http://mikemstech.blogspot.com/2011/11/windows-crash-dump-analysis.html
0x00000077, KERNEL_STACK_INPAGE_ERROR, is a similar bug check to KERNEL_DATA_INPAGE_ERROR. This error indicates that the memory manager could not read a page back into memory from disk. The two main causes of this bug check are failing hardware (hard drive and RAM are primary suspects) and viruses. Information obtained from the minidump is relatively straightforward from the !analyze -v.
0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_STACK_INPAGE_ERROR (77) The requested page of kernel data could not be read in. Caused by bad block in paging file or disk controller error. In the case when the first arguments is 0 or 1, the stack signature in the kernel stack was not found. Again, bad hardware. An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or C000016AL (STATUS_DISK_OPERATION_FAILED) normally indicates the data could not be read from the disk due to a bad block. Upon reboot autocheck will run and attempt to map out the bad sector. If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging file is on a SCSI disk device, then the cabling and termination should be checked. See the knowledge base article on SCSI termination. Arguments: Arg1: 0000000000000000, (page was retrieved from page cache) Arg2: 8013801280128013, value found in stack where signature should be Arg3: 0000000000000000, 0 Arg4: fffff880147f8f90, address of signature on kernel stack Debugging Details: ------------------ ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0 BUGCHECK_STR: 0x77_0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002d57773 to fffff80002cd2600 STACK_TEXT:
... : nt!KeBugCheckEx ... : nt! ?? ::FNODOBFM::`string'+0x4e3b1 ... : nt!MmInPageKernelStack+0x40 ... : nt!KiInSwapKernelStacks+0x1f ... : nt!KeSwapProcessOrStack+0x84 ... : nt!PspSystemThreadStartup+0x5a ... : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+4e3b1 fffff800`02d57773 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4e3b1 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb FAILURE_BUCKET_ID: X64_0x77_0_nt!_??_::FNODOBFM::_string_+4e3b1 BUCKET_ID: X64_0x77_0_nt!_??_::FNODOBFM::_string_+4e3b1 Followup: MachineOwner ---------
If this error is seen, next steps are to check the hard drive and memory for errors and perform a virus scan if neither the hard drive nor RAM report any errors.
See Also
Windows Crash Dump Analysis
Troubleshooting Memory Errors
How To Detect a Failing Hard Drive
No comments:
Post a Comment