Hi,
my laptop crashed this morning and I couldn't figure out what was the reason.
could somebody please help. I have windows 7 x64 installed on lenovo t520 laptop.
Please find below the crash dump analysis. I have also attached the minidump in rar format.
any help would be highly appreciated.
regards,
Aley
Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\Minidump\cbogonos\101614-21044-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`03066000 PsLoadedModuleList = 0xfffff800`032ab650
Debug session time: Thu Oct 16 08:39:21.268 2014 (GMT-4)
System Uptime: 1 days 15:44:18.256
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.
FAULTING_IP:
+7e1952f0458da8c
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff80000b9e9c8 -- (.exr 0xfffff80000b9e9c8)
ExceptionAddress: fffff800030e88e2 (nt!SwapContext_PatchXRstor)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff80000b9ea70 -- (.trap 0xfffff80000b9ea70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=fffff80000b9ecc0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030e88e2 rsp=fffff80000b9ec00 rbp=fffff80000b9ec70
r8=fffffa800361bbb8 r9=0000000000000000 r10=fffffffffffffffe
r11=fffff80003258e00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!SwapContext_PatchXRstor:
fffff800`030e88e2 0fae09 fxrstor [rcx] ds:c9e7:fffff800`00b9ecc0=7f
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030dd6be to fffff800030e5cd0
STACK_TEXT:
fffff800`00b9daa8 fffff800`030dd6be : fffffa80`05a0d000 fffff880`00000000 fffff800`00b9e220 fffff800`03111890 : nt!KeBugCheck
fffff800`00b9dab0 fffff800`0311155d : fffff800`032ec314 fffff800`0322d030 fffff800`03066000 fffff800`00b9e9c8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff800`00b9dae0 fffff800`03110335 : fffff800`0322d0fc fffff800`00b9db58 fffff800`00b9e9c8 fffff800`03066000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`00b9db10 fffff800`031213b1 : fffff800`00b9e9c8 fffff800`00b9e220 fffff800`00000000 fffffa80`051f8060 : nt!RtlDispatchException+0x415
fffff800`00b9e1f0 fffff800`030e5382 : fffff800`00b9e9c8 fffff800`03258e80 fffff800`00b9ea70 fffff800`03266cc0 : nt!KiDispatchException+0x135
fffff800`00b9e890 fffff800`030e3c8a : fffffa80`0452b228 fffff880`016fe3b5 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff800`00b9ea70 fffff800`030e88e2 : fffff800`00000000 fffffa80`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff800`00b9ec00 fffff800`030ddadd : fffff800`03258e80 fffff800`00000000 00000000`00000000 fffff880`00000000 : nt!SwapContext_PatchXRstor
fffff800`00b9ec40 00000000`00000000 : fffff800`00b9f000 fffff800`00b99000 fffff800`00b9ec00 00000000`00000000 : nt!KiIdleLoop+0x10d
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiKernelCalloutExceptionHandler+e
fffff800`030dd6be 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiKernelCalloutExceptionHandler+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4d9fdd5b
FAILURE_BUCKET_ID: X64_0x1E_nt!KiKernelCalloutExceptionHandler+e
BUCKET_ID: X64_0x1E_nt!KiKernelCalloutExceptionHandler+e
Followup: MachineOwner
---------
0: kd> lmvm nt
start end module name
fffff800`03066000 fffff800`0364f000 nt (pdb symbols) c:\symbols\ntkrnlmp.pdb\962458112DE04DEBBFB6761B710924452\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: c:\symbols\ntoskrnl.exe\4D9FDD5B5e9000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Sat Apr 09 00:15:23 2011 (4D9FDD5B)
CheckSum: 0054E319
ImageSize: 005E9000
File version: 6.1.7601.17592
Product version: 6.1.7601.17592
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7601.17592
FileVersion: 6.1.7601.17592 (win7sp1_gdr.110408-1631)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
0: kd> .exr 0xfffff80000b9e9c8
ExceptionAddress: fffff800030e88e2 (nt!SwapContext_PatchXRstor)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
