Sign in to follow this  
Followers 0
BINREV SPYD3R

HPR - Ep0380: Troubleshooting Blue screens of Death

1 post in this topic

Debugging Tools link

http://www.microsoft.com/whdc/devtools/deb...ng/default.mspx

Some Common STOP codes

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL

The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A. This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

Parameters

The following parameters are displayed on the blue screen.

ParameterDescription1Memory referenced2IRQL at time of reference30: Read

1: Write4Address which referenced memory Cause

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high.

The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

If you encounter bug check 0xA while upgrading to a later version of Windows, this error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version.

Resolving the Problem

If a kernel debugger is available, obtain a stack trace.

To resolve an error caused by a faulty device driver, system service, or BIOS

1. Restart your computer.

2. Press F8 at the character-based menu that displays the operating system choices.

3. Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time.

To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool

1. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.

2. Try disabling memory caching of the BIOS.

3. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner's manual for your computer.

4. Make sure the latest Service Pack is installed.

5. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination.

6. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/subordinate/stand-alone setting. Try removing all IDE devices except for hard disks.

If the message appears during an installation of Windows, make sure that the computer and all installed peripherals are listed in the Microsoft Windows Marketplace Tested Products List.

Here is a debugging example:

kd> .bugcheck [Lists bug check data.]

Bugcheck code 0000000a

Arguments 00000000 0000001c 00000000 00000000

kd> kb [Lists the stack trace.]

ChildEBP RetAddr Args to Child

8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint

8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194

8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256

8013ed5c 801263ba 00000000 00000000 e12ab000

8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> kv [Lists the trap frames.]

ChildEBP RetAddr Args to Child

8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])

8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194

8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)

8013ed5c 801263ba 00000000 00000000 e12ab000

8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> .trap 8013eee8 [Gets the registers for the trap frame at the time of the fault.]

eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10

eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202

ErrCode = 00000000

00000000 ??????????????? [The current instruction pointer is NULL.]

kd> kb [Gives the stack trace before the fault.]

ChildEBP RetAddr Args to Child

8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint

8013ef74 fe5620d2 fe5620da ff690268 80404690

NDIS!_EthFilterIndicateReceiveComplete+0x31

8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0

Comments

Before upgrading to a new version of Windows, remove all third-party device drivers and system services, and disable any virus scanners. Contact the software manufacturers to obtain updates of these third-party tools.

Others can be found at http://msdn.microsoft.com/en-us/library/ms789396.aspx

Go to this episode

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0