windows 7 - How to pinpoint the cause of a system crash?
2014-07
feed_me_code
This question already has an answer here:
- How to use Windows mini-dump files? 4 answers
Answers
and31415
Analysis
Crash dumps can be analyzed using WinDbg, which is part of the official Microsoft debugging tools. I'm going to highlight just the most significant data, providing the full command output for reference.
Machine information
BiosVendor = Award Software International, Inc.
BiosVersion = F4a
BiosReleaseDate = 05/15/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = G1.Guerrilla
Operating system
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Bug check
The bug check code is 0xD1, which translates to DRIVER_IRQL_NOT_LESS_OR_EQUAL:
A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high.
This bug check is usually caused by drivers that have used improper addresses.
Stack trace
Checking the call stack, the Xeno7x64 module appears to be the cause:
STACK_TEXT:
fffff880`0ed445d8 fffff800`03492169 : 00000000`0000000a 00001000`000102fd 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0ed445e0 fffff800`03490de0 : 00000000`00538968 00000000`00000000 fffffa80`12e1e270 00000000`00000067 : nt!KiBugCheckDispatch+0x69
fffff880`0ed44720 fffff880`10143afd : fffff880`0ed44998 fffff880`0ed44980 00000000`0000445c fffff880`10139fc6 : nt!KiPageFault+0x260
fffff880`0ed448b0 fffff880`0ed44998 : fffff880`0ed44980 00000000`0000445c fffff880`10139fc6 fffffa80`175954e8 : Xeno7x64+0x17afd
Faulting driver
The Xeno7x64.sys file is a 64-bit driver which is related to a network card device identified as Bigfoot Killer Xeno Gaming PCI device. Quoting Wikipedia:
The Killer NIC (Network Interface Card), from Killer Gaming, is designed to circumvent the Microsoft Windows TCP/IP stack, and handle processing on the card via a dedicated network processor. Most standard network cards are host based, and make use of the primary CPU. The manufacturer claims that the Killer NIC is capable of reducing network latency and lag.
Source: Killer NIC
The driver was built on May 19, 2011:
fffff880`1012c000 fffff880`10155000 Xeno7x64 Thu May 19 00:55:16 2011 (4DD44E54)
Other details
The issue occurred after the system had been running for more than 13 hours:
System Uptime: 0 days 13:09:04.168
When the system crashed Dropbox was open:
PROCESS_NAME: Dropbox.exe
Additional information
Here's the output retrieved through WinDbg:
7: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.4, DMIVersion 36, Size=1252]
BiosVendor = Award Software International, Inc.
BiosVersion = F4a
BiosReleaseDate = 05/15/2011
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = G1.Guerrilla
SystemFamily =
SystemVersion =
SystemSKU =
BaseBoardManufacturer = Gigabyte Technology Co., Ltd.
BaseBoardProduct = G1.Guerrilla
BaseBoardVersion = x.x
7: kd> vertarget
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`0341d000 PsLoadedModuleList = 0xfffff800`03660890
Debug session time: Wed May 28 05:27:22.232 2014 (UTC + 2:00)
System Uptime: 0 days 13:09:04.168
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00001000000102fd, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88010143afd, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036ca100
GetUlongFromAddress: unable to read from fffff800036ca1c0
00001000000102fd Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
Xeno7x64+17afd
fffff880`10143afd 488b07 mov rax,qword ptr [rdi]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: Dropbox.exe
ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre
TRAP_FRAME: fffff8800ed44720 -- (.trap 0xfffff8800ed44720)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa801741a332 rbx=0000000000000000 rcx=fffffa801741a332
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88010143afd rsp=fffff8800ed448b0 rbp=fffffa801756d1a0
r8=fffff8800c97a560 r9=0000000000000000 r10=38203a22746e695f
r11=fffffa801741a332 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
Xeno7x64+0x17afd:
fffff880`10143afd 488b07 mov rax,qword ptr [rdi] ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003492169 to fffff80003492bc0
STACK_TEXT:
fffff880`0ed445d8 fffff800`03492169 : 00000000`0000000a 00001000`000102fd 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0ed445e0 fffff800`03490de0 : 00000000`00538968 00000000`00000000 fffffa80`12e1e270 00000000`00000067 : nt!KiBugCheckDispatch+0x69
fffff880`0ed44720 fffff880`10143afd : fffff880`0ed44998 fffff880`0ed44980 00000000`0000445c fffff880`10139fc6 : nt!KiPageFault+0x260
fffff880`0ed448b0 fffff880`0ed44998 : fffff880`0ed44980 00000000`0000445c fffff880`10139fc6 fffffa80`175954e8 : Xeno7x64+0x17afd
fffff880`0ed448b8 fffff880`0ed44980 : 00000000`0000445c fffff880`10139fc6 fffffa80`175954e8 00000000`00000001 : 0xfffff880`0ed44998
fffff880`0ed448c0 00000000`0000445c : fffff880`10139fc6 fffffa80`175954e8 00000000`00000001 fffffa80`1363ab00 : 0xfffff880`0ed44980
fffff880`0ed448c8 fffff880`10139fc6 : fffffa80`175954e8 00000000`00000001 fffffa80`1363ab00 fffffa80`1756d1a0 : 0x445c
fffff880`0ed448d0 fffffa80`175954e8 : 00000000`00000001 fffffa80`1363ab00 fffffa80`1756d1a0 fffffa80`16fb2180 : Xeno7x64+0xdfc6
fffff880`0ed448d8 00000000`00000001 : fffffa80`1363ab00 fffffa80`1756d1a0 fffffa80`16fb2180 fffffa80`18f20740 : 0xfffffa80`175954e8
fffff880`0ed448e0 fffffa80`1363ab00 : fffffa80`1756d1a0 fffffa80`16fb2180 fffffa80`18f20740 fffffa80`17630330 : 0x1
fffff880`0ed448e8 fffffa80`1756d1a0 : fffffa80`16fb2180 fffffa80`18f20740 fffffa80`17630330 fffffa80`16cc3b30 : 0xfffffa80`1363ab00
fffff880`0ed448f0 fffffa80`16fb2180 : fffffa80`18f20740 fffffa80`17630330 fffffa80`16cc3b30 fffff880`0c97a560 : 0xfffffa80`1756d1a0
fffff880`0ed448f8 fffffa80`18f20740 : fffffa80`17630330 fffffa80`16cc3b30 fffff880`0c97a560 fffff880`10143d65 : 0xfffffa80`16fb2180
fffff880`0ed44900 fffffa80`17630330 : fffffa80`16cc3b30 fffff880`0c97a560 fffff880`10143d65 fffffa80`1756d1a0 : 0xfffffa80`18f20740
fffff880`0ed44908 fffffa80`16cc3b30 : fffff880`0c97a560 fffff880`10143d65 fffffa80`1756d1a0 00000000`0000445c : 0xfffffa80`17630330
fffff880`0ed44910 fffff880`0c97a560 : fffff880`10143d65 fffffa80`1756d1a0 00000000`0000445c fffff880`0c97a560 : 0xfffffa80`16cc3b30
fffff880`0ed44918 fffff880`10143d65 : fffffa80`1756d1a0 00000000`0000445c fffff880`0c97a560 fffffa80`16fb2180 : 0xfffff880`0c97a560
fffff880`0ed44920 fffffa80`1756d1a0 : 00000000`0000445c fffff880`0c97a560 fffffa80`16fb2180 fffffa80`16cc3b30 : Xeno7x64+0x17d65
fffff880`0ed44928 00000000`0000445c : fffff880`0c97a560 fffffa80`16fb2180 fffffa80`16cc3b30 fffff880`10133326 : 0xfffffa80`1756d1a0
fffff880`0ed44930 fffff880`0c97a560 : fffffa80`16fb2180 fffffa80`16cc3b30 fffff880`10133326 00000000`00000000 : 0x445c
fffff880`0ed44938 fffffa80`16fb2180 : fffffa80`16cc3b30 fffff880`10133326 00000000`00000000 fffffa80`16fb2180 : 0xfffff880`0c97a560
fffff880`0ed44940 fffffa80`16cc3b30 : fffff880`10133326 00000000`00000000 fffffa80`16fb2180 fffffa80`16fb2180 : 0xfffffa80`16fb2180
fffff880`0ed44948 fffff880`10133326 : 00000000`00000000 fffffa80`16fb2180 fffffa80`16fb2180 fffffa80`1756d1a0 : 0xfffffa80`16cc3b30
fffff880`0ed44950 00000000`00000000 : fffffa80`16fb2180 fffffa80`16fb2180 fffffa80`1756d1a0 fffff880`0c97a560 : Xeno7x64+0x7326
STACK_COMMAND: kb
FOLLOWUP_IP:
Xeno7x64+17afd
fffff880`10143afd 488b07 mov rax,qword ptr [rdi]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: Xeno7x64+17afd
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Xeno7x64
IMAGE_NAME: Xeno7x64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4dd44e54
FAILURE_BUCKET_ID: X64_0xD1_Xeno7x64+17afd
BUCKET_ID: X64_0xD1_Xeno7x64+17afd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xd1_xeno7x64+17afd
FAILURE_ID_HASH: {7f7f4b8b-1c65-834f-52ad-a3a52f1fc51e}
Followup: MachineOwner
---------
7: kd> lmsmt
start end module name
fffff880`00e00000 fffff880`00e57000 ACPI Sat Nov 20 10:19:16 2010 (4CE79294)
fffff880`04836000 fffff880`048bf000 afd Sat Sep 28 03:09:07 2013 (52462C33)
fffff880`10198000 fffff880`101ae000 AgileVpn Tue Jul 14 02:10:24 2009 (4A5BCCF0)
fffff880`01520000 fffff880`0152b000 amdxata Fri Mar 19 17:18:18 2010 (4BA3A3CA)
fffff880`09bef000 fffff880`09bfa000 asyncmac Tue Jul 14 02:10:13 2009 (4A5BCCE5)
fffff880`01390000 fffff880`01399000 atapi Tue Jul 14 01:19:47 2009 (4A5BC113)
fffff880`01399000 fffff880`013c3000 ataport Mon Aug 05 03:02:45 2013 (51FEF9B5)
fffff960`008f0000 fffff960`00951000 ATMFD Thu Jun 06 05:30:53 2013 (51B0026D)
fffff880`05753000 fffff880`0577c000 avgdiska Tue May 13 14:05:03 2014 (53720A6F)
fffff880`05713000 fffff880`05753000 avgidsdrivera Tue May 13 14:04:50 2014 (53720A62)
fffff880`01000000 fffff880`01031000 avgidsha Tue May 13 14:05:36 2014 (53720A90)
fffff880`056d5000 fffff880`05713000 avgldx64 Tue May 13 14:20:22 2014 (53720E06)
fffff880`00faf000 fffff880`01000000 avgloga Tue May 13 14:06:01 2014 (53720AA9)
fffff880`017d4000 fffff880`017f7000 avgmfx64 Tue May 13 14:05:03 2014 (53720A6F)
fffff880`01bef000 fffff880`01bf9000 avgrkx64 Tue May 13 14:04:26 2014 (53720A4A)
fffff880`04676000 fffff880`046bc000 avgtdia Tue May 13 14:20:00 2014 (53720DF0)
fffff880`047b2000 fffff880`047c2000 avgtpx64 Thu Mar 20 17:30:04 2014 (532B178C)
fffff880`047ab000 fffff880`047b2000 Beep Tue Jul 14 02:00:13 2009 (4A5BCA8D)
fffff880`056c4000 fffff880`056d5000 blbdrive Tue Jul 14 01:35:59 2009 (4A5BC4DF)
fffff880`09b81000 fffff880`09b9f000 bowser Wed Feb 23 05:55:04 2011 (4D649328)
fffff960`00750000 fffff960`00777000 cdd Thu Feb 03 12:25:25 2011 (4D4A90A5)
fffff880`08791000 fffff880`087ae000 cdfs Tue Jul 14 01:19:46 2009 (4A5BC112)
fffff880`04778000 fffff880`047a2000 cdrom Sat Nov 20 10:19:20 2010 (4CE79298)
fffff880`00d1a000 fffff880`00dda000 CI Sat Nov 20 14:12:36 2010 (4CE7C944)
fffff880`01200000 fffff880`01230000 CLASSPNP Sat Nov 20 10:19:23 2010 (4CE7929B)
fffff880`00cbc000 fffff880`00d1a000 CLFS Tue Jul 14 01:19:57 2009 (4A5BC11D)
fffff880`01891000 fffff880`01903000 cng Wed Aug 01 17:48:07 2012 (50194FB7)
fffff880`06a00000 fffff880`06a10000 CompositeBus Sat Nov 20 11:33:17 2010 (4CE7A3ED)
fffff880`08ec3000 fffff880`08ed1000 crashdmp Tue Jul 14 02:01:01 2009 (4A5BCABD)
fffff880`05623000 fffff880`056a6000 csc Sat Nov 20 10:27:12 2010 (4CE79470)
fffff880`056a6000 fffff880`056c4000 dfsc Sat Nov 20 10:26:31 2010 (4CE79447)
fffff880`0499f000 fffff880`049ae000 discache Tue Jul 14 01:37:18 2009 (4A5BC52E)
fffff880`01800000 fffff880`01816000 disk Tue Jul 14 01:19:57 2009 (4A5BC11D)
fffff880`06d55000 fffff880`06d77000 drmk Fri Oct 04 04:16:30 2013 (524E24FE)
fffff880`08f6a000 fffff880`08f7d000 dump_dumpfve Tue Jul 14 01:21:51 2009 (4A5BC18F)
fffff880`08edb000 fffff880`08f6a000 dump_mvs91xx Tue Aug 09 05:05:23 2011 (4E40A3F3)
fffff880`0475d000 fffff880`04765000 dump_mvxxmm Tue Aug 09 05:05:06 2011 (4E40A3E2)
fffff880`08ed1000 fffff880`08edb000 dump_storport Tue Feb 04 02:36:25 2014 (52F04419)
fffff880`08e9c000 fffff880`08ea8000 Dxapi Tue Jul 14 01:38:28 2009 (4A5BC574)
fffff880`06a24000 fffff880`06b18000 dxgkrnl Thu Aug 01 09:58:53 2013 (51FA153D)
fffff880`06b18000 fffff880`06b5e000 dxgmms1 Wed Apr 10 05:27:15 2013 (5164DC13)
fffff880`06cc4000 fffff880`06ccf000 Edge7x64 Thu May 19 00:55:15 2011 (4DD44E53)
fffff880`01577000 fffff880`0158b000 fileinfo Tue Jul 14 01:34:25 2009 (4A5BC481)
fffff880`0152b000 fffff880`01577000 fltmgr Sat Nov 20 10:19:24 2010 (4CE7929C)
fffff880`01914000 fffff880`0191e000 Fs_Rec Thu Mar 01 04:41:06 2012 (4F4EEFD2)
fffff880`019b6000 fffff880`019f0000 fvevol Thu Jan 24 04:11:24 2013 (5100A65C)
fffff880`01a8c000 fffff880`01ad5000 fwpkclnt Thu Jan 03 04:06:48 2013 (50E4F5C8)
fffff800`03a02000 fffff800`03a4b000 hal Sat Nov 20 14:00:25 2010 (4CE7C669)
fffff880`06b5e000 fffff880`06b82000 HDAudBus Sat Nov 20 11:43:42 2010 (4CE7A65E)
fffff880`08762000 fffff880`0877b000 HIDCLASS Wed Jul 03 06:05:05 2013 (51D3A2F1)
fffff880`0877b000 fffff880`08783080 HIDPARSE Wed Jul 03 06:05:04 2013 (51D3A2F0)
fffff880`08754000 fffff880`08762000 hidusb Sat Nov 20 11:43:49 2010 (4CE7A665)
fffff880`09ab8000 fffff880`09b81000 HTTP Sat Nov 20 10:24:30 2010 (4CE793CE)
fffff880`01aed000 fffff880`01af6000 hwpolicy Sat Nov 20 10:18:54 2010 (4CE7927E)
fffff880`0123c000 fffff880`01390000 iaStor Tue Sep 14 03:23:32 2010 (4C8ECE94)
fffff880`057a2000 fffff880`057b8000 intelppm Tue Jul 14 01:19:25 2009 (4A5BC0FD)
fffff880`010b3000 fffff880`010d4000 jraid Tue Sep 07 04:37:00 2010 (4C85A54C)
fffff880`0f490000 fffff880`0f49f000 kbdclass Tue Jul 14 01:19:50 2009 (4A5BC116)
fffff880`087cb000 fffff880`087d9000 kbdhid Sat Nov 20 11:33:25 2010 (4CE7A3F5)
fffff800`00bb5000 fffff800`00bbf000 kdcom Sat Feb 05 17:52:49 2011 (4D4D8061)
fffff880`10155000 fffff880`10198000 ks Sat Nov 20 11:33:23 2010 (4CE7A3F3)
fffff880`01876000 fffff880`01891000 ksecdd Sat Apr 12 03:08:30 2014 (5348920E)
fffff880`01a60000 fffff880`01a8c000 ksecpkg Sat Apr 12 03:24:10 2014 (534895BA)
fffff880`06a18000 fffff880`06a1d200 ksthunk Tue Jul 14 02:00:19 2009 (4A5BCA93)
fffff880`08fae000 fffff880`08fc3000 lltdio Tue Jul 14 02:08:50 2009 (4A5BCC92)
fffff880`08f8b000 fffff880`08fae000 luafv Tue Jul 14 01:26:13 2009 (4A5BC295)
fffff880`087d9000 fffff880`087dd300 lvbflt64 Fri Sep 21 21:01:00 2012 (505CB96C)
fffff880`08400000 fffff880`08454000 lvrs64 Fri Sep 21 21:02:17 2012 (505CB9B9)
fffff880`08a12000 fffff880`08e9b300 lvuvc64 Fri Sep 21 21:03:12 2012 (505CB9F0)
fffff880`08746000 fffff880`08754000 MBfilt64 Fri Jul 31 05:40:32 2009 (4A7267B0)
fffff880`00c59000 fffff880`00ca8000 mcupdate Sat Nov 20 14:03:51 2010 (4CE7C737)
fffff880`08f7d000 fffff880`08f8b000 monitor Tue Jul 14 01:38:52 2009 (4A5BC58C)
fffff880`0f49f000 fffff880`0f4ae000 mouclass Tue Jul 14 01:19:50 2009 (4A5BC116)
fffff880`08784000 fffff880`08791000 mouhid Tue Jul 14 02:00:20 2009 (4A5BCA94)
fffff880`01103000 fffff880`0111d000 mountmgr Sat Nov 20 10:19:21 2010 (4CE79299)
fffff880`0158b000 fffff880`015cd000 MpFilter Wed Jan 15 00:55:38 2014 (52D5CE7A)
fffff880`09b9f000 fffff880`09bb7000 mpsdrv Tue Jul 14 02:08:25 2009 (4A5BCC79)
fffff880`09bb7000 fffff880`09be4000 mrxsmb Wed Apr 27 04:40:38 2011 (4DB78226)
fffff880`09a00000 fffff880`09a4e000 mrxsmb10 Sat Jul 09 04:46:28 2011 (4E17C104)
fffff880`09a4e000 fffff880`09a72000 mrxsmb20 Wed Apr 27 04:39:37 2011 (4DB781E9)
fffff880`013c3000 fffff880`013ce000 msahci Sat Nov 20 11:33:58 2010 (4CE7A416)
fffff880`0462b000 fffff880`04636000 Msfs Tue Jul 14 01:19:47 2009 (4A5BC113)
fffff880`00e60000 fffff880`00e6a000 msisadrv Tue Jul 14 01:19:26 2009 (4A5BC0FE)
fffff880`01818000 fffff880`01876000 msrpc Sat Nov 20 10:21:56 2010 (4CE79334)
fffff880`04994000 fffff880`0499f000 mssmbios Tue Jul 14 01:31:10 2009 (4A5BC3BE)
fffff880`019a4000 fffff880`019b6000 mup Tue Jul 14 01:23:45 2009 (4A5BC201)
fffff880`0116d000 fffff880`011fa000 mv91xx Mon Nov 22 08:00:45 2010 (4CEA151D)
fffff880`0dc98000 fffff880`0dc9e000 mv_process Tue Feb 22 10:22:20 2011 (4D63804C)
fffff880`0142d000 fffff880`014bc000 mvs91xx Tue Aug 09 05:05:23 2011 (4E40A3F3)
fffff880`013ce000 fffff880`013d6000 mvxxmm Tue Aug 09 05:05:06 2011 (4E40A3E2)
fffff880`01afd000 fffff880`01bef000 ndis Wed Aug 22 17:11:46 2012 (5034F6B2)
fffff880`101d2000 fffff880`101de000 ndistapi Tue Jul 14 02:10:00 2009 (4A5BCCD8)
fffff880`0f400000 fffff880`0f42f000 ndiswan Sat Nov 20 11:52:32 2010 (4CE7A870)
fffff880`06ccf000 fffff880`06ce4000 NDProxy Sat Nov 20 11:52:20 2010 (4CE7A864)
fffff880`048f9000 fffff880`04908000 netbios Tue Jul 14 02:09:26 2009 (4A5BCCB6)
fffff880`00c00000 fffff880`00c45000 netbt Sat Nov 20 10:23:18 2010 (4CE79386)
fffff880`01a00000 fffff880`01a60000 NETIO Tue Nov 26 11:21:01 2013 (5294760D)
fffff880`09a93000 fffff880`09ab4000 NisDrvWFP Thu Mar 06 00:10:25 2014 (5317AEE1)
fffff880`04636000 fffff880`04647000 Npfs Tue Jul 14 01:19:48 2009 (4A5BC114)
fffff880`04988000 fffff880`04994000 nsiproxy Tue Jul 14 01:21:02 2009 (4A5BC15E)
fffff800`0341d000 fffff800`03a02000 nt Tue Mar 04 09:38:19 2014 (531590FB)
fffff880`0162b000 fffff880`017d4000 Ntfs Fri Jan 24 02:14:50 2014 (52E1BE8A)
fffff880`047a2000 fffff880`047ab000 Null Tue Jul 14 01:19:37 2009 (4A5BC109)
fffff880`101de000 fffff880`101f7000 nusb3hub Fri Nov 19 02:34:24 2010 (4CE5D420)
fffff880`057b8000 fffff880`057e9000 nusb3xhc Fri Nov 19 02:34:25 2010 (4CE5D421)
fffff880`06ce4000 fffff880`06d18000 nvhda64v Sun Jun 16 14:38:07 2013 (51BDB1AF)
fffff880`0f4d4000 fffff880`1012c000 nvlddmkm Tue Mar 04 12:07:52 2014 (5315B408)
fffff880`048d3000 fffff880`048f9000 pacer Sat Nov 20 11:52:18 2010 (4CE7A862)
fffff880`00eaa000 fffff880`00ebf000 partmgr Sat Mar 17 06:06:09 2012 (4F641BC1)
fffff880`00e6a000 fffff880`00e9d000 pci Sat Nov 20 10:19:11 2010 (4CE7928F)
fffff880`0109c000 fffff880`010a3000 pciide Tue Jul 14 01:19:49 2009 (4A5BC115)
fffff880`010a3000 fffff880`010b3000 PCIIDEX Tue Jul 14 01:19:48 2009 (4A5BC114)
fffff880`01903000 fffff880`01914000 pcw Tue Jul 14 01:19:27 2009 (4A5BC0FF)
fffff880`0dca0000 fffff880`0dd46000 peauth Tue Jul 14 03:01:19 2009 (4A5BD8DF)
fffff880`06d18000 fffff880`06d55000 portcls Fri Oct 04 03:36:02 2013 (524E1B82)
fffff880`00ca8000 fffff880`00cbc000 PSHED Tue Jul 14 03:32:23 2009 (4A5BE027)
fffff880`015cd000 fffff880`015d91a0 PxHlpa64 Mon Oct 17 16:29:34 2011 (4E9C3BCE)
fffff880`101ae000 fffff880`101d2000 rasl2tp Sat Nov 20 11:52:34 2010 (4CE7A872)
fffff880`0f42f000 fffff880`0f44a000 raspppoe Tue Jul 14 02:10:17 2009 (4A5BCCE9)
fffff880`0f44a000 fffff880`0f46b000 raspptp Sat Nov 20 11:52:31 2010 (4CE7A86F)
fffff880`0f46b000 fffff880`0f485000 rassstp Tue Jul 14 02:10:25 2009 (4A5BCCF1)
fffff880`04937000 fffff880`04988000 rdbss Sat Nov 20 10:27:51 2010 (4CE79497)
fffff880`0f485000 fffff880`0f490000 rdpbus Tue Jul 14 02:17:46 2009 (4A5BCEAA)
fffff880`04610000 fffff880`04619000 RDPCDD Tue Jul 14 02:16:34 2009 (4A5BCE62)
fffff880`04619000 fffff880`04622000 rdpencdd Tue Jul 14 02:16:34 2009 (4A5BCE62)
fffff880`04622000 fffff880`0462b000 rdprefmp Tue Jul 14 02:16:35 2009 (4A5BCE63)
fffff880`0196a000 fffff880`019a4000 rdyboost Sat Nov 20 10:43:10 2010 (4CE7982E)
fffff880`08fc3000 fffff880`08fdb000 rspndr Tue Jul 14 02:08:50 2009 (4A5BCC92)
fffff880`084b5000 fffff880`08745e80 RTKVHD64 Tue Jan 04 12:48:55 2011 (4D230927)
fffff880`010d4000 fffff880`01103000 SCSIPORT Sat Nov 20 11:34:01 2010 (4CE7A419)
fffff880`0dd46000 fffff880`0dd51000 secdrv Wed Sep 13 15:18:38 2006 (4508052E)
fffff880`06a10000 fffff880`06a18000 serscan Tue Jul 14 02:35:32 2009 (4A5BD2D4)
fffff880`01ae5000 fffff880`01aed000 spldr Mon May 11 18:56:27 2009 (4A0858BB)
fffff880`0dc00000 fffff880`0dc98000 srv Fri Apr 29 05:06:06 2011 (4DBA2B1E)
fffff880`0dd94000 fffff880`0ddfd000 srv2 Fri Apr 29 05:05:46 2011 (4DBA2B0A)
fffff880`0dd51000 fffff880`0dd82000 srvnet Fri Apr 29 05:05:35 2011 (4DBA2AFF)
fffff880`014bc000 fffff880`01520000 storport Tue Feb 04 02:36:50 2014 (52F04432)
fffff880`06a1e000 fffff880`06a1f480 swenum Tue Jul 14 02:00:18 2009 (4A5BCA92)
fffff880`01c00000 fffff880`01dff000 tcpip Sun Sep 08 03:11:52 2013 (522BCED8)
fffff880`0dd82000 fffff880`0dd94000 tcpipreg Wed Oct 03 18:07:26 2012 (506C62BE)
fffff880`04669000 fffff880`04676000 TDI Sat Nov 20 10:22:06 2010 (4CE7933E)
fffff880`04647000 fffff880`04669000 tdx Sat Nov 20 10:21:54 2010 (4CE79332)
fffff880`04923000 fffff880`04937000 termdd Sat Nov 20 12:03:40 2010 (4CE7AB0C)
fffff960`00420000 fffff960`0042a000 TSDDD Tue Jul 14 02:16:34 2009 (4A5BCE62)
fffff880`0577c000 fffff880`057a2000 tunnel Sat Nov 20 11:51:50 2010 (4CE7A846)
fffff880`0f4ae000 fffff880`0f4c0000 umbus Sat Nov 20 11:44:37 2010 (4CE7A695)
fffff880`087de000 fffff880`087f8d00 usbaudio Fri Jul 12 12:40:58 2013 (51DFDD3A)
fffff880`087ae000 fffff880`087cb000 usbccgp Wed Nov 27 02:41:15 2013 (52954DBB)
fffff880`057e9000 fffff880`057eae80 USBD Wed Nov 27 02:41:03 2013 (52954DAF)
fffff880`06be5000 fffff880`06bf7000 usbehci Wed Nov 27 02:41:11 2013 (52954DB7)
fffff880`06c6a000 fffff880`06cc4000 usbhub Wed Nov 27 02:41:36 2013 (52954DD0)
fffff880`06b8f000 fffff880`06be5000 USBPORT Wed Nov 27 02:41:11 2013 (52954DB7)
fffff880`08ea8000 fffff880`08ec3000 USBSTOR Fri Mar 11 05:37:16 2011 (4D79A6FC)
fffff880`06b82000 fffff880`06b8f000 usbuhci Wed Nov 27 02:41:05 2013 (52954DB1)
fffff880`00e9d000 fffff880`00eaa000 vdrvroot Tue Jul 14 02:01:31 2009 (4A5BCADB)
fffff880`047c2000 fffff880`047d0000 vga Tue Jul 14 01:38:47 2009 (4A5BC587)
fffff880`047d0000 fffff880`047f5000 VIDEOPRT Tue Jul 14 01:38:51 2009 (4A5BC58B)
fffff880`0111d000 fffff880`01159000 vmbus Sat Nov 20 10:57:29 2010 (4CE79B89)
fffff880`01ad5000 fffff880`01ae5000 vmstorfl Sat Nov 20 10:57:30 2010 (4CE79B8A)
fffff880`00ebf000 fffff880`00ed4000 volmgr Sat Nov 20 10:19:28 2010 (4CE792A0)
fffff880`01040000 fffff880`0109c000 volmgrx Sat Nov 20 10:20:43 2010 (4CE792EB)
fffff880`0191e000 fffff880`0196a000 volsnap Sat Nov 20 10:20:08 2010 (4CE792C8)
fffff880`04908000 fffff880`04923000 wanarp Sat Nov 20 11:52:36 2010 (4CE7A874)
fffff880`04600000 fffff880`04610000 watchdog Tue Jul 14 01:37:35 2009 (4A5BC53F)
fffff880`00edd000 fffff880`00f9f000 Wdf01000 Sat Jun 22 05:13:05 2013 (51C51641)
fffff880`00f9f000 fffff880`00faf000 WDFLDR Thu Jul 26 04:29:04 2012 (5010AB70)
fffff880`048ca000 fffff880`048d3000 wfplwf Tue Jul 14 02:09:26 2009 (4A5BCCB6)
fffff960`000d0000 fffff960`003e7000 win32k Fri Feb 07 02:23:07 2014 (52F4357B)
fffff880`01159000 fffff880`0116d000 winhv Sat Nov 20 10:20:02 2010 (4CE792C2)
fffff880`06bf7000 fffff880`06c00000 wmiacpi Tue Jul 14 01:31:02 2009 (4A5BC3B6)
fffff880`00e57000 fffff880`00e60000 WMILIB Tue Jul 14 01:19:51 2009 (4A5BC117)
fffff880`048bf000 fffff880`048ca000 ws2ifsl Tue Jul 14 02:10:33 2009 (4A5BCCF9)
fffff880`09a72000 fffff880`09a7d000 WSDPrint Tue Jul 14 02:39:20 2009 (4A5BD3B8)
fffff880`1012c000 fffff880`10155000 Xeno7x64 Thu May 19 00:55:16 2011 (4DD44E54)
Unloaded modules:
fffff880`09be4000 fffff880`09bef000 WSDPrint.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000B000
fffff880`06d77000 fffff880`06de8000 spsys.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00071000
fffff880`09a72000 fffff880`09a93000 NisDrvWFP.sy
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00021000
fffff880`019f0000 fffff880`019fe000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880`01600000 fffff880`0160a000 dump_storpor
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000A000
fffff880`046ce000 fffff880`0475d000 dump_mvs91xx
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0008F000
fffff880`04765000 fffff880`04778000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000
Further reading
Resolution
Installing a newer network card driver might help. While you're at it, consider updating the rest as well:
- Ethernet
https://www.qca.qualcomm.com/resources/driverdownloads/ - Audio
http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=14&PFid=24&Level=4&Conn=3&DownTypeID=3&GetDown=false - Video
http://www.nvidia.com/Download/index.aspx?lang=en-us - Chipset
https://downloadcenter.intel.com/SearchResult.aspx?lang=eng&ProductFamily=Software+Products&ProductLine=Chipset+Software&ProductProduct=Intel%C2%AE+Chipset+Software+Installation+Utility
As for the BIOS, the current version is F4a. Despite being beta, Gigabyte claims it's stable:
BETA describes a new version that is reliable yet may not include all the features of the final product. During this phase we are previewing new features and gathering customer input to insure our product provides the best experience possible.
Source: GIGABYTE - Motherboard - Socket 1366 - G1.Guerrilla (rev. 1.0)
Unless you updated the BIOS yourself, you should leave it as-is. Otherwise you might consider downgrading to version F2, which is the previous non-beta release.
Also, make sure you're using latest Dropbox version.
magicandre1981
According to the dump, the crash is caused by the Killer Xeno Gaming Adapter driver (Xeno7x64.sys) which is 3 years old, while you used Dropbox:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00001000000102fd, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88010143afd, address which referenced memory
Debugging Details:
------------------
PROCESS_NAME: Dropbox.exe
STACK_TEXT:
nt!KeBugCheckEx
nt!KiBugCheckDispatch
nt!KiPageFault
Xeno7x64
0x0
0x0
0x0
Xeno7x64
0x0
0x0
0x0
0x0
0x0
0x0
0x0
0x0
0x0
Xeno7x64
0x0
0x0
0x0
0x0
0x0
Xeno7x64
IMAGE_NAME: Xeno7x64.sys
FAILURE_BUCKET_ID: X64_0xD1_Xeno7x64+17afd
FAILURE_ID_HASH_STRING: km:x64_0xd1_xeno7x64+17afd
Loaded symbol image file: Xeno7x64.sys
Image path: Xeno7x64.sys
Image name: Xeno7x64.sys
Timestamp: Thu May 19 00:55:16 2011
Look for a driver update.
Related Question
windows xp - Blue Screen crash, how do I read the WinDbg output?
Chad
I downloaded some debugging symbols needed by the WinDbg tool. Then I opened up the DMP file created by the last Blue Screen crash. This is what was display. Is this a problem with my Video Driver?
WARNING: Inaccessible path: 'ImagePath'
Loading Dump File [C:\WINNT\Minidump\Mini072711-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Inaccessible path: 'ImagePath'
Symbol search path is: C:\WINNT\symbols;http://msdl.microsoft.com/download/symbols
Executable search path is: ImagePath
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jul 27 12:52:48.208 2011 (GMT-4)
System Uptime: 0 days 3:32:55.464
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.....................
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007F, {8, ba348d70, 0, 0}
Unable to load image DGAPIMon.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for DGAPIMon.SYS
*** ERROR: Module load completed but symbols could not be loaded for DGAPIMon.SYS
*** WARNING: Unable to verify timestamp for igxpmp32.sys
*** ERROR: Module load completed but symbols could not be loaded for igxpmp32.sys
Unable to load image igxpdx32.DLL, Win32 error 0n2
*** WARNING: Unable to verify timestamp for igxpdx32.DLL
*** ERROR: Module load completed but symbols could not be loaded for igxpdx32.DLL
Probably caused by : DGAPIMon.SYS ( DGAPIMon+49dd )
Followup: MachineOwner
---------
1: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: ba348d70
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_8
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: javaw.exe
LAST_CONTROL_TRANSFER: from 805f894c to 805e3274
STACK_TEXT:
a0c25ffc 805f894c eca75898 00000001 a0c26134 nt!RtlCreateSecurityDescriptor+0x2
a0c26064 80636ac7 a0c26100 eca75898 a0c26104 nt!SeQuerySecurityDescriptorInfo+0x198
a0c2607c 806379d6 e66d401c a0c26100 eca75898 nt!CmpQuerySecurityDescriptorInfo+0x23
a0c260c8 805bfe5b eda7eaa0 00000001 a0c26100 nt!CmpSecurityMethod+0xce
a0c26108 805c01c8 eda7eaa0 a0c26134 eda7ea9c nt!ObpGetObjectSecurity+0x99
a0c26138 8062f28f eda7eaa0 85448dc0 00000001 nt!ObCheckObjectAccess+0x2c
a0c26184 8062ff30 e6aaf008 0007ddf0 e6b17df4 nt!CmpDoOpen+0x2d5
a0c26384 805bf488 0007ddf0 0007ddf0 85448dc0 nt!CmpParseKey+0x5a6
a0c263fc 805bba14 00000000 a0c2643c 00000240 nt!ObpLookupObjectName+0x53c
a0c26450 80625696 00000000 8acacae8 a0c26500 nt!ObOpenObjectByName+0xea
a0c2654c a387b9dd a0c26928 82000000 a0c2665c nt!NtOpenKey+0x1c8
WARNING: Stack unwind information not available. Following frames may be wrong.
a0c265cc 80500699 badb0d00 a0c26644 00000024 DGAPIMon+0x49dd
a0c2663c 805e701e a0c26928 82000000 a0c2665c nt!ZwOpenKey+0x11
a0c268ac 805e7b2a 00000005 e729e380 00000000 nt!RtlpGetRegistryHandleAndPath+0x27a
a0c26b40 b8f93184 00000005 e729e380 a0c26ba0 nt!RtlQueryRegistryValues+0x9c
a0c26be8 b8f5885b 00000005 8538f33c 8538f43c igxpmp32+0x44184
a0c27260 b8f54a7b 88db9140 a0c27290 00000000 igxpmp32+0x985b
a0c27274 b9131729 88db9140 a0c27290 00000a0c igxpmp32+0x5a7b
a0c27338 804ef19f 88db9040 85de3f08 0000080c VIDEOPRT!pVideoPortDispatch+0xabf
a0c27348 bf86ebbd a0c27610 bf6e6cdc 00000014 nt!IopfCallDriver+0x31
a0c27378 bf86ec37 88db9040 00232150 a0c273f8 win32k!GreDeviceIoControl+0x93
a0c2739c bf376769 88db9040 00232150 a0c273f8 win32k!EngDeviceIoControl+0x1f
a0c28624 bf3b9f19 88db9040 bf6a593c bf6a5960 igxpdx32+0x8769
a0c286ac 8054167c a0c28994 80500699 badb0d00 igxpdx32+0x4bf19
a0c286ac 00000000 a0c28994 80500699 badb0d00 nt!KiFastCallEntry+0xfc
STACK_COMMAND: kb
FOLLOWUP_IP:
DGAPIMon+49dd
a387b9dd ?? ???
SYMBOL_STACK_INDEX: b
SYMBOL_NAME: DGAPIMon+49dd
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: DGAPIMon
IMAGE_NAME: DGAPIMon.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4acf7551
FAILURE_BUCKET_ID: 0x7f_8_DGAPIMon+49dd
BUCKET_ID: 0x7f_8_DGAPIMon+49dd
Followup: MachineOwner
---------
Hmm. I see now that it refers to javaw.exe. I sthis related to the JRE?
Related Answers
TookTheRook
Seems like the problem is caused by DGAPIMON.sys which is the driver for Digital Guardian. More info about DGAPIMON.sys here: http://www.runscanner.net/lib/DGAPIMon.SYS.html