device/driver causing blue screen in Win7 x64

[LordFett]

The dump is 399 megs and I can't get it to upload.

This was in the error report from a WoW crash report.

ERROR #132 (0x85100084) Fatal Exception

Program: C:\Users\Public\Games\World of Warcraft\WoW.exe

Exception: 0xC0000005 (ACCESS_VIOLATION) at 0023:6F2BEF55

The instruction at "0x6F2BEF55" referenced memory at "0x64AC2F3C".

The memory could not be "read".

[LordFett]

Uploading the dump, http://lordfett.com/msfn/MEMORY.zip it is 97 megs compressed.

[cluberti]

Supposedly the .dmp file is corrupt - can you open it with windbg on your machine to make sure it's actually valid?

[LordFett]

I opened it fine, it is all ascii characters, but no error messages. Rezipped it and reuploading it, will be the same location as the previous. If this doesn't work I'll just wait and try the next one.

Thanks for looking at these cluberti.

[cluberti]

So you opened windbg, clicked file > open crash dump, pointed it to the .dmp, and it opened fine?

[LordFett]

Exactly

I clicked on the open folder icon. I did it the way you asked in your previous post this time and this is what I got:

Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]

Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -

Windows 7 Kernel Version 7600 UP Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 7600.16539.amd64fre.win7_gdr.100226-1909

Machine Name:

Kernel base = 0xfffff800`02a65000 PsLoadedModuleList = 0xfffff800`02ca2e50

Debug session time: Fri Jul 23 21:59:59.381 2010 (UTC - 4:00)

System Uptime: 0 days 4:36:30.600

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y <symbol_path> argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -

Loading Kernel Symbols

...............................................................

................................................................

........................

Loading User Symbols

PEB is paged out (Peb.Ldr = 000007ff`fffd4018). Type ".hh dbgerr001" for details

Loading unloaded module list

.....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {feb35921, 2, 1, fffff88003d7255c}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for portcls.sys -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ks.sys -

*** ERROR: Module load completed but symbols could not be loaded for RTKVAC64.SYS

*** ERROR: Module load completed but symbols could not be loaded for ksthunk.sys

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

Probably caused by : portcls.sys ( portcls!PcUnregisterIoTimeout+532c )

Followup: MachineOwner

---------

Edited July 28, 2010 by LordFett

[LordFett]

I got another dump last night, but it is 3.99 gigs and 2.19 gigs zipped. My web server doesn't have enough space to upload it there. What can I do in windbg to get the info you need to help me find the problem?