KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000008, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
+619b2faf02c9de64
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000008
EXCEPTION_PARAMETER2: 0000000000000000
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032fc100
0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff880027bd320 -- (.trap 0xfffff880027bd320)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000038 rbx=0000000000000000 rcx=fffffa8005562658
rdx=fffffa800553bb58 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=fffff880027bd4b8 rbp=00000000ffffffff
r8=fffff78000000008 r9=0000000000000000 r10=0000000000000000
r11=fffff88003563180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
00000000`00000000 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000310f728 to fffff800030c4c00
STACK_TEXT:
fffff880`027bca98 fffff800`0310f728 : 00000000`0000001e ffffffff`c0000005 00000000`00000000 00000000`00000008 : nt!KeBugCheckEx
fffff880`027bcaa0 fffff800`030c4282 : fffff880`027bd278 fffffa80`0553bb40 fffff880`027bd320 fffffa80`05369bc0 : nt! ?? ::FNODOBFM::`string'+0x487ed
fffff880`027bd140 fffff800`030c2dfa : 00000000`00000008 00000000`00000000 00000000`00000000 fffffa80`0553bb40 : nt!KiExceptionDispatch+0xc2
fffff880`027bd320 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`03563180 : nt!KiPageFault+0x23a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+487ed
fffff800`0310f728 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+487ed
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5147d9c6
FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!_??_::FNODOBFM::_string_+487ed
BUCKET_ID: X64_0x1E_c0000005_nt!_??_::FNODOBFM::_string_+487ed
Followup: MachineOwner
---------
This is a side effect of Basic Block Tools optimization (BBT). Using public symbols the debugger will find it hard to get to the right symbol, there is a nice a trick you can use in order to get to the right function.
http://blogs.msdn.com/b/ntdebugging/...he-rescue.aspx http://forum.sysinternals.com/what-i...247_page2.html