Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Thu Mar 18 13:17:06 2010
System Uptime: 0 days 0:09:21
start end module name
804d8000 806e5000 nt Checksum: 001FD3A1 Timestamp: Tue Aug 04 22:
20:04 2009 (4A784394)
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: de076dfa, memory referenced Arg2: 000000ff, IRQL Arg3: 00000001, value 0 = read operation, 1 = write operation Arg4: b75cf7fb, address which referenced memory
Debugging Details: ------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** *************************************************************************
MODULE_NAME: TesSafe
FAULTING_MODULE: 804d8000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4b62962c
WRITE_ADDRESS: de076dfa
CURRENT_IRQL: ff
FAULTING_IP: TesSafe+77fb b75cf7fb 088946148326 or byte ptr [ecx+26831446h],cl
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from b75cf854 to b75cf7fb
STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. b78459bc b75cf854 b7845d9c 83e65340 00000000 TesSafe+0x77fb b7845dc8 028f37df 0000001b 00000206 154cff08 TesSafe+0x7854 b7845dcc 00000000 00000206 154cff08 00000023 0x28f37df
STACK_COMMAND: kb
FOLLOWUP_IP: TesSafe+77fb b75cf7fb 088946148326 or byte ptr [ecx+26831446h],cl
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: TesSafe+77fb
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: TesSafe.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner ---------
1: kd> lmvm TesSafe start end module name b75c8000 b7602000 TesSafe T (no symbols) Loaded symbol image file: TesSafe.sys Image path: TesSafe.sys Image name: TesSafe.sys Timestamp: Fri Jan 29 16:02:52 2010 (4B62962C) CheckSum: 00041D84 ImageSize: 0003A000 Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
