MiniDump Analysis

[goombawaho]

Hi all. I'm dealing with a particularly annoying blue screen and I was wondering what the best way to analyze it would be. In other words, what method would you recommend to ferret out the source of the BSOD from the minidump?

This site says to use WinDbg

http://elliottback.com/wp/how-to-analyze-windows-xp-bsod-minidump-files/

It's not a normal BSOD where a driver is mentioned to give you a clue. It's an Unknown Hard Error 0x0000007E (0xc0000005 0x438b003 0xf7aa27cc 0xf7aa24c8)

This is a very important customer and she's going to execute me if I don't figure it out.

All built-in hardware tests pass on this Dell Inspiron 6000 with XP Media Center Edition

 

[Diancecht]

Any help in this thread?

Cheers,
Dian

 

[goombawaho]

Ok - there's some good links in there from Linney and that's probably what I need.

I've already rounded up the usual suspects:
"1. Memtest preferable from a bootable CD image...
2. CHKDSK /F (or /R) from the Recovery Console, to ensure that the drive is ok...
3. SFC /SCANNOW to check the system files integrity, have the XP CD at hand..."

+ all hardware tests on the built-in diagnostics.


So, I'm kind of down to a driver.

 

[BadBigBen]

0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

A system thread generated an exception which the error handler did not catch. There are numerous individual causes for this problem, including hardware incompatibility, a faulty device driver or system service, or some software issues. Check Event Viewer (EventVwr.msc) for additional information.

source: aumha.org


“0x0000007E, 0xC0000005, 0xFC5CCAF3, 0xFC90F8C0, 0xFC90F5C0” Error Message at Startup {KB 321637} Win XP

http://support.microsoft.com/kb/321637

“STOP 0x0000007E” Error Message After You Upgrade to Windows XP

http://support.microsoft.com/kb/330182

“Stop 0x0000007E” error message after you upgrade to Win XP Service Pack 2 on a non-Intel-processor computer

http://support.microsoft.com/kb/888372

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[linney]

Is the machine able to be booted at all, or is it a constant and permanent BSOD?

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

Can you run the above from Normal Mode, Safe Mode, or can you run via the "Last known Good Configuration"?

 

[goombawaho]

It would run fine for hours/days and then whammo. It was never at startup or shutdown, just in the middle of doing whatever normal task.

It's too late to troubleshoot now since I did a reload of XP, but if the mini-dump has some information about what was going on, I'd still like to try to get a clue and to learn how to analyze the dumps.

 

[goombawaho]

None of those three Microsoft suggestions apply because it's NOT a startup, it doesn't have a sound blaster card and it's not related to SP install.

I can run the unverified driver tool on the newly installed windows if it happens again.

 

[BadBigBen]

How to troubleshoot a Stop 0x0000007E error in Windows XP

http://support.microsoft.com/kb/330182/

also check the following file, if you installed SP3 or SP2 after install:

%SystemRoot%\svcpack.log

especially for "SKIPPED COPY" entries, then manually copy them from %SystemRoot%\ServicePackFiles\i386 to %SystemRoot%\System32 and %SystemRoot%\Drivers ...

also the SP3 USB drivers (windows\system32\drivers\usbehci.sys and windows\system32\drivers\usbport.sys) cause problems with some mainboards out there, mind you not all, and replacing them with the SP2 version seems to help in those cases...

I only ever experienced this issue, when the OS loaded the wrong SATA drivers (e.g. AHCI instead of RAID or vice versa)...

on another thread, other Forum, I read where someone had a problem with RAM modules (generic or not compatible)...

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[linney]

I'd still like to try to get a clue and to learn how to analyze the dumps"

The links in this thread mentioned earlier by "Diancecht" and originally posted by myself, were supposed to help you in this matter. Can you elaborate further on what you are failing to understand, or what is failing to satisfy your request for information, so that we can further help you?

Need Help Analyzing MiniDump
thread779-1540581

 

[goombawaho]

You misunderstood or wrote unclearly. I just haven't yet started to digest them because the critical time is over since we just reloaded the machine.

I'll check out the links as I have time and maybe analyze the dump that I obtained from the PC in question BEFORE it wasr reloaded.


John

 

[goombawaho]

Can anyone interpret this. I can't tell if it's pointing out memory or a disk issue. I've never done this before. MiniDump analysis from WinDbg:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\Documents\Dawn\Mini050109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*DownstreamStore*

http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Fri May 1 09:13:40.062 2009 (GMT-4)
System Uptime: 1 days 18:20:47.613
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, 8726e2c0, 8726e434, 805c8c88}

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : hardware_disk ( +f8 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 8726e2c0, Terminating object
Arg3: 8726e434, Process image file name
Arg4: 805c8c88, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 8726e2c0

IMAGE_NAME: hardware_disk

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: f56ec9d8 -- (.exr 0xfffffffff56ec9d8)
ExceptionAddress: 75b7b3b9
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000008
Parameter[1]: 75b7b3b9
Parameter[2]: c000000e
Inpage operation failed at 75b7b3b9, due to I/O error c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

EXCEPTION_PARAMETER1: 00000008

EXCEPTION_PARAMETER2: 75b7b3b9

EXCEPTION_PARAMETER3: c000000e

IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

EXCEPTION_STR: 0xc0000006_c000000e

FAULTING_IP:
+f8
75b7b3b9 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C000000E

FOLLOWUP_IP:
+f8
75b7b3b9 ?? ???

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware_disk

SYMBOL_NAME: +f8

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xF4_IOERR_C000000E_+f8

BUCKET_ID: 0xF4_IOERR_C000000E_+f8

Followup: MachineOwner
---------

 

[BadBigBen]

Probably HDD:

Clues:

BugCheck F4, {3, 8726e2c0, 8726e434, 805c8c88} <-- This tells you the Stop Error (BSOD)

...
IMAGE_NAME: hardware_disk <-- Where something happened
...
ExceptionCode: c0000006 (In-page I/O error) <-- Interesting code, used to search further if BugCheck code leads nowhere...
...
IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was specified. <-- Ah, tells me that either the HDD or Path does not exist, or windows thinks it does not exist... see last link below!
...

Searching MS for 0xc0000006 leads to this:

Programs that are run from a network share on Terminal Services close or generate errors

http://support.microsoft.com/kb/294816

blue screen f4 error

Connecting a hard disk drive in slave only mode leads to system halt during resume from standby

http://support.microsoft.com/default.aspx?scid=kb;en-us;330100

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[goombawaho]

Probably HDD" Wow - but nothing really DEFINITIVE that I could point out to the customer and see "replace your hard drive and I guarantee your problem will go away"?

None of those links really seem to apply.

 

[goombawaho]

I meant to type "say" instead of "see"

say "replace your hard drive and I guarantee your problem will go away"?

 

[BadBigBen]

oh, well...

and good luck with the problem...



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

How to ask a question, when posting them to a professional forum.

 

[linney]

To eliminate the hard drive as being a problem you could try running BartPE which runs from CD and memory. See if you can reproduce the BSOD while in that. Of course you will need a working computer to create a BartPE CD.

You might be able to make other uses of BartPE (a mini XP self contained on a bootable CD and run from CD), even if it is no help in this situation.

http://www.nu2.nu/pebuilder/

We all try our best here, but to give 100% guarantees that this is the problem, or this is the fix, is not often possible, especially when working from distance. Still, we have fun trying, otherwise we would be off somewhere else doing something else.

Keep at it, you'll solve it in the end

 

[goombawaho]

I had thought of the BART PE idea, but this user "cannot be without her computer" according to her, so letting it sit there running Bart PE for hours wasn't in the cards.

She's going to buy a new machine and then I'll troubleshoot the old one for her son.

What I was trying to say was that a debugging that doesn't lead to a 100% positive determination of the problem is not worth too much (especially if it involves spending money to fix the alleged problem). It's like your doctor saying you might have cancer but then again it might be irritable bowel syndrome. It's pretty tough to take a course of action based on that assessment.

I'm not blaming anyone here - just M$ I guess, if anyone.

 

[chronics]

Youre best option is to tell the customer that you are 95% sure the problem is the HDD. Let her know the only way you would be able to confirm this problem is through more testing which is a reasonable argument anyway.

What manufacturer is the HDD, have you tried running the manufacturers diagnostic tools. SeaTools often finds bad sectors etc that may be causing these errors.

 

[goombawaho]

Toshiba unfortunately. Only the built-in diagnostics are available. No Toshiba-specific tool is available for download.

 

[goombawaho]

I think you guys are forgetting something regarding troubleshooting in this case: Time = Money.

My boss charges $85/hr for my time. So, if we buy a new hard drive for her at $60 for the cheapest I can find locally (160GB laptop PATA) then add in 1 hour of my time to Ghost her windows installation over to the new hard drive plus add in the 3 hours I just spent reloading windows for her, you see that it is cost prohibitive troubleshooting this problem.

Yes, if it were MY COMPUTER, I could piddle with it for hours and borrow a hard drive to test the "hard drive is bad" theory. But not when it's a customer.

She doesn't want to spend good money after bad without a 100% for sure diagnosis.