Help with Mini Dump

[xx.He1ix.xx]

Anyone here good at analyzing mini dump files. I used the windbg and got this; Any help would much appreciated!! I don't really know what to make of this

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, 804dbe05, f8ad3e08, 0}

Probably caused by : hardware ( nt!KiDispatchInterrupt+2 )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c000001d, The exception code that was not handled

Arg2: 804dbe05, The address that the exception occurred at

Arg3: f8ad3e08, Trap Frame

Arg4: 00000000

Debugging Details:

------------------

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:

nt!KiDispatchInterrupt+2

804dbe05 f08945f0 lock mov [ebp-0x10],eax

TRAP_FRAME: f8ad3e08 -- (.trap fffffffff8ad3e08)

ErrCode = 00000000

eax=f8ad3e88 ebx=82c8fea0 ecx=82c8fe08 edx=f8ad3e88 esi=82c8fe98 edi=00000000

eip=804dbe05 esp=f8ad3e7c ebp=f8ad3e98 iopl=0 nv up ei ng nz ac pe cy

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293

nt!KiDispatchInterrupt+0x2:

804dbe05 f08945f0 lock mov [ebp-0x10],eax ss:0010:f8ad3e88=82c8fe08

Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

MISALIGNED_IP:

nt!KiDispatchInterrupt+2

804dbe05 f08945f0 lock mov [ebp-0x10],eax

LAST_CONTROL_TRANSFER: from f8ad3e98 to 804dbe05

FAILED_INSTRUCTION_ADDRESS:

nt!KiDispatchInterrupt+2

804dbe05 f08945f0 lock mov [ebp-0x10],eax

STACK_TEXT:

f8ad3e78 f8ad3e98 82c8fe98 f8ad3eb0 82c8fe08 nt!KiDispatchInterrupt+0x2

WARNING: Frame IP not in any known module. Following frames may be wrong.

f8ad3e98 804dc4a8 df927ccf 000000c5 f8ad3fc0 0xf8ad3e98

f8ad3fa4 804dc378 df927751 00000000 ffdff000 nt!KiInsertTreeTimer+0x77

f8ad3fd0 804dbbd4 80559280 00000000 00005dc5 nt!KiWaitTest+0x56

f8ad3fd4 80559280 00000000 00005dc5 00000000 nt!ExReleaseResourceLite+0x4

ffdff980 00000000 f8ad4000 00006372 00000000 nt!VdmStringIoBuffer+0x3a0

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:

nt!KiDispatchInterrupt+2

804dbe05 f08945f0 lock mov [ebp-0x10],eax

FAULTING_SOURCE_CODE:

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiDispatchInterrupt+2

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner

---------

[fizban2]

check your NIC drivers and try installing a newer version or reinstalling the verion that you are on now.

[xx.He1ix.xx]

Ok, I updated the NIC drivers, we'll see what happens. If you don't mind my asking how made you think NIC?

Thanks again for your help!

[cluberti]

Could you post the actual minidump here? The data shows a driver error, but doesn't say which and I'd need to look deeper to see if there's an indication which driver could've caused this.

[xx.He1ix.xx]

Sure thing, here it is. Appreciate your help! I renamed it to .txt so i could upload it here, so just rename it back to .dmp

Mini040506_01.txt

Edited April 5, 2006 by xx.He1ix.xx

[cluberti]

Well, I've got some bad news. The minidump is lacking information about the driver in the callstack, and is only showing me the memory address of the driver (which isn't included in the minidump). However, I can tell you that the driver trapped due to an illegal instruction (that's what the c000001d means). I would suggest configuring your server for a complete dump, make sure the pagefile is on C: and is at least RAM+50 for the minimum size, and then try to reproduce the issue. Once the machine dumps and reboots, it will create a file (by default) in %windir% as memory.dmp. That file will have the information needed to make a determiniation as to which driver is causing the bugcheck.