Vista- Minidump - ntkrnlmp.exe

[Beebop]

posto di seguito l'analisi del file Minidump (Vista sp1 x64); qualcuno mi può dare una delucidazione sul tipo di errore che ho riscontrato e soprattutto quale tra le milioni di informazioni disponibility sul file è l'effettivo errore riportato dal file. GRAZIE mille

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini041809-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18000.amd64fre.longhorn_rtm.080118-1840
Machine Name:
Kernel base = 0xfffff800`02212000 PsLoadedModuleList = 0xfffff800`023d7db0
Debug session time: Sat Apr 18 22:33:21.049 2009 (GMT+2)
System Uptime: 0 days 0:00:37.079
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff9800b250000, 0, fffff800024e5083, 4}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CcMapData+113 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff9800b250000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800024e5083, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000004, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000243b080
fffff9800b250000

FAULTING_IP:
nt!CcMapData+113
fffff800`024e5083 0fb602 movzx eax,byte ptr [rdx]

MM_INTERNAL_CODE: 4

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: SearchIndexer.e

CURRENT_IRQL: 0

TRAP_FRAME: fffffa600210e470 -- (.trap 0xfffffa600210e470)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000f rbx=0000000000000000 rcx=000000000000002f
rdx=fffff9800b250000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800024e5083 rsp=fffffa600210e600 rbp=fffffa8007e11810
r8=000000000000000f r9=0000000000000000 r10=0000000000000001
r11=fffffa600210e5d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!CcMapData+0x113:
fffff800`024e5083 0fb602 movzx eax,byte ptr [rdx] ds:0001:fffff980`0b250000=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002275083 to fffff80002267390

STACK_TEXT:
fffffa60`0210e378 fffff800`02275083 : 00000000`00000050 fffff980`0b250000 00000000`00000000 fffffa60`0210e470 : nt!KeBugCheckEx
fffffa60`0210e380 fffff800`02265f19 : 00000000`00000000 00000000`00000002 00000000`00000000 00000000`0000000e : nt!MmAccessFault+0x83
fffffa60`0210e470 fffff800`024e5083 : 00000000`00000000 00000000`00000001 00000000`0000000e fffffa80`07e11810 : nt!KiPageFault+0x119
fffffa60`0210e600 fffffa60`012eff17 : 00000000`00040000 fffffa80`03995ba8 00000000`00000670 fffffa80`0000000e : nt!CcMapData+0x113
fffffa60`0210e6c0 fffffa60`012ed0b1 : fffffa80`07e0d4d0 fffffa80`07e11810 00000000`00000000 fffffa60`0210e801 : Ntfs!NtfsReadUsnJournal+0x167
fffffa60`0210e830 fffffa60`012ed485 : fffffa80`07e0d4d0 00000000`00000000 fffffa80`07e11810 00000000`00000000 : Ntfs!NtfsUserFsRequest+0xa1
fffffa60`0210e870 fffffa60`00767e17 : 00000000`0000000b fffffa80`07e11810 fffffa80`077ab000 fffffa80`07e0d4d0 : Ntfs!NtfsFsdFileSystemControl+0x145
fffffa60`0210e920 fffffa60`00784c32 : fffffa80`04a3ab40 00000000`00000001 fffffa80`05d9a300 00000000`00000000 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227
fffffa60`0210e990 fffff800`024ed25a : fffffa80`07a27f20 fffffa80`07a27f20 fffffa80`039bb930 00000000`00000001 : fltmgr!FltpFsControl+0x102
fffffa60`0210e9f0 fffff800`024f5a06 : fffffa80`077ab040 00000000`00000ffc 00000000`00000000 00000000`01c1c1d0 : nt!IopXxxControlFile+0x5da
fffffa60`0210eb40 fffff800`02266e33 : fffff880`08f585d0 fffffa80`0794f6f0 00000000`00001128 fffff800`024e5e04 : nt!NtFsControlFile+0x56
fffffa60`0210ebb0 00000000`779c5e0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0b64e928 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779c5e0a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcMapData+113
fffff800`024e5083 0fb602 movzx eax,byte ptr [rdx]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!CcMapData+113

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

FAILURE_BUCKET_ID: X64_0x50_nt!CcMapData+113

BUCKET_ID: X64_0x50_nt!CcMapData+113

Followup: MachineOwner
---------

3: kd> lmvm nt
start end module name
fffff800`02212000 fffff800`0272a000 nt (pdb symbols) c:\symbols\ntkrnlmp.pdb\AAFD50F81F4A41F3A99CECBB18945C1F2\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: c:\symbols\ntkrnlmp.exe\479192B7518000\ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Sat Jan 19 07:03:35 2008 (479192B7)
CheckSum: 00485FC7
ImageSize: 00518000
File version: 6.0.6001.18000
Product version: 6.0.6001.18000
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.0.6001.18000
FileVersion: 6.0.6001.18000 (longhorn_rtm.080118-1840)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

 

[Tommikk]

come hai fatto ad analizzare il file minidump?