Microsoft (R) Windows Debugger Version 6.12.0002.633 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\Minidump\Mini050111-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\Symbole*http://msdl.microsoft.com/download/symbols Executable search path is: Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_rtm.040803-2158 Machine Name: Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0 Debug session time: Sun May 1 23:13:02.203 2011 (UTC + 2:00) System Uptime: 0 days 1:08:49.940 Loading Kernel Symbols ............................................................... ................................................................ ....... Loading User Symbols Loading unloaded module list ............ Unable to load image dwprot.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for dwprot.sys *** ERROR: Module load completed but symbols could not be loaded for dwprot.sys ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 10000050, {f463655f, 0, a5f96481, 2} Could not read faulting driver name Probably caused by : dwprot.sys ( dwprot+9481 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: f463655f, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: a5f96481, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: f463655f FAULTING_IP: dwprot+9481 a5f96481 8b760c mov esi,dword ptr [esi+0Ch] MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: System LAST_CONTROL_TRANSFER: from a5f9649f to a5f96481 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. f78d2b40 a5f9649f 00000000 f78d2bc0 a5f98483 dwprot+0x9481 f78d2b4c a5f98483 e1692530 00000000 52700424 dwprot+0x949f f78d2bc0 a5f964d6 f78d2bd8 a5f96492 00000000 dwprot+0xb483 f78d2be0 a5fa891e 527003d0 88f87000 88ee7860 dwprot+0x94d6 f78d2c34 a5fa872a 88f87000 52700360 8991e338 dwprot+0x1b91e f78d2c84 805a3777 8991e338 88f87000 00000000 dwprot+0x1b72a f78d2d54 805ad447 0000005c 00000001 00000000 nt!IopLoadDriver+0x66c f78d2d7c 804e29d6 0000005c 00000000 8af2eb30 nt!IopLoadUnloadDriver+0x45 f78d2dac 80576b24 a9d66cf4 00000000 00000000 nt!ExpWorkerThread+0xef f78d2ddc 804eed86 804e2912 00000001 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: dwprot+9481 a5f96481 8b760c mov esi,dword ptr [esi+0Ch] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: dwprot+9481 FOLLOWUP_NAME: MachineOwner MODULE_NAME: dwprot IMAGE_NAME: dwprot.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4cef6120 FAILURE_BUCKET_ID: 0x50_dwprot+9481 BUCKET_ID: 0x50_dwprot+9481 Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: f463655f, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: a5f96481, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: f463655f FAULTING_IP: dwprot+9481 a5f96481 8b760c mov esi,dword ptr [esi+0Ch] MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: System LAST_CONTROL_TRANSFER: from a5f9649f to a5f96481 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. f78d2b40 a5f9649f 00000000 f78d2bc0 a5f98483 dwprot+0x9481 f78d2b4c a5f98483 e1692530 00000000 52700424 dwprot+0x949f f78d2bc0 a5f964d6 f78d2bd8 a5f96492 00000000 dwprot+0xb483 f78d2be0 a5fa891e 527003d0 88f87000 88ee7860 dwprot+0x94d6 f78d2c34 a5fa872a 88f87000 52700360 8991e338 dwprot+0x1b91e f78d2c84 805a3777 8991e338 88f87000 00000000 dwprot+0x1b72a f78d2d54 805ad447 0000005c 00000001 00000000 nt!IopLoadDriver+0x66c f78d2d7c 804e29d6 0000005c 00000000 8af2eb30 nt!IopLoadUnloadDriver+0x45 f78d2dac 80576b24 a9d66cf4 00000000 00000000 nt!ExpWorkerThread+0xef f78d2ddc 804eed86 804e2912 00000001 00000000 nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 STACK_COMMAND: kb FOLLOWUP_IP: dwprot+9481 a5f96481 8b760c mov esi,dword ptr [esi+0Ch] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: dwprot+9481 FOLLOWUP_NAME: MachineOwner MODULE_NAME: dwprot IMAGE_NAME: dwprot.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4cef6120 FAILURE_BUCKET_ID: 0x50_dwprot+9481 BUCKET_ID: 0x50_dwprot+9481 Followup: MachineOwner ---------