0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904aa
Arg2: 98ef259c
Arg3: 98ef2298
Arg4: 82a25ee5
Debugging Details:
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
EXCEPTION_RECORD: 98ef259c -- (.exr 0xffffffff98ef259c)
ExceptionAddress: 82a25ee5 (Ntfs!NtfsAcquirePagingResourceExclusive+0x00000020)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000044
Attempt to read from address 00000044
CONTEXT: 98ef2298 -- (.cxr 0xffffffff98ef2298)
eax=862c8d08 ebx=87660688 ecx=00000000 edx=05ab0004 esi=862c8d08 edi=00001000
eip=82a25ee5 esp=98ef2664 ebp=98ef2668 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Ntfs!NtfsAcquirePagingResourceExclusive+0x20:
82a25ee5 ff7144 push dword ptr [ecx+44h] ds:0023:00000044=????????
Resetting default scope
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000044
READ_ADDRESS: 00000044
FOLLOWUP_IP:
Ntfs!NtfsAcquirePagingResourceExclusive+20
82a25ee5 ff7144 push dword ptr [ecx+44h]
FAULTING_IP:
Ntfs!NtfsAcquirePagingResourceExclusive+20
82a25ee5 ff7144 push dword ptr [ecx+44h]
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 82a15ace to 82a25ee5
STACK_TEXT:
98ef2668 82a15ace 87660688 862c8d08 00000001 Ntfs!NtfsAcquirePagingResourceExclusive+0x20
98ef2684 82a23c8f 87660688 875dd340 862c8d08 Ntfs!NtfsReadCacheCoherencyFlush+0x16
98ef2750 82a23787 87660688 875dd340 1a4b9c9f Ntfs!NtfsCommonRead+0x447
98ef27c0 81cd2fd3 862e5020 875dd340 875dd340 Ntfs!NtfsFsdRead+0x273
98ef27d8 807a3ba7 00000000 876e0a28 00000000 nt!IofCallDriver+0x63
98ef27fc 807a47c7 98ef281c 862c1e60 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x251
98ef2834 807a4be7 87b82008 87851640 87851588 fltmgr!FltPerformSynchronousIo+0xb9
98ef28a4 97ff8a4f 87b82008 879b0d00 98ef28d8 fltmgr!FltReadFile+0x2ed
98ef28e0 97ff8fa5 98ef29b8 00001000 98ef292c cpdrm!UtSyncReadFile+0x9f [d:\pikewerks\cp-drm\client\windows\filter\utility.c @ 151]
98ef290c 97ff8cdb 98ef2964 98ef292c 98ef2934 cpdrm!DrmpSyncReadNextBlock+0x65 [d:\pikewerks\cp-drm\client\windows\filter\platform.c @ 101]
98ef293c 97ff842a 98ef2964 98ef2978 00000000 cpdrm!DrmcIsProtectedFile+0x4b [d:\pikewerks\cp-drm\client\common\filter\parse.c @ 454]
98ef2994 807a00f3 878515e8 98ef29b8 00000000 cpdrm!DrmPostCreate+0x1da [d:\pikewerks\cp-drm\client\windows\filter\driver.c @ 524]
98ef29f8 807a3090 00851588 00000000 87851588 fltmgr!FltpPerformPostCallbacks+0x1f1
98ef2a0c 807a35c6 87851588 878e0b70 98ef2a4c fltmgr!FltpProcessIoCompletion+0x10
98ef2a1c 807a3c37 862c1e60 878e0b70 87851588 fltmgr!FltpPassThroughCompletion+0x94
98ef2a4c 807b6643 98ef2a6c 00000000 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2e1
98ef2a98 81cd2fd3 862c1e60 8629fa48 879b0d5c fltmgr!FltpCreate+0x2a1
98ef2ab0 81e37d11 6b2d9610 872c0564 85f41be8 nt!IofCallDriver+0x63
98ef2b80 81e5d3ff 85f41c00 00000000 872c04c0 nt!IopParseDevice+0xf61
98ef2c10 81e350f6 00000000 98ef2c68 00000040 nt!ObpLookupObjectName+0x5a8
98ef2c70 81e36bf3 01a9edbc 00000000 862c0101 nt!ObOpenObjectByName+0x13c
98ef2ce4 81e3dfea 01a9ee20 00100080 01a9edbc nt!IopCreateFile+0x63b
98ef2d30 81c6ea1a 01a9ee20 00100080 01a9edbc nt!NtCreateFile+0x34
98ef2d30 76f09a94 01a9ee20 00100080 01a9edbc nt!KiFastCallEntry+0x12a
01a9ed78 76f08014 75bece0b 01a9ee20 00100080 ntdll!KiFastSystemCallRet
01a9ed7c 75bece0b 01a9ee20 00100080 01a9edbc ntdll!ZwCreateFile+0xc
01a9ee18 70c03556 01a9ee90 00000000 00000001 kernel32!CreateFileW+0x379
01a9ee6c 70c0370a 01a9ee90 01a9ee8c 00000000 emdmgmt!EcbFileExtentsGetRetrievalPointers+0x25
01a9f2e8 70c03fad 70c42af8 00cce820 01a9f30c emdmgmt!EcbFileExtentsGetFileLocationInfo+0x13a
01a9f43c 70c04388 00000000 70c42af8 70c42b48 emdmgmt!EcbFileExtentsLogicalToPhysicalOrdered+0xe6
01a9f454 70c044b0 70c42b2c 0199d050 70c344e8 emdmgmt!EcbFileExtentsLoadFxHistory+0x59
01a9f8e8 70c0246d 01a9f908 0199d050 75bc0236 emdmgmt!EcbTraceGetBootHistories+0xe7
01a9ff28 70c02c8b 000003d4 00000000 00000000 emdmgmt!EcbBootFilesProcess+0xe0
01a9ff7c 70c0a4e7 000003d4 75be4911 00000000 emdmgmt!EcSvcBootFilesProcess+0xa9
01a9ff84 75be4911 00000000 01a9ffd0 76eee4b6 emdmgmt!EcSvcWorkThread+0x76
01a9ff90 76eee4b6 00000000 775e8d7e 00000000 kernel32!BaseThreadInitThunk+0xe
01a9ffd0 76eee489 70c01481 00000000 00000000 ntdll!__RtlUserThreadStart+0x23
01a9ffe8 00000000 70c01481 00000000 00000000 ntdll!_RtlUserThreadStart+0x1b
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsAcquirePagingResourceExclusive+20
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 47918a96
STACK_COMMAND: .cxr 0xffffffff98ef2298 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsAcquirePagingResourceExclusive+20
BUCKET_ID: 0x24_Ntfs!NtfsAcquirePagingResourceExclusive+20
Followup: MachineOwner
0: kd> kf
Memory ChildEBP RetAddr
98ef1c2c 81ce4257 nt!RtlpBreakWithStatusInstruction
50 98ef1c7c 81ce4d3d nt!KiBugCheckDebugBreak+0x1c
3cc 98ef2048 81ce40e3 nt!KeBugCheck2+0x66d
24 98ef206c 82a28316 nt!KeBugCheckEx+0x1e
28 98ef2094 82a237a1 Ntfs!NtfsExceptionFilter+0xad
c 98ef20a0 82a1cf54 Ntfs!NtfsFsdRead+0x288
14 98ef20b4 82a270ba Ntfs!_EH4_CallFilterFunc+0x12
28 98ef20dc 81cccae2 Ntfs!_except_handler4+0x8e
24 98ef2100 81cccab4 nt!ExecuteHandler2+0x26
bc 98ef21bc 81c4d557 nt!ExecuteHandler+0x24
3c4 98ef2580 81c6f5da nt!KiDispatchException+0x170
68 98ef25e8 81c6f58e nt!CommonDispatchException+0x4a
1c 98ef2604 81fd75b0 nt!Kei386EoiHelper+0x186
64 98ef2668 82a15ace hal!KfLowerIrql+0x64
1c 98ef2684 82a23c8f Ntfs!NtfsReadCacheCoherencyFlush+0x16
cc 98ef2750 82a23787 Ntfs!NtfsCommonRead+0x447
70 98ef27c0 81cd2fd3 Ntfs!NtfsFsdRead+0x273
18 98ef27d8 807a3ba7 nt!IofCallDriver+0x63
24 98ef27fc 807a47c7 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x251
38 98ef2834 807a4be7 fltmgr!FltPerformSynchronousIo+0xb9