kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 804de9a4, The address that the exception occurred at
Arg3: b849ecf0, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgeführt werden.
FAULTING_IP:
nt!ZwYieldExecution+d30
804de9a4 fa cli
TRAP_FRAME: b849ecf0 -- (.trap ffffffffb849ecf0)
ErrCode = 00000000
eax=00be0000 ebx=b849edcc ecx=00000001 edx=7634de0f esi=f8afa008 edi=f8afa3f0
eip=804de9a4 esp=b849ed64 ebp=b849ed64 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!ZwYieldExecution+0xd30:
804de9a4 fa cli
Resetting default scope
CUSTOMER_CRASH_COUNT: 5
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x8E
CLI_FAULT_INSTR:
nt!ZwYieldExecution+d30
804de9a4 fa cli
LAST_CONTROL_TRANSFER: from f8a6e194 to 804de9a4
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b849ed64 f8a6e194 badb0d00 7634de0f b849ed64 nt!ZwYieldExecution+0xd30
b849ed88 bf800b52 bf824275 00120000 00400000 0xf8a6e194
bf824247 c8e856ec 8bfffdc8 c985084d 03b22374 win32k+0xb52
bf82424b 8bfffdc8 c985084d 03b22374 01265ae8 0xc8e856ec
bf82424f c985084d 03b22374 01265ae8 74c08500 0x8bfffdc8
bf824253 03b22374 01265ae8 74c08500 6ce850da 0xc985084d
bf824257 01265ae8 74c08500 6ce850da 85ffffff 0x3b22374
bf82425b 74c08500 6ce850da 85ffffff 8bd074c0 0x1265ae8
bf82425f 6ce850da 85ffffff 8bd074c0 c8d1e830 0x74c08500
bf824263 85ffffff 8bd074c0 c8d1e830 c68bfffd 0x6ce850da
bf824267 8bd074c0 c8d1e830 c68bfffd 04c25d5e 0x85ffffff
bf82426b c8d1e830 c68bfffd 04c25d5e ebc03300 0x8bd074c0
bf82426f c68bfffd 04c25d5e ebc03300 909090e4 0xc8d1e830
bf824273 04c25d5e ebc03300 909090e4 ff8b9090 0xc68bfffd
bf824277 ebc03300 909090e4 ff8b9090 8bec8b55 0x4c25d5e
bf82427b 909090e4 ff8b9090 8bec8b55 4d8b0845 0xebc03300
bf82427f ff8b9090 8bec8b55 4d8b0845 0108290c 0x909090e4
bf824283 8bec8b55 4d8b0845 0108290c 4d8b0848 0xff8b9090
bf824287 4d8b0845 0108290c 4d8b0848 04482910 0x8bec8b55
bf82428b 0108290c 4d8b0848 04482910 330c4801 0x4d8b0845
bf82428f 4d8b0848 04482910 330c4801 c25d40c0 0x108290c
bf824293 04482910 330c4801 c25d40c0 c033000c 0x4d8b0848
bf824297 330c4801 c25d40c0 c033000c 8b3deb40 0x4482910
bf82429b c25d40c0 c033000c 8b3deb40 9a91f815 0x330c4801
bf82429f c033000c 8b3deb40 9a91f815 ac8203bf 0xc25d40c0
bf8242a3 8b3deb40 9a91f815 ac8203bf eb000008 0xc033000c
bf8242a7 9a91f815 ac8203bf eb000008 02c5f640 0x8b3deb40
bf8242ab ac8203bf eb000008 02c5f640 40404174 0x9a91f815
bf8242af eb000008 02c5f640 40404174 026a3deb 0xac8203bf
bf8242b3 02c5f640 40404174 026a3deb 9021eb58 0xeb000008
bf8242b7 40404174 026a3deb 9021eb58 90909090 0x2c5f640
bf8242bb 026a3deb 9021eb58 90909090 8b55ff8b 0x40404174
bf8242bf 9021eb58 90909090 8b55ff8b 0c4d8bec 0x26a3deb
bf8242c3 90909090 8b55ff8b 0c4d8bec 4539c033 0x9021eb58
bf8242c7 8b55ff8b 0c4d8bec 4539c033 f61e7410 0x90909090
bf8242cb 0c4d8bec 4539c033 f61e7410 e27501c5 0x8b55ff8b
bf8242cf 4539c033 f61e7410 e27501c5 0000c1f7 0xc4d8bec
bf8242d3 f61e7410 e27501c5 0000c1f7 be750002 0x4539c033
bf8242d7 e27501c5 0000c1f7 be750002 c00a45f6 0xf61e7410
bf8242db 00000000 be750002 c00a45f6 c1f61575 0xe27501c5
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804de8ea - nt!ZwYieldExecution+c76
[ 05:06 ]
1 error : !nt (804de8ea)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
MEMORY_CORRUPTOR: ONE_BYTE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE
BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE
Followup: memory_corruption
---------