1 dumps montre une corruption de la mémoire :
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa80b2a2af08, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff802580b2a31, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80258366168
GetUlongFromAddress: unable to read from fffff802583661f8
fffffa80b2a2af08 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiImagePageOk+41
fffff802`580b2a31 488b11 mov rdx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: RzSynapse.exe
ANALYSIS_VERSION: 6.3.9431.0 (debuggers(dbg).130615-1214) amd64fre
TRAP_FRAME: fffff880230bc580 -- (.trap 0xfffff880230bc580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80b2a2af08
rdx=fffffa800325f110 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802580b2a31 rsp=fffff880230bc710 rbp=fffff880230bc7b0
r8=0000058000000000 r9=fffffa80158d3e28 r10=0000000000000000
r11=00000000f8a003ee r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MiImagePageOk+0x41:
fffff802`580b2a31 488b11 mov rdx,qword ptr [rcx] ds:fffffa80`b2a2af08=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80258067769 to fffff80258068440
STACK_TEXT:
fffff880`230bc438 fffff802`58067769 : 00000000`0000000a fffffa80`b2a2af08 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`230bc440 fffff802`58065fe0 : 00000000`00000000 00000000`70a5a5a0 00000001`00000000 fffff880`230bc580 : nt!KiBugCheckDispatch+0x69
fffff880`230bc580 fffff802`580b2a31 : 00000001`07ce9025 00000000`00000001 00000000`00002596 fffff802`5809d745 : nt!KiPageFault+0x260
fffff880`230bc710 fffff802`580a4185 : 00000000`00000000 fffff802`580e3241 00000000`00000000 fffff880`230bc850 : nt!MiImagePageOk+0x41
fffff880`230bc740 fffff802`5809f34f : 00000000`00000000 00000000`70a5a5a0 fffffa80`0301c290 fffffa80`158d3e28 : nt!MiResolveTransitionFault+0xf5
fffff880`230bc7e0 fffff802`5809b132 : fffff880`230bca88 00000000`70a5a5a0 fffff680`003852d0 fffffa80`158d3e28 : nt!MiResolveProtoPteFault+0x4cf
fffff880`230bc880 fffff802`580a27f9 : fffffa80`1432e080 00000000`00000000 fffff880`230bcb00 fffff880`230bca50 : nt!MiDispatchFault+0x272
fffff880`230bc9c0 fffff802`58065eee : 00000000`00000000 00000000`00000000 00000000`00000001 fffff880`230bcb00 : nt!MmAccessFault+0x289
fffff880`230bcb00 00000000`70934daa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`082bd33c 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x70934daa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiImagePageOk+41
fffff802`580b2a31 488b11 mov rdx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiImagePageOk+41
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 51a966cd
IMAGE_VERSION: 6.2.9200.16628
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 41
FAILURE_BUCKET_ID: AV_nt!MiImagePageOk
Cela peut être un problème de RAM ou de disque dur. Exécutez memtest86+ pour tester la RAM et un outil de diagnostic du disque dur pour tester le disque dur.
Le deuxième vidage montre un problème avec le pilote réseau Intel e1d63x64.sys :
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 00000000000011c1, (reserved)
Arg3: 0000000001500743, Memory contents of the pool block
Arg4: fffffa80127c6640, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: fffffa80127c6640 Nonpaged pool
FREED_POOL_TAG: Ntfx
BUGCHECK_STR: 0xc2_7_Ntfx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
TAG_NOT_DEFINED_c000000f: FFFFF80331124FB0
LAST_CONTROL_TRANSFER: from fffff8032f87ea6e to fffff8032f666440
STACK_TEXT:
nt!KeBugCheckEx
nt!ExFreePool
Ndu!PplGenericFreeFunction
Ndu!NduDeleteNblContext
Ndu!NduHandleNblContextRemoved
Ndu!NduNblNotifyCallback
fwpkclnt!FwppNetBufferListEventNotify
NETIO!WfpNblInfoCleanup
ndis!NdisFreeNetBufferList
tcpip!TcpTcbSendDatagramsComplete
NETIO!NetioDereferenceNetBufferListChain
tcpip!FlSendNetBufferListChainComplete
ndis!ndisMSendCompleteNetBufferListsInternal
ndis!ndisInvokeNextSendCompleteHandler
ndis!NdisMSendNetBufferListsComplete
e1d63x64
0x0
STACK_COMMAND: kb
FOLLOWUP_IP:
Ndu!PplGenericFreeFunction+2f
fffff880`1ee0b807 eb0c jmp Ndu!PplGenericFreeFunction+0x3d (fffff880`1ee0b815)
FAILURE_BUCKET_ID: 0xc2_7_Ntfx_Ndu!PplGenericFreeFunction
Loaded symbol image file: e1d63x64.sys
Image path: \SystemRoot\system32\DRIVERS\e1d63x64.sys
Image name: e1d63x64.sys
Timestamp: Wed Jan 23 17:39:53 2013
