1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Crash Dump

Discussion in 'Windows XP' started by fxa, 2009/06/09.

  1. 2009/06/09
    fxa

    fxa Inactive Thread Starter

    Joined:
    2009/06/09
    Messages:
    3
    Likes Received:
    0
    Would anyone care to be awesome and help me make sense of this crash dump?

    I've tried installing a new broadcom NIC driver but it hasn't worked. the computer crashes when the user does a keyboard shortcut or access a network based application.


    Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\fxa\Desktop\donna\Minidump\Mini060909-05.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*C:\WINDOWS\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.050301-1519
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
    Debug session time: Tue Jun 9 12:49:11.369 2009 (GMT-5)
    System Uptime: 0 days 0:04:08.571
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..............
    Loading User Symbols
    Loading unloaded module list
    ...........
    Unable to load image b57xp32.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for b57xp32.sys
    *** ERROR: Module load completed but symbols could not be loaded for b57xp32.sys
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007F, {8, 80042000, 0, 0}

    *** WARNING: Unable to verify timestamp for SYMEVENT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
    *** WARNING: Unable to verify timestamp for SPBBCDrv.sys
    *** ERROR: Module load completed but symbols could not be loaded for SPBBCDrv.sys
    Probably caused by : b57xp32.sys ( b57xp32+a53b )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
    This means a trap occurred in kernel mode, and it's a trap of a kind
    that the kernel isn't allowed to have/catch (bound trap) or that
    is always instant death (double fault). The first number in the
    bugcheck params is the number of the trap (8 = double fault, etc)
    Consult an Intel x86 family manual to learn more about what these
    traps are. Here is a *portion* of those codes:
    If kv shows a taskGate
    use .tss on the part before the colon, then kv.
    Else if kv shows a trapframe
    use .trap on that value
    Else
    .trap on the appropriate frame will show where the trap was taken
    (on x86, this will be the ebp that goes with the procedure KiTrap)
    Endif
    kb will then show the corrected stack.
    Arguments:
    Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
    Arg2: 80042000
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x7f_8

    CUSTOMER_CRASH_COUNT: 5

    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

    PROCESS_NAME: AppShell.exe

    LAST_CONTROL_TRANSFER: from f746b2e3 to f747353b

    STACK_TEXT:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ed8c5414 f746b2e3 86979000 8695fdd0 8697de4c b57xp32+0xa53b
    ed8c5754 f746b3da 86979000 00000000 8697de2c b57xp32+0x22e3
    ed8c5768 f746b57c 02979000 00000000 86e3f130 b57xp32+0x23da
    ed8c5788 f75f0600 86979000 ed8c57b4 00000001 b57xp32+0x257c
    ed8c57a0 80701c4f 86e3f030 00000000 8660f620 NDIS!ndisMProcessSGList+0x90
    ed8c57c4 f75f056e 00000000 86e3f030 86b2bf08 hal!HalBuildScatterGatherList+0x191
    ed8c581c f75d7a08 00000000 00000001 86a62b10 NDIS!ndisMAllocSGList+0xd9
    ed8c5838 f732c528 86a62b10 86b25d08 86b25cd0 NDIS!ndisMSendX+0x1a0
    ed8c5874 f75d7985 86bdc818 86b25d08 00000002 psched!MpSend+0x706
    ed8c589c eeda6d00 86cb3b60 86b25d08 86bb6008 NDIS!ndisMSendX+0x1d6
    ed8c58c4 eeda68ce 86bb6008 86b25d08 86794c58 tcpip!ARPSendData+0x198
    ed8c58f0 eeda670a 86bb6008 ed8c5900 00000001 tcpip!ARPTransmit+0x193
    ed8c5920 eeda64a9 86ad8008 020a0b0a 86b25d08 tcpip!SendIPPacket+0x18e
    ed8c5a6c eedabda8 eede4698 8680d088 8680d020 tcpip!IPTransmit+0x287f
    ed8c5ad8 eedac13b 6d461a52 00000000 867f3d64 tcpip!TCPSend+0x5d8
    ed8c5b00 eedab766 00000001 00000000 00000000 tcpip!TdiSend+0x1cc
    ed8c5b34 eed2216f 867f3cd0 86b9874c 867f3d88 tcpip!TCPSendData+0x83
    ed8c5b60 eed21a12 86b8b030 867f3cd0 867f3cd0 netbt!NTSend+0x1e1
    ed8c5b78 804e13d9 86b8b030 867f3d88 ed8c5bd0 netbt!NbtDispatchInternalCtrl+0x12f
    ed8c5b88 eec70867 86c7780c 867f3cd0 86b2bf08 nt!IopfCallDriver+0x31
    ed8c5bb0 eec70b72 86b8b030 867f3cd0 ed8c5bd0 rdbss!RxCeSubmitTdiRequest+0x4b
    ed8c5be8 eec7a0a0 86c7780c 86c77834 8676112c rdbss!RxTdiSend+0x112
    ed8c5c44 eebfc489 86761164 10000000 86b2bf08 rdbss!RxCeSend+0x74
    ed8c5c6c eebda152 86761110 86d246d0 866dcc00 mrxsmb!VctTranceive+0x66
    ed8c5cb0 eebfcfa6 006dcc00 90000000 86b2bf08 mrxsmb!SmbCeTranceive+0x233
    ed8c5d28 eebfc934 866dcc00 866dcc04 866dcc00 mrxsmb!SmbTransactExchangeStart+0x415
    ed8c5d4c eebfd6e9 86d246d0 ed8c5e14 00000000 mrxsmb!SmbCeInitiateExchange+0x287
    ed8c5d64 eebfcd04 866dcc00 eebf71a4 ed8c5da8 mrxsmb!SmbCeSubmitTransactionRequest+0x122
    ed8c5dc4 eebffef6 865fc368 eebf71a4 ed8c5e68 mrxsmb!_SmbCeTransact+0x78
    ed8c5ea0 eec023a3 865fc368 00000000 8668d008 mrxsmb!MRxSmbQueryFileInformation+0x613
    ed8c5eb8 eebff668 8668d008 86612008 00000004 mrxsmb!MRxSmbQueryFileInformationFromPseudoOpen+0xe2
    ed8c5f04 eebfe4e8 0068d008 86612008 ed8c5f38 mrxsmb!SmbPseExchangeStart_Create+0x1f3
    ed8c5f14 eebfc934 8668d008 e624f008 86612008 mrxsmb!SmbPseExchangeStart_default+0x12
    ed8c5f38 eebfdefd 86d246d0 86612088 86612008 mrxsmb!SmbCeInitiateExchange+0x287
    ed8c5fac eec7d270 00612008 00100080 86612008 mrxsmb!MRxSmbCreate+0x4a1
    ed8c5ffc eec7d07e 86612008 00000004 0000005c rdbss!RxCollapseOrCreateSrvOpen+0xea
    ed8c6060 eec79d17 86612008 ed8c60ac 8669c380 rdbss!RxCreateFromNetRoot+0x2ba
    ed8c60c0 eec6fd51 86612008 866188b0 eec787a8 rdbss!RxCommonCreate+0x2dd
    ed8c6158 eec79bb0 eec787a8 8669c300 8669c438 rdbss!RxFsdCommonDispatch+0x353
    ed8c6180 eebfc097 86ba9030 8669c300 866188b0 rdbss!RxFsdDispatch+0xda
    ed8c61a0 804e13d9 00000000 0169c380 8669c380 mrxsmb!MRxSmbFsdDispatch+0x134
    ed8c61b0 f76ca0c4 8669c45c 86f6b908 ed8c6250 nt!IopfCallDriver+0x31
    ed8c61e0 804e13d9 86a50870 8669c438 8669c480 fltmgr!FltpCreate+0x154
    ed8c61f0 ef07b891 8669c45c 8669c480 ed8c6250 nt!IopfCallDriver+0x31
    ed8c6218 ef084e88 86a50870 866188b0 ed8c6250 SYMEVENT+0x7891
    ed8c6234 ef07b90b ed8c6250 804eab50 ef07b9d3 SYMEVENT+0x10e88
    ed8c6274 804e13d9 86bcc020 8669c380 8669c380 SYMEVENT+0x790b
    ed8c6284 f76ca0c4 8669c390 86f6b908 866188b0 nt!IopfCallDriver+0x31
    ed8c62b4 804e13d9 86c88690 8669c45c 8669c380 fltmgr!FltpCreate+0x154
    ed8c62c4 8057ccc7 86ba9018 867e0cec ed8c645c nt!IopfCallDriver+0x31
    ed8c63a4 8056c063 86ba9030 00000000 867e0c48 nt!IopParseDevice+0xa58
    ed8c641c 8056f2a8 00000000 ed8c645c 00000240 nt!ObpLookupObjectName+0x53c
    ed8c6470 8057d2d3 00000000 00000000 00037400 nt!ObOpenObjectByName+0xea
    ed8c64ec 8057d3a2 ed8c661c 00100080 ed8c65cc nt!IopCreateFile+0x407
    ed8c6548 eec9cc67 ed8c661c 00100080 ed8c65cc nt!IoCreateFile+0x8e
    ed8c65ec eec9cf24 ed8c7df0 ed8c5000 00000007 SPBBCDrv+0x2c67
    ed8c6620 eec9d451 ed8c6644 ed8c6654 ed8c664c SPBBCDrv+0x2f24
    ed8c666c eeca99b4 e5651eec e55fecc8 00000000 SPBBCDrv+0x3451
    ed8c66a8 eecb8941 ed8c681c 00000005 0000000b SPBBCDrv+0xf9b4
    ed8c66d8 eecb8626 ed8c67a4 e1137f28 00000000 SPBBCDrv+0x1e941
    ed8c6714 eeca94a7 00000001 ed8c67a4 e52854b0 SPBBCDrv+0x1e626
    ed8c6774 eecaa7f0 ed8c68a0 008c68c4 00000001 SPBBCDrv+0xf4a7
    ed8c6838 804dc605 0000005d ed8c686c e1cd5bb4 SPBBCDrv+0x107f0
    ed8c6848 00000000 86d13500 eeca3200 00000000 nt!ExReleaseResourceLite+0x8d


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    b57xp32+a53b
    f747353b 57 push edi

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: b57xp32+a53b

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: b57xp32

    IMAGE_NAME: b57xp32.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 3fbe9da8

    FAILURE_BUCKET_ID: 0x7f_8_b57xp32+a53b

    BUCKET_ID: 0x7f_8_b57xp32+a53b

    Followup: MachineOwner
    ---------

    0: kd> lmvm b57xp32
    start end module name
    f7469000 f7484a00 b57xp32 T (no symbols)
    Loaded symbol image file: b57xp32.sys
    Image path: b57xp32.sys
    Image name: b57xp32.sys
    Timestamp: Fri Nov 21 17:20:08 2003 (3FBE9DA8)
    CheckSum: 0001C736
    ImageSize: 0001BA00
    Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
    0: kd> lmvm b57xp32
     
    fxa,
    #1
  2. 2009/06/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    b57xp32.sys = Broadcom NetXtreme Gigabit Ethernet NDIS5.1 Driver
     

  3. to hide this advert.

  4. 2009/06/09
    fxa

    fxa Inactive Thread Starter

    Joined:
    2009/06/09
    Messages:
    3
    Likes Received:
    0
    right. but this driver has been working fine for years. do drivers suddenly go bad in an environment where all the other desktops are using the same driver with no issue?

    thank you for the quick reply by the way.
     
    fxa,
    #3
  5. 2009/06/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Yes, they do, like anythings else.
    You're not really expecting your car to display dashboard message:
    "Hey, don't drive more than 18 miles today, because I'm gonna break at 17th mile "
    Do you? :)
    Reinstalling costs nothing.
     
  6. 2009/06/09
    fxa

    fxa Inactive Thread Starter

    Joined:
    2009/06/09
    Messages:
    3
    Likes Received:
    0
    agreed. worth a shot?
     
    fxa,
    #5
  7. 2009/06/09
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Sure thing...
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.