1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Windows can someone read my minidump

Discussion in 'Software' started by fartonmyear, 14 Dec 2006.

  1. fartonmyear

    fartonmyear What's a Dremel?

    Joined:
    16 Jul 2004
    Posts:
    565
    Likes Received:
    0
  2. Arthur2Sheds

    Arthur2Sheds Jackson

    Joined:
    19 May 2003
    Posts:
    817
    Likes Received:
    1
    Is there a program I'm supposed to be using other than Notepad to view these files? Because Notepad ain't cuttin' it, that's for sure.

    What's the actual problem you're having?
     
  3. fartonmyear

    fartonmyear What's a Dremel?

    Joined:
    16 Jul 2004
    Posts:
    565
    Likes Received:
    0
    azureus BSOD when i open a torrent
     
  4. lcdguy

    lcdguy Minimodder

    Joined:
    25 May 2004
    Posts:
    2,336
    Likes Received:
    19
    Output of analysis of first mini dump.
    Code:
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 4141413d, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 804dc42a, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS:  4141413d 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!PopApplyProcessorPolicy+e1
    804dc42a 3b51fc          cmp     edx,dword ptr [ecx-4]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO
    
    BUGCHECK_STR:  0xA
    
    LAST_CONTROL_TRANSFER:  from 804dc4ae to 804dc42a
    
    STACK_TEXT:  
    eea5895c 804dc4ae fff0bdc0 ffffffff 46c799cb nt!PopApplyProcessorPolicy+0xe1
    eea58978 804e7e5d fff0bdc0 ffffffff 8216ea88 nt!PopIdleUpdateIdleHandlers+0xb6
    eea589b8 80566488 00000005 eea58bec 00000001 nt!KiSetPriorityThread+0x178
    eea589bc 00000000 eea58bec 00000001 00000006 nt!_87except
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!PopApplyProcessorPolicy+e1
    804dc42a 3b51fc          cmp     edx,dword ptr [ecx-4]
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nt!PopApplyProcessorPolicy+e1
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntoskrnl.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  41108004
    
    FAILURE_BUCKET_ID:  0xA_nt!PopApplyProcessorPolicy+e1
    
    BUCKET_ID:  0xA_nt!PopApplyProcessorPolicy+e1
    
    
    Output of analysis of second crash dump

    Code:
    DRIVER_CORRUPTED_EXPOOL (c5)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is
    caused by drivers that have corrupted the system pool.  Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.
    Arguments:
    Arg1: 41414141, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 8054b88f, address which referenced memory
    
    Debugging Details:
    ------------------
    
    Unable to load image ibmfilter.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for ibmfilter.sys
    *** ERROR: Module load completed but symbols could not be loaded for ibmfilter.sys
    
    BUGCHECK_STR:  0xC5_2
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!KeDeregisterNmiCallback+40
    8054b88f 8b08            mov     ecx,dword ptr [eax]
    
    CUSTOMER_CRASH_COUNT:  2
    
    DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO
    
    PROCESS_NAME:  Ø|e‰
    
    LAST_CONTROL_TRANSFER:  from 8054ba1e to 8054b88f
    
    STACK_TEXT:  
    b0c2ba64 8054ba1e 890697f8 00000000 890969d8 nt!KeDeregisterNmiCallback+0x40
    b0c2baa4 b12d13d1 89069008 00000000 894be930 nt!KeForceAttachProcess+0x42
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b0c2bce8 804e3d77 89069008 890969d8 806ee2d0 ibmfilter+0x63d1
    b0c2bd0c 80574e0a 89463208 890969d8 8944c910 nt!KeConnectInterrupt+0x6f
    b0c2bd30 804df06b 00000dec 00000000 00000000 nt!PsNtosImageBase+0x2
    b0c2bd64 7c90eb94 badb0d00 0021fefc b16bcd98 nt!MmCreateProcessAddressSpace+0xf9
    b0c2bd74 b16bcdcc 00000000 00000000 00000000 0x7c90eb94
    b0c2bd78 00000000 00000000 00000000 00000000 0xb16bcdcc
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    ibmfilter+63d1
    b12d13d1 ??              ???
    
    SYMBOL_STACK_INDEX:  2
    
    SYMBOL_NAME:  ibmfilter+63d1
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: ibmfilter
    
    IMAGE_NAME:  ibmfilter.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  40b23a2e
    
    FAILURE_BUCKET_ID:  0xC5_2_ibmfilter+63d1
    
    BUCKET_ID:  0xC5_2_ibmfilter+63d1
    In the future you need 2 things to analyse crash dumps

    windows debugging tools (free from MS)
    symbols for the os your debugging (free from MS)

    hope this helps.

    Cheers.

    LCDGUY
     
Tags:

Share This Page