Hello, I am new so forgive me if I am in the wrong spot. I have been looking for a site with information on debugging. I did a search in google and it came up with the following:
http://www.osronline.com/lists_archive/ntfsd/thread3749.html
I found it very in depth and helpful. So I am posting here in hopes that someone can point me in the proper direction with my problem.
Thank you in advance.
How do I copy that information here. I tried the normal cut and paste but it won’t allow it.
What are you asking, how to copy the output from !analyze -v and paste it?
Highlight it, do a ctrl +c to copy it, and then a ctrl +v to paste it.
m.
xxxxx@aol.com wrote:
Hello, I am new so forgive me if I am in the wrong spot. I have been looking for a site with information on debugging. I did a search in google and it came up with the following:
http://www.osronline.com/lists_archive/ntfsd/thread3749.html
I found it very in depth and helpful. So I am posting here in hopes that someone can point me in the proper direction with my problem.
Thank you in advance.
How do I copy that information here. I tried the normal cut and paste but it won’t allow it.
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com
Thanks. I tried to use the lazy way of selecting all and then right clicking and it wasn’t presenting a vchoice to copy.
Here is the total file output:
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\windows\minidump\mini091806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: e:\symbols
Executable search path is: c:\windows\i386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Sep 18 01:47:45.062 2006 (GMT-7)
System Uptime: 0 days 0:32:53.625
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
…
Loading User Symbols
Loading unloaded module list
…
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7A, {c03dd008, c000000e, f74023c5, 1ab5d860}
Unable to load image atapi.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for atapi.sys
*** WARNING: Unable to verify timestamp for Ntfs.sys
Probably caused by : memory_corruption ( nt!MiGetInPageSupportBlock+f6 )
kd> !drivers
The !drivers command is no longer supported.
Please use the ‘lm t n’ command.
Consult the debugger documentation for the supported ‘lm’ command options.
The WinDbg “Modules” window can also be used to display timestamps.
The “Modules” window supports sorting on name or timestamp values
kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: c03dd008, lock type that was held (value 1,2,3, or PTE address)
Arg2: c000000e, error status (normally i/o status code)
Arg3: f74023c5, current process (virtual address for lock type 3, or PTE)
Arg4: 1ab5d860, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c000000e
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80521b5d to 8053331e
STACK_TEXT:
f7a0deb4 80521b5d 0000007a c03dd008 c000000e nt!KeBugCheck2+0x4d4
f7a0dedc 804f51b8 81d540b8 c03dd008 f74023c5 nt!MiGetInPageSupportBlock+0xf6
f7a0df54 804ebace 1ab5d860 f74023c5 c03dd008 nt!CcInitializeCacheMap+0x4f7
f7a0dfa4 804e1718 00000000 f74023c5 00000000 nt!MiInsertVad+0x36
f7a0dfbc f74023c4 badb0d00 00000000 00000000 nt!VdmFixEspEbp+0x6d
f7a0e6a8 f73c58f4 8590f8f0 86ecd100 e31304c8 Ntfs!NtfsReadMftRecord+0xb6
f7a0e6e0 f73c584a 8590f8f0 86ecd100 e31304c8 Ntfs!NtfsReadFileRecord+0x7a
f7a0e718 f73c9271 8590f8f0 e31304c0 e31304c8 Ntfs!NtfsLookupInFileRecord+0x37
f7a0e7e8 f73a5669 8590f8f0 e31304c0 8590f8f0 Ntfs!NtfsUpdateStandardInformation+0x46
f7a0e830 f73c6d00 8590f8f0 86ecd100 e31304c0 Ntfs!NtfsTeardownFromLcb+0x175
f7a0e888 f73a1759 8590f8f0 e3130588 e3130720 Ntfs!NtfsTeardownStructures+0x125
f7a0e8b4 f73c46eb 8590f8f0 00130588 e3130720 Ntfs!NtfsDecrementCloseCounts+0x9e
f7a0e938 f73c448a 8590f8f0 e3130588 e31304c0 Ntfs!NtfsCommonClose+0x397
f7a0e9d8 804e37f7 86ecd020 85a959c0 86f5f4c8 Ntfs!NtfsFsdClose+0x21f
f7a0e9d8 f7a0ea98 86ecd020 85a959c0 86f5f4c8 nt!KeUpdateSystemTime+0xba
WARNING: Frame IP not in any known module. Following frames may be wrong.
f74bc660 00000000 00000000 00000000 00000000 0xf7a0ea98
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiGetInPageSupportBlock+f6
80521b5d ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiGetInPageSupportBlock+f6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x7a_c000000e_nt!MiGetInPageSupportBlock+f6
BUCKET_ID: 0x7a_c000000e_nt!MiGetInPageSupportBlock+f6
kd> !anaylze -show
No export anaylze found
kd> !analyze -show
ERROR: FindPlugIns 8007007b
Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: c03dd008, lock type that was held (value 1,2,3, or PTE address)
Arg2: c000000e, error status (normally i/o status code)
Arg3: f74023c5, current process (virtual address for lock type 3, or PTE)
Arg4: 1ab5d860, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c000000e
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80521b5d to 8053331e
STACK_TEXT:
f7a0deb4 80521b5d 0000007a c03dd008 c000000e nt!KeBugCheck2+0x4d4
f7a0dedc 804f51b8 81d540b8 c03dd008 f74023c5 nt!MiGetInPageSupportBlock+0xf6
f7a0df54 804ebace 1ab5d860 f74023c5 c03dd008 nt!CcInitializeCacheMap+0x4f7
f7a0dfa4 804e1718 00000000 f74023c5 00000000 nt!MiInsertVad+0x36
f7a0dfbc f74023c4 badb0d00 00000000 00000000 nt!VdmFixEspEbp+0x6d
f7a0e6a8 f73c58f4 8590f8f0 86ecd100 e31304c8 Ntfs!NtfsReadMftRecord+0xb6
f7a0e6e0 f73c584a 8590f8f0 86ecd100 e31304c8 Ntfs!NtfsReadFileRecord+0x7a
f7a0e718 f73c9271 8590f8f0 e31304c0 e31304c8 Ntfs!NtfsLookupInFileRecord+0x37
f7a0e7e8 f73a5669 8590f8f0 e31304c0 8590f8f0 Ntfs!NtfsUpdateStandardInformation+0x46
f7a0e830 f73c6d00 8590f8f0 86ecd100 e31304c0 Ntfs!NtfsTeardownFromLcb+0x175
f7a0e888 f73a1759 8590f8f0 e3130588 e3130720 Ntfs!NtfsTeardownStructures+0x125
f7a0e8b4 f73c46eb 8590f8f0 00130588 e3130720 Ntfs!NtfsDecrementCloseCounts+0x9e
f7a0e938 f73c448a 8590f8f0 e3130588 e31304c0 Ntfs!NtfsCommonClose+0x397
f7a0e9d8 804e37f7 86ecd020 85a959c0 86f5f4c8 Ntfs!NtfsFsdClose+0x21f
f7a0e9d8 f7a0ea98 86ecd020 85a959c0 86f5f4c8 nt!KeUpdateSystemTime+0xba
WARNING: Frame IP not in any known module. Following frames may be wrong.
f74bc660 00000000 00000000 00000000 00000000 0xf7a0ea98
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiGetInPageSupportBlock+f6
80521b5d ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiGetInPageSupportBlock+f6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x7a_c000000e_nt!MiGetInPageSupportBlock+f6
BUCKET_ID: 0x7a_c000000e_nt!MiGetInPageSupportBlock+f6
The Memory Manager is trying to retrieve a chunk of paged pool and the
I/O failed (0xC000000E - STATUS_NO_SUCH_DEVICE). From this, I’d guess
someone yanked a drive with a paging file out (or the OS THINKS someone
yanked the device out.)
I’d try “!pte c03dd008” (the address of the PTE being paged in) or you
can always decode the value (arg4) manually to figure out where it was
in the paging file, but bottom line is that the OS is screwed at this
point - a critical piece of OS data cannot be retrieved and there’s no
way to recover from this problem.
Most likely: hardware failure (disk error, controller error or human
error). But if you have some sort of funky disk or volume level filter
you might be able to cause this as well.
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@aol.com
Sent: Monday, September 18, 2006 7:02 PM
To: ntfsd redirect
Subject: RE:[ntfsd] Bug check problem - hope right location
Thanks. I tried to use the lazy way of selecting all and then right
clicking and it wasn’t presenting a vchoice to copy.
Here is the total file output:
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [c:\windows\minidump\mini091806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: e:\symbols
Executable search path is: c:\windows\i386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Sep 18 01:47:45.062 2006 (GMT-7)
System Uptime: 0 days 0:32:53.625
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
…
…
…
Loading User Symbols
Loading unloaded module list
…
ERROR: FindPlugIns 8007007b
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******
Use !analyze -v to get detailed debugging information.
BugCheck 7A, {c03dd008, c000000e, f74023c5, 1ab5d860}
Unable to load image atapi.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for atapi.sys
*** WARNING: Unable to verify timestamp for Ntfs.sys
Probably caused by : memory_corruption ( nt!MiGetInPageSupportBlock+f6 )
kd> !drivers
The !drivers command is no longer supported.
Please use the ‘lm t n’ command.
Consult the debugger documentation for the supported ‘lm’ command
options.
The WinDbg “Modules” window can also be used to display timestamps.
The “Modules” window supports sorting on name or timestamp values
kd> !analyze -v
ERROR: FindPlugIns 8007007b
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically
caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed
because
a filesystem failed to make forward progress.
Arguments:
Arg1: c03dd008, lock type that was held (value 1,2,3, or PTE address)
Arg2: c000000e, error status (normally i/o status code)
Arg3: f74023c5, current process (virtual address for lock type 3, or
PTE)
Arg4: 1ab5d860, virtual address that could not be in-paged (or PTE
contents if arg1 is a PTE address)
ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c000000e
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80521b5d to 8053331e
STACK_TEXT:
f7a0deb4 80521b5d 0000007a c03dd008 c000000e nt!KeBugCheck2+0x4d4
f7a0dedc 804f51b8 81d540b8 c03dd008 f74023c5
nt!MiGetInPageSupportBlock+0xf6
f7a0df54 804ebace 1ab5d860 f74023c5 c03dd008
nt!CcInitializeCacheMap+0x4f7
f7a0dfa4 804e1718 00000000 f74023c5 00000000 nt!MiInsertVad+0x36
f7a0dfbc f74023c4 badb0d00 00000000 00000000 nt!VdmFixEspEbp+0x6d
f7a0e6a8 f73c58f4 8590f8f0 86ecd100 e31304c8 Ntfs!NtfsReadMftRecord+0xb6
f7a0e6e0 f73c584a 8590f8f0 86ecd100 e31304c8
Ntfs!NtfsReadFileRecord+0x7a
f7a0e718 f73c9271 8590f8f0 e31304c0 e31304c8
Ntfs!NtfsLookupInFileRecord+0x37
f7a0e7e8 f73a5669 8590f8f0 e31304c0 8590f8f0
Ntfs!NtfsUpdateStandardInformation+0x46
f7a0e830 f73c6d00 8590f8f0 86ecd100 e31304c0
Ntfs!NtfsTeardownFromLcb+0x175
f7a0e888 f73a1759 8590f8f0 e3130588 e3130720
Ntfs!NtfsTeardownStructures+0x125
f7a0e8b4 f73c46eb 8590f8f0 00130588 e3130720
Ntfs!NtfsDecrementCloseCounts+0x9e
f7a0e938 f73c448a 8590f8f0 e3130588 e31304c0 Ntfs!NtfsCommonClose+0x397
f7a0e9d8 804e37f7 86ecd020 85a959c0 86f5f4c8 Ntfs!NtfsFsdClose+0x21f
f7a0e9d8 f7a0ea98 86ecd020 85a959c0 86f5f4c8 nt!KeUpdateSystemTime+0xba
WARNING: Frame IP not in any known module. Following frames may be
wrong.
f74bc660 00000000 00000000 00000000 00000000 0xf7a0ea98
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiGetInPageSupportBlock+f6
80521b5d ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiGetInPageSupportBlock+f6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x7a_c000000e_nt!MiGetInPageSupportBlock+f6
BUCKET_ID: 0x7a_c000000e_nt!MiGetInPageSupportBlock+f6
kd> !anaylze -show
No export anaylze found
kd> !analyze -show
ERROR: FindPlugIns 8007007b
Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
kd> !analyze -v
ERROR: FindPlugIns 8007007b
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******
KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in. Typically
caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed
because
a filesystem failed to make forward progress.
Arguments:
Arg1: c03dd008, lock type that was held (value 1,2,3, or PTE address)
Arg2: c000000e, error status (normally i/o status code)
Arg3: f74023c5, current process (virtual address for lock type 3, or
PTE)
Arg4: 1ab5d860, virtual address that could not be in-paged (or PTE
contents if arg1 is a PTE address)
ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was
specified.
DISK_HARDWARE_ERROR: There was error with disk hardware
BUGCHECK_STR: 0x7a_c000000e
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80521b5d to 8053331e
STACK_TEXT:
f7a0deb4 80521b5d 0000007a c03dd008 c000000e nt!KeBugCheck2+0x4d4
f7a0dedc 804f51b8 81d540b8 c03dd008 f74023c5
nt!MiGetInPageSupportBlock+0xf6
f7a0df54 804ebace 1ab5d860 f74023c5 c03dd008
nt!CcInitializeCacheMap+0x4f7
f7a0dfa4 804e1718 00000000 f74023c5 00000000 nt!MiInsertVad+0x36
f7a0dfbc f74023c4 badb0d00 00000000 00000000 nt!VdmFixEspEbp+0x6d
f7a0e6a8 f73c58f4 8590f8f0 86ecd100 e31304c8 Ntfs!NtfsReadMftRecord+0xb6
f7a0e6e0 f73c584a 8590f8f0 86ecd100 e31304c8
Ntfs!NtfsReadFileRecord+0x7a
f7a0e718 f73c9271 8590f8f0 e31304c0 e31304c8
Ntfs!NtfsLookupInFileRecord+0x37
f7a0e7e8 f73a5669 8590f8f0 e31304c0 8590f8f0
Ntfs!NtfsUpdateStandardInformation+0x46
f7a0e830 f73c6d00 8590f8f0 86ecd100 e31304c0
Ntfs!NtfsTeardownFromLcb+0x175
f7a0e888 f73a1759 8590f8f0 e3130588 e3130720
Ntfs!NtfsTeardownStructures+0x125
f7a0e8b4 f73c46eb 8590f8f0 00130588 e3130720
Ntfs!NtfsDecrementCloseCounts+0x9e
f7a0e938 f73c448a 8590f8f0 e3130588 e31304c0 Ntfs!NtfsCommonClose+0x397
f7a0e9d8 804e37f7 86ecd020 85a959c0 86f5f4c8 Ntfs!NtfsFsdClose+0x21f
f7a0e9d8 f7a0ea98 86ecd020 85a959c0 86f5f4c8 nt!KeUpdateSystemTime+0xba
WARNING: Frame IP not in any known module. Following frames may be
wrong.
f74bc660 00000000 00000000 00000000 00000000 0xf7a0ea98
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiGetInPageSupportBlock+f6
80521b5d ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiGetInPageSupportBlock+f6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x7a_c000000e_nt!MiGetInPageSupportBlock+f6
BUCKET_ID: 0x7a_c000000e_nt!MiGetInPageSupportBlock+f6
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com