Microsoft (R) Windows Debugger Version 6.3.9600.17237 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [e:\110914-6926-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*c:\symbols*
http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18526.amd64fre.win7sp1_gdr.140706-1506
Machine Name:
Kernel base = 0xfffff800`0301b000 PsLoadedModuleList = 0xfffff800`0325e890
Debug session time: Sun Nov 9 21:54:49.555 2014 (UTC + 8:00)
System Uptime: 0 days 1:07:00.381
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck BE, {fffff8800142a390, c00000003f79121, fffff88005db8940, b}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+44cde )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8800142a390, Virtual address for the attempted write.
Arg2: 0c00000003f79121, PTE contents.
Arg3: fffff88005db8940, (reserved)
Arg4: 000000000000000b, (reserved)
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: System
CURRENT_IRQL: 1
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
TRAP_FRAME: fffff88005db8940 -- (.trap 0xfffff88005db8940)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800142a390 rbx=0000000000000000 rcx=fffff8a010fa38c0
rdx=fffff8a0037207b0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880016ba167 rsp=fffff88005db8ad0 rbp=fffff80003236280
r8=0000000000000000 r9=0000000000000009 r10=0000000000000004
r11=fffff8a0037207b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
Ntfs!NtfsCommonClose+0x1e7:
fffff880`016ba167 488908 mov qword ptr [rax],rcx ds:fffff880`0142a390=83485708245c8948
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000310e7c6 to fffff80003090bc0
STACK_TEXT:
fffff880`05db87d8 fffff800`0310e7c6 : 00000000`000000be fffff880`0142a390 0c000000`03f79121 fffff880`05db8940 : nt!KeBugCheckEx
fffff880`05db87e0 fffff800`0308ecee : 00000000`00000001 fffff880`0142a390 fffff8a0`03632300 fffffa80`060e2010 : nt! ?? ::FNODOBFM::`string'+0x44cde
fffff880`05db8940 fffff880`016ba167 : fffffa80`060e2010 fffff800`03236280 fffff8a0`03720680 00000000`00000009 : nt!KiPageFault+0x16e
fffff880`05db8ad0 fffff880`0170cd32 : fffffa80`060e2010 fffff8a0`037207b0 fffff8a0`03720680 fffffa80`03f42180 : Ntfs!NtfsCommonClose+0x1e7
fffff880`05db8ba0 fffff800`0309a261 : 00000000`00000000 fffff800`03387c01 fffffa80`07073b00 00000000`00000011 : Ntfs!NtfsFspCloseInternal+0x186
fffff880`05db8c70 fffff800`0332c73a : 00000000`d2235aa9 fffffa80`07073b50 00000000`00000080 fffffa80`036cd740 : nt!ExpWorkerThread+0x111
fffff880`05db8d00 fffff800`030818e6 : fffff880`009eb180 fffffa80`07073b50 fffffa80`036f9660 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`05db8d40 00000000`00000000 : fffff880`05db9000 fffff880`05db3000 fffff880`05db89a0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+44cde
fffff800`0310e7c6 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+44cde
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 53b9f073
IMAGE_VERSION: 6.1.7601.18526
FAILURE_BUCKET_ID: X64_0xBE_nt!_??_::FNODOBFM::_string_+44cde
BUCKET_ID: X64_0xBE_nt!_??_::FNODOBFM::_string_+44cde
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xbe_nt!_??_::fnodobfm::_string_+44cde
FAILURE_ID_HASH: {a16fedb0-3e79-665d-fa99-475fc0f2a4bc}
Followup: MachineOwner
---------