I've enabled crash dumps to be created, and I'm having a hard time understanding exactly what is causing the issue from reading the dump file in WinDbg. Can anyone assist?
Dump File:
User Mini Dump File: Only registers, stack and portions of memory are availableSymbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Thu Jan 16 09:46:32.000 2014 (UTC - 5:00)
System Uptime: not available
Process Uptime: 0 days 0:14:32.000
................................................................
................................................................
.........
Loading unloaded module list
..........
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(5d8.f94): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=0466ef04 ecx=00000400 edx=00000000 esi=00000002 edi=00000000
eip=76ec70f4 esp=0466eeb4 ebp=0466ef50 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
76ec70f4 c3 ret
0:014> .ecxr
eax=0000003f ebx=00000001 ecx=00000000 edx=02020e21 esi=00000006 edi=05ab528c
eip=0466f686 esp=0466f674 ebp=0466f674 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
0466f686 a4 movs byte ptr es:[edi],byte ptr [esi] es:0023:05ab528c=?? ds:0023:00000006=??
0:014> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
Cannot find frame 0x22, previous scope unchanged
Cannot find frame 0x22, previous scope unchanged
Cannot find frame 0x27, previous scope unchanged
FAULTING_IP:
+0
0466f686 a4 movs byte ptr es:[edi],byte ptr [esi]
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0466f686
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000006
Attempt to read from address 00000006
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000006
READ_ADDRESS: 00000006
FOLLOWUP_IP:
+0
0466f686 a4 movs byte ptr es:[edi],byte ptr [esi]
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
APP: explorer.exe
FAULTING_THREAD: 00000f94
STACK_ADDR_RAW_STACK_SYMBOL: 466f18c
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 00000000 to 0466f686
DEFAULT_BUCKET_ID: STACKIMMUNE
PRIMARY_PROBLEM_CLASS: STACKIMMUNE
BUGCHECK_STR: APPLICATION_FAULT_STACKIMMUNE_NULL_CLASS_PTR_READ
IP_ON_STACK:
+0
0466f686 a4 movs byte ptr es:[edi],byte ptr [esi]
STACK_TEXT:
00000000 00000000 explorer.exe!unknown_error_in_process+0x0
STACK_COMMAND: .cxr 0466F21C ; kb ; ** Pseudo Context ** ; kb
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: explorer.exe!unknown_error_in_process
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: explorer
IMAGE_NAME: explorer.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4d6727a7
FAILURE_BUCKET_ID: STACKIMMUNE_c0000005_explorer.exe!unknown_error_in_process
BUCKET_ID: APPLICATION_FAULT_STACKIMMUNE_NULL_CLASS_PTR_READ_explorer.exe!unknown_error_in_process
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer_exe/6_1_7601_17567/4d6727a7/unknown/0_0_0_0/bbbbbbb4/c0000005/0466f686.htm?Retriage=1
Followup: MachineOwner
---------
0:014> .exr 0xffffffffffffffff
ExceptionAddress: 0466f686
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000006
Attempt to read from address 00000006
0:014> lm N T
Unknown option 'N'
Unknown option 'T'
start end module name
00150000 003d1000 explorer (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\explorer.pdb\8F1A3D8113A3418BACA0D822DBF3A8E52\explorer.pdb
0f170000 0f223000 msoshext (deferred)
16980000 16a20000 SearchFolder (deferred)
63e00000 63e0d000 dfscli (deferred)
63e10000 63e19000 fdWNet (deferred)
63f60000 63f79000 WcnApi (deferred)
63f80000 63f97000 fdWCN (deferred)
63ff0000 63ffa000 fdProxy (deferred)
64030000 6403b000 dtsh (deferred)
64040000 6404d000 NetworkItemFactory (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\NetworkItemFactory.pdb\6D0F78F2FB054F05BBC2433592B7F6291\NetworkItemFactory.pdb
64580000 64596000 thumbcache (deferred)
64f50000 64fac000 StructuredQuery (deferred)
65000000 65022000 EhStorAPI (deferred)
65250000 65292000 ieproxy (deferred)
659a0000 65b1d000 tquery (deferred)
6a630000 6b355000 ieframe (private pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\ieframe.pdb\2BC87F989368405AB432AEDD1E82BBBB2\ieframe.pdb
6be20000 6be89000 msvcp100 (deferred)
6c120000 6c132000 l3codeca (deferred)
6c1b0000 6c1b4000 api_ms_win_downlevel_shell32_l1_1_0 (deferred)
6c1c0000 6c1c4000 api_ms_win_downlevel_shlwapi_l2_1_0 (deferred)
6c1d0000 6c368000 NetworkExplorer (deferred)
6c370000 6c3c8000 tiptsf (deferred)
6c3d0000 6c3fb000 msls31 (deferred)
6c400000 6c494000 msftedit (deferred)
6c720000 6c76e000 actxprxy (deferred)
6c7f0000 6c860000 ntshrui (deferred)
6c8a0000 6c90a000 cscui (deferred)
6c920000 6c94f000 shdocvw (deferred)
6c950000 6cabf000 EXPLORERFRAME (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\ExplorerFrame.pdb\E5AAAE8E539E418481918BC99DDF5A302\ExplorerFrame.pdb
6cac0000 6cb7f000 msvcr100 (deferred)
6cd50000 6cd57000 msiltcfg (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\msiltcfg.pdb\2E23B94E6C584AC5993CCD655D8D58D21\msiltcfg.pdb
6cd60000 6cd69000 linkinfo (deferred)
6ce00000 6ce31000 EhStorShell (deferred)
6d110000 6d350000 msi (deferred)
6d640000 6d642000 netmsg (deferred)
6d650000 6d656000 IconCodecService (deferred)
6eea0000 6eeb2000 mpr (deferred)
6f800000 6f825000 cscobj (deferred)
6fbb0000 6fbbd000 browcli (deferred)
6fe50000 6fe59000 cscdll (deferred)
700e0000 700eb000 cscapi (deferred)
70200000 7022b000 fundisc (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\FunDisc.pdb\031B050F569649C7B1C9B3E781EBBDB62\FunDisc.pdb
703c0000 70517000 msxml6 (deferred)
70df0000 70e79000 PortableDeviceApi (deferred)
70f20000 70f2d000 sfc_os (deferred)
70f30000 70f33000 sfc (deferred)
71130000 71138000 npmproxy (deferred)
71480000 71488000 davhlpr (deferred)
71490000 714a7000 davclnt (deferred)
714b0000 714c4000 ntlanman (deferred)
714d0000 714d8000 drprov (deferred)
714e0000 714ed000 vmhgfs (deferred)
71f10000 71f16000 rasadhlp (deferred)
72560000 72572000 dhcpcsvc (deferred)
725e0000 725ed000 dhcpcsvc6 (deferred)
72640000 72647000 midimap (deferred)
72680000 72694000 msacm32_72680000 (deferred)
726a0000 726a8000 msacm32 (deferred)
726b0000 726e6000 AudioSes (deferred)
72780000 72787000 winnsi (deferred)
72790000 72794000 ksuser (deferred)
727b0000 727cc000 IPHLPAPI (deferred)
727d0000 72800000 wdmaud (deferred)
72810000 72842000 winmm (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\winmm.pdb\7AFD98FCAAD34F6B8B31A4667C4E2BFC2\winmm.pdb
72860000 7286a000 slc (deferred)
729a0000 729b4000 atl (deferred)
729f0000 729f4000 api_ms_win_downlevel_advapi32_l2_1_0 (deferred)
73300000 73307000 avrt (deferred)
73310000 73335000 powrprof (deferred)
73640000 7364f000 wkscli (deferred)
73760000 73890000 WindowsCodecs (deferred)
73890000 738bf000 xmllite (deferred)
738c0000 738d3000 dwmapi (deferred)
738e0000 739d5000 propsys (deferred)
739e0000 73a19000 MMDevAPI (deferred)
73a70000 73a9f000 duser (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\DUser.pdb\363E97D3DCE44C3786A74C5EF3BB268D2\DUser.pdb
73aa0000 73b52000 dui70 (deferred)
73b60000 73cf0000 GdiPlus (deferred)
73cf0000 73d30000 uxtheme (deferred)
73d30000 73ece000 comctl32 (deferred)
74190000 741b1000 ntmarta (deferred)
74270000 74279000 version (deferred)
743b0000 74426000 FirewallAPI (deferred)
74500000 74517000 userenv (deferred)
74520000 7452e000 devrtl (deferred)
746c0000 746c9000 netutils (deferred)
746d0000 7470b000 rsaenh (deferred)
747b0000 747f4000 dnsapi (deferred)
748f0000 7492c000 mswsock (deferred)
74930000 74946000 cryptsp (deferred)
74b40000 74b59000 srvcli (deferred)
74c50000 74c58000 secur32 (deferred)
74da0000 74dbb000 sspicli (deferred)
74dc0000 74e0c000 apphelp (deferred)
74e10000 74e39000 winsta (deferred)
74e40000 74e4c000 CRYPTBASE (deferred)
74e50000 74eaf000 sxs (deferred)
74eb0000 74ebe000 RpcRtRemote (deferred)
74ec0000 74ecb000 profapi (deferred)
74f30000 74f3c000 msasn1 (deferred)
74f40000 74f45000 api_ms_win_downlevel_advapi32_l1_1_0 (deferred)
74f50000 74f62000 devobj (deferred)
74f70000 74f9e000 wintrust (deferred)
74fa0000 74fa4000 api_ms_win_downlevel_shlwapi_l1_1_0 (deferred)
74fb0000 74ffb000 KERNELBASE (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\kernelbase.pdb\4784EC188D05497EBC81D127F049ACCD2\kernelbase.pdb
75000000 75004000 api_ms_win_downlevel_user32_l1_1_0 (deferred)
75010000 75014000 api_ms_win_downlevel_version_l1_1_0 (deferred)
75020000 75140000 crypt32 (deferred)
75140000 75143000 api_ms_win_downlevel_normaliz_l1_1_0 (deferred)
75150000 75154000 api_ms_win_downlevel_ole32_l1_1_0 (deferred)
751f0000 75217000 cfgmgr32 (deferred)
75220000 752a3000 clbcatq (deferred)
752b0000 752ba000 lpk (deferred)
752c0000 75362000 rpcrt4 (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\rpcrt4.pdb\74C423E0915E49068D1835F72FC754B02\rpcrt4.pdb
75370000 7541c000 msvcrt (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\msvcrt.pdb\F1D253F9555C46DF8076400A52B3A9292\msvcrt.pdb
75420000 7543f000 imm32 (deferred)
754a0000 760ea000 shell32 (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\shell32.pdb\71AF3344690C4786B3DDD0D1356C23512\shell32.pdb
760f0000 76109000 sechost (deferred)
76110000 761dc000 msctf (deferred)
761e0000 7626f000 oleaut32 (deferred)
76270000 762c7000 shlwapi (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\shlwapi.pdb\E128B1CEE2EB438C8646E6967118F33E2\shlwapi.pdb
762d0000 7631e000 gdi32 (deferred)
76320000 763e9000 user32 (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\user32.pdb\DD74D86F12624845A42A6A5BAAB4D7A82\user32.pdb
763f0000 765a8000 wininet (deferred)
765b0000 76684000 kernel32 (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\kernel32.pdb\DFC928461D46441BB667A828FACCE7B82\kernel32.pdb
76690000 76888000 iertutil (deferred)
76890000 76a2d000 setupapi (deferred)
76a30000 76b8c000 ole32 (private pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\ole32.pdb\5061F11A9A57433595EA5EA75A156F4B2\ole32.pdb
76b90000 76cb1000 urlmon (deferred)
76cc0000 76d5d000 usp10 (deferred)
76d60000 76e00000 advapi32 (deferred)
76e80000 76fbc000 ntdll (pdb symbols) C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x86\sym\ntdll.pdb\CD4062A231154A17A18DAE7D1A0FBACC2\ntdll.pdb
76fc0000 76fc6000 nsi (deferred)
76fd0000 76fd5000 psapi (deferred)
76fe0000 77025000 Wldap32 (deferred)
77060000 77095000 ws2_32 (deferred)
770a0000 770a3000 normaliz (deferred)
Unloaded modules:
72600000 72638000 fwpuclnt.dll
74430000 74435000 wshtcpip.dll
748e0000 748e6000 wship6.dll
29410000 29648000 wpdshext.dll
5a220000 5a25d000 WMASF.DLL
2b440000 2b6a7000 WMVCore.DLL
573d0000 5740f000 audiodev.dll
70f60000 70fc1000 wer.dll
6c4a0000 6c718000 gameux.dll
73890000 738bf000 xmllite.dll