Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\Minidump\Mini081910-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: C:\WINDOWS\Symbols Executable search path is: Unable to load image ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Machine Name: Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0 Debug session time: Thu Aug 19 09:05:16.715 2010 (GMT+2) System Uptime: 0 days 1:27:36.414 Unable to load image ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe Loading Kernel Symbols ............................................................... ............................................................ Loading User Symbols Loading unloaded module list ............ Unable to load image win32k.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for win32k.sys ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000008E, {c0000005, bf953715, aa415c00, 0} Probably caused by : win32k.sys ( win32k!NtGdiEngCopyBits+a ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: bf953715, The address that the exception occurred at Arg3: aa415c00, Trap Frame Arg4: 00000000 Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het geheugen is mislukt. FAULTING_IP: win32k!NtGdiEngCopyBits+a bf953715 8b4004 mov eax,dword ptr [eax+4] TRAP_FRAME: aa415c00 -- (.trap 0xffffffffaa415c00) ErrCode = 00000000 eax=00000000 ebx=00000100 ecx=00000000 edx=00000000 esi=e1808000 edi=e2ecd858 eip=bf953715 esp=aa415c74 ebp=aa415c8c iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 win32k!NtGdiEngCopyBits+0xa: bf953715 8b4004 mov eax,dword ptr [eax+4] ds:0023:00000004=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x8E PROCESS_NAME: chrome.exe LAST_CONTROL_TRANSFER: from 00000000 to bf953715 STACK_TEXT: aa415c70 00000000 0012f008 00000100 e2ecd858 win32k!NtGdiEngCopyBits+0xa STACK_COMMAND: kb FOLLOWUP_IP: win32k!NtGdiEngCopyBits+a bf953715 8b4004 mov eax,dword ptr [eax+4] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: win32k!NtGdiEngCopyBits+a FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4bdd0c20 FAILURE_BUCKET_ID: 0x8E_win32k!NtGdiEngCopyBits+a BUCKET_ID: 0x8E_win32k!NtGdiEngCopyBits+a Followup: MachineOwner ---------