1. 2: kd> !analyze -v
  2. *******************************************************************************
  3. * *
  4. * Bugcheck Analysis *
  5. * *
  6. *******************************************************************************
  8. UNEXPECTED_KERNEL_MODE_TRAP (7f)
  9. This means a trap occurred in kernel mode, and it's a trap of a kind
  10. that the kernel isn't allowed to have/catch (bound trap) or that
  11. is always instant death (double fault). The first number in the
  12. bugcheck params is the number of the trap (8 = double fault, etc)
  13. Consult an Intel x86 family manual to learn more about what these
  14. traps are. Here is a *portion* of those codes:
  15. If kv shows a taskGate
  16. use .tss on the part before the colon, then kv.
  17. Else if kv shows a trapframe
  18. use .trap on that value
  19. Else
  20. .trap on the appropriate frame will show where the trap was taken
  21. (on x86, this will be the ebp that goes with the procedure KiTrap)
  22. Endif
  23. kb will then show the corrected stack.
  24. Arguments:
  25. Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
  26. Arg2: 0000000080050033
  27. Arg3: 00000000000406f8
  28. Arg4: fffff800034c9d3d
  30. Debugging Details:
  31. ------------------
  34. BUGCHECK_STR: 0x7f_8
  36. CUSTOMER_CRASH_COUNT: 1
  38. DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
  40. PROCESS_NAME: System
  42. CURRENT_IRQL: 2
  44. ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre
  46. LAST_CONTROL_TRANSFER: from fffff800034c6169 to fffff800034c6bc0
  48. STACK_TEXT:
  49. fffff880`0336bce8 fffff800`034c6169 : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000406f8 : nt!KeBugCheckEx
  50. fffff880`0336bcf0 fffff800`034c4632 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
  51. fffff880`0336be30 fffff800`034c9d3d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
  52. fffff880`03717fd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SwapContext+0xd
  55. STACK_COMMAND: kb
  57. FOLLOWUP_IP:
  58. nt!KiDoubleFaultAbort+b2
  59. fffff800`034c4632 90 nop
  61. SYMBOL_STACK_INDEX: 2
  63. SYMBOL_NAME: nt!KiDoubleFaultAbort+b2
  65. FOLLOWUP_NAME: MachineOwner
  67. MODULE_NAME: nt
  69. IMAGE_NAME: ntkrnlmp.exe
  71. DEBUG_FLR_IMAGE_TIMESTAMP: 531590fb
  73. IMAGE_VERSION: 6.1.7601.18409
  75. FAILURE_BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
  77. BUCKET_ID: X64_0x7f_8_nt!KiDoubleFaultAbort+b2
  79. ANALYSIS_SOURCE: KM
  81. FAILURE_ID_HASH_STRING: km:x64_0x7f_8_nt!kidoublefaultabort+b2
  83. FAILURE_ID_HASH: {0367acc4-9bb4-ab69-5701-46a2011718e9}
  85. Followup: MachineOwner