SysnativeBSODApps - additional check 'drivers found in stack'

niemiro · Sep 26, 2012

usasma said:
I've just upgraded to v2121 of the app and got a hang on the 5/28/12 memory dump
Attached is the tmp folder and the dump folder.....

Just noted this from the KD box in the app:

{1} !niemiro.rawstack
{2} !niemiro.rawstack -dc
{3} {124} !niemiro.auto_errrec

Click to expand...

I had tried to rename the {3} to {124}
It seems that the app added the {3} back in

I'll try it without the renaming....

I crossed posted. I will look into this. Thank you.

@writhziden, a hang is probably caused by my extension.

usasma · Sep 26, 2012

missing \pshed.pdb\F1B5874289B044199CE35519D256D3E32\pshed.pdb
Going to repopulate now.....

Don't recall having done any STOP 0x124 dumps in a very long time.
__________________________________________________________
Done, I now have \pshed.pdb\F1B5874289B044199CE35519D256D3E32\pshed.pdb

Thanks Richard!
___________________________________________________________
Just FYI - I had a curious issue at the last set of dumps (a group of 3 STOP 0x116 errors).
Had many, many corruption errors and a popup that said the following dumps were corrupted.
It named 2 of the 3 dumps - and named each of them 4 or 5 times

When the dumps finished, the reports looked normal to me.
No tmp folder present either.

I'll gather all the output stuff if it happens again.

niemiro · Sep 26, 2012

usasma said:
missing \pshed.pdb\F1B5874289B044199CE35519D256D3E32\pshed.pdb
Going to repopulate now.....

Don't recall having done any STOP 0x124 dumps in a very long time.
__________________________________________________________
Done, I now have \pshed.pdb\F1B5874289B044199CE35519D256D3E32\pshed.pdb

Thanks Richard!
___________________________________________________________
Just FYI - I had a curious issue at the last set of dumps (a group of 3 STOP 0x116 errors).
Had many, many corruption errors and a popup that said the following dumps were corrupted.
It named 2 of the 3 dumps - and named each of them 4 or 5 times

When the dumps finished, the reports looked normal to me.
No tmp folder present either.

I'll gather all the output stuff if it happens again.

No problem. Glad to be able to help.

I don't suppose you have those three dumps or a link to the thread so that we can take a look?

Thank you very much.

usasma · Sep 26, 2012

The app saved everything. It's in the attachment.
It's from this post:
http://windows7forums.com/blue-screen-death-bsod/85072-bsod-while-browsing-various-locations.html

usasma · Sep 26, 2012

STOP 0x124's work fine with the updated .pdb file
Why, if the .pdb was missing, didn't the app go get the symbol (that's how it says it's set)?
********************************************
The previous errors are reproducible on my system (the corrupted dump files)
I've run some older dumps that didn't give the problem - so I've gotta conclude that the above situation was due to corrupted dumps in that one particular post.

I do wonder why it says corrupted - and then generates the text files without any issues (that I can see)?

writhziden · Sep 26, 2012

Code:

Missing image name, possible paged-out or corrupt data.
Missing image name, possible paged-out or corrupt data.

...

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

BUCKET_ID:  CORRUPT_MODULELIST

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` 

FAILURE_BUCKET_ID:  X64_0x116_ANALYSIS_INCONCLUSIVE

The first two lines are what led the apps to print out that the .dmps were probably corrupted.

As to the {124} then switching back to {3} {124} issue, that was due to numbering the list out of order. The apps were expecting that to be the third item in the list, so they added {3} because 124 was not equal to 3. The apps likely had a hang up due to trying to run a command through the kernel debugger that the debugger did not recognize. I'll check the tmp data...

It would appear the problem was indeed due to the {124} as we both suspected.

usasma said:
STOP 0x124's work fine with the updated .pdb file
Why, if the .pdb was missing, didn't the app go get the symbol (that's how it says it's set)?
********************************************
The previous errors are reproducible on my system (the corrupted dump files)
I've run some older dumps that didn't give the problem - so I've gotta conclude that the above situation was due to corrupted dumps in that one particular post.

I do wonder why it says corrupted - and then generates the text files without any issues (that I can see)?

Tracked it down. The error message was not the typical message for symbols missing. I have now added in more robust symbol checking for wrong symbols. It won't always work since not all symbols are provided via http://msdl.microsoft.com/download/symbols, but it should work most of the time. Here is an example case where even online symbols did not resolve symbols errors:

Code:

**************************Sun Jun 17 07:26:39.485 2012 (UTC - 6:00)************************** 



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 
Copyright (c) Microsoft Corporation. All rights reserved. 


Loading Dump File [C:\Users\Mike\Downloads\testDumps\061712-23119-01.dmp] 
Mini Kernel Dump File: Only registers and stack trace are available 

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols 
Executable search path is:  
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 
Product: WinNt, suite: TerminalServer SingleUserTS Personal 
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850 
Machine Name: 
Kernel base = 0xfffff800`0300f000 PsLoadedModuleList = 0xfffff800`03254e90 
Debug session time: Sun Jun 17 07:26:39.485 2012 (UTC - 6:00) 
System Uptime: 0 days 0:36:27.968 
Loading Kernel Symbols 
............................................................... 
................................................................ 
........................................... 
Loading User Symbols 
Loading unloaded module list 
.......................................... 
******************************************************************************* 
*                                                                             * 
*                        Bugcheck Analysis                                    * 
*                                                                             * 
******************************************************************************* 

Use !analyze -v to get detailed debugging information. 

BugCheck FE, {8, 6, 5, fffffa8004ed2000} 

************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Your debugger is not using the correct symbols                 *** 
***                                                                   *** 
***    In order for this command to work properly, your symbol path   *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: usbport!_DEVICE_EXTENSION                     *** 
***                                                                   *** 
************************************************************************* 
************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Your debugger is not using the correct symbols                 *** 
***                                                                   *** 
***    In order for this command to work properly, your symbol path   *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: usbhub!_DEVICE_EXTENSION_HUB                  *** 
***                                                                   *** 
************************************************************************* 
************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Your debugger is not using the correct symbols                 *** 
***                                                                   *** 
***    In order for this command to work properly, your symbol path   *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: usbhub!_DEVICE_EXTENSION_HUB                  *** 
***                                                                   *** 
************************************************************************* 
************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Your debugger is not using the correct symbols                 *** 
***                                                                   *** 
***    In order for this command to work properly, your symbol path   *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: usbhub!_DEVICE_EXTENSION_HUB                  *** 
***                                                                   *** 
************************************************************************* 
Probably caused by : usbhub.sys ( usbhub!UsbhHubProcessChangeWorker+ec ) 

Followup: MachineOwner 
--------- 

2: kd> kd: Reading initial command '!analyze -v; !sysinfo cpuspeed; !sysinfo SMBIOS; lmtsmn; q' 
******************************************************************************* 
*                                                                             * 
*                        Bugcheck Analysis                                    * 
*                                                                             * 
******************************************************************************* 

BUGCODE_USB_DRIVER (fe) 
USB Driver bugcheck, first parameter is USB bugcheck code. 
Arguments: 
Arg1: 0000000000000008, USBBUGCODE_RESERVED_USBHUB 
Arg2: 0000000000000006, USBHUB_TRAP_FATAL_TIMEOUT 
Arg3: 0000000000000005, TimeoutCode: Timeout_PCE_Suspend_Action3 - PortData->PortSuspendEvent 
Arg4: fffffa8004ed2000, TimeoutContext - PortData 

Debugging Details: 
------------------ 

************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Your debugger is not using the correct symbols                 *** 
***                                                                   *** 
***    In order for this command to work properly, your symbol path   *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: usbport!_DEVICE_EXTENSION                     *** 
***                                                                   *** 
************************************************************************* 
************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Your debugger is not using the correct symbols                 *** 
***                                                                   *** 
***    In order for this command to work properly, your symbol path   *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: usbhub!_DEVICE_EXTENSION_HUB                  *** 
***                                                                   *** 
************************************************************************* 
************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Your debugger is not using the correct symbols                 *** 
***                                                                   *** 
***    In order for this command to work properly, your symbol path   *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: usbhub!_DEVICE_EXTENSION_HUB                  *** 
***                                                                   *** 
************************************************************************* 
************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Your debugger is not using the correct symbols                 *** 
***                                                                   *** 
***    In order for this command to work properly, your symbol path   *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: usbhub!_DEVICE_EXTENSION_HUB                  *** 
***                                                                   *** 
************************************************************************* 

CUSTOMER_CRASH_COUNT:  1 

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT 

BUGCHECK_STR:  0xFE 

PROCESS_NAME:  System 

CURRENT_IRQL:  0 

LAST_CONTROL_TRANSFER:  from fffff88004a55a60 to fffff8000308f640 

STACK_TEXT:   
fffff880`033c4c18 fffff880`04a55a60 : 00000000`000000fe 00000000`00000008 00000000`00000006 00000000`00000005 : nt!KeBugCheckEx 
fffff880`033c4c20 fffff800`03385f33 : fffffa80`04eb4050 00000000`00000001 ffffffff`dc3a58a0 fffff800`0322c658 : usbhub!UsbhHubProcessChangeWorker+0xec 
fffff880`033c4c80 fffff800`03099a21 : fffff800`0322c600 fffff800`03385f01 fffffa80`03b65600 fffffa80`03b65680 : nt!IopProcessWorkItem+0x23 
fffff880`033c4cb0 fffff800`0332ccce : 00000000`00000000 fffffa80`03b65680 00000000`00000080 fffffa80`03b4f840 : nt!ExpWorkerThread+0x111 
fffff880`033c4d40 fffff800`03080fe6 : fffff880`031d3180 fffffa80`03b65680 fffff880`031ddfc0 ffffffff`fffff7fb : nt!PspSystemThreadStartup+0x5a 
fffff880`033c4d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 


STACK_COMMAND:  kb 

FOLLOWUP_IP:  
usbhub!UsbhHubProcessChangeWorker+ec 
fffff880`04a55a60 cc              int     3 

SYMBOL_STACK_INDEX:  1 

SYMBOL_NAME:  usbhub!UsbhHubProcessChangeWorker+ec 

FOLLOWUP_NAME:  MachineOwner 

MODULE_NAME: usbhub 

IMAGE_NAME:  usbhub.sys 

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7a68e 

FAILURE_BUCKET_ID:  X64_0xFE_usbhub!UsbhHubProcessChangeWorker+ec 

BUCKET_ID:  X64_0xFE_usbhub!UsbhHubProcessChangeWorker+ec 

Followup: MachineOwner 
--------- 

CPUID:        "Intel(R) Core(TM) i5 CPU       M 520  @ 2.40GHz" 
MaxSpeed:     2400 
CurrentSpeed: 2393 
[SMBIOS Data Tables v2.6] 
[DMI Version - 0] 
[2.0 Calling Convention - No] 
[Table Size - 2211 bytes] 

[BIOS Information (Type 0) - Length 24 - Handle 0000h] 
  Vendor                        Phoenix Technologies Ltd. 
  BIOS Version                  04JB.M014.20091221.hkk 
  BIOS Starting Address Segment e27a 
  BIOS Release Date             12/21/2009 
  BIOS ROM Size                 400000 
  BIOS Characteristics 
       04: - ISA Supported 
       07: - PCI Supported 
       08: - PCMCIA Supported 
       09: - Plug and Play Supported 
       11: - Upgradeable FLASH BIOS 
       12: - BIOS Shadowing Supported 
       14: - ESCD Supported 
       15: - CD-Boot Supported 
  BIOS Characteristic Extensions 
       00: - ACPI Supported 
       01: - USB Legacy Supported 
       02: - AGP Supported 
       08: - BIOS Boot Specification Supported 
       10: - Specification Reserved 
  BIOS Major Revision           4 
  BIOS Minor Revision           0 
  EC Firmware Major Revision    255 
  EC Firmware Minor Revision    255 
[System Information (Type 1) - Length 27 - Handle 0001h] 
  Manufacturer                  SAMSUNG ELECTRONICS CO., LTD. 
  Product Name                  R580                        
  Version                       Not Applicable 
  Serial Number                                
  UUID                          00000000-0000-0000-0000-000000000000 
  Wakeup Type                   Power Switch 
  SKUNumber                     [String Not Specified] 
  Family                        [String Not Specified] 
[BaseBoard Information (Type 2) - Length 17 - Handle 0002h] 
  Manufacturer                  SAMSUNG ELECTRONICS CO., LTD. 
  Product                       R580                        
  Version                       Not Applicable 
  Serial Number                                
  Asset Tag                               
  Feature Flags                 09h 
       -333146424: - h 
       -333146472: -  

  Location                      Not Applicable 
  Chassis Handle                0003h 
  Board Type                    0ah - Processor/Memory Module 
  Number of Child Handles       1 
  ChildHandle[0]                0000h 
[System Enclosure (Type 3) - Length 21 - Handle 0003h] 
  Manufacturer                  SAMSUNG ELECTRONICS CO., LTD. 
  Chassis Type                  Laptop 
  Version                       N/A          
  Serial Number                              
  Asset Tag Number                           
  Bootup State                  Safe 
  Power Supply State            Safe 
  Thermal State                 Safe 
  Security Status               None 
  OEM Defined                   4660 
  Height                        0U 
  Number of Power Cords         0 
  Number of Contained Elements  0 
  Contained Element Size        0 
[Processor Information (Type 4) - Length 42 - Handle 0004h] 
  Socket Designation            CPU 1 
  Processor Type                Central Processor 
  Processor Family              c6h - Specification Reserved 
  Processor Manufacturer        Intel 
  Processor ID                  52060200fffbebbf 
  Processor Version             Genuine Intel(R) CPU 
  Processor Voltage             02h - 3.3V  
  External Clock                133MHz 
  Max Speed                     3200MHz 
  Current Speed                 2400MHz 
  Status                        Enabled Populated 
  Processor Upgrade             Slot 1 
  L1 Cache Handle               0005h 
  L2 Cache Handle               0006h 
  L3 Cache Handle               0007h 
  Serial Number                 [String Not Specified] 
  Asset Tag Number              [String Not Specified] 
  Part Number                   [String Not Specified] 
[Cache Information (Type 7) - Length 19 - Handle 0005h] 
  Socket Designation            L1 Cache 
  Cache Configuration           0088h - WT Enabled Int Socketed L1 
  Maximum Cache Size            0020h - 32K 
  Installed Size                0020h - 32K 
  Supported SRAM Type           0058h - Burst Pipeline-Burst Asynchronous  
  Current SRAM Type             0040h - Asynchronous  
  Cache Speed                   0ns 
  Error Correction Type         Multi-Bit ECC 
  System Cache Type             Data 
  Associativity                 8-way Set-Associative 
[Cache Information (Type 7) - Length 19 - Handle 0006h] 
  Socket Designation            L2 Cache 
  Cache Configuration           0089h - WT Enabled Int Socketed L2 
  Maximum Cache Size            0400h - 1024K 
  Installed Size                0100h - 256K 
  Supported SRAM Type           0058h - Burst Pipeline-Burst Asynchronous  
  Current SRAM Type             0008h - Burst  
  Cache Speed                   0ns 
  Error Correction Type         Multi-Bit ECC 
  System Cache Type             Unified 
  Associativity                 8-way Set-Associative 
[Cache Information (Type 7) - Length 19 - Handle 0007h] 
  Socket Designation            L3 Cache 
  Cache Configuration           018ah - WB Enabled Int Socketed L3 
  Maximum Cache Size            2000h - 8192K 
  Installed Size                0c00h - 3072K 
  Supported SRAM Type           0058h - Burst Pipeline-Burst Asynchronous  
  Current SRAM Type             0008h - Burst  
  Cache Speed                   0ns 
  Error Correction Type         Unknown 
  System Cache Type             Unknown 
  Associativity                 Unknown 
[Onboard Devices Information (Type 10) - Length 6 - Handle 0013h] 
  Number of Devices             1 
  01: Type                      Video [disabled] 
  01: Description               IGD 
[Onboard Devices Information (Type 10) - Length 6 - Handle 0014h] 
  Number of Devices             1 
  01: Type                      Ethernet [disabled] 
  01: Description               GigaLAN 
[OEM Strings (Type 11) - Length 5 - Handle 0015h] 
  Number of Strings             2 
   1                            AABBAAAAAAAA 
   2                            2010/01/20 
[System Configuration Options (Type 12) - Length 5 - Handle 0016h] 
[Physical Memory Array (Type 16) - Length 15 - Handle 0018h] 
  Location                      03h - SystemBoard/Motherboard 
  Use                           03h - System Memory 
  Memory Error Correction       03h - None 
  Maximum Capacity              16777216KB 
  Memory Error Inf Handle       [Not Provided] 
  Number of Memory Devices      4 
[Memory Device (Type 17) - Length 28 - Handle 0019h] 
  Physical Memory Array Handle  0018h 
  Memory Error Info Handle      [No Errors] 
  Total Width                   64 bits 
  Data Width                    64 bits 
  Size                          2048MB 
  Form Factor                   0dh - SODIMM 
  Device Set                    01h 
  Device Locator                M1 
  Bank Locator                  Bank 0 
  Memory Type                   18h - Specification Reserved 
  Type Detail                   0080h - Synchronous 
  Speed                         533MHz 
  Manufacturer                  02FE             
  Serial Number                                  
  Asset Tag Number                   
  Part Number                   EBJ21UE8BDS0-AE-F  
[Memory Device (Type 17) - Length 28 - Handle 001ah] 
  Physical Memory Array Handle  0018h 
  Memory Error Info Handle      [No Errors] 
  Total Width                   64 bits 
  Data Width                    64 bits 
  Size                          2048MB 
  Form Factor                   0dh - SODIMM 
  Device Set                    01h 
  Device Locator                M2 
  Bank Locator                  Bank 1 
  Memory Type                   18h - Specification Reserved 
  Type Detail                   0080h - Synchronous 
  Speed                         533MHz 
  Manufacturer                  02FE             
  Serial Number                                  
  Asset Tag Number                   
  Part Number                   EBJ21UE8BDS0-AE-F  
[Memory Device (Type 17) - Length 28 - Handle 001bh] 
  Physical Memory Array Handle  0018h 
  Memory Error Info Handle      [No Errors] 
  Total Width                   0 bits 
  Data Width                    0 bits 
  Size                          [Not Populated] 
  Form Factor                   0dh - SODIMM 
  Device Set                    01h 
  Device Locator                M3 
  Bank Locator                  Bank 2 
  Memory Type                   18h - Specification Reserved 
  Type Detail                   0080h - Synchronous 
  Speed                         0MHz 
  Manufacturer                                   
  Serial Number                                  
  Asset Tag Number                   
  Part Number                                      
[Memory Device (Type 17) - Length 28 - Handle 001ch] 
  Physical Memory Array Handle  0018h 
  Memory Error Info Handle      [No Errors] 
  Total Width                   0 bits 
  Data Width                    0 bits 
  Size                          [Not Populated] 
  Form Factor                   0dh - SODIMM 
  Device Set                    01h 
  Device Locator                M4 
  Bank Locator                  Bank 3 
  Memory Type                   18h - Specification Reserved 
  Type Detail                   0080h - Synchronous 
  Speed                         0MHz 
  Manufacturer                                   
  Serial Number                                  
  Asset Tag Number                   
  Part Number                                      
[32Bit Memory Error Information (Type 18) - Length 23 - Handle 001dh] 
[32Bit Memory Error Information (Type 18) - Length 23 - Handle 001eh] 
[Memory Array Mapped Address (Type 19) - Length 15 - Handle 001fh] 
  Starting Address              00000000h 
  Ending Address                003fffffh 
  Memory Array Handle           0018h 
  Partition Width               02 
[Memory Device Mapped Address (Type 20) - Length 19 - Handle 0020h] 
  Starting Address              00000000h 
  Ending Address                001fffffh 
  Memory Device Handle          0019h 
  Mem Array Mapped Adr Handle   001fh 
  Partition Row Position        [Unknown] 
  Interleave Position           [Unknown] 
  Interleave Data Depth         [Unknown] 
[Memory Device Mapped Address (Type 20) - Length 19 - Handle 0021h] 
  Starting Address              00200000h 
  Ending Address                003fffffh 
  Memory Device Handle          001ah 
  Mem Array Mapped Adr Handle   001fh 
  Partition Row Position        [Unknown] 
  Interleave Position           [Unknown] 
  Interleave Data Depth         [Unknown] 
start             end                 module name 
fffff880`00f0f000 fffff880`00f66000   ACPI     ACPI.sys     Sat Nov 20 02:19:16 2010 (4CE79294) 
fffff880`040f1000 fffff880`0417a000   afd      afd.sys      Sat Nov 20 02:23:27 2010 (4CE7938F) 
fffff880`05a35000 fffff880`05a4b000   AgileVpn AgileVpn.sys Mon Jul 13 18:10:24 2009 (4A5BCCF0) 
fffff880`00c10000 fffff880`00c1b000   amdxata  amdxata.sys  Fri Mar 19 10:18:18 2010 (4BA3A3CA) 
fffff880`06671000 fffff880`0667c000   asyncmac asyncmac.sys Mon Jul 13 18:10:13 2009 (4A5BCCE5) 
fffff880`00dbb000 fffff880`00dc4000   atapi    atapi.sys    Mon Jul 13 17:19:47 2009 (4A5BC113) 
fffff880`00dc4000 fffff880`00dee000   ataport  ataport.SYS  Sat Nov 20 02:19:15 2010 (4CE79293) 
fffff880`05c2c000 fffff880`05ede000   athrx    athrx.sys    Mon Dec 12 06:02:13 2011 (4EE5FB55) 
fffff880`00fd7000 fffff880`00fe3000   BATTC    BATTC.SYS    Mon Jul 13 17:31:01 2009 (4A5BC3B5) 
fffff880`01683000 fffff880`0168a000   Beep     Beep.SYS     Mon Jul 13 18:00:13 2009 (4A5BCA8D) 
fffff880`04620000 fffff880`04740000   BHDrvx64 BHDrvx64.sys Tue Mar 13 14:02:37 2012 (4F5FA7DD) 
fffff880`0452c000 fffff880`0453d000   blbdrive blbdrive.sys Mon Jul 13 17:35:59 2009 (4A5BC4DF) 
fffff880`03d4a000 fffff880`03d68000   bowser   bowser.sys   Mon Jul 13 17:23:50 2009 (4A5BC206) 
fffff880`06a00000 fffff880`06a10000   BthEnum  BthEnum.sys  Mon Jul 13 18:06:52 2009 (4A5BCC1C) 
fffff880`0453d000 fffff880`04554000   bthmodem bthmodem.sys Mon Jul 13 18:06:52 2009 (4A5BCC1C) 
fffff880`04600000 fffff880`04620000   bthpan   bthpan.sys   Mon Jul 13 18:07:00 2009 (4A5BCC24) 
fffff880`06d71000 fffff880`06dfd000   bthport  bthport.sys  Sat Nov 20 03:44:51 2010 (4CE7A6A3) 
fffff880`06d59000 fffff880`06d71000   BTHUSB   BTHUSB.sys   Sat Nov 20 03:44:33 2010 (4CE7A691) 
fffff880`06d49000 fffff880`06d59000   btusbflt btusbflt.sys Tue Jun 09 15:46:26 2009 (4A2ED832) 
fffff880`020a1000 fffff880`02127000   btwaudio btwaudio.sys Mon Sep 28 09:47:34 2009 (4AC0DA96) 
fffff880`04554000 fffff880`045cf000   btwavdt  btwavdt.sys  Tue Aug 25 14:35:17 2009 (4A944B05) 
fffff880`02127000 fffff880`02133000   btwl2cap btwl2cap.sys Fri Apr 03 18:28:45 2009 (49D6A9BD) 
fffff880`02133000 fffff880`02136880   btwrchid btwrchid.sys Tue Aug 25 14:36:32 2009 (4A944B50) 
fffff880`01655000 fffff880`01683000   ccSetx64 ccSetx64.sys Fri Nov 04 16:05:25 2011 (4EB461A5) 
fffff960`00670000 fffff960`00697000   cdd      cdd.dll      unavailable (00000000) 
fffff880`0162b000 fffff880`01655000   cdrom    cdrom.sys    Sat Nov 20 02:19:20 2010 (4CE79298) 
fffff880`00ce1000 fffff880`00da1000   CI       CI.dll       Sat Nov 20 06:12:36 2010 (4CE7C944) 
fffff880`01b49000 fffff880`01b79000   CLASSPNP CLASSPNP.SYS Sat Nov 20 02:19:23 2010 (4CE7929B) 
fffff880`00c83000 fffff880`00ce1000   CLFS     CLFS.SYS     Mon Jul 13 17:19:57 2009 (4A5BC11D) 
fffff880`05f4e000 fffff880`05f52500   CmBatt   CmBatt.sys   Mon Jul 13 17:31:03 2009 (4A5BC3B7) 
fffff880`01000000 fffff880`01072000   cng      cng.sys      Sat Nov 20 03:08:45 2010 (4CE79E2D) 
fffff880`00fce000 fffff880`00fd7000   compbatt compbatt.sys Mon Jul 13 17:31:02 2009 (4A5BC3B6) 
fffff880`05a25000 fffff880`05a35000   CompositeBus CompositeBus.sys Sat Nov 20 03:33:17 2010 (4CE7A3ED) 
fffff880`06cd0000 fffff880`06cde000   crashdmp crashdmp.sys Mon Jul 13 18:01:01 2009 (4A5BCABD) 
fffff880`0450e000 fffff880`0452c000   dfsc     dfsc.sys     Sat Nov 20 02:26:31 2010 (4CE79447) 
fffff880`044ff000 fffff880`0450e000   discache discache.sys Mon Jul 13 17:37:18 2009 (4A5BC52E) 
fffff880`01b33000 fffff880`01b49000   disk     disk.sys     Mon Jul 13 17:19:57 2009 (4A5BC11D) 
fffff880`047a3000 fffff880`047c5000   drmk     drmk.sys     Mon Jul 13 19:01:25 2009 (4A5BD8E5) 
fffff880`06cde000 fffff880`06cea000   dump_dumpata dump_dumpata.sys Mon Jul 13 17:19:47 2009 (4A5BC113) 
fffff880`06cf5000 fffff880`06d08000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 17:21:51 2009 (4A5BC18F) 
fffff880`06cea000 fffff880`06cf5000   dump_msahci dump_msahci.sys Sat Nov 20 03:33:58 2010 (4CE7A416) 
fffff880`06d08000 fffff880`06d49000   dump_truecrypt dump_truecrypt.sys Tue Feb 07 02:09:36 2012 (4F30EA50) 
fffff880`02159000 fffff880`02165000   Dxapi    Dxapi.sys    Mon Jul 13 17:38:28 2009 (4A5BC574) 
fffff880`042d4000 fffff880`043c8000   dxgkrnl  dxgkrnl.sys  Sat Nov 20 02:50:50 2010 (4CE799FA) 
fffff880`04200000 fffff880`04246000   dxgmms1  dxgmms1.sys  Sat Nov 20 02:49:53 2010 (4CE799C1) 
fffff880`04460000 fffff880`044d9000   eeCtrl64 eeCtrl64.sys Fri Jan 20 16:39:48 2012 (4F19FB44) 
fffff880`044d9000 fffff880`044ff000   EraserUtilRebootDrv EraserUtilRebootDrv.sys Fri Jan 20 16:39:49 2012 (4F19FB45) 
fffff880`01197000 fffff880`011ab000   fileinfo fileinfo.sys Mon Jul 13 17:34:25 2009 (4A5BC481) 
fffff880`010da000 fffff880`01126000   fltmgr   fltmgr.sys   Sat Nov 20 02:19:24 2010 (4CE7929C) 
fffff880`01411000 fffff880`0141b000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 17:19:45 2009 (4A5BC111) 
fffff880`01af9000 fffff880`01b33000   fvevol   fvevol.sys   Sat Nov 20 02:24:06 2010 (4CE793B6) 
fffff880`01a06000 fffff880`01a50000   fwpkclnt fwpkclnt.sys Sat Nov 20 02:21:37 2010 (4CE79321) 
fffff800`035f9000 fffff800`03642000   hal      hal.dll      Sat Nov 20 06:00:25 2010 (4CE7C669) 
fffff880`04246000 fffff880`0426a000   HDAudBus HDAudBus.sys Sat Nov 20 03:43:42 2010 (4CE7A65E) 
fffff880`02137000 fffff880`02150000   HIDCLASS HIDCLASS.SYS Sat Nov 20 03:43:49 2010 (4CE7A665) 
fffff880`02150000 fffff880`02158080   HIDPARSE HIDPARSE.SYS Mon Jul 13 18:06:17 2009 (4A5BCBF9) 
fffff880`03c81000 fffff880`03d4a000   HTTP     HTTP.sys     Sat Nov 20 02:24:30 2010 (4CE793CE) 
fffff880`01af0000 fffff880`01af9000   hwpolicy hwpolicy.sys Sat Nov 20 02:18:54 2010 (4CE7927E) 
fffff880`05f53000 fffff880`05f71000   i8042prt i8042prt.sys Mon Jul 13 17:19:57 2009 (4A5BC11D) 
fffff880`02e00000 fffff880`02e7d000   IDSvia64 IDSvia64.sys Fri Mar 09 14:57:02 2012 (4F5A7CAE) 
fffff880`05a0f000 fffff880`05a25000   intelppm intelppm.sys Mon Jul 13 17:19:25 2009 (4A5BC0FD) 
fffff880`01200000 fffff880`01231000   Ironx64  Ironx64.SYS  Mon Nov 14 19:00:53 2011 (4EC1C7D5) 
fffff880`05f71000 fffff880`05f80000   kbdclass kbdclass.sys Mon Jul 13 17:19:50 2009 (4A5BC116) 
fffff800`00ba2000 fffff800`00bac000   kdcom    kdcom.dll    Mon Jul 13 19:31:07 2009 (4A5BDFDB) 
fffff880`04a00000 fffff880`04a43000   ks       ks.sys       Sat Nov 20 03:33:23 2010 (4CE7A3F3) 
fffff880`015df000 fffff880`015fa000   ksecdd   ksecdd.sys   Sat Nov 20 02:21:15 2010 (4CE7930B) 
fffff880`01600000 fffff880`0162b000   ksecpkg  ksecpkg.sys  Sat Nov 20 03:10:34 2010 (4CE79E9A) 
fffff880`05bf9000 fffff880`05bfe200   ksthunk  ksthunk.sys  Mon Jul 13 18:00:19 2009 (4A5BCA93) 
fffff880`021b7000 fffff880`021cc000   lltdio   lltdio.sys   Mon Jul 13 18:08:50 2009 (4A5BCC92) 
fffff880`02173000 fffff880`02196000   luafv    luafv.sys    Mon Jul 13 17:26:13 2009 (4A5BC295) 
fffff880`00c20000 fffff880`00c6f000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Nov 20 06:03:51 2010 (4CE7C737) 
fffff880`047f1000 fffff880`04800000   modem    modem.sys    Mon Jul 13 18:10:48 2009 (4A5BCD08) 
fffff880`02165000 fffff880`02173000   monitor  monitor.sys  Mon Jul 13 17:38:52 2009 (4A5BC58C) 
fffff880`05a00000 fffff880`05a0f000   mouclass mouclass.sys Mon Jul 13 17:19:50 2009 (4A5BC116) 
fffff880`00da1000 fffff880`00dbb000   mountmgr mountmgr.sys Sat Nov 20 02:19:21 2010 (4CE79299) 
fffff880`03d68000 fffff880`03d80000   mpsdrv   mpsdrv.sys   Mon Jul 13 18:08:25 2009 (4A5BCC79) 
fffff880`03d80000 fffff880`03dad000   mrxsmb   mrxsmb.sys   Sat Nov 20 02:27:41 2010 (4CE7948D) 
fffff880`03dad000 fffff880`03dfa000   mrxsmb10 mrxsmb10.sys Sat Nov 20 02:26:53 2010 (4CE7945D) 
fffff880`03c00000 fffff880`03c24000   mrxsmb20 mrxsmb20.sys Sat Nov 20 02:26:47 2010 (4CE79457) 
fffff880`00dee000 fffff880`00df9000   msahci   msahci.sys   Sat Nov 20 03:33:58 2010 (4CE7A416) 
fffff880`01231000 fffff880`0123c000   Msfs     Msfs.SYS     Mon Jul 13 17:19:47 2009 (4A5BC113) 
fffff880`00f6f000 fffff880`00f79000   msisadrv msisadrv.sys Mon Jul 13 17:19:26 2009 (4A5BC0FE) 
fffff880`01392000 fffff880`013f0000   msrpc    msrpc.sys    Sat Nov 20 02:21:56 2010 (4CE79334) 
fffff880`02f9e000 fffff880`02fa9000   mssmbios mssmbios.sys Mon Jul 13 17:31:10 2009 (4A5BC3BE) 
fffff880`01ade000 fffff880`01af0000   mup      mup.sys      Mon Jul 13 17:23:45 2009 (4A5BC201) 
fffff880`01696000 fffff880`01789000   ndis     ndis.sys     Sat Nov 20 02:23:30 2010 (4CE79392) 
fffff880`05a6f000 fffff880`05a7b000   ndistapi ndistapi.sys Mon Jul 13 18:10:00 2009 (4A5BCCD8) 
fffff880`02053000 fffff880`02066000   ndisuio  ndisuio.sys  Sat Nov 20 03:50:08 2010 (4CE7A7E0) 
fffff880`05f80000 fffff880`05faf000   ndiswan  ndiswan.sys  Sat Nov 20 03:52:32 2010 (4CE7A870) 
fffff880`04a9d000 fffff880`04ab2000   NDProxy  NDProxy.SYS  Sat Nov 20 03:52:20 2010 (4CE7A864) 
fffff880`04016000 fffff880`04025000   netbios  netbios.sys  Mon Jul 13 18:09:26 2009 (4A5BCCB6) 
fffff880`0417a000 fffff880`041bf000   netbt    netbt.sys    Sat Nov 20 02:23:18 2010 (4CE79386) 
fffff880`01789000 fffff880`017e9000   NETIO    NETIO.SYS    Sat Nov 20 02:23:13 2010 (4CE79381) 
fffff880`01097000 fffff880`010a8000   Npfs     Npfs.SYS     Mon Jul 13 17:19:48 2009 (4A5BC114) 
fffff880`02f92000 fffff880`02f9e000   nsiproxy nsiproxy.sys Mon Jul 13 17:21:02 2009 (4A5BC15E) 
fffff800`0300f000 fffff800`035f9000   nt       ntkrnlmp.exe Sat Nov 20 02:30:02 2010 (4CE7951A) 
fffff880`0143c000 fffff880`015df000   Ntfs     Ntfs.sys     Sat Nov 20 02:20:57 2010 (4CE792F9) 
fffff880`01bf2000 fffff880`01bfb000   Null     Null.SYS     Mon Jul 13 17:19:37 2009 (4A5BC109) 
fffff880`055e4000 fffff880`055e5180   nvBridge nvBridge.kmd Wed Feb 10 06:15:51 2010 (4B72B187) 
fffff880`055e6000 fffff880`055fe000   nvhda64v nvhda64v.sys Fri Jun 26 16:54:59 2009 (4A4551C3) 
fffff880`04ab8000 fffff880`055e3880   nvlddmkm nvlddmkm.sys Wed Feb 10 06:57:28 2010 (4B72BB48) 
fffff880`02000000 fffff880`02053000   nwifi    nwifi.sys    Mon Jul 13 18:07:23 2009 (4A5BCC3B) 
fffff880`041c8000 fffff880`041ee000   pacer    pacer.sys    Sat Nov 20 03:52:18 2010 (4CE7A862) 
fffff880`00fb9000 fffff880`00fce000   partmgr  partmgr.sys  Sat Nov 20 02:20:00 2010 (4CE792C0) 
fffff880`00f79000 fffff880`00fac000   pci      pci.sys      Sat Nov 20 02:19:11 2010 (4CE7928F) 
fffff880`00c00000 fffff880`00c10000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 17:19:48 2009 (4A5BC114) 
fffff880`01400000 fffff880`01411000   pcw      pcw.sys      Mon Jul 13 17:19:27 2009 (4A5BC0FF) 
fffff880`0646c000 fffff880`06512000   peauth   peauth.sys   Mon Jul 13 19:01:19 2009 (4A5BD8DF) 
fffff880`04766000 fffff880`047a3000   portcls  portcls.sys  Mon Jul 13 18:06:27 2009 (4A5BCC03) 
fffff880`00c6f000 fffff880`00c83000   PSHED    PSHED.dll    Mon Jul 13 19:32:23 2009 (4A5BE027) 
fffff880`05a4b000 fffff880`05a6f000   rasl2tp  rasl2tp.sys  Sat Nov 20 03:52:34 2010 (4CE7A872) 
fffff880`05faf000 fffff880`05fca000   raspppoe raspppoe.sys Mon Jul 13 18:10:17 2009 (4A5BCCE9) 
fffff880`05fca000 fffff880`05feb000   raspptp  raspptp.sys  Sat Nov 20 03:52:31 2010 (4CE7A86F) 
fffff880`05a7b000 fffff880`05a95000   rassstp  rassstp.sys  Mon Jul 13 18:10:25 2009 (4A5BCCF1) 
fffff880`02f41000 fffff880`02f92000   rdbss    rdbss.sys    Sat Nov 20 02:27:51 2010 (4CE79497) 
fffff880`017f7000 fffff880`01800000   RDPCDD   RDPCDD.sys   Mon Jul 13 18:16:34 2009 (4A5BCE62) 
fffff880`0168a000 fffff880`01693000   rdpencdd rdpencdd.sys Mon Jul 13 18:16:34 2009 (4A5BCE62) 
fffff880`0142b000 fffff880`01434000   rdprefmp rdprefmp.sys Mon Jul 13 18:16:35 2009 (4A5BCE63) 
fffff880`01aa4000 fffff880`01ade000   rdyboost rdyboost.sys Sat Nov 20 02:43:10 2010 (4CE7982E) 
fffff880`047c5000 fffff880`047f1000   rfcomm   rfcomm.sys   Mon Jul 13 18:06:56 2009 (4A5BCC20) 
fffff880`02066000 fffff880`0207e000   rspndr   rspndr.sys   Mon Jul 13 18:08:50 2009 (4A5BCC92) 
fffff880`06a12000 fffff880`06ccfc80   RTKVHD64 RTKVHD64.sys Tue May 24 06:32:39 2011 (4DDBA567) 
fffff880`06512000 fffff880`0651d000   secdrv   secdrv.SYS   Wed Sep 13 07:18:38 2006 (4508052E) 
fffff880`01a9c000 fffff880`01aa4000   spldr    spldr.sys    Mon May 11 10:56:27 2009 (4A0858BB) 
fffff880`02f2c000 fffff880`02f41000   SRTSPX64 SRTSPX64.SYS Thu Mar 15 12:09:21 2012 (4F623051) 
fffff880`066d5000 fffff880`0676e000   srv      srv.sys      Sat Nov 20 02:28:05 2010 (4CE794A5) 
fffff880`06560000 fffff880`065cb000   srv2     srv2.sys     Sat Nov 20 02:27:43 2010 (4CE7948F) 
fffff880`0651d000 fffff880`0654e000   srvnet   srvnet.sys   Sat Nov 20 02:27:20 2010 (4CE79478) 
fffff880`05bf7000 fffff880`05bf8480   swenum   swenum.sys   Mon Jul 13 18:00:18 2009 (4A5BCA92) 
fffff880`01126000 fffff880`01197000   SYMDS64  SYMDS64.SYS  Mon May 16 16:15:03 2011 (4DD1A1E7) 
fffff880`01240000 fffff880`01351000   SYMEFA64 SYMEFA64.SYS Tue Nov 22 17:49:28 2011 (4ECC4318) 
fffff880`02ef4000 fffff880`02f2c000   SYMEVENT64x86 SYMEVENT64x86.SYS Tue Nov 22 11:30:48 2011 (4ECBEA58) 
fffff880`02e88000 fffff880`02ef4000   SYMNETS  SYMNETS.SYS  Sat Nov 12 14:11:53 2011 (4EBEE119) 
fffff880`05a95000 fffff880`05bf5000   SynTP    SynTP.sys    Fri Feb 25 11:13:32 2011 (4D67F14C) 
fffff880`01802000 fffff880`01a06000   tcpip    tcpip.sys    Sat Nov 20 02:25:52 2010 (4CE79420) 
fffff880`0654e000 fffff880`06560000   tcpipreg tcpipreg.sys Sat Nov 20 03:51:48 2010 (4CE7A844) 
fffff880`013f0000 fffff880`013fd000   TDI      TDI.SYS      Sat Nov 20 02:22:06 2010 (4CE7933E) 
fffff880`010a8000 fffff880`010ca000   tdx      tdx.sys      Sat Nov 20 02:21:54 2010 (4CE79332) 
fffff880`040a2000 fffff880`040b6000   termdd   termdd.sys   Sat Nov 20 04:03:40 2010 (4CE7AB0C) 
fffff880`01351000 fffff880`01392000   truecrypt truecrypt.sys Tue Feb 07 02:09:36 2012 (4F30EA50) 
fffff960`00400000 fffff960`0040a000   TSDDD    TSDDD.dll    unavailable (00000000) 
fffff880`04740000 fffff880`04766000   tunnel   tunnel.sys   Sat Nov 20 03:51:50 2010 (4CE7A846) 
fffff880`05feb000 fffff880`05ffd000   umbus    umbus.sys    Sat Nov 20 03:44:37 2010 (4CE7A695) 
fffff880`0679c000 fffff880`067b9000   usbccgp  usbccgp.sys  Sat Nov 20 03:44:03 2010 (4CE7A673) 
fffff880`05bf5000 fffff880`05bf6f00   USBD     USBD.SYS     Mon Jul 13 18:06:23 2009 (4A5BCBFF) 
fffff880`0426a000 fffff880`0427b000   usbehci  usbehci.sys  Sat Nov 20 03:43:54 2010 (4CE7A66A) 
fffff880`04a43000 fffff880`04a9d000   usbhub   usbhub.sys   Sat Nov 20 03:44:30 2010 (4CE7A68E) 
fffff880`0427b000 fffff880`042d1000   USBPORT  USBPORT.SYS  Sat Nov 20 03:44:00 2010 (4CE7A670) 
fffff880`067b9000 fffff880`067e6280   usbvideo usbvideo.sys Sat Nov 20 03:44:34 2010 (4CE7A692) 
fffff880`04066000 fffff880`040a2000   VBoxDrv  VBoxDrv.sys  Tue Apr 03 06:19:05 2012 (4F7AEAB9) 
fffff880`05c00000 fffff880`05c2a000   VBoxNetAdp VBoxNetAdp.sys Tue Apr 03 06:19:06 2012 (4F7AEABA) 
fffff880`043c8000 fffff880`043f7000   VBoxNetFlt VBoxNetFlt.sys Tue Apr 03 06:19:04 2012 (4F7AEAB8) 
fffff880`04040000 fffff880`04066000   VBoxUSBMon VBoxUSBMon.sys Tue Apr 03 06:19:05 2012 (4F7AEAB9) 
fffff880`00fac000 fffff880`00fb9000   vdrvroot vdrvroot.sys Mon Jul 13 18:01:31 2009 (4A5BCADB) 
fffff880`017e9000 fffff880`017f7000   vga      vga.sys      Mon Jul 13 17:38:47 2009 (4A5BC587) 
fffff880`01072000 fffff880`01097000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 17:38:51 2009 (4A5BC58B) 
fffff880`00fe3000 fffff880`00ff8000   volmgr   volmgr.sys   Sat Nov 20 02:19:28 2010 (4CE792A0) 
fffff880`00e00000 fffff880`00e5c000   volmgrx  volmgrx.sys  Sat Nov 20 02:20:43 2010 (4CE792EB) 
fffff880`01a50000 fffff880`01a9c000   volsnap  volsnap.sys  Sat Nov 20 02:20:08 2010 (4CE792C8) 
fffff880`05ede000 fffff880`05eeb000   vwifibus vwifibus.sys Mon Jul 13 18:07:21 2009 (4A5BCC39) 
fffff880`04000000 fffff880`04016000   vwififlt vwififlt.sys Mon Jul 13 18:07:22 2009 (4A5BCC3A) 
fffff880`0207e000 fffff880`02088000   vwifimp  vwifimp.sys  Mon Jul 13 18:07:28 2009 (4A5BCC40) 
fffff880`04025000 fffff880`04040000   wanarp   wanarp.sys   Sat Nov 20 03:52:36 2010 (4CE7A874) 
fffff880`0141b000 fffff880`0142b000   watchdog watchdog.sys Mon Jul 13 17:37:35 2009 (4A5BC53F) 
fffff880`00e5c000 fffff880`00f00000   Wdf01000 Wdf01000.sys Mon Jul 13 17:22:07 2009 (4A5BC19F) 
fffff880`00f00000 fffff880`00f0f000   WDFLDR   WDFLDR.SYS   Mon Jul 13 17:19:54 2009 (4A5BC11A) 
fffff880`041bf000 fffff880`041c8000   wfplwf   wfplwf.sys   Mon Jul 13 18:09:26 2009 (4A5BCCB6) 
fffff960`00050000 fffff960`00360000   win32k   win32k.sys   unavailable (00000000) 
fffff880`00f66000 fffff880`00f6f000   WMILIB   WMILIB.SYS   Mon Jul 13 17:19:51 2009 (4A5BC117) 
fffff880`02196000 fffff880`021b7000   WudfPf   WudfPf.sys   Sat Nov 20 03:42:44 2010 (4CE7A624) 
fffff880`05eeb000 fffff880`05f4e000   yk62x64  yk62x64.sys  Fri May 06 04:11:27 2011 (4DC3C94F) 

Unloaded modules: 
fffff880`066aa000 fffff880`066c7000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0676e000 fffff880`0679c000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0664b000 fffff880`06668000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0667c000 fffff880`066aa000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`06600000 fffff880`0661d000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0661d000 fffff880`0664b000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0679c000 fffff880`067b9000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`067b9000 fffff880`067e7000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`066aa000 fffff880`066c7000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0676e000 fffff880`0679c000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0664b000 fffff880`06668000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0667c000 fffff880`066aa000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`06600000 fffff880`0661d000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0661d000 fffff880`0664b000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0679c000 fffff880`067b9000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`067b9000 fffff880`067e7000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`066aa000 fffff880`066c7000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0676e000 fffff880`0679c000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`067b9000 fffff880`067d6000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0667c000 fffff880`066aa000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`06600000 fffff880`06671000   spsys.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  00071000 
fffff880`0676e000 fffff880`0678b000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0678b000 fffff880`067b9000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0667c000 fffff880`06699000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`06699000 fffff880`066c7000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0679c000 fffff880`067b9000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`067b9000 fffff880`067e7000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`066aa000 fffff880`066c7000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0676e000 fffff880`0679c000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`067b9000 fffff880`067d6000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0667c000 fffff880`066aa000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0676e000 fffff880`0678b000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0678b000 fffff880`067b9000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0667c000 fffff880`06699000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`06699000 fffff880`066c7000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`0676e000 fffff880`0678b000   usbccgp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0001D000 
fffff880`0678b000 fffff880`067b9000   usbvideo.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0002E000 
fffff880`01b79000 fffff880`01b87000   crashdmp.sys 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0000E000 
fffff880`01b87000 fffff880`01b93000   dump_pciidex 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0000C000 
fffff880`01b93000 fffff880`01b9e000   dump_msahci. 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  0000B000 
fffff880`01b9e000 fffff880`01bb1000   dump_dumpfve 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  00013000 
fffff880`01bb1000 fffff880`01bf2000   dump_truecry 
    Timestamp: unavailable (00000000) 
    Checksum:  00000000 
    ImageSize:  00041000 
quit:

usasma · Sep 26, 2012

But now that we know that it occurs - it's easy to check for (so the fix isn't critical)
Take your time - you're both working way too hard! (but I do really appreciate it!)

writhziden · Sep 26, 2012

Thanks John. I'm in the process of implementing some other fixes for problems that the extensions revealed.

Here is what I've found so far:

FIXED "Now running user commands..." only prints once.
FIXED user kd commands no longer cause corrupted lists to grow unless "Only Use User kd Commands" is checked.
FIXED "Only Use User kd Commands" now have correct debug session time for header in _99-debug.txt file
FIXED size issue with _99-debug.txt html viewer
FIXED Better symbols checking for wrong symbols now also works with user kd commands.
ADDED Better symbols checking for wrong symbols.

Anyone familiar with:

Code:

************************************************************************* 
************************************************************************* 
***                                                                   *** 
***                                                                   *** 
***    Either you specified an unqualified symbol, or your debugger   *** 
***    doesn't have full symbol information.  Unqualified symbol      *** 
***    resolution is turned off by default. Please either specify a   *** 
***    fully qualified symbol module!symbolname, or enable resolution *** 
***    of unqualified symbols by typing ".symopt- 100". Note that     *** 
***    enabling unqualified symbol resolution with network symbol     *** 
***    server shares in the symbol path may cause the debugger to     *** 
***    appear to hang for long periods of time when an incorrect      *** 
***    symbol name is typed or the network symbol server is down.     *** 
***                                                                   *** 
***    For some commands to work properly, your symbol path           *** 
***    must point to .pdb files that have full type information.      *** 
***                                                                   *** 
***    Certain .pdb files (such as the public OS symbols) do not      *** 
***    contain the required information.  Contact the group that      *** 
***    provided you with these symbols if you need this command to    *** 
***    work.                                                          *** 
***                                                                   *** 
***    Type referenced: ContextRecord                                 *** 
***                                                                   *** 
*************************************************************************

It only appears with kernel debugger 6.2, not with 6.11, and has me baffled as to why one version would have issues and the other would not.

Attached is the .dmp that causes the above message in 6.2 but not in 6.11 if someone would like to confirm the same behavior with different versions.

niemiro · Sep 26, 2012

That dump works fine for me on 6.2.8229.0. However, I did see exactly the same symbol errors you have on another computer I was using this morning. I will have to check tomorrow to see what exact version of 6.2 it is running.

Thanks for finding those problems Mike.

writhziden · Sep 26, 2012

No problem. 6.2.9200.16384 is the version I see the issue on. I have 6.2.8229.0 somewhere. Hopefully the installer for 6.2.8229.0 was backed up. I'll try installing it later if I can find it when I get a chance.

My installers were all deleted due to a partition wipe when I installed XP and created a new partition. Did not know that creating a new primary partition in unallocated space would erase the old partition that was already allocated. There are times when Windows does things without asking the user and it really irks me.

EDIT: John has the same errors in 6.2.8400, though that was before the pdb symbols downloads, so I am not sure he still sees it with the new symbols.

writhziden · Sep 26, 2012

I uploaded the latest version of the apps, but I'll warn that they are a little slower due to the symbols checking. I am working on a better method for symbols errors to distinguish between when symbols are possibly wrong and when they are definitely wrong. I also want to fix that the apps check symbol errors for each user command even if the symbols could not be fixed in a previous command...

The symbols checking for user commands is still a work in progress, but it should at least be robust now with the new methods. BETA: Sysnative BSOD Processing Apps 2.1.2.7.

writhziden · Oct 1, 2012

niemiro said:
@usasma: Your crash report is still a work in progress and consequently there is no fix for it in this update. Sorry.

However, Vir Gnarus, I think that your problem should now be fixed.

Changelog:

Code:

[B]v1.0.0.0 [/B]Initial Release [B]v1.1.0.0 FIXED:[/B] Extension no longer reports range errors on 32bit targets. [B]FIXED:[/B] Extension no longer hangs or reports range errors when the entire raw stack lies in unavailable memory. [B]FIXED:[/B] Extension no longer sometimes loses the first or last available memory address in the raw stack on 32bit targets. [B]FIXED:[/B] File details are now correct. [B]v1.2.0.0[/B] [B]FIXED: [/B]Extension now calculates offset from start of nt!_KTHREAD structure using symbol information to correct incorrect offset calculation on certain platforms.

Latest source code also included.

Any idea why I am now getting an error running with the .dll?

6: kd> kd: Reading initial command '!niemiro.rawstack; !niemiro.rawstack -dc; !niemiro.auto_errrec; q'
The call to LoadLibrary(niemiro) failed, Win32 error 0n126
"The specified module could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(niemiro) failed, Win32 error 0n126
"The specified module could not be found."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(niemiro) failed, Win32 error 0n126
"The specified module could not be found."
Please check your debugger configuration and/or network access.

The .dll is in the winext directory for the debugging tools I am using, so I do not know what the problem might be...

Others having the same problems, or is it local to my system?

niemiro · Oct 2, 2012

That is a pretty generic error code which can mean a couple of things. Which machine is this on?

The most usual cause is a missing dependency. You can use Dependency Walker to check this out: http://www.dependencywalker.com/

Please load up my .dll. It should only have four direct dependencies: dbgeng.dll, kernel32.dll, msvcp100.dll, msvcr100.dll

Do any of these show up with a yellow question mark? This shows a missing dependency. Also, look at the bottom of the program, and you should see a complete list of .dlls. Other than ieshims.dll (and ieframe.dll or shlwapi.dll), are any other depenedencies missing?

Ususally you just need to install VC++2010 (my toolchain is currently broken and I am struggeling to backwards compile ATM

)

However, there are a couple of other causes, but I suspect this is a dependency issue. If it isn't, please let me know :)

Richard

writhziden · Oct 2, 2012

This is why I recommend installing both the x86 and x64 versions of the Visual C++ Redistributables. I had only installed the x86 version for the apps.

Thanks Richard!

writhziden · Oct 6, 2012

Having a problem with a specific .dmp file. It seems to hang the !niemiro commands.

Confirm?

niemiro · Oct 6, 2012

writhziden said:
Having a problem with a specific .dmp file. It seems to hang the !niemiro commands.

Confirm?

Confirmed. Will fix tomorrow. The dump is corrupt, but there must be a single line of code causing the hang, and hopefully I can figure out a fix to avoid hanging on these corrupt dumps in future.

Thank you.

writhziden · Oct 6, 2012

No problem. I've gone through isssues with corrupt .dmps with the apps development. I'm sure you went through the same with the jcgriff2 apps. It's inevitable a .dmp will come along to break the code. I still expect a PM on a daily basis from someone having problems with the new apps due to a .dmp that I did not anticipate.

niemiro · Oct 6, 2012

writhziden said:
No problem. I've gone through isssues with corrupt .dmps with the apps development. I'm sure you went through the same with the jcgriff2 apps. It's inevitable a .dmp will come along to break the code. I still expect a PM on a daily basis from someone having problems with the new apps due to a .dmp that I did not anticipate.

Yep, I remember those times! You are doing a great job with the apps and all the challenges they pose!

niemiro · Oct 14, 2012

Sorry it took longer than anticipated. Hopefully this is now quite a robust corruption detection system.

Code:

[B]v1.0.0.0[/B]
Initial Release

[B]v1.1.0.0[/B]
[B]FIXED:[/B] Extension no longer reports range errors on 32bit targets.
[B]FIXED:[/B] Extension no longer hangs or reports range errors when the entire raw stack lies in unavailable memory.
[B]FIXED:[/B] Extension no longer sometimes loses the first or last available memory address in the raw stack on 32bit targets.
[B]FIXED:[/B] File details are now correct.

[B]v1.2.0.0[/B]
[B]FIXED:[/B] Extension now calculates offset from start of nt!_KTHREAD structure using symbol information to correct incorrect offset calculation on certain platforms.

[B]v1.3.0.0[/B]
[B]FIXED:[/B] Extension now no longer hangs when encountering certain types of memory dump corruption.

writhziden · Oct 14, 2012

No problem on the time taken. I've only encountered that one .dmp so far that caused problems. Thanks for putting it together.

Code:

FAILURE: Dump file is corrupt.

Did you add that message? If so, nice!

SysnativeBSODApps - additional check 'drivers found in stack'

Senior Administrator, Windows Update Expert

Retired Admin

Senior Administrator, Windows Update Expert

Retired Admin

Attachments

Retired Admin

Administrator, .NET/UWP Developer

Retired Admin

Administrator, .NET/UWP Developer

Attachments

Senior Administrator, Windows Update Expert

Administrator, .NET/UWP Developer

Administrator, .NET/UWP Developer

Administrator, .NET/UWP Developer

Senior Administrator, Windows Update Expert

Administrator, .NET/UWP Developer

Administrator, .NET/UWP Developer

Attachments

Senior Administrator, Windows Update Expert

Administrator, .NET/UWP Developer

Senior Administrator, Windows Update Expert

Senior Administrator, Windows Update Expert

Attachments

Administrator, .NET/UWP Developer