Tech Support Forum - View Single Post

**jcgriff2** · 11-21-2008, 12:29 AM

The dump file is corrupt - the NT kernel module was not present, nor was a module listing. I was able to read the bugcheck from it -

0x7f (0x8, 0x803d3130, 0x0, 0x0)

0x7f = UNEXPECTED_KERNEL_MODE_TRAP = the Intel CPU generated a trap and the kernel failed to catch this trap. 2nd parm 0x8 = double fault = exception generated during call to error handler for a prior exception. Usually handled serially. 2 primary reasons for this:
1. Hardware
2. kernel stack overflow

What is very odd about this is that the CPU per Belarc is:

2.30 gigahertz AMD Athlon 64 X2 Dual Core

This bugcheck specifically refers to Intel CPUs.

Regards. . .

jcgriff2

.

Code:

Loading Dump File [A:\D\#Dumps\tech_chico_Vista_11-21-08\Mini111308-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Invalid directory table base value 0x0
Mini Kernel Dump does not have thread information
Symbol search path is: SRV*a:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 

"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000.

Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt, Win32 error 0n2
Unable to add module at 00000000
Debugger can not determine kernel base address
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x81e4f000 PsLoadedModuleList = 0x81f66c70
Debug session time: Thu Nov 13 14:02:22.694 2008 (GMT-5)
System Uptime: 0 days 0:16:21.567

"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000.

Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt, Win32 error 0n2
Unable to add module at 00000000
Debugger can not determine kernel base address
Loading Kernel Symbols

Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 803d3130, 0, 0}

***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

Unable to read KTHREAD address 87768078
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

0: kd> !analyze -v;kv;lmtn
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 803d3130
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

Unable to read KTHREAD address 87768078

AUTOBUG_OS_SKU:  3

BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

LAST_CONTROL_TRANSFER:  from 00000000 to 81ea9b34

STACK_TEXT:  
888885b4 00000000 00000000 00000000 00000000 0x81ea9b34


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  CORRUPT_MODULELIST

Followup: MachineOwner
---------

ChildEBP RetAddr  Args to Child              
WARNING: Frame IP not in any known module. Following frames may be wrong.
888885b4 00000000 00000000 00000000 00000000 0x81ea9b34
start    end        module name
0: kd> r
eax=ffffe850 ebx=8888867c ecx=87768030 edx=00000000 esi=0a6ab92a edi=face7d08
eip=81ea9b34 esp=888885b4 ebp=888885b4 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000206
81ea9b34 0f84ea010000    je      81ea9d24                                [br=0]
0: kd> lm o
start    end        module name
0: kd> lm
start    end        module name