[Lotus]

This is my error message during my everyday memory dumps. (Starting since SP3)

I finally had time to write it down.

STOP: 0x000000E1 Work_Thread_Returned_At_Bad_IRQL

Address 80421FB0 base at 80400000

Datestamp: 3ee6c002 - ntoskrnl.exe



Does the error message mean anything to anyone? It was the reason I asked about multiple devices sharing IRQ's.

[sapiens74]

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/bccodes_6zvr.asp

this explains how to fix it

[Lotus]

I can't get the LN command to work in debug. Am I missing something here?

[sapiens74]

whats the command you are using?

[Lotus]

I downloaded the debugging tools from microsoft, but have never done a debug before. I typed in



kd> ln "Address"


It says use positive decimal value

[Lotus]

How do I trace the address to the driver? I can't figure this one out.

[Lotus]

*bump* =)

I need to track this problem down!

[DS3Circuit]

Seems to be a hardware / driver issue. All drivers been updated to the latest?

This has helped me before with INTEL NIC drivers.
http://is-it-true.org/nt/atips/atips300.shtml

[Lotus]

Will dumpchk.exe for Win NT 4.0 work with 2000 Pro? If not is there a dumpchk.exe for Win2k? I don't see it listed on the Win2k Resource Kit download page.

[DS3Circuit]

Few more helpful links

How to Use Dumpchk.exe to Check a Memory Dump File
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q156280

Gathering Blue Screen Information After Memory Dump in Windows 2000 or Windows NT
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q192463

Download Pstat here
Pstat.exe: Process and Thread Status
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/pstat-o.asp

Dumpchk.exe is part of the windows 2000 support tools found on your CD of windows 2000. Keep in my other required files include Kdextx86.dll and Msdis110.dll

Anything else I can help ya with?

[Lotus]

Thanks

[Lotus]

Well, I'm having no luck. It says it can't initialize the dump file. Is there another way to trace the address to a driver?

[Lotus]

The file is a mini dump file...does that make a diff?

[Lotus]

Is there a switch I should be using with dumpchk.exe? This is really annoying. I keep losing work do to the comp going blue screen on me. Any additional advice would be greatly appreciated.

[CUViper]

You will need to set it to at least a kernel dump, and preferably a complete dump. Look for it in the System Properties -> Advanced tab...

[Lotus]

Ok, I need to get this thread going again. The problem is getting worse and worse. I opened up Windows Debugger and then opened my memory.dmp file. Below is what was listed after opening:


Thread Create: Process=0, Thread=0
DMKD: Unable to get address of debugger data list
Module Load: D:\WINNT\system32\NTOSKRNL.EXE (no symbols loaded)
Could not get address of KiProcessorBlock
Module Unload: D:\WINNT\system32\NTOSKRNL.EXE
Module Load: D:\WINNT\system32\NTOSKRNL.EXE (no symbols loaded)
Module Load: HALACPI.DLL (no symbols loaded)
Module Load: D:\WINNT\system32\BOOTVID.DLL (symbol loading deferred)
Module Load: ACPI.SYS (symbol loading deferred)
Module Load: WMILIB.SYS (symbol loading deferred)
Module Load: PCI.SYS (symbol loading deferred)
Module Load: ISAPNP.SYS (symbol loading deferred)
Module Load: COMPBATT.SYS (symbol loading deferred)
Module Load: BATTC.SYS (symbol loading deferred)
Module Load: INTELIDE.SYS (symbol loading deferred)
Module Load: PCIIDEX.SYS (symbol loading deferred)
Module Load: FTDISK.SYS (symbol loading deferred)
Module Load: DISKPERF.SYS (symbol loading deferred)
Module Load: DMLOAD.SYS (symbol loading deferred)
Module Load: DMIO.SYS (symbol loading deferred)
Module Load: PARTMGR.SYS (symbol loading deferred)
Module Load: MOUNTMGR.SYS (symbol loading deferred)
Module Load: ATAPI.SYS (symbol loading deferred)
Module Load: DISK.SYS (symbol loading deferred)
Module Load: CLASSPNP.SYS (symbol loading deferred)
Module Load: FASTFAT.SYS (symbol loading deferred)
Module Load: KSECDD.SYS (symbol loading deferred)
Module Load: DNBUDF.SYS (symbol loading deferred)
Module Load: NDIS.SYS (symbol loading deferred)
Module Load: MUP.SYS (symbol loading deferred)
Module Load: IOMDISK.SYS (symbol loading deferred)
Module Load: VIDEOPRT.SYS (symbol loading deferred)
Module Load: I81XNT5.SYS (symbol loading deferred)
Module Load: USBD.SYS (symbol loading deferred)
Module Load: UHCD.SYS (symbol loading deferred)
Module Load: OUSBEHCI.SYS (symbol loading deferred)
Module Load: KS.SYS (symbol loading deferred)
Module Load: PORTCLS.SYS (symbol loading deferred)
Module Load: SBPCI.SYS (symbol loading deferred)
Module Load: EL90XBC5.SYS (symbol loading deferred)
Module Load: I8042PRT.SYS (symbol loading deferred)
Module Load: MOUCLASS.SYS (symbol loading deferred)
Module Load: KBDCLASS.SYS (symbol loading deferred)
Module Load: FDC.SYS (symbol loading deferred)
Module Load: SERIAL.SYS (symbol loading deferred)
Module Load: SERENUM.SYS (symbol loading deferred)
Module Load: PARPORT.SYS (symbol loading deferred)
Module Load: CDR4_2K.SYS (symbol loading deferred)
Module Load: CDROM.SYS (symbol loading deferred)
Module Load: CDRALW2K.SYS (symbol loading deferred)
Module Load: AUDSTUB.SYS (symbol loading deferred)
Module Load: RASL2TP.SYS (symbol loading deferred)
Module Load: NDISTAPI.SYS (symbol loading deferred)
Module Load: NDISWAN.SYS (symbol loading deferred)
Module Load: TDI.SYS (symbol loading deferred)
Module Load: RASPPTP.SYS (symbol loading deferred)
Module Load: PTILINK.SYS (symbol loading deferred)
Module Load: RASPTI.SYS (symbol loading deferred)
Module Load: PARALLEL.SYS (symbol loading deferred)
Module Load: SWENUM.SYS (symbol loading deferred)
Module Load: UPDATE.SYS (symbol loading deferred)
Module Load: USBHUB.SYS (symbol loading deferred)
Module Load: D:\WINNT\system32\OUSB2HUB.SYS (symbol loading deferred)
Module Load: FLPYDISK.SYS (symbol loading deferred)
Module Load: NDPROXY.SYS (symbol loading deferred)
Module Load: USBSTOR.SYS (symbol loading deferred)
Module Load: USBPRINT.SYS (symbol loading deferred)
Module Load: USBSCAN.SYS (symbol loading deferred)
Module Load: HIDPARSE.SYS (symbol loading deferred)
Module Load: HIDCLASS.SYS (symbol loading deferred)
Module Load: HIDUSB.SYS (symbol loading deferred)
Module Load: FS_REC.SYS (symbol loading deferred)
Module Load: NULL.SYS (symbol loading deferred)
Module Load: BEEP.SYS (symbol loading deferred)
Module Load: VGA.SYS (symbol loading deferred)
Module Load: MNMDD.SYS (symbol loading deferred)
Module Load: MSFS.SYS (symbol loading deferred)
Module Load: NPFS.SYS (symbol loading deferred)
Module Load: RASACD.SYS (symbol loading deferred)
Module Load: TCPIP.SYS (symbol loading deferred)
Module Load: MSGPC.SYS (symbol loading deferred)
Module Load: WANARP.SYS (symbol loading deferred)
Module Load: NETBT.SYS (symbol loading deferred)
Module Load: NETBIOS.SYS (symbol loading deferred)
Module Load: RDBSS.SYS (symbol loading deferred)
Module Load: MRXSMB.SYS (symbol loading deferred)
Module Load: NTFS.SYS (symbol loading deferred)
Module Load: EFS.SYS (symbol loading deferred)
Module Load: DUMP_WMILIB.SYS (symbol loading deferred)
Module Load: DUMP_ATAPI.SYS (symbol loading deferred)
Module Load: D:\WINNT\system32\WIN32K.SYS (symbol loading deferred)
Module Load: VCHNT5.DLL (symbol loading deferred)
Module Load: CH7XXNT5.DLL (symbol loading deferred)
Module Load: SIINT5.DLL (symbol loading deferred)
Module Load: ATV01NT5.DLL (symbol loading deferred)
Module Load: ADV01NT5.DLL (symbol loading deferred)
Module Load: ATV02NT5.DLL (symbol loading deferred)
Module Load: ADV02NT5.DLL (symbol loading deferred)
Module Load: ATV04NT5.DLL (symbol loading deferred)
Module Load: ADV05NT5.DLL (symbol loading deferred)
Module Load: ATV06NT5.DLL (symbol loading deferred)
Module Load: ADV07NT5.DLL (symbol loading deferred)
Module Load: ADV08NT5.DLL (symbol loading deferred)
Module Load: ADV09NT5.DLL (symbol loading deferred)
Module Load: ATV10NT5.DLL (symbol loading deferred)
Module Load: ADV11NT5.DLL (symbol loading deferred)
Module Load: D:\WINNT\system32\I81XDNT5.DLL (symbol loading deferred)
Module Load: SYMTDI.SYS (symbol loading deferred)
Module Load: NETPROBE.SYS (symbol loading deferred)
Module Load: AFD.SYS (symbol loading deferred)
Module Load: WDMAUD.SYS (symbol loading deferred)
Module Load: SYSAUDIO.SYS (symbol loading deferred)
Module Load: PARVDM.SYS (symbol loading deferred)
Module Load: FIPS.SYS (symbol loading deferred)
Module Load: SRV.SYS (symbol loading deferred)
cannot complete modload 0000ff50
Could not get address of KiProcessorBlock
Finished re-loading kernel modules
Kernel Debugger connection established for D:\WINNT\MEMORY.DMP
Kernel Version 2195 Free loaded @ ffffffff80400000
Bugcheck 000000e1 : 80421fb0 00000002 fcb40a68 fcb40a68
Stopped at an unexpected exception: code=80000003 addr=ffffffff804191fa
Hard coded breakpoint hit
>




Can anyone make sense of this? I am very new to debugging. I am still going to try and play around with this. But anyone with debugging experience would really be helpful.

I just tried an LN command like so:

> ln 80421FB0

and it said no symbols found. Going to try and find some symbols heh. Thought I downloaded them a month ago, but maybe I am mistaken. Any help is appreciated.

[Lotus]

Ok some good news I guess. I downloaded the new debugging tools and it works much better. Have it set to download the sybols I need on demand. This is what I got when debugging the dmp file:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)
Arguments:
Arg1: 80421fb0, address of worker routine (do ln on this to find guilty driver)
Arg2: 00000002, IRQL returned at (should have been 0, but isn't).
Arg3: fcb40a68, workitem parameter
Arg4: fcb40a68, workitem address

Debugging Details:
------------------


FAULTING_IP:
nt+21fb0
80421fb0 8b442404 mov eax,[esp+0x4]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xE1

LAST_CONTROL_TRANSFER: from 80455a16 to 804191fa

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f0833da8 80455a16 fcb40a68 00000000 00000000 nt+0x191fa
f0833ddc 80469bb2 804190f0 00000000 00000000 nt+0x55a16
00000000 00000000 00000000 00000000 00000000 nt+0x69bb2


FOLLOWUP_IP:
nt+21fb0
80421fb0 8b442404 mov eax,[esp+0x4]

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt+21fb0

MODULE_NAME: nt

IMAGE_NAME:

DEBUG_FLR_IMAGE_TIMESTAMP: 3ee6c002

STACK_COMMAND: kb

BUCKET_ID: 0xE1_nt+21fb0

Followup: MachineOwner
---------

kd> ln 80421fb0

As you can see it said to find the guilty driver do an "ln" command. Which I did and it came up with nothing. I don't know where to go from here...