REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: [COLOR="#FF0000"]ffff98855e4c5080[/COLOR], Object whose reference count is being lowered
[COLOR="#008000"]// das ist die Adresse des auslösenden Objekts[/COLOR]
Arg3: 0000000000000006, Reserved
Arg4: ffffffffffffffff, Reserved
....
# Memory Child-SP RetAddr Call Site
00 ffffab84`6e630a28 fffff800`f6c71696 nt!KeBugCheckEx
[COLOR="#008000"]// Stoppfehler, weil der Referenzzähler schon 0 (Null) war[/COLOR]
01 8 ffffab84`6e630a30 fffff800`f6f9d779 [COLOR="#FF0000"]nt!IopDecrementDeviceObjectRef[/COLOR]+0x14af66
[COLOR="#008000"]// die Objekt-Referenz um eines erniedrigen[/COLOR]
02 40 ffffab84`6e630a70 fffff800`f6f8fa70 nt!IopDeleteFile+0x1a9
03 80 ffffab84`6e630af0 fffff800`f6b14a21 [COLOR="#FF0000"]nt!ObpRemoveObjectRoutine+0x80[/COLOR]
[COLOR="#008000"]// ein Objekt entfernen[/COLOR]
04 60 ffffab84`6e630b50 fffff800`f6b20f0b nt!ObfDereferenceObject+0xa1
05 40 ffffab84`6e630b90 fffff800`f6ad7234 nt!CcDeleteSharedCacheMap+0x18b
06 50 ffffab84`6e630be0 fffff800`f6ace335 nt!CcWriteBehindInternal+0x334
07 e0 ffffab84`6e630cc0 fffff800`f6b70cd7 nt!ExpWorkerThread+0xf5
08 90 ffffab84`6e630d50 fffff800`f6c2b8d6 nt!PspSystemThreadStartup+0x47
09 50 ffffab84`6e630da0 00000000`00000000 nt!KiStartSystemThread+0x16
....
[COLOR="#008000"]// jetzt mit Arg2 des BugcheckCode das Objekt ermitteln[/COLOR]
!devobj ffff98855e4c5080
Device object (ffff98855e4c5080) is for:
Cannot read info offset from nt!ObpInfoMaskToOffset
Unable to load image \??\[COLOR="#FF0000"]C:\Windows\Sleen1764.sys[/COLOR], Win32 error 0n2
[COLOR="#008000"]// dieser Treiber hat den Fehler verursacht.[/COLOR]
*** WARNING: Unable to verify timestamp for Sleen1764.sys
*** ERROR: Module load completed but symbols could not be loaded for Sleen1764.sys
\Driver\SLEE_17_DRIVER DriverObject ffff988557a6be60
Current Irp 00000000 RefCount -1 Type 00000007 Flags 00000050
Vpb ffff98855ee34210 SecurityDescriptor ffffd488a4983060 DevExt ffff98855e4c51d0 DevObjExt ffff98855e4c54e8
ExtensionFlags (0x00000002) DOE_DELETE_PENDING
Characteristics (0x00000001) FILE_REMOVABLE_MEDIA
Device queue is not busy.