can anyone analyze this for me? I can't make heads or tails out of it

Toggle sidebar Toggle sidebar
S

solidsecret15

Distinguished
Dec 19, 2011
40
0
18,540
*****Ignore this dump file, it's the wrong dump, a full dump is posted on my next post****

I put this into open systems resource, to try and analyze my dump file, but i still don't understand, can anyone help me out? I've been having crashing issues (BSOD)

Primary Analysis

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 8 Kernel Version 10586 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10586.63.amd64fre.th2_release.160104-1513
Machine Name:
Kernel base = 0xfffff800`7a090000 PsLoadedModuleList = 0xfffff800`7a36ec70
Debug session time: Wed Jan 20 20:21:43.733 2016 (UTC - 5:00)
System Uptime: 0 days 1:23:18.359

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff800d1360058, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8007a108220, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

OVERLAPPED_MODULE: Address regions for 'dump_iaStorA' and 'dump_storpor' overlap

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
fffff800d1360058

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiDispatchException+18
fffff800`7a108220 488b05317e2500 mov rax,qword ptr [nt!_security_cookie (fffff800`7a360058)]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: System

TRAP_FRAME: ffffd001c99f4330 -- (.trap 0xffffd001c99f4330)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd001c99f4638 rbx=0000000000000000 rcx=ffffd001c99f4638
rdx=ffffd001c99f4500 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8007a108220 rsp=ffffd001c99f44c8 rbp=ffff70055cddd1a0
r8=ffffd001c99f46e0 r9=0000000000000000 r10=0000000000000000
r11=00000000000000c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiDispatchException+0x18:
fffff800`7a108220 488b05317e2500 mov rax,qword ptr [nt!_security_cookie (fffff800`7a360058)] ds:fffff800`7a360058=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8007a1dd2e9 to fffff8007a1d2770

STACK_TEXT:
ffffd001`c99f41e8 fffff800`7a1dd2e9 : 00000000`0000000a fffff800`d1360058 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd001`c99f41f0 fffff800`7a1dbac7 : fffff800`68822800 00000000`0007c0c8 fffff800`68822800 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd001`c99f4330 fffff800`7a108220 : ffffd001`c99de180 00000000`00000000 00000000`000000ff 00000000`00000000 : nt!KiPageFault+0x247
ffffd001`c99f44c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x18


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiDispatchException+18
fffff800`7a108220 488b05317e2500 mov rax,qword ptr [nt!_security_cookie (fffff800`7a360058)]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!KiDispatchException+18

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 568b1c58

FAILURE_BUCKET_ID: X64_AV_nt!KiDispatchException+18

BUCKET_ID: X64_AV_nt!KiDispatchException+18

Followup: MachineOwner
---------
 
Solution
S
For anyone wondering, my bluescreen issue was driver related, I downloaded a great little program (free I might add, so that's always a bonus!) That analyzed all of my crash dumps for me, the program was called "Whocrashed" and it told me what the most likely reasons for my crashes were, in my case it pointed to two drivers that were likely causing me grief (Aichargerplus.sys and an avast driver) I just thought I'd post and let the forum know as it may help someone else with bsod issues (and at the price of free, the worst thing that will happen is wasting your time :p) Thanks for looking, and a big thanks for dudmont for his response!
Sort by date Sort by votes
dudmont

dudmont

Reputable
Feb 23, 2015
1,404
0
5,660
Did you recently add some new piece of hardware? Have you ever manually set up your irqs? First part looks like windows 8 doesn't have the exact correct specs on a piece of hardware, caused by one of the drivers. When setting up IRQs(which is supposed to be all automatic now). One of the secondary settings is off, due to the windows driver . To solve it, you'd have to figure out which piece of hardware it is, what it's exact settings are supposed to be, and then go into bios and adjust accordingly, manually taking over one of the IRQs and then leaving the rest on auto. Wandering back to my days of DOS, 16 bit ISA cards, and manual IRQ info for Sid Meier's Pirates Gold. *queue up the Bach*
At least, that's what it looks like me.
Or you could remove the driver, from the offender, and re-install, and hope that clears it up.
 
Upvote 0 Downvote
S

solidsecret15

Distinguished
Dec 19, 2011
40
0
18,540
weird, I have windows 10, this system was built by me, and all hardware was installed at the same time, but i've had issues almost since the start. and I've never manually adjusted my irqs before, sorry, I'm going to copy and paste my dump below, I do apologize, but i just realized i uploaded the wrong dump file, although they could be the same anyway (been happening for awhile) here is the new dump:


Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 10586 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10586.122.amd64fre.th2_release_inmarket.160222-1549
Machine Name:
Kernel base = 0xfffff802`c660d000 PsLoadedModuleList = 0xfffff802`c68ebcf0
Debug session time: Mon Mar 7 19:42:57.178 2016 (UTC - 4:00)
System Uptime: 0 days 0:23:56.802
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols

Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff802c667a4c6, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!KiTimerWaitTest+86 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff802c667a4c6, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 10586.122.amd64fre.th2_release_inmarket.160222-1549

SYSTEM_MANUFACTURER: System manufacturer

SYSTEM_PRODUCT_NAME: System Product Name

SYSTEM_SKU: SKU

SYSTEM_VERSION: System Version

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: 1702

BIOS_DATE: 01/28/2016

BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.

BASEBOARD_PRODUCT: Z170-A

BASEBOARD_VERSION: Rev 1.xx

DUMP_TYPE: 1

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff802c667a4c6

BUGCHECK_P3: 0

BUGCHECK_P4: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

FAULTING_IP:
nt!KiTimerWaitTest+86
fffff802`c667a4c6 4d8b36 mov r14,qword ptr [r14]

EXCEPTION_PARAMETER2: ffffffffffffffff

BUGCHECK_STR: 0x1E_c0000005_R

CPU_COUNT: 8

CPU_MHZ: d50

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 74'00000000 (cache) 74'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: DESKTOP-V2H5VMF

ANALYSIS_SESSION_TIME: 03-07-2016 20:35:32.0557

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

EXCEPTION_RECORD: ffffe0005b420fc8 -- (.exr 0xffffe0005b420fc8)
ExceptionAddress: ffffe0005b420fd0
ExceptionCode: 00060000
ExceptionFlags: 00000001
NumberParameters: 393216
Parameter[0]: ffffe0005b420fe8
Parameter[1]: ffffe0005b420fe8
Parameter[2]: 0000000000000000
Parameter[3]: 6353634302220000
Parameter[4]: fbd081f9e07adafe
Parameter[5]: 00000001021002ff
Parameter[6]: 0000000000001000
Parameter[7]: ffffe0005b421020
Parameter[8]: ffffe0005b421020
Parameter[9]: 0000000000100000
Parameter[10]: 7fffffffffffffff
Parameter[11]: 7fffffffffffffff
Parameter[12]: ffffe00055faa838
Parameter[13]: 0000000000000000
Parameter[14]: 0000000000000000

LAST_CONTROL_TRANSFER: from fffff802c67ccb86 to fffff802c674f450

STACK_TEXT:
fffff802`c87d56a8 fffff802`c67ccb86 : 00000000`0000001e ffffffff`c0000005 fffff802`c667a4c6 00000000`00000000 : nt!KeBugCheckEx
fffff802`c87d56b0 fffff802`c67554fd : fffff802`c693e000 fffff802`c660d000 0004c758`007cc000 fffff801`26a3bc6e : nt!KiFatalExceptionHandler+0x22
fffff802`c87d56f0 fffff802`c6612139 : 00000000`00000000 00000000`00000399 fffff802`c87d5cf0 fffff802`c87d5950 : nt!RtlpExecuteHandlerForException+0xd
fffff802`c87d5720 fffff802`c66105a8 : fffff802`c87d6638 fffff802`c87d6350 fffff802`c87d6638 00000000`00000001 : nt!RtlDispatchException+0x429
fffff802`c87d5e20 fffff802`c675a0c2 : ffffe000`5b420fc8 ffffe000`5ad35000 00000000`00000000 00000000`000000ff : nt!KiDispatchException+0x144
fffff802`c87d6500 fffff802`c675857d : 00000000`00000002 00000000`00000001 fffff802`c69a0740 fffff802`c6667371 : nt!KiExceptionDispatch+0xc2
fffff802`c87d66e0 fffff802`c667a4c6 : 00000000`20000080 00000000`00000000 00000000`00400a02 fffff802`c66d8000 : nt!KiGeneralProtectionFault+0xfd
fffff802`c87d6870 fffff802`c667ad89 : ffffe000`5b9c5770 fffff802`00000000 fffff802`c87d6a18 00000000`00000001 : nt!KiTimerWaitTest+0x86
fffff802`c87d6910 fffff802`c675220a : 00000000`00000000 fffff802`c692a180 fffff802`c69a0740 ffffe000`56eac080 : nt!KiRetireDpcList+0x399
fffff802`c87d6b60 00000000`00000000 : fffff802`c87d7000 fffff802`c87d0000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: 0cd2398a569898ec895af18194ebb2d1a6ab3ca7

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: ab69c45a9c2e9389ec4f9b4ffb87039498cbd373

THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406

FOLLOWUP_IP:
nt!KiTimerWaitTest+86
fffff802`c667a4c6 4d8b36 mov r14,qword ptr [r14]

FAULT_INSTR_CODE: 41368b4d

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: nt!KiTimerWaitTest+86

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 56cc074e

BUCKET_ID_FUNC_OFFSET: 86

FAILURE_BUCKET_ID: 0x1E_c0000005_R_nt!KiTimerWaitTest

BUCKET_ID: 0x1E_c0000005_R_nt!KiTimerWaitTest

PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_nt!KiTimerWaitTest

TARGET_TIME: 2016-03-07T23:42:57.000Z

OSBUILD: 10586

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-02-23 03:16:30

BUILDDATESTAMP_STR: 160222-1549

BUILDLAB_STR: th2_release_inmarket

BUILDOSVER_STR: 10.0.10586.122.amd64fre.th2_release_inmarket.160222-1549

ANALYSIS_SESSION_ELAPSED_TIME: ad1

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_nt!kitimerwaittest

FAILURE_ID_HASH: {60392e1e-177d-1e45-9fd7-b743dcff84fd}

Followup: MachineOwner
---------

 
Upvote 0 Downvote
S

solidsecret15

Distinguished
Dec 19, 2011
40
0
18,540
For anyone wondering, my bluescreen issue was driver related, I downloaded a great little program (free I might add, so that's always a bonus!) That analyzed all of my crash dumps for me, the program was called "Whocrashed" and it told me what the most likely reasons for my crashes were, in my case it pointed to two drivers that were likely causing me grief (Aichargerplus.sys and an avast driver) I just thought I'd post and let the forum know as it may help someone else with bsod issues (and at the price of free, the worst thing that will happen is wasting your time :p) Thanks for looking, and a big thanks for dudmont for his response!
 
Upvote 0 Downvote
Solution
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom