BSOD Windows 7 64 bit SP1 with sptd 1.59

[Guest]

StarBurn installed sptd 1.59 in my system. This caused a bsod error. Then I used the verifier.exe tool to test sptd.sys driver and gave the a bsod error described in the following minidump file:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\082711-19453-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03807000 PsLoadedModuleList = 0xfffff800`03a4c670
Debug session time: Sat Aug 27 21:54:06.986 2011 (GMT-3)
System Uptime: 0 days 0:05:40.828
Loading Kernel Symbols
.................................................. .............
.................................................. ..............
...............................................
Loading User Symbols
Loading unloaded module list
.....
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff880011cb148, 0, fffff800038a02f8, 0}

Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MmProbeAndLockPages+118 )
Followup: MachineOwner
---------
6: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff880011cb148, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800038a02f8, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003ab6100
fffff880011cb148
FAULTING_IP:
nt!MmProbeAndLockPages+118
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: verifier.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800c6d64b0 -- (.trap 0xfffff8800c6d64b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800038a02f8 rsp=fffff8800c6d6640 rbp=fffffa800baaa110
r8=fffffa8007cf7bc0 r9=fffff880011cb148 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe nc
nt!MmProbeAndLockPages+0x118:
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9] ds:fffff880`011cb148=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000382f9fc to fffff80003883c40
STACK_TEXT:
fffff880`0c6d6348 fffff800`0382f9fc : 00000000`00000050 fffff880`011cb148 00000000`00000000 fffff880`0c6d64b0 : nt!KeBugCheckEx
fffff880`0c6d6350 fffff800`03881d6e : 00000000`00000000 fffff880`011cb148 fffff880`0c6d6400 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0c6d64b0 fffff800`038a02f8 : 00000000`00000000 00000000`00000000 00000000`000001f0 fffff880`0c6d6790 : nt!KiPageFault+0x16e
fffff880`0c6d6640 fffff800`03d219cf : fffffa80`07cf7b90 00000000`00000300 fffff800`00000001 fffff880`011cb148 : nt!MmProbeAndLockPages+0x118
fffff880`0c6d6750 fffff800`03d21b2f : fffffa80`07cf7b90 fffffa80`00000001 fffffa80`05452a60 fffff800`03c12950 : nt!ViThunkApplyMandatoryThunksCurrentSession+0x8f
fffff880`0c6d67c0 fffff800`03d21ea6 : fffffa80`05452a60 fffffa80`0baaa110 fffffa80`05452a60 fffff800`03d0eb21 : nt!VfThunkApplyMandatoryThunks+0x8f
fffff880`0c6d6820 fffff800`03c4d0ab : 00000000`00000000 fffffa80`0baaa110 fffffa80`05452a60 00000000`00000018 : nt!VfSuspectDriversLoadCallback+0x106
fffff880`0c6d6870 fffff800`03d22115 : 00000000`00000000 00000000`00000000 fffffa80`0baaa110 00000000`00000101 : nt!VfDriverLoadImage+0x1b
fffff880`0c6d68a0 fffff800`03d234e4 : fffff880`0c6d6978 00000000`00000000 fffff880`0c6d6978 fffffa80`0af5c810 : nt!VfDriverEnableVerifier+0x125
fffff880`0c6d68f0 fffff800`03cf9b86 : fffff880`0c6d6a20 fffff880`0c6d6b60 00000000`00000000 00000000`00000000 : nt!MmEnableVerifierForDriver+0x54
fffff880`0c6d6930 fffff800`03cfa5f9 : 00000000`00000000 00000000`00000001 00000000`0012e880 00000000`00000010 : nt!VfAddVerifierEntry+0x86
fffff880`0c6d6970 fffff800`03882ed3 : fffffa80`0af5c810 00000000`00000104 00000000`00000104 00000000`0012e3e0 : nt!NtSetSystemInformation+0x87c
fffff880`0c6d6ae0 00000000`77172a0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0012e858 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77172a0a

STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmProbeAndLockPages+118
fffff800`038a02f8 410fb601 movzx eax,byte ptr [r9]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MmProbeAndLockPages+118
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_VRF_nt!MmProbeAndLockPages+118
BUCKET_ID: X64_0x50_VRF_nt!MmProbeAndLockPages+118
Followup: MachineOwner
---------

I've already tried updating to sptd 1.78 but the problem persists. I had to uninstall StarBurn and sptd. However it is very important for me to mount image files.

Please someone helps me!

Thanks in advance.

[Digger]

Please send minidump of crash with v1.78 to our support@duplexsecure.com.