WaxDragon wrote:
Well, I guess I could have been slightly more helpful
than that.
I guess 7c907b49 is lib/ntdll/main/i386/dispatch.S:60 (RtlGetVersion)?
Memory at 0x00000000 could not be read: Page not
present.
kdb:> bt
Eip:
<7c907b49>
Frames:
kdb:> regs
CS:EIP 0x001b:0x7c907b49
SS:ESP 0x0023:0x0061fd1c
EAX 0x00000000 EBX 0x00000001
ECX 0x00000002 EDX 0x00000003
ESI 0x00000004 EDI 0x00000005
EBP 0x00000000
EFLAGS 0x00000202 IF IOPL0
kdb:>
WD
--
<Alex_Ionescu> it's like saying let's rename Ke to Kernel because
people think it's Ketchup
(./ntoskrnl/ldr/loader.c:267) Could not open module file: \SystemRoot\system32\d
rivers\sndblst.sys (Status 0xc0000034)
(./ntoskrnl/ldr/loader.c:267) Could not open module file: \SystemRoot\system32\d
rivers\mpu401.sys (Status 0xc0000034)
(./ntoskrnl/mm/mm.c:275) Page fault at high IRQL was 2, address 1812c46
Entered debugger on last-chance exception number 14 (Page Fault)
Memory at 0x01812c46 could not be read: Page not present.
kdb:> bt
Eip:
<ntoskrnl.exe:3e91b (./ntoskrnl/mm/npool.c:497 (avl_remove))>
Frames:
<ntoskrnl.exe:3ec06 (./ntoskrnl/mm/npool.c:1141 (remove_from_free_list))>
<ntoskrnl.exe:3f576 (./ntoskrnl/mm/npool.c:1413 (ExAllocateNonPagedPoolWithTag))
<ntoskrnl.exe:413b7 (./ntoskrnl/mm/pool.c:40
(EiAllocatePool))>
<ntoskrnl.exe:414b6 (./ntoskrnl/mm/pool.c:124 (ExAllocatePoolWithTag))>
<i8042prt.sys:24dd (drivers/input/i8042prt/keyboard.c:387 (I8042InternalDeviceCo
ntrolKbd))>
<i8042prt.sys:1779 (w32api/include/ddk/ntdd8042.h:499 (I8042InternalDeviceContro
l))>
<ntoskrnl.exe:220a4 (./ntoskrnl/io/irp.c:1076 (IofCallDriver))>
<kbdclass.sys:15b5 (w32api/include/ddk/ntddkbd.h:475 (ConnectPortDriver))>
<kbdclass.sys:1922 (w32api/include/ddk/ntddkbd.h:706 (ClassAddDevice))>
<ntoskrnl.exe:22bba (./ntoskrnl/io/device.c:91 (IopInitializeDevice))>
<ntoskrnl.exe:2b925 (./ntoskrnl/io/driver.c:2027 (NtLoadDriver))>
<ntoskrnl.exe:65347 (ntoskrnl/ke/i386/trap.s:306 (KiFastCallEntry))>
<ntoskrnl.exe:8b0ed (./ntoskrnl/io/driver.c:1398 (IopLoadDriver))>
<ntoskrnl.exe:24c26 (./ntoskrnl/io/driver.c:1469 (IopInitializeSystemDrivers))>
<ntoskrnl.exe:8c6c5 (./ntoskrnl/io/iomgr.c:434 (IoInit3))>
<ntoskrnl.exe:8a27f (./ntoskrnl/ex/init.c:664 (ExpInitializeExecutive))>
<ntoskrnl.exe:4e75 (./ntoskrnl/ke/main.c:108 (KiSystemStartup))>
<ntoskrnl.exe:8853d (./ntoskrnl/ke/main.c:295 (_main))>
<00000000>
On real hardware. Doesn't happen often, one out of 4 boots.
Thanks,
James