StarBurn installed sptd 1.59 in my system. This caused a bsod error. Then I used the verifier.exe tool to test sptd.sys driver and gave the a bsod error described in the following minidump file:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\082711-19453-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03807000 PsLoadedModuleList = 0xfffff800`03a4c670
Debug session time: Sat Aug 27 21:54:06.986 2011 (GMT-3)
System Uptime: 0 days 0:05:40.828
Loading Kernel Symbols
.................................................. .............
.................................................. ..............
...............................................
Loading User Symbols
Loading unloaded module list
.....
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff880011cb148, 0, fffff800038a02f8, 0}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MmProbeAndLockPages+118 )
Followup: MachineOwner
---------
6: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff880011cb148, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800038a02f8, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003ab6100
fffff880011cb148
FAULTING_IP:
nt!MmProbeAndLockPages+118
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: verifier.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800c6d64b0 -- (.trap 0xfffff8800c6d64b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800038a02f8 rsp=fffff8800c6d6640 rbp=fffffa800baaa110
r8=fffffa8007cf7bc0 r9=fffff880011cb148 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe nc
nt!MmProbeAndLockPages+0x118:
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9] ds:fffff880`011cb148=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000382f9fc to fffff80003883c40
STACK_TEXT:
fffff880`0c6d6348 fffff800`0382f9fc : 00000000`00000050 fffff880`011cb148 00000000`00000000 fffff880`0c6d64b0 : nt!KeBugCheckEx
fffff880`0c6d6350 fffff800`03881d6e : 00000000`00000000 fffff880`011cb148 fffff880`0c6d6400 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0c6d64b0 fffff800`038a02f8 : 00000000`00000000 00000000`00000000 00000000`000001f0 fffff880`0c6d6790 : nt!KiPageFault+0x16e
fffff880`0c6d6640 fffff800`03d219cf : fffffa80`07cf7b90 00000000`00000300 fffff800`00000001 fffff880`011cb148 : nt!MmProbeAndLockPages+0x118
fffff880`0c6d6750 fffff800`03d21b2f : fffffa80`07cf7b90 fffffa80`00000001 fffffa80`05452a60 fffff800`03c12950 : nt!ViThunkApplyMandatoryThunksCurrentSession+0x8f
fffff880`0c6d67c0 fffff800`03d21ea6 : fffffa80`05452a60 fffffa80`0baaa110 fffffa80`05452a60 fffff800`03d0eb21 : nt!VfThunkApplyMandatoryThunks+0x8f
fffff880`0c6d6820 fffff800`03c4d0ab : 00000000`00000000 fffffa80`0baaa110 fffffa80`05452a60 00000000`00000018 : nt!VfSuspectDriversLoadCallback+0x106
fffff880`0c6d6870 fffff800`03d22115 : 00000000`00000000 00000000`00000000 fffffa80`0baaa110 00000000`00000101 : nt!VfDriverLoadImage+0x1b
fffff880`0c6d68a0 fffff800`03d234e4 : fffff880`0c6d6978 00000000`00000000 fffff880`0c6d6978 fffffa80`0af5c810 : nt!VfDriverEnableVerifier+0x125
fffff880`0c6d68f0 fffff800`03cf9b86 : fffff880`0c6d6a20 fffff880`0c6d6b60 00000000`00000000 00000000`00000000 : nt!MmEnableVerifierForDriver+0x54
fffff880`0c6d6930 fffff800`03cfa5f9 : 00000000`00000000 00000000`00000001 00000000`0012e880 00000000`00000010 : nt!VfAddVerifierEntry+0x86
fffff880`0c6d6970 fffff800`03882ed3 : fffffa80`0af5c810 00000000`00000104 00000000`00000104 00000000`0012e3e0 : nt!NtSetSystemInformation+0x87c
fffff880`0c6d6ae0 00000000`77172a0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0012e858 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77172a0a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmProbeAndLockPages+118
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MmProbeAndLockPages+118
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_VRF_nt!MmProbeAndLockPages+118
BUCKET_ID: X64_0x50_VRF_nt!MmProbeAndLockPages+118
Followup: MachineOwner
---------
I've already tried updating to sptd 1.78 but the problem persists. I had to uninstall StarBurn and sptd. However it is very important for me to mount image files.
Please someone helps me!
Thanks in advance.
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\082711-19453-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03807000 PsLoadedModuleList = 0xfffff800`03a4c670
Debug session time: Sat Aug 27 21:54:06.986 2011 (GMT-3)
System Uptime: 0 days 0:05:40.828
Loading Kernel Symbols
.................................................. .............
.................................................. ..............
...............................................
Loading User Symbols
Loading unloaded module list
.....
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff880011cb148, 0, fffff800038a02f8, 0}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MmProbeAndLockPages+118 )
Followup: MachineOwner
---------
6: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff880011cb148, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800038a02f8, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003ab6100
fffff880011cb148
FAULTING_IP:
nt!MmProbeAndLockPages+118
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: verifier.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800c6d64b0 -- (.trap 0xfffff8800c6d64b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800038a02f8 rsp=fffff8800c6d6640 rbp=fffffa800baaa110
r8=fffffa8007cf7bc0 r9=fffff880011cb148 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe nc
nt!MmProbeAndLockPages+0x118:
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9] ds:fffff880`011cb148=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000382f9fc to fffff80003883c40
STACK_TEXT:
fffff880`0c6d6348 fffff800`0382f9fc : 00000000`00000050 fffff880`011cb148 00000000`00000000 fffff880`0c6d64b0 : nt!KeBugCheckEx
fffff880`0c6d6350 fffff800`03881d6e : 00000000`00000000 fffff880`011cb148 fffff880`0c6d6400 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0c6d64b0 fffff800`038a02f8 : 00000000`00000000 00000000`00000000 00000000`000001f0 fffff880`0c6d6790 : nt!KiPageFault+0x16e
fffff880`0c6d6640 fffff800`03d219cf : fffffa80`07cf7b90 00000000`00000300 fffff800`00000001 fffff880`011cb148 : nt!MmProbeAndLockPages+0x118
fffff880`0c6d6750 fffff800`03d21b2f : fffffa80`07cf7b90 fffffa80`00000001 fffffa80`05452a60 fffff800`03c12950 : nt!ViThunkApplyMandatoryThunksCurrentSession+0x8f
fffff880`0c6d67c0 fffff800`03d21ea6 : fffffa80`05452a60 fffffa80`0baaa110 fffffa80`05452a60 fffff800`03d0eb21 : nt!VfThunkApplyMandatoryThunks+0x8f
fffff880`0c6d6820 fffff800`03c4d0ab : 00000000`00000000 fffffa80`0baaa110 fffffa80`05452a60 00000000`00000018 : nt!VfSuspectDriversLoadCallback+0x106
fffff880`0c6d6870 fffff800`03d22115 : 00000000`00000000 00000000`00000000 fffffa80`0baaa110 00000000`00000101 : nt!VfDriverLoadImage+0x1b
fffff880`0c6d68a0 fffff800`03d234e4 : fffff880`0c6d6978 00000000`00000000 fffff880`0c6d6978 fffffa80`0af5c810 : nt!VfDriverEnableVerifier+0x125
fffff880`0c6d68f0 fffff800`03cf9b86 : fffff880`0c6d6a20 fffff880`0c6d6b60 00000000`00000000 00000000`00000000 : nt!MmEnableVerifierForDriver+0x54
fffff880`0c6d6930 fffff800`03cfa5f9 : 00000000`00000000 00000000`00000001 00000000`0012e880 00000000`00000010 : nt!VfAddVerifierEntry+0x86
fffff880`0c6d6970 fffff800`03882ed3 : fffffa80`0af5c810 00000000`00000104 00000000`00000104 00000000`0012e3e0 : nt!NtSetSystemInformation+0x87c
fffff880`0c6d6ae0 00000000`77172a0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0012e858 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77172a0a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmProbeAndLockPages+118
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MmProbeAndLockPages+118
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_VRF_nt!MmProbeAndLockPages+118
BUCKET_ID: X64_0x50_VRF_nt!MmProbeAndLockPages+118
Followup: MachineOwner
---------
I've already tried updating to sptd 1.78 but the problem persists. I had to uninstall StarBurn and sptd. However it is very important for me to mount image files.
Please someone helps me!
Thanks in advance.
Comment