---------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\symbols*
Symbol information
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18226.amd64fre.vistasp1_gdr.090302-1506
Machine Name:
Kernel base = 0xfffff800`0225a000 PsLoadedModuleList = 0xfffff800`0241fdb0
Debug session time: Sun Aug 9 16:09:26.720 2009 (GMT+2)
System Uptime: 0 days 3:13:09.749
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {8, 2, 1, fffffa6004372eb8}
*** ERROR: Module load completed but symbols could not be loaded for inspect.sys
Probably caused by : inspect.sys ( inspect+1eb8 )
Followup: MachineOwner
---------
2: kd> !analyze –v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {8, 2, 1, fffffa6004372eb8}
Probably caused by : inspect.sys ( inspect+1eb8 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffffa6004372eb8, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 0000000000000008
CURRENT_IRQL: 2
FAULTING_IP:
inspect+1eb8
fffffa60`04372eb8 48894208 mov qword ptr [rdx+8],rax
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffffa60027c9b20 -- (.trap 0xfffffa60027c9b20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa6004382d20 rbx=0000000000000000 rcx=fffffa6004382d30
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa6004372eb8 rsp=fffffa60027c9cb0 rbp=0000000000000080
r8=0000000000000000 r9=50007d489e000000 r10=50007d489fe30001
r11=00000000000007ff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
inspect+0x1eb8:
fffffa60`04372eb8 48894208 mov qword ptr [rdx+8],rax ds:1690:0008=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800022ae3ee to fffff800022ae650
STACK_TEXT:
fffffa60`027c99d8 fffff800`022ae3ee : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffffa60`027c99e0 fffff800`022ad2cb : 00000000`00000001 00000000`00000000 00000000`00000000 fffffa80`03ea44f0 : nt!KiBugCheckDispatch+0x6e
fffffa60`027c9b20 fffffa60`04372eb8 : fffffa80`042433f0 fffffa60`00e066a6 fffffa80`06754310 fffffa60`00e17786 : nt!KiPageFault+0x20b
fffffa60`027c9cb0 fffffa60`04378d0f : fffffa60`043828b0 fffffa60`043828c0 fffffa60`043828b0 fffffa80`06754310 : inspect+0x1eb8
fffffa60`027c9ce0 fffffa60`0437cd6d : fffffa80`03ea44f0 fffffa80`066963e0 fffffa60`043828c0 fffffa80`03ea44f0 : inspect+0x7d0f
fffffa60`027c9d10 fffff800`024d2fd3 : fffffa80`06750040 00000000`00000000 fffffa80`03681690 fffffa60`0437cb54 : inspect+0xbd6d
fffffa60`027c9d50 fffff800`022e8816 : fffffa60`01963180 fffffa80`06750040 fffffa60`0196cd40 00000000`00000001 : nt!PspSystemThreadStartup+0x57
fffffa60`027c9d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
inspect+1eb8
fffffa60`04372eb8 48894208 mov qword ptr [rdx+8],rax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: inspect+1eb8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: inspect
IMAGE_NAME: inspect.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 49a43ce5
FAILURE_BUCKET_ID: X64_0xD1_inspect+1eb8
BUCKET_ID: X64_0xD1_inspect+1eb8
Followup: MachineOwner
---------
---------------------------------------------------------------------
