Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\Minidump\Mini032313-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: http://msdl.microsoft.com/download/symbols Executable search path is: Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 2600.xpsp.080413-2111 Machine Name: Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0 Debug session time: Sat Mar 23 21:46:28.937 2013 (GMT+1) System Uptime: 0 days 3:17:10.534 Loading Kernel Symbols ............................................................... ............................................. Loading User Symbols Loading unloaded module list ............. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 100000BE, {f7496453, 9daa121, b164a8d0, b} Probably caused by : memory_corruption Followup: memory_corruption --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) An attempt was made to write to readonly memory. The guilty driver is on the stack trace (and is typically the current instruction pointer). When possible, the guilty driver's name (Unicode string) is printed on the bugcheck screen and saved in KiBugCheckDriver. Arguments: Arg1: f7496453, Virtual address for the attempted write. Arg2: 09daa121, PTE contents. Arg3: b164a8d0, (reserved) Arg4: 0000000b, (reserved) Debugging Details: ------------------ CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0xBE PROCESS_NAME: update.exe LAST_CONTROL_TRANSFER: from f7493a22 to f749520e STACK_TEXT: b164a978 f7493a22 89b520d8 00040020 896e3af0 sr!SrHandleEvent+0xda b164a9dc 804e37f7 00000000 00000003 89182188 sr!SrCreate+0x2fc b164a9ec f74a3e9b 00000000 89182188 89182360 nt!IopfCallDriver+0x31 b164aa10 f74b0754 b164aa30 89b53ce0 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b b164aa4c 804e37f7 89b53ce0 89182188 89182188 fltmgr!FltpCreate+0x26a b164aa5c 8056c712 89b2c8e8 8921f36c b164ac04 nt!IopfCallDriver+0x31 b164ab3c 80563fec 89b2c900 00000000 8921f2c8 nt!IopParseDevice+0xa12 b164abc4 805684da 00000000 b164ac04 00000040 nt!ObpLookupObjectName+0x56a b164ac18 8056cbeb 00000000 00000000 5646c301 nt!ObOpenObjectByName+0xeb b164ac94 8056ccba 0006a338 c0100080 0006a2d8 nt!IopCreateFile+0x407 b164acf0 8056cdf0 0006a338 c0100080 0006a2d8 nt!IoCreateFile+0x8e b164ad30 804de7ec 0006a338 c0100080 0006a2d8 nt!NtCreateFile+0x30 b164ad30 7c90e4f4 0006a338 c0100080 0006a2d8 nt!KiFastCallEntry+0xf8 WARNING: Frame IP not in any known module. Following frames may be wrong. 0006a330 00000000 00000000 00000000 00000000 0x7c90e4f4 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -db !sr 4 errors : !sr (f7495204-f749521c) f7495200 00 89 45 e0 *ff c7 0f 8c bf 00 00 00 *ff c0 01 49 ..E............I f7495210 f7 80 78 1c *ff 0f 85 b0 00 00 00 f6 *ff 01 0f 85 ..x............. MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: STRIDE FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE BUCKET_ID: MEMORY_CORRUPTION_STRIDE Followup: memory_corruption --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) An attempt was made to write to readonly memory. The guilty driver is on the stack trace (and is typically the current instruction pointer). When possible, the guilty driver's name (Unicode string) is printed on the bugcheck screen and saved in KiBugCheckDriver. Arguments: Arg1: f7496453, Virtual address for the attempted write. Arg2: 09daa121, PTE contents. Arg3: b164a8d0, (reserved) Arg4: 0000000b, (reserved) Debugging Details: ------------------ CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0xBE PROCESS_NAME: update.exe LAST_CONTROL_TRANSFER: from f7493a22 to f749520e STACK_TEXT: b164a978 f7493a22 89b520d8 00040020 896e3af0 sr!SrHandleEvent+0xda b164a9dc 804e37f7 00000000 00000003 89182188 sr!SrCreate+0x2fc b164a9ec f74a3e9b 00000000 89182188 89182360 nt!IopfCallDriver+0x31 b164aa10 f74b0754 b164aa30 89b53ce0 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b b164aa4c 804e37f7 89b53ce0 89182188 89182188 fltmgr!FltpCreate+0x26a b164aa5c 8056c712 89b2c8e8 8921f36c b164ac04 nt!IopfCallDriver+0x31 b164ab3c 80563fec 89b2c900 00000000 8921f2c8 nt!IopParseDevice+0xa12 b164abc4 805684da 00000000 b164ac04 00000040 nt!ObpLookupObjectName+0x56a b164ac18 8056cbeb 00000000 00000000 5646c301 nt!ObOpenObjectByName+0xeb b164ac94 8056ccba 0006a338 c0100080 0006a2d8 nt!IopCreateFile+0x407 b164acf0 8056cdf0 0006a338 c0100080 0006a2d8 nt!IoCreateFile+0x8e b164ad30 804de7ec 0006a338 c0100080 0006a2d8 nt!NtCreateFile+0x30 b164ad30 7c90e4f4 0006a338 c0100080 0006a2d8 nt!KiFastCallEntry+0xf8 WARNING: Frame IP not in any known module. Following frames may be wrong. 0006a330 00000000 00000000 00000000 00000000 0x7c90e4f4 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -db !sr 4 errors : !sr (f7495204-f749521c) f7495200 00 89 45 e0 *ff c7 0f 8c bf 00 00 00 *ff c0 01 49 ..E............I f7495210 f7 80 78 1c *ff 0f 85 b0 00 00 00 f6 *ff 01 0f 85 ..x............. MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: STRIDE FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE BUCKET_ID: MEMORY_CORRUPTION_STRIDE Followup: memory_corruption ---------