their regular blue screen on a completely patched and up-to-date Win7/x86 box. And I'm a programmer but I'm no driver/windbg expert. I did find a 'gotcha' though: My !irp command didn't identify the driver that was causing it (ditto with the bucket). It identified 0x9F_3_IMAGE_usbccgp.sys as the fault. Because I only had a minidump and not a fulldump, I almost gave up at that point (the instructions implied I wouldn't get much further without the full dump), but I thought I'd try the two commands also mentioned (!devobj and !devstack). While !devobj just brought up nonsense (I assume because of the lack of information), !devstack identified the vendor and product ID of the faulty device. At that point it was simple enough to go through the sysdata.xml and figure out the true cause. Lesson to learn: don't give up because you don't have a full dump. !devstack may prove particularly useful even if the only information it can give you is the vendor and product ID -- these are listed in the sysdata file. - Grotty.
    Corrine, LilBambi, usasma and 1 others say thanks for this.

  12. #12
    LilBambi's Avatar
    Join Date
    Apr 2012
    Location
    Virgina, USA
    Posts
    292

    Re: Stopped-up IRPs (0x9F)

    Awesome work!
    Bambi
    If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology. Bruce Schneier

  13. #13
    jcgriff2's Avatar
    Join Date
    Feb 2012
    Location
    New Jersey Shore
    Posts
    15,563
    • specs System Specs
      • Manufacturer:
        HP
      • Model Number:
        HP ENVY TouchSmart 17-j130us Notebook - E8A04UA
      • Motherboard:
        HP Insyde 720265-501 6050A2549501-MB-A02
      • CPU:
        Intel Core i7-4700MQ Processor with Turbo Boost up to 3.4GHz.
      • Memory:
        12GB DDR3L SDRAM (2 DIMM)
      • Graphics:
        Intel HD graphics 4600 with up to 1792MB total graphics memory
      • Sound Card:
        Beats Audio quad speakers and two subwoofers
      • Hard Drives:
        1TB 5400RPM hard drive with HP ProtectSmart Hard Drive Protection
      • Disk Drives:
        Hitachi 500 GB SSD; 7 TB USB External
      • Power Supply:
        90w
      • Case:
        Laptop
      • Display:
        17.3-inch diagonal HD+ BrightView LED-backlit touchscreen display (1600 x 900)
      • Operating System:
        Windows 8.1

    Re: Stopped-up IRPs (0x9F)

    Agree -- the !irp command can indeed be very useful.

    BSOD Posting Instructions - Windows 10, 8.1, 8, 7 & Vista ` ` `Carrona Driver Reference Table (DRT)
    https://www.sysnative.com/
    Sysnative Hex-Decimal-UNIX Date Conversion

    Has Sysnative Forums helped you?
    Please consider donating to help support the forum.
    Thank You!

    Microsoft MVP 2009-2015

  14. #14

    Join Date
    Mar 2012
    Posts
    469

    Re: Stopped-up IRPs (0x9F)

    Thanks, grotlek, and glad to hear it worked out for ya! Yes, this particular case was very minimal and only the !irp was necessary. You were lucky to see anything coming from either !devobj or !devstack for the devobjs on the IRP stacks because that information is not always present in a minidump (more often absent than present) so they aren't very reliable. That's kinda the reason why I didn't go as far as to note those in this particular article. Thank you for covering them, though!

  15. #15

    Re: Stopped-up IRPs (0x9F)

    Ahoy, fellas. Followed your advice after my machine shut down on its own after falling asleep. Here's what I got:

    Code:
    0: kd> !analyze -v*******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    
    DRIVER_POWER_STATE_FAILURE (9f)
    A driver is causing an inconsistent power state.
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: fffffa800b28f060, Physical Device Object of the stack
    Arg3: fffff800047bd3d8, Functional Device Object of the stack
    Arg4: fffffa800c8a7ac0, The blocked IRP
    
    
    Debugging Details:
    ------------------
    
    
    
    
    DRVPOWERSTATE_SUBCODE:  3
    
    
    DRIVER_OBJECT: fffffa800a88d8c0
    
    
    IMAGE_NAME:  usbhub.sys
    
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  52954e12
    
    
    MODULE_NAME: usbhub
    
    
    FAULTING_MODULE: fffff88004e00000 usbhub
    
    
    CUSTOMER_CRASH_COUNT:  1
    
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    
    BUGCHECK_STR:  0x9F
    
    
    PROCESS_NAME:  System
    
    
    CURRENT_IRQL:  2
    
    
    STACK_TEXT:  
    fffff800`047bd388 fffff800`031368d2 : 00000000`0000009f 00000000`00000003 fffffa80`0b28f060 fffff800`047bd3d8 : nt!KeBugCheckEx
    fffff800`047bd390 fffff800`030d185c : fffff800`047bd4c0 fffff800`047bd4c0 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x33af0
    fffff800`047bd430 fffff800`030d16f6 : fffff800`03276f80 00000000`00550ec8 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
    fffff800`047bd4a0 fffff800`030d15de : 000000ca`7866356b fffff800`047bdb18 00000000`00550ec8 fffff800`03245b88 : nt!KiProcessExpiredTimerList+0xc6
    fffff800`047bdaf0 fffff800`030d13c7 : 0000003d`27fce8c1 0000003d`00550ec8 0000003d`27fce874 00000000`000000c8 : nt!KiTimerExpiration+0x1be
    fffff800`047bdb90 fffff800`030be8ca : fffff800`03241e80 fffff800`0324fcc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    fffff800`047bdc40 00000000`00000000 : fffff800`047be000 fffff800`047b8000 fffff800`047bdc00 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    
    
    STACK_COMMAND:  kb
    
    
    FOLLOWUP_NAME:  MachineOwner
    
    
    FAILURE_BUCKET_ID:  X64_0x9F_3_IMAGE_usbhub.sys
    
    
    BUCKET_ID:  X64_0x9F_3_IMAGE_usbhub.sys
    
    
    Followup: MachineOwner
    ---------
    
    
    0: kd> !irp fffffa800c8a7ac0
    Irp is active with 11 stacks 7 is current (= 0xfffffa800c8a7d40)
     No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
         cmd  flg cl Device   File     Completion-Context
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
    			Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
    			Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
    			Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
    			Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
    			Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
    			Args: 00000000 00000000 00000000 00000000
    >[ 16, 2]   0 e0 fffffa800b28f060 00000000 fffff88000fa857c-fffff88000fa83c4 Success Error Cancel 
    	       \Driver\usbhub	ACPI!ACPIDeviceIrpDeviceFilterRequest
    			Args: 00015400 00000001 00000004 00000003
     [ 16, 2]   0 e1 fffffa800b4f88c0 00000000 fffff88006cf59f4-00000000 Success Error Cancel pending
    	       \Driver\ACPI	hidusb!HumPowerCompletion
    			Args: 00015400 00000001 00000004 00000003
     [ 16, 2]   0 e0 fffffa800a365b30 00000000 fffff88006d0b2ec-fffffa800a365c80 Success Error Cancel 
    	       \Driver\HidUsb	HIDCLASS!HidpFdoPowerCompletion
    			Args: 00015400 00000001 00000004 00000003
     [ 16, 2]   0 e1 fffffa800a365b30 00000000 fffff800030b2710-fffffa800b578bf0 Success Error Cancel pending
    	       \Driver\HidUsb	nt!IopUnloadSafeCompletion
    			Args: 00015400 00000001 00000004 00000003
     [  0, 0]   0  0 00000000 00000000 00000000-fffffa8009dc2530    
    
    
    			Args: 00000000 00000000 00000000 00000000
    No particular driver is reported as offending. So far, disconnected my laser printer (nothing else hooked up to USB, except for mouse/kbd), gonna see what happens. Any thoughts?

  16. #16

    Re: Stopped-up IRPs (0x9F)

    Quote Originally Posted by shura View Post
    Ahoy, fellas. Followed your advice after my machine shut down on its own after falling asleep. Here's what I got:

    Code:
    0: kd> !analyze -v*******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    
    DRIVER_POWER_STATE_FAILURE (9f)
    A driver is causing an inconsistent power state.
    Arguments:
    Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
    Arg2: fffffa800b28f060, Physical Device Object of the stack
    Arg3: fffff800047bd3d8, Functional Device Object of the stack
    Arg4: fffffa800c8a7ac0, The blocked IRP
    
    
    Debugging Details:
    ------------------
    
    
    
    
    DRVPOWERSTATE_SUBCODE:  3
    
    
    DRIVER_OBJECT: fffffa800a88d8c0
    
    
    IMAGE_NAME:  usbhub.sys
    
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  52954e12
    
    
    MODULE_NAME: usbhub
    
    
    FAULTING_MODULE: fffff88004e00000 usbhub
    
    
    CUSTOMER_CRASH_COUNT:  1
    
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    
    BUGCHECK_STR:  0x9F
    
    
    PROCESS_NAME:  System
    
    
    CURRENT_IRQL:  2
    
    
    STACK_TEXT:  
    fffff800`047bd388 fffff800`031368d2 : 00000000`0000009f 00000000`00000003 fffffa80`0b28f060 fffff800`047bd3d8 : nt!KeBugCheckEx
    fffff800`047bd390 fffff800`030d185c : fffff800`047bd4c0 fffff800`047bd4c0 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x33af0
    fffff800`047bd430 fffff800`030d16f6 : fffff800`03276f80 00000000`00550ec8 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
    fffff800`047bd4a0 fffff800`030d15de : 000000ca`7866356b fffff800`047bdb18 00000000`00550ec8 fffff800`03245b88 : nt!KiProcessExpiredTimerList+0xc6
    fffff800`047bdaf0 fffff800`030d13c7 : 0000003d`27fce8c1 0000003d`00550ec8 0000003d`27fce874 00000000`000000c8 : nt!KiTimerExpiration+0x1be
    fffff800`047bdb90 fffff800`030be8ca : fffff800`03241e80 fffff800`0324fcc0 00000000`00000002 fffff880`00000000 : nt!KiRetireDpcList+0x277
    fffff800`047bdc40 00000000`00000000 : fffff800`047be000 fffff800`047b8000 fffff800`047bdc00 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    
    
    STACK_COMMAND:  kb
    
    
    FOLLOWUP_NAME:  MachineOwner
    
    
    FAILURE_BUCKET_ID:  X64_0x9F_3_IMAGE_usbhub.sys
    
    
    BUCKET_ID:  X64_0x9F_3_IMAGE_usbhub.sys
    
    
    Followup: MachineOwner
    ---------
    
    
    0: kd> !irp fffffa800c8a7ac0
    Irp is active with 11 stacks 7 is current (= 0xfffffa800c8a7d40)
     No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
         cmd  flg cl Device   File     Completion-Context
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
                Args: 00000000 00000000 00000000 00000000
     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
    
    
                Args: 00000000 00000000 00000000 00000000
    >[ 16, 2]   0 e0 fffffa800b28f060 00000000 fffff88000fa857c-fffff88000fa83c4 Success Error Cancel 
               \Driver\usbhub    ACPI!ACPIDeviceIrpDeviceFilterRequest
                Args: 00015400 00000001 00000004 00000003
     [ 16, 2]   0 e1 fffffa800b4f88c0 00000000 fffff88006cf59f4-00000000 Success Error Cancel pending
               \Driver\ACPI    hidusb!HumPowerCompletion
                Args: 00015400 00000001 00000004 00000003
     [ 16, 2]   0 e0 fffffa800a365b30 00000000 fffff88006d0b2ec-fffffa800a365c80 Success Error Cancel 
               \Driver\HidUsb    HIDCLASS!HidpFdoPowerCompletion
                Args: 00015400 00000001 00000004 00000003
     [ 16, 2]   0 e1 fffffa800a365b30 00000000 fffff800030b2710-fffffa800b578bf0 Success Error Cancel pending
               \Driver\HidUsb    nt!IopUnloadSafeCompletion
                Args: 00015400 00000001 00000004 00000003
     [  0, 0]   0  0 00000000 00000000 00000000-fffffa8009dc2530    
    
    
                Args: 00000000 00000000 00000000 00000000
    No particular driver is reported as offending. So far, disconnected my laser printer (nothing else hooked up to USB, except for mouse/kbd), gonna see what happens. Any thoughts?
    Hi,

    We'll need the dumps to see what's going. Make a thread here and be sure to follow the instructions here.

    Regards,

    Patrick

  17. #17
    x BlueRobot's Avatar
    Join Date
    May 2013
    Location
    Minkowski Space
    Posts
    1,749

    Re: Stopped-up IRPs (0x9F)

    You may want (if possible) to check the Device Objects involved with the IRP, and the corresponding Device Stack.
    Machines Can Think

    Oxygen, Nature's paradox.

Similar Threads

  1. Windows Explorer has stopped working loop
    By tylerofl in forum Windows 7 | Windows Vista
    Replies: 1
    Last Post: 07-05-2013, 06:25 AM
  2. Vista notebook, 0x9F, "Too many Irp stacks to be believed (>30)!!"
    By satrow in forum BSOD Kernel Dump Analysis Debugging Information
    Replies: 10
    Last Post: 06-17-2013, 06:53 AM
  3. 0x9F Bugcheck
    By partof in forum BSOD, Crashes, Kernel Debugging
    Replies: 5
    Last Post: 05-14-2013, 10:59 AM

Log in

Log in