BSOD debugging basics guide

[qwertylesh]

yes, a dump generated by my 7100 worked, but trying to debug yours gave me the same symbols problem you had.
IDK weather its because yours is RTM or because of some other reason though.

[TheBear21]

Originally Posted by tofuartist

You said it worked on W7 RC, maybe the RTM isn't fully supported yet?

I am using W7 RTM. Working fine for me. Used the first page info for symbols.

[tofuartist]

Originally Posted by TheBear21

I am using W7 RTM. Working fine for me. Used the first page info for symbols.

Now that makes it even more confusing. Did you install the 16399 updates? Else could you see if my dump file works for you?

http://www.megaupload.com/?d=GMB8J0IB

[TheBear21]

Originally Posted by tofuartist

Now that makes it even more confusing. Did you install the 16399 updates? Else could you see if my dump file works for you?

http://www.megaupload.com/?d=GMB8J0IB

Doesn't seem to work right for me (I think?). This is what I get....

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Currey\Downloads\091009-18610-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at start of path element
Symbol search path is: SRV*C:\custom*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows\System32; http://www.alexander.com/SymServe
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16399.amd64fre.win7_gdr.090722-1835
Machine Name:
Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e53e50
Debug session time: Thu Sep 10 15:24:44.494 2009 (GMT+10)
System Uptime: 0 days 0:02:41.398
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.................................................Unable to load image Unknown_Module_00000000`00000000, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Unable to add module at 00000000`00000000


Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.


Loading User Symbols
Missing image name, possible paged-out or corrupt data.
Loading unloaded module list
.Missing image name, possible paged-out or corrupt data.
.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960001197a7, fffff8800c43f020, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+7fa3a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960001197a7, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800c43f020, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff80002c16000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a6806f2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+0
fffff960`001197a7 488b8370010000  mov     rax,qword ptr [rbx+170h]

CONTEXT:  fffff8800c43f020 -- (.cxr 0xfffff8800c43f020)
Unable to read context, Win32 error 0n30

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002c95a3a to fffff88000de39c2

STACK_TEXT:  
fffff800`00b9cc98 fffff800`02c95a3a : 00000000`0035a540 fffffa80`05bc05d8 fffff800`02e0ec40 00000000`00000001 : 0xfffff880`00de39c2
fffff800`00b9cca0 00000000`0035a540 : fffffa80`05bc05d8 fffff800`02e0ec40 00000000`00000001 fffff800`02e00e80 : nt+0x7fa3a
fffff800`00b9cca8 fffffa80`05bc05d8 : fffff800`02e0ec40 00000000`00000001 fffff800`02e00e80 fffff800`02c93697 : 0x35a540
fffff800`00b9ccb0 fffff800`02e0ec40 : 00000000`00000001 fffff800`02e00e80 fffff800`02c93697 00000000`21e131d1 : 0xfffffa80`05bc05d8
fffff800`00b9ccb8 00000000`00000001 : fffff800`02e00e80 fffff800`02c93697 00000000`21e131d1 00000000`21e131ba : nt+0x1f8c40
fffff800`00b9ccc0 fffff800`02e00e80 : fffff800`02c93697 00000000`21e131d1 00000000`21e131ba 00000000`21e131d1 : 0x1
fffff800`00b9ccc8 fffff800`02c93697 : 00000000`21e131d1 00000000`21e131ba 00000000`21e131d1 00000000`0000006a : nt+0x1eae80
fffff800`00b9ccd0 00000000`21e131d1 : 00000000`21e131ba 00000000`21e131d1 00000000`0000006a fffffa80`05bc0540 : nt+0x7d697
fffff800`00b9ccd8 00000000`21e131ba : 00000000`21e131d1 00000000`0000006a fffffa80`05bc0540 400000c2`400000c1 : 0x21e131d1
fffff800`00b9cce0 00000000`21e131d1 : 00000000`0000006a fffffa80`05bc0540 400000c2`400000c1 00000000`400000c3 : 0x21e131ba
fffff800`00b9cce8 00000000`0000006a : fffffa80`05bc0540 400000c2`400000c1 00000000`400000c3 00000000`1c55b1c7 : 0x21e131d1
fffff800`00b9ccf0 fffffa80`05bc0540 : 400000c2`400000c1 00000000`400000c3 00000000`1c55b1c7 fffff800`00b96080 : 0x6a
fffff800`00b9ccf8 400000c2`400000c1 : 00000000`400000c3 00000000`1c55b1c7 fffff800`00b96080 fffffa80`042d4040 : 0xfffffa80`05bc0540
fffff800`00b9cd00 00000000`400000c3 : 00000000`1c55b1c7 fffff800`00b96080 fffffa80`042d4040 00000000`00000000 : 0x400000c2`400000c1
fffff800`00b9cd08 00000000`1c55b1c7 : fffff800`00b96080 fffffa80`042d4040 00000000`00000000 00000087`835d36d0 : 0x400000c3
fffff800`00b9cd10 fffff800`00b96080 : fffffa80`042d4040 00000000`00000000 00000087`835d36d0 00000087`835d3e32 : 0x1c55b1c7
fffff800`00b9cd18 fffffa80`042d4040 : 00000000`00000000 00000087`835d36d0 00000087`835d3e32 fffff800`02c8e1a2 : 0xfffff800`00b96080
fffff800`00b9cd20 00000000`00000000 : 00000087`835d36d0 00000087`835d3e32 fffff800`02c8e1a2 fffff800`00b96080 : 0xfffffa80`042d4040


FOLLOWUP_IP: 
nt+7fa3a
fffff800`02c95a3a ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt+7fa3a

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

STACK_COMMAND:  .cxr 0xfffff8800c43f020 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

[tofuartist]

Yeh that's exactly my problem. Have you installed the 16399 updates? And to clarify, you use Kernel memory dump, not Small memory dump?

[TheBear21]

Originally Posted by tofuartist

Yeh that's exactly my problem. Have you installed the 16399 updates? And to clarify, you use Kernel memory dump, not Small memory dump?

Only if it has auto-updated. Using mini dump.

[tofuartist]

Originally Posted by TheBear21

Only if it has auto-updated. Using mini dump.

Ahh maybe that's why. Those updates were leaked, not auto-updates And what I meant by which dump I meant this:


Accessed by:

1. Right click Computer -> Properties
2. Advanced system settings
3. Settings button under 'Startup and Recovery'

[qwertylesh]

If you've applied leaked windows updates, its probably why there are no publicly available symbols, this would depend on weather actual RTM editions get those updates or not i suppose, but it seems to me, considering you got two people to check and both got the same result that it has to do with your W7 installation in some way or another that is writing dumps that claim to retrieve wrong symbols.

[tofuartist]

Originally Posted by qwertylesh

If you've applied leaked windows updates, its probably why there are no publicly available symbols, this would depend on weather actual RTM editions get those updates or not i suppose, but it seems to me, considering you got two people to check and both got the same result that it has to do with your W7 installation in some way or another that is writing dumps that claim to retrieve wrong symbols.

Most likely the leaked updates then. I'll uninstall them, and the next time I get a bsod I'll debug again.

[TheBear21]

And again....

Is this pointing towards dodgy memory?

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 2, 0, fffff80002f3550b}

Probably caused by : memory_corruption ( nt!MiStoreSetEvictPageFile+b )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002f3550b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b00e0
 0000000000000008 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiStoreSetEvictPageFile+b
fffff800`02f3550b 488b5008        mov     rdx,qword ptr [rax+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800317e770 -- (.trap 0xfffff8800317e770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8006c8c920
rdx=00000000fa8008d6 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f3550b rsp=fffff8800317e908 rbp=00000000fa8008d6
 r8=00000000fa8008d6  r9=fffff8800317e8c8 r10=fffffa80047c1e80
r11=fffff8800317e9a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiStoreSetEvictPageFile+0xb:
fffff800`02f3550b 488b5008        mov     rdx,qword ptr [rax+8] ds:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e79469 to fffff80002e79f00

STACK_TEXT:  
fffff880`0317e628 fffff800`02e79469 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0317e630 fffff800`02e780e0 : 00000000`06000100 fffffa80`039e3b60 fffffa80`04d30800 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0317e770 fffff800`02f3550b : fffff800`02f36a4e 00000000`00000000 fffffa80`039e3b60 fffffa80`06c8c920 : nt!KiPageFault+0x260
fffff880`0317e908 fffff800`02f36a4e : 00000000`00000000 fffffa80`039e3b60 fffffa80`06c8c920 fa8008d6`426004c0 : nt!MiStoreSetEvictPageFile+0xb
fffff880`0317e910 fffff800`02e6420a : fa8008d6`426000c0 fa8008d6`426004c0 fffffa80`08d64260 fa8008d6`426000c0 : nt!MiReleaseConfirmedPageFileSpace+0x7e
fffff880`0317e990 fffff800`03167f13 : fffffa80`08d641e0 00000000`00000000 00000000`0008c081 fffff8a0`0008c081 : nt!MiDeleteSegmentPages+0x316
fffff880`0317ea40 fffff800`02e7f0b4 : 00000000`00000000 00000000`00000002 fffffa80`039e6660 fffffa80`039e6660 : nt!MiSegmentDelete+0x7b
fffff880`0317ea80 fffff800`02e69b50 : 00000000`00000002 fffffa80`093a4f20 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`0317eae0 fffff800`02e6d55c : fffffa80`06ce0010 00000000`00000011 fffffa80`06ce0010 fffffa80`00000000 : nt!CcDeleteSharedCacheMap+0x1bc
fffff880`0317eb50 fffff800`02e6dd60 : fffff880`045e9d00 fffff880`0317ec58 00000000`00000000 fffff800`00000000 : nt!CcWriteBehind+0x5bc
fffff880`0317ec00 fffff800`02e87161 : fffffa80`039e7d60 fffff800`03173504 fffff800`0307f140 00000000`00000000 : nt!CcWorkerThread+0x1c8
fffff880`0317ecb0 fffff800`0311d166 : fdefcded`d7fffdbf fffffa80`039e3b60 00000000`00000080 fffffa80`039cd040 : nt!ExpWorkerThread+0x111
fffff880`0317ed40 fffff800`02e58486 : fffff880`02f63180 fffffa80`039e3b60 fffff880`02f6dfc0 7f3577de`bd7753f5 : nt!PspSystemThreadStartup+0x5a
fffff880`0317ed80 00000000`00000000 : fffff880`0317f000 fffff880`03179000 fffff880`0317e9f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiStoreSetEvictPageFile+b
fffff800`02f3550b 488b5008        mov     rdx,qword ptr [rax+8]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiStoreSetEvictPageFile+b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiStoreSetEvictPageFile+b

BUCKET_ID:  X64_0xA_nt!MiStoreSetEvictPageFile+b

Followup: MachineOwner
---------

[qwertylesh]

Well it does state there that the most common cause is usually a bad driver trying to use IRQL's which arent availabile.

the cause is really one of 3 things, unstable/bad ram, bad/broken drivers, or a faulty motherboard.

There are sometimes other things that can bsod a system like this where looking at the event viewer usually gives away the cause, like a bad pci sata/ide controller card or other kinds of bad pci cards.

If you are getting them on a fresh installation, you can pretty much assume the problem is caused by hardware which as mentioned is probably 1 of 3 different kinds, ram, mobo, addin cards.

You can always test the CPU by using a single healthy piece of ram, using linpack so either way you can rule that out, you can also use VMT to rule out a bad video card provided you meet some conditions,
The card must be under 1GB GDDR 2/3/4/5, if its an nVidia card, you need to use fairly old drivers (at least six months old).

[TheBear21]

I have replaced all three during this time. Starting with the memory (Geil to Corsair), upgrade GPU (8800GT to GTX260+) and now changed mobo (P35 DS3p to P5K Deluxe) and the problem has carried on through out.

The only common items are CPU/HDD/PSU. I only ever ran the short linpack test, I could test this further. Also only ran the short WD diagnostic test for HDD. I don't have a PSU available to me to change mine out.

You said the event log may provide some further assistance? Can you have a look at it for me? The last 2 crashes on 13/10 7:35 & 11/10 11:23 are since the new mobo went in.

Event Log

[qwertylesh]

2/10/2009 4:33:53 AM:
The operating system started at system time ‎2009‎-‎10‎-‎01T18:33:53.109999300Z.

2/10/2009 4:34:34 AM:
The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80002dbb500, 0xfffff88003b0fd40, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 100209-34913-01.

Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION

Cause:
This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

then you get the same bugcheck again at 2/10/2009 4:44:08 AM

The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80002cd0455, 0xfffff8800aa6d280, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 100209-34273-01.

Here it wasnt able to record what happened; The previous system shutdown at 5:01:08 AM on ‎2/‎10/‎2009 was unexpected.
Probably a hard lockup or hard reset if not a bugcheck or bsod.

These seem to be related to video pagepool allocation but debugging probably would be more specific it'd likely say vista driver fault.
----

then at 2/10/2009 8:08:09 AM you get a BAD_POOL_HEADER bugcheck out of no where.

---

also without any indication of anything you get a different crash again at 2/10/2009 8:11:34 AM
Page Fault in Non Paged Area : 0x00000050 (0xffffffffb841177d, 0x0000000000000001, 0xfffff880012fbf01, 0x0000000000000005).

the system gets the same kind of bugcheck hard reset at 2/10/2009 8:13:32 AM - (0xfffff87fcb1a5a63, 0x0000000000000001, 0xfffff88001030d40, 0x0000000000000005

and well it seems to go on an on in that fashion.

looks like you are some serious instability, hows ur bios configured? tried using a single piece of ram, making sure its running on its stock volts?

My best assumption would still be memory instability of some sort causing your problems, the way the problems are so random and how all your debugs claim its memory corruption. If you are just running your current kit on auto then use cpu-z to make sure its running on the timings its able to.

also, by the looks of things you seem to run your pc overnight im guessing? if thats the case you should really get a psu on loan from someone and see if that helps at all when you have just a single piece of ram in it, determined ur cpu and gfx are ok.


-
looking at the last one - 0x0000000A (IRQL_NOT_LESS_OR_EQUAL) on 13/10/2009 8:34:59 AM

its still very random, the second last one was clearly the last one you posted a analysis from here, which i mention that it seems the system couldnt read/write to the os disk.


Did you change the motherboard without reinstalling the os?

[TheBear21]

Originally Posted by qwertylesh

Did you change the motherboard without reinstalling the os?

Yes. I also haven't really gone into the bios in too much detail with the new board. The ram may not be set up properly.

[mixsetup]

Does this work the same kind of way for Windows 7?