****************************************************************
**
** Windows NT Crash Dump Analysis
**
****************************************************************
*
Filename . . . . . . .C:\WINNT\MEMORY.DMP
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .1381
DirectoryTableBase . .0x00030000
PfnDataBase. . . . . .0x83f9f000
PsLoadedModuleList . .0x8014eab0
PsActiveProcessHead. .0x8014e9a8
MachineImageType . . .i386
NumberProcessors . . .1
BugCheckCode . . . . .0x0000007f
BugCheckParameter1 . .0x00000008
BugCheckParameter2 . .0x00000000
BugCheckParameter3 . .0x00000000
BugCheckParameter4 . .0x00000000
ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x8013eab2

****************************************************************
** Symbol File Load Log
****************************************************************
*
loaded ntoskrnl.exe     0x80100000 0x000d7000   F:\SUPPORT\DEBUG\I386\symbols\exe\ntoskrnl.dbg
**** Warning: Checksum mismatch (SYMCHK=000d3c90, SYSCHK=000e7f2a) for F:\SUPPORT\DEBUG\I386\symbols\exe\ntoskrnl.dbg
loaded hal.dll          0x80010000 0x0000ca20   F:\SUPPORT\DEBUG\I386\symbols\dll\hal.dbg
**** Warning: Checksum mismatch (SYMCHK=0001a0ff, SYSCHK=000133fc) for F:\SUPPORT\DEBUG\I386\symbols\dll\hal.dbg
loaded atapi.sys        0x80001000 0x00006000   F:\SUPPORT\DEBUG\I386\symbols\sys\atapi.dbg
**** Warning: Checksum mismatch (SYMCHK=000120ec, SYSCHK=0000dc4d) for F:\SUPPORT\DEBUG\I386\symbols\sys\atapi.dbg
loaded SCSIPORT.SYS     0x80007000 0x00008000   F:\SUPPORT\DEBUG\I386\symbols\SYS\SCSIPORT.dbg
**** Warning: Checksum mismatch (SYMCHK=0001084e, SYSCHK=0001034b) for F:\SUPPORT\DEBUG\I386\symbols\SYS\SCSIPORT.dbg
loaded Disk.sys         0x802b4000 0x00003a60   F:\SUPPORT\DEBUG\I386\symbols\sys\Disk.dbg
**** Warning: Checksum mismatch (SYMCHK=00004d3b, SYSCHK=000104d9) for F:\SUPPORT\DEBUG\I386\symbols\sys\Disk.dbg
loaded CLASS2.SYS       0x802b8000 0x00003320   F:\SUPPORT\DEBUG\I386\symbols\SYS\CLASS2.dbg
**** Warning: Checksum mismatch (SYMCHK=00011dab, SYSCHK=0000dd36) for F:\SUPPORT\DEBUG\I386\symbols\SYS\CLASS2.dbg
loaded avk8w.sys        0x802bc000 0x0000b000   
**** Warning: Checksum mismatch (SYMCHK=00000000, SYSCHK=0000a407) for 
loaded Fastfat.sys      0x802c7000 0x00021000   F:\SUPPORT\DEBUG\I386\symbols\sys\Fastfat.dbg
**** Warning: Checksum mismatch (SYMCHK=00025ff2, SYSCHK=0002c6be) for F:\SUPPORT\DEBUG\I386\symbols\sys\Fastfat.dbg
loaded sparrow.sys      0xf8ef8000 0x00005000   F:\SUPPORT\DEBUG\I386\symbols\sys\sparrow.dbg
loaded Floppy.SYS       0xf8f08000 0x00005000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Floppy.dbg
loaded Scsiscan.SYS     0xf907c000 0x00003000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Scsiscan.dbg
loaded Cdrom.SYS        0xf8f18000 0x00006000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Cdrom.dbg
loaded Fs_Rec.SYS       0xf910a000 0x00002000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Fs_Rec.dbg
**** Warning: Checksum mismatch (SYMCHK=000102dd, SYSCHK=00001fd4) for F:\SUPPORT\DEBUG\I386\symbols\SYS\Fs_Rec.dbg
loaded Null.SYS         0xf91c9000 0x00001000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Null.dbg
loaded KSecDD.SYS       0xf9084000 0x00003000   F:\SUPPORT\DEBUG\I386\symbols\SYS\KSecDD.dbg
loaded Beep.SYS         0xf91ca000 0x00001000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Beep.dbg
**** Warning: Checksum mismatch (SYMCHK=0000dd98, SYSCHK=00002589) for F:\SUPPORT\DEBUG\I386\symbols\SYS\Beep.dbg
loaded Sysmon.SYS       0xf9110000 0x00002000   
**** Warning: Checksum mismatch (SYMCHK=00000000, SYSCHK=000101d3) for 
loaded i8042prt.sys     0xf8f48000 0x00008000   F:\SUPPORT\DEBUG\I386\symbols\sys\i8042prt.dbg
**** Warning: Checksum mismatch (SYMCHK=00014363, SYSCHK=00016635) for F:\SUPPORT\DEBUG\I386\symbols\sys\i8042prt.dbg
loaded mouclass.sys     0xf9090000 0x00003000   F:\SUPPORT\DEBUG\I386\symbols\sys\mouclass.dbg
loaded kbdclass.sys     0xf9098000 0x00003000   F:\SUPPORT\DEBUG\I386\symbols\sys\kbdclass.dbg
loaded VIDEOPRT.SYS     0xf8f60000 0x00006000   F:\SUPPORT\DEBUG\I386\symbols\SYS\VIDEOPRT.dbg
**** Warning: Checksum mismatch (SYMCHK=00012833, SYSCHK=00010fef) for F:\SUPPORT\DEBUG\I386\symbols\SYS\VIDEOPRT.dbg
loaded mga64.sys        0xfe498000 0x00043000   
**** Warning: Checksum mismatch (SYMCHK=00000000, SYSCHK=00052723) for 
loaded vga.sys          0xf90d0000 0x00004000   F:\SUPPORT\DEBUG\I386\symbols\sys\vga.dbg
loaded Msfs.SYS         0xf9000000 0x00006000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Msfs.dbg
**** Warning: Checksum mismatch (SYMCHK=00005f1e, SYSCHK=00012db9) for F:\SUPPORT\DEBUG\I386\symbols\SYS\Msfs.dbg
loaded Npfs.SYS         0xf8c10000 0x0000a000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Npfs.dbg
**** Warning: Checksum mismatch (SYMCHK=00009de4, SYSCHK=0000ab8f) for F:\SUPPORT\DEBUG\I386\symbols\SYS\Npfs.dbg
loaded NDIS.SYS         0xfe458000 0x00020000   F:\SUPPORT\DEBUG\I386\symbols\SYS\NDIS.dbg
**** Warning: Checksum mismatch (SYMCHK=0001e022, SYSCHK=000223d8) for F:\SUPPORT\DEBUG\I386\symbols\SYS\NDIS.dbg
loaded win32k.sys       0xa0000000 0x0013b000   F:\SUPPORT\DEBUG\I386\symbols\sys\win32k.dbg
**** Warning: Checksum mismatch (SYMCHK=0012fb1f, SYSCHK=00140c9f) for F:\SUPPORT\DEBUG\I386\symbols\sys\win32k.dbg
loaded mga64.dll        0xfe3d8000 0x00058000   
**** Warning: Checksum mismatch (SYMCHK=00000000, SYSCHK=00069469) for 
loaded Parport.SYS      0xf9078000 0x00003000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Parport.dbg
loaded Parallel.SYS     0xf9088000 0x00004000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Parallel.dbg
loaded ParVdm.SYS       0xf9180000 0x00002000   F:\SUPPORT\DEBUG\I386\symbols\SYS\ParVdm.dbg
loaded Serial.SYS       0xf8c50000 0x0000c000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Serial.dbg
**** Warning: Checksum mismatch (SYMCHK=00016dcc, SYSCHK=0001aa9e) for F:\SUPPORT\DEBUG\I386\symbols\SYS\Serial.dbg
loaded ASPI32.SYS       0xf90c8000 0x00003000   
**** Warning: Checksum mismatch (SYMCHK=00000000, SYSCHK=0000cf56) for 
loaded Cdfs.SYS         0xf8e40000 0x0000f000   F:\SUPPORT\DEBUG\I386\symbols\SYS\Cdfs.dbg
**** Warning: Checksum mismatch (SYMCHK=000130ef, SYSCHK=0001cbf8) for F:\SUPPORT\DEBUG\I386\symbols\SYS\Cdfs.dbg
loaded avkfsavp.sys     0xf8e50000 0x0000f000   
**** Warning: Checksum mismatch (SYMCHK=00000000, SYSCHK=0001d168) for 
loaded ntdll.dll        0x77f60000 0x0005b000   F:\SUPPORT\DEBUG\I386\symbols\dll\ntdll.dbg
loaded kernel32.dll     0x77f00000 0x0005c000   F:\SUPPORT\DEBUG\I386\symbols\dll\kernel32.dbg

****************************************************************
** !drivers 
****************************************************************
*
Loaded System Driver Summary

Base       Code Size        Data Size       Driver Name        Creation Time
PsLoadedModuleList is NULL!
****************************************************************
** !locks -p -v -d
****************************************************************
*
**** Dump Resource Performance Data ****

0012fec8: No resource performance data available
****************************************************************
** !memusage 
****************************************************************
*
 loading PFN database.Unable to get PFN table block - address 6e6c4c46 - count 408 - page 0
****************************************************************
** !vm 
****************************************************************
*

*** Virtual Memory Usage ***
	Physical Memory:       32   (   128 Kb)
	Available Pages:    69632   (278528 Kb)
	Modified Pages:         0   (     0 Kb)
	NonPagedPool Usage: 6029555   (24118220 Kb)
	********** Excessive NonPaged Pool Usage *****
00010006: Unable to get pool descriptor
****************************************************************
** !errlog 
****************************************************************
*
PacketAdr  DeviceObj  DriverObj  Function  ErrorCode  UniqueVal  FinalStat
c000006c   0033b047   0033c047   47        00383047   00384047   00385047
		     
		      DumpData:  0038a047 0038b047 005cc047 005cd047 
		                 005ce047 0034f047 00610047 00611047 
		                 00612047 00613047 00614047 00615047 
		                 00616047 005d7047 005d8047 00000000 
		                 00000000 00000000 00000000 00000000 
		                 00000000 00000000 00000000 00000000 
		                 00000000 
00339043: Cannot read entry
****************************************************************
** !irpzone full
****************************************************************
*
irpzone is no longer supported.  Use irpfind to search nonpaged pool for active Irps
****************************************************************
** !process 0 0
****************************************************************
*
**** NT ACTIVE PROCESS DUMP ****
PsActiveProcessHead is NULL!
****************************************************************
** !process 0 7
****************************************************************
*
**** NT ACTIVE PROCESS DUMP ****
PsActiveProcessHead is NULL!
****************************************************************
** !process 
****************************************************************
*
Unable to read PCR for Processor 0
Unable to get current process pointer.
****************************************************************
** !thread 
****************************************************************
*
Unable to read PCR for Processor 0
00000000: Unable to get thread contents
****************************************************************
** Register Dump For Processor #0
****************************************************************
*
eax=00143df0 ebx=77f02a7a ecx=00000000 edx=00140000 esi=0012ff04 edi=00000643
eip=732deba0 esp=77f13fb2 ebp=0526e190 iopl=0         nv up di pl nz na pe nc
cs=0000  ss=0000  ds=77f028f3  es=12ff00  fs=0000  gs=0000             efl=732d0000
cr0=0012fed4 cr2=00000000 cr3=0012ff28 dr0=77f3ce38 dr1=ffffffff dr2=0012ff38
dr3=05262c22 dr6=00143df0 dr7=00000001 cr4=77f3b048
gdtr=00000000   gdtl=0014 idtr=0012ff10   idtl=0014 tr=ff34  ldtr=0012

****************************************************************
** Stack Trace
****************************************************************
*
ChildEBP RetAddr  Args to Child
fffffffc 00000000 00000000 00000000 00000000 0x00143df0+0x12d0e4

    FFFFFFB0: 00 00              add         byte ptr [eax],al
    FFFFFFB2: 00 00              add         byte ptr [eax],al
    FFFFFFB4: 00 00              add         byte ptr [eax],al
    FFFFFFB6: 00 00              add         byte ptr [eax],al
    FFFFFFB8: 00 00              add         byte ptr [eax],al
    FFFFFFBA: 00 00              add         byte ptr [eax],al
    FFFFFFBC: 00 00              add         byte ptr [eax],al
    FFFFFFBE: 00 00              add         byte ptr [eax],al
    FFFFFFC0: 00 00              add         byte ptr [eax],al
    FFFFFFC2: 00 00              add         byte ptr [eax],al
    FFFFFFC4: 00 00              add         byte ptr [eax],al
    FFFFFFC6: 00 00              add         byte ptr [eax],al
    FFFFFFC8: 00 00              add         byte ptr [eax],al
    FFFFFFCA: 00 00              add         byte ptr [eax],al
    FFFFFFCC: 00 00              add         byte ptr [eax],al
    FFFFFFCE: 00 00              add         byte ptr [eax],al
    FFFFFFD0: 00 00              add         byte ptr [eax],al
    FFFFFFD2: 00 00              add         byte ptr [eax],al
    FFFFFFD4: 00 00              add         byte ptr [eax],al
    FFFFFFD6: 00 00              add         byte ptr [eax],al
    FFFFFFD8: 00 00              add         byte ptr [eax],al
    FFFFFFDA: 00 00              add         byte ptr [eax],al
    FFFFFFDC: 00 00              add         byte ptr [eax],al
    FFFFFFDE: 00 00              add         byte ptr [eax],al
    FFFFFFE0: 00 00              add         byte ptr [eax],al
    FFFFFFE2: 00 00              add         byte ptr [eax],al
    FFFFFFE4: 00 00              add         byte ptr [eax],al
    FFFFFFE6: 00 00              add         byte ptr [eax],al
    FFFFFFE8: 00 00              add         byte ptr [eax],al
    FFFFFFEA: 00 00              add         byte ptr [eax],al
    FFFFFFEC: 00 00              add         byte ptr [eax],al
    FFFFFFEE: 00 00              add         byte ptr [eax],al
    FFFFFFF0: 00 00              add         byte ptr [eax],al
    FFFFFFF2: 00 00              add         byte ptr [eax],al
    FFFFFFF4: 00 00              add         byte ptr [eax],al
    FFFFFFF6: 00 00              add         byte ptr [eax],al
    FFFFFFF8: 00 00              add         byte ptr [eax],al
    FFFFFFFA: 00 00              add         byte ptr [eax],al
    FFFFFFFC: 00 00              add         byte ptr [eax],al
    FFFFFFFE: 00 00              add         byte ptr [eax],al
--->00000000: 00 00              add         byte ptr [eax],al
    00000002: 00 00              add         byte ptr [eax],al
    00000004: 00 00              add         byte ptr [eax],al
    00000006: 00 00              add         byte ptr [eax],al
    00000008: 00 00              add         byte ptr [eax],al
    0000000A: 00 00              add         byte ptr [eax],al
    0000000C: 00 00              add         byte ptr [eax],al
    0000000E: 00 00              add         byte ptr [eax],al
    00000010: 00 00              add         byte ptr [eax],al
    00000012: 00 00              add         byte ptr [eax],al
    00000014: 00 00              add         byte ptr [eax],al
    00000016: 00 00              add         byte ptr [eax],al
    00000018: 00 00              add         byte ptr [eax],al
    0000001A: 00 00              add         byte ptr [eax],al
    0000001C: 00 00              add         byte ptr [eax],al
    0000001E: 00 00              add         byte ptr [eax],al
    00000020: 00 00              add         byte ptr [eax],al
    00000022: 00 00              add         byte ptr [eax],al
    00000024: 00 00              add         byte ptr [eax],al
    00000026: 00 00              add         byte ptr [eax],al
    00000028: 00 00              add         byte ptr [eax],al
    0000002A: 00 00              add         byte ptr [eax],al
    0000002C: 00 00              add         byte ptr [eax],al
    0000002E: 00 00              add         byte ptr [eax],al
    00000030: 00 00              add         byte ptr [eax],al
    00000032: 00 00              add         byte ptr [eax],al
    00000034: 00 00              add         byte ptr [eax],al
    00000036: 00 00              add         byte ptr [eax],al
    00000038: 00 00              add         byte ptr [eax],al
    0000003A: 00 00              add         byte ptr [eax],al
    0000003C: 00 00              add         byte ptr [eax],al
    0000003E: 00 00              add         byte ptr [eax],al
    00000040: 00 00              add         byte ptr [eax],al
    00000042: 00 00              add         byte ptr [eax],al
    00000044: 00 00              add         byte ptr [eax],al
    00000046: 00 00              add         byte ptr [eax],al
    00000048: 00 00              add         byte ptr [eax],al
    0000004A: 00 00              add         byte ptr [eax],al
    0000004C: 00 00              add         byte ptr [eax],al
    0000004E: 00 00              add         byte ptr [eax],al


