Sign in with
Sign up | Sign in
Your question

Anyone good with understanding debugging info after bluescreen?

Last response: in Windows 7
Share
September 7, 2012 3:27:44 PM

Blue screen then restart,


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\090612-17425-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03000000 PsLoadedModuleList = 0xfffff800`0323de50
Debug session time: Thu Sep 6 21:14:10.760 2012 (UTC + 1:00)
System Uptime: 0 days 0:22:32.430
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a00d9d7000, 0, fffff80003336079, 0}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiCompressRelocations+70 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a00d9d7000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80003336079, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032a80e0
fffff8a00d9d7000

FAULTING_IP:
nt!MiCompressRelocations+70
fffff800`03336079 410fb701 movzx eax,word ptr [r9]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: rundll32.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff8800da7c5d0 -- (.trap 0xfffff8800da7c5d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003336079 rsp=fffff8800da7c760 rbp=000000000008fc28
r8=000000007ffff960 r9=fffff8a00d9d7000 r10=000000000006ed2c
r11=0000000000000008 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiCompressRelocations+0x70:
fffff800`03336079 410fb701 movzx eax,word ptr [r9] ds:fffff8a0`0d9d7000=????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800030f11e4 to fffff80003071f00

STACK_TEXT:
fffff880`0da7c468 fffff800`030f11e4 : 00000000`00000050 fffff8a0`0d9d7000 00000000`00000000 fffff880`0da7c5d0 : nt!KeBugCheckEx
fffff880`0da7c470 fffff800`0306ffee : 00000000`00000000 00000000`00000003 fffff800`03227a00 fffff800`03098e00 : nt! ?? ::FNODOBFM::`string'+0x42907
fffff880`0da7c5d0 fffff800`03336079 : 00000000`01000000 fffff800`03336461 fffffa80`07baaf20 fffff800`033365a4 : nt!KiPageFault+0x16e
fffff880`0da7c760 fffff800`03334932 : 00000000`000d56a0 00000000`01000000 00000000`00000001 00000000`00000004 : nt!MiCompressRelocations+0x70
fffff880`0da7c7b0 fffff800`0336a5d1 : fffff8a0`0d22f000 fffff880`0da7c9c0 00000000`00000095 00000000`00000000 : nt!MiRelocateImage+0x4a2
fffff880`0da7c920 fffff800`0335f893 : fffff880`0da7cb80 00000000`00000000 00000000`00000000 00000000`00000001 : nt!MmCreateSection+0x825
fffff880`0da7cb30 fffff800`03071153 : fffffa80`0743cb60 00000000`000bb7e8 fffff880`0da7cbc8 00000000`00000000 : nt!NtCreateSection+0x162
fffff880`0da7cbb0 00000000`7717035a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000bb7c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7717035a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiCompressRelocations+70
fffff800`03336079 410fb701 movzx eax,word ptr [r9]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!MiCompressRelocations+70

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x50_nt!MiCompressRelocations+70

BUCKET_ID: X64_0x50_nt!MiCompressRelocations+70

Followup: MachineOwner
---------
a b $ Windows 7
September 7, 2012 3:43:31 PM

Looks like RAM.... most blue screens are RAM or a bad driver. I would run memtest to make sure. Then if it is RAM check your voltage in BIOS and try memtest again with just one stick of RAM. till you find the bad chip.
a c 228 $ Windows 7
September 7, 2012 3:45:42 PM

I agree, plus these kind of shout it out.

Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiCompressRelocations+70 )

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Related resources
a b $ Windows 7
September 7, 2012 4:07:35 PM

50 series codes more often than not point to memory as the issue.
September 7, 2012 5:05:03 PM

1) Use WhoCrashed
http://www.resplendence.com/download/whocrashedSetup.ex...

2)
Quote:
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.


I was facing this problem when i didn't have enough page file on my C: drive. I had set it to 512MB and kept the rest on a partition on my HDD (C: is on my SSD).

This was probably happening because i turn my HDD off, and when windows wanted to use it, it wasn't available, so i got a BSOD.
!