Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\symbols*
Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a59000 PsLoadedModuleList = 0xfffff800`02c96e50
Debug session time: Sun Apr 4 11:32:25.321 2010 (GMT+2)
System Uptime: 0 days 0:00:36.695
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff881031bd57e, 0, fffff88003a900fa, 5}
*** ERROR: Module load completed but symbols could not be loaded for peauth.sys
Probably caused by : peauth.sys ( peauth+720fa )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff881031bd57e, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88003a900fa, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
READ_ADDRESS: fffff881031bd57e
FAULTING_IP:
peauth+720fa
fffff880`03a900fa 448b0408 mov r8d,dword ptr [rax+rcx]
MM_INTERNAL_CODE: 5
IMAGE_NAME: peauth.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bd8df
MODULE_NAME: peauth
FAULTING_MODULE: fffff88003a1e000 peauth
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff880031bd2e0 -- (.trap 0xfffff880031bd2e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffde rbx=0000000000000000 rcx=fffff880031bd5a0
rdx=73e25abc0e2ef6f3 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003a900fa rsp=fffff880031bd478 rbp=fffff880031bd590
r8=fffff88003aab230 r9=fffff880031bd5a0 r10=0000000065b363c9
r11=0000000073e25abc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
peauth+0x720fa:
fffff880`03a900fa 448b0408 mov r8d,dword ptr [rax+rcx] ds:2e09:d57e=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002b48b91 to fffff80002acaf00
STACK_TEXT:
fffff880`031bd178 fffff800`02b48b91 : 00000000`00000050 fffff881`031bd57e 00000000`00000000 fffff880`031bd2e0 : nt!KeBugCheckEx
fffff880`031bd180 fffff800`02ac8fee : 00000000`00000000 fffff880`031bd5a0 00000000`00000000 fffff880`031bd4a0 : nt! ?? ::FNODOBFM::`string'+0x40f5b
fffff880`031bd2e0 fffff880`03a900fa : fffff880`03a9be6e fffff880`031bd4a0 73e25abc`0e2ef6f3 ac28f8bf`d6132ddf : nt!KiPageFault+0x16e
fffff880`031bd478 fffff880`03a9be6e : fffff880`031bd4a0 73e25abc`0e2ef6f3 ac28f8bf`d6132ddf aa01fb6c`8cca98db : peauth+0x720fa
fffff880`031bd480 fffff880`03a9bf4b : fffff8a0`015ee000 fffffa80`06478000 fffffa80`064c4970 00000000`00000001 : peauth+0x7de6e
fffff880`031bd790 fffff880`03a260b9 : 36c23ced`3ae0067f 00000000`0c2a9000 00000000`00000001 00000000`00000000 : peauth+0x7df4b
fffff880`031bd7e0 fffff880`03abe104 : fffff8a0`015ee000 fffffa80`06478000 fffffa80`06478000 fffff880`03a25982 : peauth+0x80b9
fffff880`031bd810 fffff880`03abe1e6 : fffffa80`00000000 fffffa80`13358652 fffffa80`00000000 fffffa80`06478000 : peauth+0xa0104
fffff880`031bd860 fffff880`03abe391 : fffffa80`00000000 fffff880`03abe168 0000057f`f9b49b68 0000057f`f9b539b8 : peauth+0xa01e6
fffff880`031bd8b0 fffff880`03a1f659 : 00000000`00000000 fffffa80`06478000 fffff800`00000000 0000057f`f9b5f188 : peauth+0xa0391
fffff880`031bd940 fffff880`03abe583 : fffffa80`064c4970 00000000`00000000 fffffa80`06478000 fffffa80`03a07680 : peauth+0x1659
fffff880`031bd970 fffff800`02eb2477 : fffffa80`064c4970 fffffa80`064c4970 00000000`00000000 00000000`000007ff : peauth+0xa0583
fffff880`031bd9a0 fffff800`02eb2875 : 00000000`00000001 00000000`00000000 00000000`00000000 fffffa80`061ab158 : nt!IopLoadDriver+0xa07
fffff880`031bdc70 fffff800`02ad8161 : fffff880`00000000 ffffffff`80000620 fffff800`02eb2820 00000000`00000000 : nt!IopLoadUnloadDriver+0x55
fffff880`031bdcb0 fffff800`02d6e166 : 00000554`00000000 fffffa80`03a07680 00000000`00000080 fffffa80`039f6040 : nt!ExpWorkerThread+0x111
fffff880`031bdd40 fffff800`02aa9486 : fffff880`02f64180 fffffa80`03a07680 fffff880`02f6efc0 00000554`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031bdd80 00000000`00000000 : fffff880`031be000 fffff880`031b8000 fffff880`031bc140 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
peauth+720fa
fffff880`03a900fa 448b0408 mov r8d,dword ptr [rax+rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: peauth+720fa
FOLLOWUP_NAME: MachineOwner
FAILURE_BUCKET_ID: X64_0x50_peauth+720fa
BUCKET_ID: X64_0x50_peauth+720fa