> > >******************************************************************************* >* * >* Bugcheck Analysis * >* * >******************************************************************************* > >Use !analyze -v to get detailed debugging information. > >BugCheck 1000008E, {c0000005, 8169e323, c5c29840, 0} > >Probably caused by : win32k.sys ( win32k!SpBitBlt+210 ) > >Followup: MachineOwner >--------- > >0: kd> !analyze -v >******************************************************************************* >* * >* Bugcheck Analysis * >* * >******************************************************************************* > >KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) >This is a very common bugcheck. Usually the exception address pinpoints >the driver/function that caused the problem. Always note this address >as well as the link date of the driver/image that contains this address. >Some common problems are exception code 0x80000003. This means a hard >coded breakpoint or assertion was hit, but this system was booted >/NODEBUG. This is not supposed to happen as developers should never have >hardcoded breakpoints in retail code, but ... >If this happens, make sure a debugger gets connected, and the >system is booted /DEBUG. This will let us see why this breakpoint is >happening. >Arguments: >Arg1: c0000005, The exception code that was not handled >Arg2: 8169e323, The address that the exception occurred at >Arg3: c5c29840, Trap Frame >Arg4: 00000000 > >Debugging Details: >------------------ > > >EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. > >FAULTING_IP: >nt!RtlInitUnicodeString+1b >8169e323 f266af repne scas word ptr es:[edi] > >TRAP_FRAME: c5c29840 -- (.trap 0xffffffffc5c29840) >ErrCode = 00000000 >eax=00000000 ebx=fe818fd8 ecx=ffffffec edx=c5c29914 esi=fe818a90 edi=fe819000 >eip=8169e323 esp=c5c298b4 ebp=c5c29924 iopl=0 nv up ei pl zr na pe nc >cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 >nt!RtlInitUnicodeString+0x1b: >8169e323 f266af repne scas word ptr es:[edi] >Resetting default scope > >CUSTOMER_CRASH_COUNT: 1 > >DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP > >BUGCHECK_STR: 0x8E > >PROCESS_NAME: Flexexe.exe > >CURRENT_IRQL: 0 > >LAST_CONTROL_TRANSFER: from 973db97e to 8169e323 > >STACK_TEXT: >c5c298e8 973db97e c5c2998c c5c29978 c5c29998 nt!RtlInitUnicodeString+0x1b >c5c29924 9742f05b 410100ac 00000006 00000002 win32k!SpBitBlt+0x210 >c5c29a0c 9743ec00 410100ac 00000006 00000002 win32k!xxxRealDrawMenuItem+0x80b >c5c29abc 9741460a 410100ac 0110007f c5c29b04 win32k!xxxDrawState+0x1c9 >c5c29b2c 97415490 410100ac fe818a18 00c8d0d4 win32k!xxxDrawMenuItem+0x3f8 >c5c29b98 9742f5c1 410100ac 00000000 fe817f98 win32k!xxxMenuDraw+0x1f2 >c5c29bf0 9737cfff 00000017 410100ac 00000004 win32k!xxxMenuBarDraw+0x1bf >c5c29c38 9739bf25 fe817f98 410100ac 00000001 win32k!xxxDrawWindowFrame+0xf7 >c5c29cb4 9739d56d fe817f98 00000085 00000001 win32k!xxxRealDefWindowProc+0x88b >c5c29ccc 97376599 fe817f98 00000085 00000001 win32k!xxxWrapRealDefWindowProc+0x2b >c5c29ce8 9739d524 fe817f98 00000085 00000001 win32k!NtUserfnNCDESTROY+0x27 >c5c29d20 816a3a7a 00040242 00000085 00000001 win32k!NtUserMessageCall+0xc6 >c5c29d20 770b9a94 00040242 00000085 00000001 nt!KiFastCallEntry+0x12a >WARNING: Frame IP not in any known module. Following frames may be wrong. >0012ea4c 00000000 00000000 00000000 00000000 0x770b9a94 > > >STACK_COMMAND: kb > >FOLLOWUP_IP: >win32k!SpBitBlt+210 >973db97e 85c0 test eax,eax > >SYMBOL_STACK_INDEX: 1 > >SYMBOL_NAME: win32k!SpBitBlt+210 > >FOLLOWUP_NAME: MachineOwner > >MODULE_NAME: win32k > >IMAGE_NAME: win32k.sys > >DEBUG_FLR_IMAGE_TIMESTAMP: 47918c6e > >FAILURE_BUCKET_ID: 0x8E_win32k!SpBitBlt+210 > >BUCKET_ID: 0x8E_win32k!SpBitBlt+210 > >Followup: MachineOwner >--------- > >0: kd> .trap 0xffffffffc5c29840 >ErrCode = 00000000 >eax=00000000 ebx=fe818fd8 ecx=ffffffec edx=c5c29914 esi=fe818a90 edi=fe819000 >eip=8169e323 esp=c5c298b4 ebp=c5c29924 iopl=0 nv up ei pl zr na pe nc >cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 >nt!RtlInitUnicodeString+0x1b: >8169e323 f266af repne scas word ptr es:[edi] > > > > > > >******************************************************************************* >* * >* Bugcheck Analysis * >* * >******************************************************************************* > >Use !analyze -v to get detailed debugging information. > >BugCheck 1000008E, {c0000005, 81c91313, bbc88834, 0} > >Probably caused by : win32k.sys ( win32k!xxxRealDrawMenuItem+686 ) > >Followup: MachineOwner >--------- > >1: kd> !analyze -v >******************************************************************************* >* * >* Bugcheck Analysis * >* * >******************************************************************************* > >KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) >This is a very common bugcheck. Usually the exception address pinpoints >the driver/function that caused the problem. Always note this address >as well as the link date of the driver/image that contains this address. >Some common problems are exception code 0x80000003. This means a hard >coded breakpoint or assertion was hit, but this system was booted >/NODEBUG. This is not supposed to happen as developers should never have >hardcoded breakpoints in retail code, but ... >If this happens, make sure a debugger gets connected, and the >system is booted /DEBUG. This will let us see why this breakpoint is >happening. >Arguments: >Arg1: c0000005, The exception code that was not handled >Arg2: 81c91313, The address that the exception occurred at >Arg3: bbc88834, Trap Frame >Arg4: 00000000 > >Debugging Details: >------------------ > > >EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. > >FAULTING_IP: >nt!RtlInitUnicodeString+1b >81c91313 f266af repne scas word ptr es:[edi] > >TRAP_FRAME: bbc88834 -- (.trap 0xffffffffbbc88834) >ErrCode = 00000000 >eax=00000000 ebx=fe618fd8 ecx=ffffffec edx=bbc88908 esi=fe6159e8 edi=fe619000 >eip=81c91313 esp=bbc888a8 ebp=bbc88918 iopl=0 nv up ei pl zr na pe nc >cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 >nt!RtlInitUnicodeString+0x1b: >81c91313 f266af repne scas word ptr es:[edi] >Resetting default scope > >CUSTOMER_CRASH_COUNT: 1 > >DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP > >BUGCHECK_STR: 0x8E > >PROCESS_NAME: Flexexe.exe > >CURRENT_IRQL: 0 > >LAST_CONTROL_TRANSFER: from bbc88908 to 81c91313 > >STACK_TEXT: >bbc888ac bbc88908 fe618fda ffffffff 97603634 nt!RtlInitUnicodeString+0x1b >WARNING: Frame IP not in any known module. Following frames may be wrong. >bbc88918 97810a2b 14010070 00000006 00000002 0xbbc88908 >bbc88a00 978207c6 14010070 00000006 00000002 win32k!xxxRealDrawMenuItem+0x686 >bbc88ab0 977f42dc 14010070 0110007e bbc88af8 win32k!xxxDrawState+0x21 >bbc88b20 977f5244 14010070 fe616878 00c8d0d4 win32k!xxxDrawMenuItem+0x208 >bbc88b98 97810fa4 14010070 00000000 fe6155c8 win32k!xxxMenuDraw+0x38 >bbc88bf0 9775d71a 00000017 14010070 00000004 win32k!xxxDrawMenuBarTemp+0x2d2 >bbc88c38 9777c525 fe6155c8 14010070 00000001 win32k!xxxSendNCPaint+0xa3 >bbc88cb4 9777db6d fe6155c8 00000085 6504040f win32k!xxxRealDefWindowProc+0x78b >bbc88ccc 97756b5c fe6155c8 00000085 6504040f win32k!NtUserMessageCall+0xf >bbc88d20 81c96a2a 0001023c 00000085 6504040f win32k!xxxSetWindowData+0x36b >bbc88d20 00000000 0001023c 00000085 6504040f nt!KiFastCallEntry+0x12a >00000000 00000000 00000000 00000000 00000000 0x0 > > >STACK_COMMAND: kb > >FOLLOWUP_IP: >win32k!xxxRealDrawMenuItem+686 >97810a2b 66f7060020 test word ptr [esi],2000h > >SYMBOL_STACK_INDEX: 2 > >SYMBOL_NAME: win32k!xxxRealDrawMenuItem+686 > >FOLLOWUP_NAME: MachineOwner > >MODULE_NAME: win32k > >IMAGE_NAME: win32k.sys > >DEBUG_FLR_IMAGE_TIMESTAMP: 4de78921 > >FAILURE_BUCKET_ID: 0x8E_win32k!xxxRealDrawMenuItem+686 > >BUCKET_ID: 0x8E_win32k!xxxRealDrawMenuItem+686 > >Followup: MachineOwner >--------- > >1: kd> .trap 0xffffffffbbc88834 >ErrCode = 00000000 >eax=00000000 ebx=fe618fd8 ecx=ffffffec edx=bbc88908 esi=fe6159e8 edi=fe619000 >eip=81c91313 esp=bbc888a8 ebp=bbc88918 iopl=0 nv up ei pl zr na pe nc >cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 >nt!RtlInitUnicodeString+0x1b: >81c91313 f266af repne scas word ptr es:[edi] > >