cavasm crashes xp debug.txt

International Comodo Forums Deutsch / German
#1

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini101507-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***

  • Symbol loading may be unreliable without a symbol search path. *
  • Use .symfix to have the debugger choose a symbol path. *
  • After setting your symbol path, use .reload to refresh symbol locations. *

Executable search path is:

  • Symbols can not be loaded because symbol path is not initialized. *
  •                                                               *
  • The Symbol Path can be set by: *
  • using the _NT_SYMBOL_PATH environment variable. *
  • using the -y <symbol_path> argument when starting the debugger. *
  • using .sympath and .sympath+ *

Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Oct 15 17:03:30.171 2007 (GMT+2)
System Uptime: 0 days 6:14:24.883

  • Symbols can not be loaded because symbol path is not initialized. *
  •                                                               *
  • The Symbol Path can be set by: *
  • using the _NT_SYMBOL_PATH environment variable. *
  • using the -y <symbol_path> argument when starting the debugger. *
  • using .sympath and .sympath+ *

Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
…
Loading User Symbols
Loading unloaded module list
…
Unable to load image cavasm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for cavasm.sys
*** ERROR: Module load completed but symbols could not be loaded for cavasm.sys

  •                                                                         *

  •                    Bugcheck Analysis                                    *

  •                                                                         *

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {74008b, 1c, 0, 804fa11e}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : cavasm.sys ( cavasm+7848 )

Followup: MachineOwner

1: kd> !analyze -v

  •                                                                         *

  •                    Bugcheck Analysis                                    *

  •                                                                         *

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0074008b, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804fa11e, address which referenced memory

Debugging Details:

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

MODULE_NAME: cavasm

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 46264bc2

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
0074008b

CURRENT_IRQL: 1c

FAULTING_IP:
nt+2311e
804fa11e 66394616 cmp word ptr [esi+16h],ax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from b9ec6848 to 804fa11e

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
ba4dfa84 b9ec6848 895568a8 00000000 00000000 nt+0x2311e
ba4dfa98 b9ecc50a 00000000 00000000 891da054 cavasm+0x7848
ba4dfab4 b9eccad3 89660a10 00000000 891da054 cavasm+0xd50a
ba4dfaec b9ec0cc9 89660a10 00000000 8958dc58 cavasm+0xdad3
ba4dfb88 b9ec88ed 89660a10 00000000 00000000 cavasm+0x1cc9
ba4dfbf0 b9ec8b1f 89e4ea38 8958dc58 89e468f8 cavasm+0x98ed
ba4dfc1c 804ef095 89e4ea38 8958dc58 8958de04 cavasm+0x9b1f
ba4dfc70 b9ec8854 89e4e790 8958dc58 8958dc68 nt+0x18095
ba4dfcd4 b9ec8b1f 89e4e6d8 8958dc58 89e468f8 cavasm+0x9854
ba4dfd00 804ef095 89e4e6d8 8958dc58 8958dc58 cavasm+0x9b1f
ba4dfd48 805b9edd 006269d8 00000000 896269d8 nt+0x18095
ba4dfd64 805ba330 896269d8 00000001 80561e80 nt+0xe2edd
ba4dfdac 805ce84c 00000000 00000000 00000000 nt+0xe3330
ba4dfddc 8054532e 805378ce 00000000 00000000 nt+0xf784c
00000000 00000000 00000000 00000000 00000000 nt+0x6e32e

STACK_COMMAND: kb

FOLLOWUP_IP:
cavasm+7848
b9ec6848 ?? ???

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: cavasm.sys

SYMBOL_NAME: cavasm+7848

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

1: kd> lmvm cavasm
start end module name
b9ebf000 b9ed8000 cavasm T (no symbols)
Loaded symbol image file: cavasm.sys
Image path: cavasm.sys
Image name: cavasm.sys
Timestamp: Wed Apr 18 18:48:02 2007 (46264BC2)
CheckSum: 000247DF
ImageSize: 00019000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0