takže já ti sem okopčím chybu z dumpu a jdu mrknout, co s tím
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88007e68e78
Arg3: fffff88007e686d0
Arg4: fffff800030f9089
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88007e68e78 -- (.exr 0xfffff88007e68e78)
ExceptionAddress: fffff800030f9089 (nt!FsRtlDeleteKeyFromTunnelCache+0x0000000000000079)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88007e686d0 -- (.cxr 0xfffff88007e686d0)
rax=7ffff8a00dc485a0 rbx=fffffa8004c3c238 rcx=fffffa8004c3c238
rdx=001e000000000b87 rsi=001e000000000b87 rdi=0000000000000000
rip=fffff800030f9089 rsp=fffff88007e690b0 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=fffff880009e86c0
r11=fffff88007e690f8 r12=0000000000000001 r13=0000000000000000
r14=fffff88007e696f0 r15=fffff8a00b4b32f0
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!FsRtlDeleteKeyFromTunnelCache+0x79:
fffff800`030f9089 48397030 cmp qword ptr [rax+30h],rsi ds:002b:7ffff8a0`0dc485d0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: SearchIndexer.
CURRENT_IRQL: 1
ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukce na adrese 0x%08lx odkazovala na adresu pam
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukce na adrese 0x%08lx odkazovala na adresu pam
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030be0e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsCommonCleanup+24a0
fffff880`012ecad3 448a642470 mov r12b,byte ptr [rsp+70h]
FAULTING_IP:
nt!FsRtlDeleteKeyFromTunnelCache+79
fffff800`030f9089 48397030 cmp qword ptr [rax+30h],rsi
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012ecad3 to fffff800030f9089
STACK_TEXT:
fffff880`07e690b0 fffff880`012ecad3 : fffff8a0`0d81f010 fffff880`07e69940 fffff8a0`11bb9b01 fffff880`07e6917c : nt!FsRtlDeleteKeyFromTunnelCache+0x79
fffff880`07e69100 fffff880`01259aa9 : 00000000`00000000 fffff880`011cc78c fffff880`07e69650 fffff880`07e58000 : Ntfs!NtfsCommonCleanup+0x24a0
fffff880`07e69510 fffff800`02e9764a : fffff880`07e69650 00000000`00000002 fffffa80`05dcf600 fffff800`02fbb2dd : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`07e69540 fffff880`01259662 : fffff880`01259a90 fffff880`07e69650 fffff880`07e69900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`07e69620 fffff880`012fb244 : fffff880`07e696f0 fffff880`07e696f0 fffff880`07e696f0 00000000`00000000 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`07e69690 fffff880`0118223f : fffff880`07e696f0 fffffa80`0a8b7010 fffffa80`0a8b73b0 fffffa80`0a69cc30 : Ntfs!NtfsFsdCleanup+0x144
fffff880`07e69900 fffff880`011806df : fffffa80`04ce1520 00000000`00000000 fffffa80`04aa2f00 fffffa80`0a8b7010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07e69990 fffff800`0319b68f : fffffa80`0a8b7010 fffffa80`0ab12b30 00000000`00000000 fffffa80`0a9b16a0 : fltmgr!FltpDispatch+0xcf
fffff880`07e699f0 fffff800`03181304 : 00000000`00000000 fffffa80`0ab12b30 fffffa80`0a6f0101 fffffa80`0a9b16a0 : nt!IopCloseFile+0x11f
fffff880`07e69a80 fffff800`0319b181 : fffffa80`0ab12b30 fffffa80`00000001 fffff8a0`01c814b0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`07e69b00 fffff800`0319b094 : 00000000`000001b4 fffffa80`0ab12b30 fffff8a0`01c814b0 00000000`000001b4 : nt!ObpCloseHandleTableEntry+0xb1
fffff880`07e69b90 fffff800`02e87153 : fffffa80`0ab10b60 fffff880`07e69c60 00000000`01898e10 fffffa80`0aa477d0 : nt!ObpCloseHandle+0x94
fffff880`07e69be0 00000000`76feffaa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00fee518 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76feffaa
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Ntfs!NtfsCommonCleanup+24a0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff88007e686d0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCommonCleanup+24a0
BUCKET_ID: X64_0x24_Ntfs!NtfsCommonCleanup+24a0
Followup: MachineOwner
---------