Darkbreeze :
Nah, you'll have to try again, it says file not found.
I think that site i was using limits you to 1 download, Kno wany better ones to use? Also it turns out the file is 703 MB large,
I downloaded what I assume to be the right debugging program Windbg(x64) and put memory.dmp through it but got some strange results, let me know if this helps.
Microsoft (R) Windows Debugger Version 6.3.9600.17237 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Windows 8 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9600.17085.amd64fre.winblue_gdr.140330-1035
Machine Name:
Kernel base = 0xfffff800`c6c70000 PsLoadedModuleList = 0xfffff800`c6f3a2d0
Debug session time: Fri Sep 12 18:15:24.324 2014 (UTC - 4:00)
System Uptime: 1 days 0:49:36.068
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.............
************* Symbol Loading Error Summary **************
Module name Error
ntkrnlmp The system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {ffffb7b7c6c05340, 7, 8, ffffb7b7c6c05340}
*** ERROR: Symbol file could not be found. Defaulted to export symbols for nvlddmkm.sys -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for dxgkrnl.sys -
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : nvlddmkm.sys ( nvlddmkm+2e45 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffb7b7c6c05340, memory referenced
Arg2: 0000000000000007, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: ffffb7b7c6c05340, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
FAULTING_MODULE: fffff800c6c70000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 53b4446a
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
ffffb7b7c6c05340
CURRENT_IRQL: 0
FAULTING_IP:
+6cd4fbe44da1
ffffb7b7`c6c05340 ?? ???
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff800c6dcfae9 to fffff800c6dc3fa0
FAILED_INSTRUCTION_ADDRESS:
+6cd4fbe44da1
ffffb7b7`c6c05340 ?? ???
STACK_TEXT:
ffffd000`6a82b708 fffff800`c6dcfae9 : 00000000`0000000a ffffb7b7`c6c05340 00000000`00000007 00000000`00000008 : nt!KeBugCheckEx
ffffd000`6a82b710 fffff800`c6dce33a : 00000000`00000008 00000000`00000000 ffffe001`fef02000 ffffd000`6a82b850 : nt!setjmpex+0x37e9
ffffd000`6a82b850 ffffb7b7`c6c05340 : fffff800`3eaade45 ffffe002`0020a000 fffff800`3ec827f4 00000000`00000000 : nt!setjmpex+0x203a
ffffd000`6a82b9e8 fffff800`3eaade45 : ffffe002`0020a000 fffff800`3ec827f4 00000000`00000000 00000000`00000000 : 0xffffb7b7`c6c05340
ffffd000`6a82b9f0 fffff800`3ebb74d0 : 00000000`00000000 ffffe001`fef02e60 00000000`00000004 ffffe001`feae69f0 : nvlddmkm+0x2e45
ffffd000`6a82ba20 fffff800`3ec47c95 : ffffe002`00215000 00000000`00000001 ffffe002`00215000 fffff800`3ecc1716 : nvlddmkm+0x10c4d0
ffffd000`6a82bb90 fffff800`3ec478e6 : ffffe002`00000001 ffffe002`00215000 ffffe002`0020a001 ffffd000`6a82bcd0 : nvlddmkm+0x19cc95
ffffd000`6a82bc40 fffff800`3ec4df75 : ffffe002`0020a000 ffffd000`6a82bd29 00000000`00000000 ffffe002`0020a000 : nvlddmkm+0x19c8e6
ffffd000`6a82bc80 fffff800`3ec45bb1 : 00000000`00000000 00000000`00000000 ffffe002`0020e640 ffffe002`0020a000 : nvlddmkm+0x1a2f75
ffffd000`6a82bd90 fffff800`3eba0c9b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nvlddmkm+0x19abb1
ffffd000`6a82bdc0 fffff800`3eba0d27 : ffffe001`fef02000 fffff800`3eba0c3a 00000000`00000000 fffff800`c6cca6c3 : nvlddmkm+0xf5c9b
ffffd000`6a82be50 fffff800`3eb7a88d : ffffe001`fef02000 00000000`00000000 ffffd000`743ca830 00000000`00000001 : nvlddmkm+0xf5d27
ffffd000`6a82be80 fffff800`3ebda9be : ffffe001`fef02000 00000000`00000000 00000000`00000000 00000000`00000000 : nvlddmkm+0xcf88d
ffffd000`6a82beb0 fffff800`3e696ae1 : fffff800`3ebda940 00000000`00000000 00000000`00000001 ffffd000`6a7ec180 : nvlddmkm+0x12f9be
ffffd000`6a82bf40 fffff800`c6d3f363 : ffffd000`743ca780 00000000`00000000 ffff778e`f0f89f30 00000000`0000000c : dxgkrnl!DpSynchronizeExecution+0x451
ffffd000`6a82bf70 fffff800`c6dc51e8 : ffffd000`743ca780 ffffe002`00ca9640 00000000`00210040 ffffe001`fc46a640 : nt!RtlInterlockedSetClearRun+0x38f
ffffd000`6a82bfb0 fffff800`c6dc553b : 00000000`00000001 00000000`00000001 ffffe001`ffc18010 ffffd000`6a7ec180 : nt!KeSynchronizeExecution+0x5f8
ffffd000`6a81ca50 fffff800`c6dc7ac2 : ffffd000`6a7ec180 ffffd000`6a7ec180 ffffd000`6a7f83c0 00000000`00210040 : nt!KeSynchronizeExecution+0x94b
ffffd000`6a81cbe0 00000000`00000000 : ffffd000`6a81d000 ffffd000`6a816000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x2ed2
STACK_COMMAND: kb
FOLLOWUP_IP:
nvlddmkm+2e45
fffff800`3eaade45 488984dec80e0000 mov qword ptr [rsi+rbx*8+0EC8h],rax
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nvlddmkm+2e45
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
BUCKET_ID: WRONG_SYMBOLS
FAILURE_BUCKET_ID: WRONG_SYMBOLS
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:wrong_symbols
FAILURE_ID_HASH: {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner
---------