UNEXPECTED_KERNEL_MODE_TRAP (7f) nach Neustart bei Patchday

Hallo zusammen,



nachdem Windows 10 einige Updates installiert hatte (habe mir nicht gemerkt welche dazu gekommen waren und was nach dem Restore noch drauf war) endete jeder Neustart in einem Bluescreen, bis ich es endlich geschafft hatte in den abgesicherten Modus zu kommen und den Rechner wieder zurücksetzen konnte. Fehlermeldung war UNEXPECTED_KERNEL_MODE_TRAP (7f).

Da ich hier keinen Punkt zum anhängen von Dateien gesehen habe weiter unten die Memory Dump Analyze.

Vielleicht kann mir ja hier jemand helfen. Meine Erfahrung seit dem Windows 10 Upgrade ist: nur noch Probleme. Mit Windows 8.1 vorher hatte ich Null Probleme.


Viele Grüße

Björn


Microsoft (R) Windows Debugger Version 10.0.10586.567 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 10586 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 10586.17.amd64fre.th2_release.151121-2308
Machine Name:
Kernel base = 0xfffff803`a5888000 PsLoadedModuleList = 0xfffff803`a5b66c70
Debug session time: Tue Dec 8 22:54:08.590 2015 (UTC + 1:00)
System Uptime: 0 days 0:00:04.329
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000003f`b76d9018). Type ".hh dbgerr001" for details
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, ffffd00044854b30, ffffd00045f8c000, fffff803a58aa5cb}

*** ERROR: Module load completed but symbols could not be loaded for oodivdh.sys
*** ERROR: Module load completed but symbols could not be loaded for oodisrh.sys
*** ERROR: Module load completed but symbols could not be loaded for cmdguard.sys
*** ERROR: Module load completed but symbols could not be loaded for trufos.sys
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceCopyEnd+13 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffd00044854b30
Arg3: ffffd00045f8c000
Arg4: fffff803a58aa5cb

Debugging Details:
------------------

Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details
Page 380 not present in the dump file. Type ".hh dbgerr004" for details

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 10586.17.amd64fre.th2_release.151121-2308

SYSTEM_MANUFACTURER: Acer

SYSTEM_PRODUCT_NAME: Aspire VN7-791

SYSTEM_SKU: Aspire VN7-791_091D_1.11

SYSTEM_VERSION: V1.11

BIOS_VENDOR: Insyde Corp.

BIOS_VERSION: V1.11

BIOS_DATE: 01/09/2015

BASEBOARD_MANUFACTURER: Acer

BASEBOARD_PRODUCT: Aspire VN7-791

BASEBOARD_VERSION: V1.11

DUMP_TYPE: 1

BUGCHECK_P1: 8

BUGCHECK_P2: ffffd00044854b30

BUGCHECK_P3: ffffd00045f8c000

BUGCHECK_P4: fffff803a58aa5cb

BUGCHECK_STR: 0x7f_8

TRAP_FRAME: ffffd00044854b30 -- (.trap 0xffffd00044854b30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc65561ebc4ca rbx=0000000000000000 rcx=00001655241304ca
rdx=0000000000000552 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803a58aa5cb rsp=ffffd00045f8c000 rbp=ffffd00045f8c100
r8=fffff803a5b845e8 r9=0000000000000001 r10=7ffff803a5b845e8
r11=7ffffffffffffffc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiFlushTbList+0x3b:
fffff803`a58aa5cb e8d0f91000 call nt!_security_check_cookie (fffff803`a59b9fa0)
Resetting default scope

CPU_COUNT: 8

CPU_MHZ: 9be

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3c

CPU_STEPPING: 3

CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 1E'00000000 (cache) 1E'00000000 (init)

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: smss.exe

CURRENT_IRQL: 0

ANALYSIS_SESSION_HOST: DAGOBERT3

ANALYSIS_SESSION_TIME: 12-08-2015 23:15:43.0657

ANALYSIS_VERSION: 10.0.10586.567 x86fre

STACK_OVERFLOW: Stack Limit: ffffd00045f8c000. Use (kF) and (!stackusage) to investigate stack usage.

STACKUSAGE_FUNCTION: The function at address 0xFFFFF803A59D4FA3 was blamed for the stack overflow. It is using 2264 bytes of stack total in 5 instances (likely recursion).

FOLLOWUP_IP:
nt!KiSystemServiceCopyEnd+13
fffff803`a59d4fa3 65ff0425382e0000 inc dword ptr gs:[2E38h]

STACK_COMMAND: .trap 0xffffd00044854b30 ; kb

THREAD_SHA1_HASH_MOD_FUNC: 074a0537ae7f397ffc098ce3d775ad10840985a1

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2d1e39787fe16fec67502ed66c65fcaecde45dc3

THREAD_SHA1_HASH_MOD: 300d2e6c2be61527525bfe116509e1a1133acf21

FAULT_INSTR_CODE: 2504ff65

SYMBOL_STACK_INDEX: a

SYMBOL_NAME: nt!KiSystemServiceCopyEnd+13

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 565189c8

IMAGE_VERSION: 10.0.10586.17

BUCKET_ID_FUNC_OFFSET: 13

FAILURE_BUCKET_ID: 0x7f_8_STACK_USAGE_RECURSION_nt!KiSystemServiceCopyEnd

BUCKET_ID: 0x7f_8_STACK_USAGE_RECURSION_nt!KiSystemServiceCopyEnd

PRIMARY_PROBLEM_CLASS: 0x7f_8_STACK_USAGE_RECURSION_nt!KiSystemServiceCopyEnd

TARGET_TIME: 2015-12-08T21:54:08.000Z

OSBUILD: 10586

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2015-11-22 10:24:24

BUILDDATESTAMP_STR: 151121-2308

BUILDLAB_STR: th2_release

BUILDOSVER_STR: 10.0.10586.17.amd64fre.th2_release.151121-2308

ANALYSIS_SESSION_ELAPSED_TIME: 5719

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x7f_8_stack_usage_recursion_nt!kisystemservicecopyend

FAILURE_ID_HASH: {4bb95f7f-6292-7571-312a-1da8c64f08d4}

Followup: MachineOwner
---------

1: kd> kv
# Child-SP RetAddr : Args to Child : Call Site
00 ffffd000`448549e8 fffff803`a59d52e9 : 00000000`0000007f 00000000`00000008 ffffd000`44854b30 ffffd000`45f8c000 : nt!KeBugCheckEx
01 ffffd000`448549f0 fffff803`a59d3373 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
02 ffffd000`44854b30 fffff803`a58aa5cb : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb3 (TrapFrame @ ffffd000`44854b30)
03 ffffd000`45f8c000 fffff803`a58a9834 : 00000000`00000000 00000000`00000001 ffffd000`45f8c300 00000000`00000000 : nt!MiFlushTbList+0x3b
04 ffffd000`45f8c200 fffff803`a5ab8e18 : 00000000`2079654b ffffd000`45f8c6c8 00000000`00000000 00000000`00000020 : nt!MiAllocatePagedPoolPages+0x634
05 ffffd000`45f8c3e0 fffff803`a5c5a69e : ffffd000`45f8c8d0 00000000`00001000 ffffe001`a8167a70 00000000`00000001 : nt!ExAllocatePoolWithTag+0x4c8
06 ffffd000`45f8c4c0 fffff803`a5c66654 : 00000000`00000000 ffffc000`3b302b00 00000000`00000000 ffffd000`45f8c5b0 : nt!ObpAllocateObject+0x14e
07 ffffd000`45f8c540 fffff803`a5c68e37 : ff000100`00000000 ffffd000`006659c0 ffffe001`adc38b10 ffffc000`00000000 : nt!CmpDoOpen+0x1e4
08 ffffd000`45f8c630 fffff803`a5c72c96 : ffffffff`80000680 ffffffff`80000680 ffffe001`ae3b90b0 00000000`00000000 : nt!CmpParseKey+0x487
09 ffffd000`45f8c940 fffff803`a5c7169c : ffffe001`adc38b00 ffffd000`45f8cb50 fffff803`00000240 ffffe001`a8167a70 : nt!ObpLookupObjectName+0x776
0a ffffd000`45f8cae0 fffff803`a5c9b1f6 : 00000000`00000001 ffffe001`a8167a70 ffffd000`45f8cfc8 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ec
0b ffffd000`45f8cc00 fffff803`a5c9a4e2 : ffffd000`45f8d128 00000000`00000000 ffffffff`80000680 00000000`00000001 : nt!CmOpenKey+0x2a6
0c ffffd000`45f8cdb0 fffff803`a59d4fa3 : 00000000`00000000 ffffe001`ad2f4360 00000000`00000001 ffffe001`a803b148 : nt!NtOpenKey+0x12
0d ffffd000`45f8cdf0 fffff803`a59cd650 : fffff800`8ef32d4e ffffc000`00000000 00000000`00001000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`45f8cdf0)
0e ffffd000`45f8cf88 fffff800`8ef32d4e : ffffc000`00000000 00000000`00001000 00000000`00000000 00000000`00000634 : nt!KiServiceLinkage
0f ffffd000`45f8cf90 fffff800`8ef32c31 : 00000000`00000000 ffffe001`ae3f67e0 00000000`00000000 ffffe001`00000634 : FLTMGR!FltpCreateInstanceFromName+0xce
10 ffffd000`45f8d070 fffff800`8ef33172 : ffffe001`aa9c5bd0 ffffe001`aa9c5bc0 ffffe001`ae40d202 00000000`00000028 : FLTMGR!FltpEnumerateRegistryInstances+0x145
11 ffffd000`45f8d110 fffff800`8ef3642c : ffffe001`ae3f67e0 fffff803`00000000 ffffe001`aa9c5bd0 ffffe001`aa9d2010 : FLTMGR!FltpDoFilterNotificationForNewVolume+0x126
12 ffffd000`45f8d190 fffff800`90705121 : ffffe001`adf59c01 ffffe001`adf59ed8 ffffe001`00000060 ffffe001`acd69868 : FLTMGR!FltpCreate+0x49c
13 ffffd000`45f8d240 fffff800`90701268 : ffffe001`adf59ca0 ffffe001`adf59ca0 ffffe001`ae299370 fffff800`90711eeb : oodivdh+0x5121
14 ffffd000`45f8d270 fffff800`90704a66 : ffffe001`ae3f6690 00000000`00000000 ffffe001`adf59ca0 ffffe001`ae34cd10 : oodivdh+0x1268
15 ffffd000`45f8d2a0 fffff800`90712655 : ffffe001`adf59f20 00000000`00000801 ffffe001`ae45b0c0 00000000`000007ff : oodivdh+0x4a66
16 ffffd000`45f8d2d0 fffff800`90711d4f : ffffe001`adf59ca0 ffffe001`ae34cd10 fffff803`a5b9cc20 00000000`00000000 : oodisrh+0x2655
17 ffffd000`45f8d300 fffff800`9071200e : ffffe001`ae34cd10 ffffe001`adf59ca0 ffffe001`adf59ca0 fffff800`8ef08924 : oodisrh+0x1d4f
18 ffffd000`45f8d390 fffff800`8ef07895 : ffffe001`adcd3010 fffff800`8ef330ca ffffd000`45f8d499 ffffe001`adf59ca0 : oodisrh+0x200e
19 ffffd000`45f8d3c0 fffff800`8ef362d7 : ffffe001`ae406df0 ffffd000`00000000 ffffe001`ae406d01 ffffe001`ad0c6880 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5
1a ffffd000`45f8d450 fffff803`a5c7c328 : 00000000`00000001 00000000`00000026 00000000`00000060 ffffe001`acd69868 : FLTMGR!FltpCreate+0x347
1b ffffd000`45f8d500 fffff803`a5c72c96 : ffffc000`3b3a788a ffffc000`3b3a788a ffffd000`45f8d7d0 ffffe001`acd81030 : nt!IopParseDevice+0x7c8
1c ffffd000`45f8d6d0 fffff803`a5c7169c : ffffe001`ae246800 ffffd000`45f8d8e0 00000000`00000240 ffffe001`a8099f20 : nt!ObpLookupObjectName+0x776
1d ffffd000`45f8d870 fffff803`a5c9a8c8 : 00000000`00000001 ffffe001`ade39b10 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ec
1e ffffd000`45f8d990 fffff803`a5c99e58 : ffffd000`45f8dcd0 00000000`00000008 ffffd000`45f8dc60 ffffd000`45f8dc50 : nt!IopCreateFile+0x3d8
1f ffffd000`45f8da40 fffff800`8ef33be1 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd000`45f8db50 : nt!IoCreateFileEx+0x120
20 ffffd000`45f8dad0 fffff800`8ef32a5a : ffffd000`45f8de90 ffffd000`45f8ddf0 ffffd000`45f8dcd0 00000000`00000000 : FLTMGR!FltpCreateFile+0x1cd
21 ffffd000`45f8dbd0 fffff800`8ef32969 : 00000000`00000000 fffff800`8ef03e2c 00000000`00000000 fffff800`8ef3018b : FLTMGR!FltOpenVolume+0xaa
22 ffffd000`45f8dca0 fffff800`91cdec60 : ffffd000`45f8de90 ffffd000`45f8de50 00000000`00000008 ffffe001`ae444010 : FLTMGR!FltQueryVolumeInformation+0x29
23 ffffd000`45f8dcf0 fffff800`8ef3a9e0 : 00000000`00000000 00000000`00000005 00000000`00000000 ffffe001`ae344740 : cmdguard+0x2ec60
24 ffffd000`45f8de60 fffff800`8ef3a341 : 00000000`00000000 ffffe001`ae444010 ffffd000`45f8e002 ffffe001`ae344740 : FLTMGR!FltpDoInstanceSetupNotification+0x8c
25 ffffd000`45f8ded0 fffff800`8ef32e2d : ffffe001`ad0cd920 ffffe001`ae444010 00000000`00000005 ffffd000`45f8dfd0 : FLTMGR!FltpInitInstance+0x2f5
26 ffffd000`45f8df90 fffff800`8ef32c31 : 00000000`00000000 ffffe001`ae444010 00000000`00000000 fffff803`0000001a : FLTMGR!FltpCreateInstanceFromName+0x1ad
27 ffffd000`45f8e070 fffff800`8ef33172 : ffffe001`ad0cd930 ffffe001`ad0cd920 ffffe001`ae214402 00000000`00000028 : FLTMGR!FltpEnumerateRegistryInstances+0x145
28 ffffd000`45f8e110 fffff800`8ef3642c : ffffe001`ae444010 ffffd000`00000000 ffffe001`ad0cd930 ffffe001`ad0c6880 : FLTMGR!FltpDoFilterNotificationForNewVolume+0x126
29 ffffd000`45f8e190 fffff803`a5c7c328 : 00000000`00000000 00000000`00000004 00000000`00000000 ffffc000`3b19eb01 : FLTMGR!FltpCreate+0x49c
2a ffffd000`45f8e240 fffff803`a5c72c96 : ffffc000`3b1d36ba ffffc000`3b1d36ba ffffd000`45f8e510 ffffe001`acd81030 : nt!IopParseDevice+0x7c8
2b ffffd000`45f8e410 fffff803`a5c7169c : ffffe001`adc3b700 ffffd000`45f8e620 00000000`00000240 ffffe001`a8099f20 : nt!ObpLookupObjectName+0x776
2c ffffd000`45f8e5b0 fffff803`a5c9a8c8 : ffffd000`00000001 ffffe001`ae21e500 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ec
2d ffffd000`45f8e6d0 fffff803`a5c9a429 : ffffd000`45f8ea88 ffffc000`3acfa840 ffffd000`45f8ead8 ffffd000`45f8ea90 : nt!IopCreateFile+0x3d8
2e ffffd000`45f8e780 fffff803`a59d4fa3 : 00000000`00000000 fffff803`a5c78d89 ffffe001`ae21e6c0 ffffd000`45f8e838 : nt!NtCreateFile+0x79
2f ffffd000`45f8e810 fffff803`a59cd650 : fffff800`8f3c5fd8 ffffd000`45f8eac0 00000000`00000000 ffffd000`45f8ea40 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`45f8e880)
30 ffffd000`45f8ea18 fffff800`8f3c5fd8 : ffffd000`45f8eac0 00000000`00000000 ffffd000`45f8ea40 ffffd000`00000090 : nt!KiServiceLinkage
31 ffffd000`45f8ea20 fffff800`8f3c3614 : ffffd000`45f8ec28 ffffd000`45f8ebd0 00000000`00000500 fffff800`8f405410 : trufos+0x15fd8
32 ffffd000`45f8eb40 fffff800`8f3b89bc : ffffe001`accc9c80 ffffd000`45f8ed50 ffffe001`ae2c3880 fffff803`a58d4ade : trufos+0x13614
33 ffffd000`45f8ec60 fffff800`8ef3a9e0 : ffffd000`45f8eda0 00000000`00000005 ffffe001`00000008 ffffe001`00000003 : trufos+0x89bc
34 ffffd000`45f8ed70 fffff800`8ef3a341 : 00000000`00000000 ffffe001`ae2c37e0 ffffd000`45f8ef02 ffffe001`ae355500 : FLTMGR!FltpDoInstanceSetupNotification+0x8c
35 ffffd000`45f8ede0 fffff800`8ef32e2d : ffffe001`adf0bce0 ffffe001`ae2c37e0 00000000`00000005 ffffd000`45f8eee0 : FLTMGR!FltpInitInstance+0x2f5
36 ffffd000`45f8eea0 fffff800`8ef32c31 : 00000000`00000000 ffffe001`ae2c37e0 00000000`00000000 ffffe001`0000001a : FLTMGR!FltpCreateInstanceFromName+0x1ad
37 ffffd000`45f8ef80 fffff800`8ef33172 : ffffe001`adf0bcf0 ffffe001`adf0bce0 ffffe001`ad0cb902 00000000`0000002e : FLTMGR!FltpEnumerateRegistryInstances+0x145
38 ffffd000`45f8f020 fffff800`8ef3642c : ffffe001`ae2c37e0 fffff803`00000000 ffffe001`adf0bcf0 ffffe001`aa9d2010 : FLTMGR!FltpDoFilterNotificationForNewVolume+0x126
39 ffffd000`45f8f0a0 fffff800`90705121 : ffffe001`ad0d4b01 ffffe001`ad0d4ee0 ffffe001`00000060 ffffe001`aa9f2808 : FLTMGR!FltpCreate+0x49c
3a ffffd000`45f8f150 fffff800`90701268 : ffffe001`ad0d4b40 ffffe001`ad0d4b40 ffffe001`ae296370 fffff800`90711eeb : oodivdh+0x5121
3b ffffd000`45f8f180 fffff800`90704a66 : ffffe001`ae3c81d0 00000000`00000000 ffffe001`ad0d4b40 ffffe001`ae41a390 : oodivdh+0x1268
3c ffffd000`45f8f1b0 fffff800`90712655 : ffffe001`ad0d4f28 00000000`00000801 ffffe001`ae3f1370 00000000`000007ff : oodivdh+0x4a66
3d ffffd000`45f8f1e0 fffff800`90711d4f : ffffe001`ad0d4b40 ffffe001`ae41a390 fffff803`a5b9cc20 00000000`00000000 : oodisrh+0x2655
3e ffffd000`45f8f210 fffff800`9071200e : ffffe001`ae41a390 ffffe001`ad0d4b40 ffffe001`ad0d4b40 fffff800`8ef08924 : oodisrh+0x1d4f
3f ffffd000`45f8f2a0 fffff800`8ef07895 : ffffe001`ad0c9b30 fffff800`8ef330ca ffffd000`45f8f3a9 ffffe001`ad0d4b40 : oodisrh+0x200e
40 ffffd000`45f8f2d0 fffff800`8ef362d7 : ffffe001`ae20bdf0 ffffd000`00000000 ffffe001`ae20bd01 ffffe001`ad0c6880 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a5
41 ffffd000`45f8f360 fffff803`a5c7c328 : 00000000`00000001 00000000`00000026 00000000`00000060 ffffe001`aa9f2808 : FLTMGR!FltpCreate+0x347
42 ffffd000`45f8f410 fffff803`a5c72c96 : ffffc000`3a9d191e ffffc000`3a9d191e ffffd000`45f8f6e0 ffffe001`accc9c50 : nt!IopParseDevice+0x7c8
43 ffffd000`45f8f5e0 fffff803`a5c7169c : ffffe001`adff8600 ffffd000`45f8f7f0 00000000`00000240 ffffe001`a8099f20 : nt!ObpLookupObjectName+0x776
44 ffffd000`45f8f780 fffff803`a5c9a8c8 : 00000000`00000001 ffffe001`ae219780 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ec
45 ffffd000`45f8f8a0 fffff803`a5c99e58 : ffffd000`45f8fbe0 00000000`00000008 ffffd000`45f8fb70 ffffd000`45f8fb60 : nt!IopCreateFile+0x3d8
46 ffffd000`45f8f950 fffff800`8ef33be1 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd000`45f8fa60 : nt!IoCreateFileEx+0x120
47 ffffd000`45f8f9e0 fffff800`8ef32a5a : ffffd000`45f8fda0 ffffd000`45f8fd00 ffffd000`45f8fbe0 00000000`00000000 : FLTMGR!FltpCreateFile+0x1cd
48 ffffd000`45f8fae0 fffff800`8ef32969 : 00000000`00000000 fffff800`8ef03e2c 00000000`00000000 fffff800`8ef3018b : FLTMGR!FltOpenVolume+0xaa
49 ffffd000`45f8fbb0 fffff800`91cdec60 : ffffd000`45f8fda0 ffffd000`45f8fd60 00000000`00000008 ffffe001`ad3117e0 : FLTMGR!FltQueryVolumeInformation+0x29
4a ffffd000`45f8fc00 fffff800`8ef3a9e0 : 00000000`00000000 00000000`00000005 00000000`00000000 ffffe001`ae205280 : cmdguard+0x2ec60
4b ffffd000`45f8fd70 fffff800`8ef3a341 : 00000000`00000000 ffffe001`ad3117e0 ffffd000`45f8ff02 ffffe001`ae205280 : FLTMGR!FltpDoInstanceSetupNotification+0x8c
4c ffffd000`45f8fde0 fffff800`8ef32e2d : ffffe001`ad0cd920 ffffe001`ad3117e0 00000000`00000005 ffffd000`45f8fee0 : FLTMGR!FltpInitInstance+0x2f5
4d ffffd000`45f8fea0 fffff800`8ef32c31 : 00000000`00000000 ffffe001`ad3117e0 00000000`00000000 fffff803`0000001a : FLTMGR!FltpCreateInstanceFromName+0x1ad
4e ffffd000`45f8ff80 fffff800`8ef33172 : ffffe001`ad0cd930 ffffe001`ad0cd920 ffffe001`ae212302 00000000`00000028 : FLTMGR!FltpEnumerateRegistryInstances+0x145
4f ffffd000`45f90020 fffff800`8ef3642c : ffffe001`ad3117e0 ffffd000`00000000 ffffe001`ad0cd930 ffffe001`ad0c6880 : FLTMGR!FltpDoFilterNotificationForNewVolume+0x126
50 ffffd000`45f900a0 fffff803`a5c7c328 : 00000000`00000000 00000000`00000024 00000000`00000000 ffffd000`00000001 : FLTMGR!FltpCreate+0x49c
51 ffffd000`45f90150 fffff803`a5c72c96 : ffffc000`3b3a79de ffffc000`3b3a79de ffffd000`45f90420 ffffe001`accc9c50 : nt!IopParseDevice+0x7c8
52 ffffd000`45f90320 fffff803`a5c7169c : ffffe001`ae1c5b00 ffffd000`45f90530 ffffe001`00000240 ffffe001`a8099f20 : nt!ObpLookupObjectName+0x776
53 ffffd000`45f904c0 fffff803`a5c9a8c8 : 00000000`00000001 ffffe001`ae1c4610 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1ec
54 ffffd000`45f905e0 fffff803`a5c9a3a0 : ffffd000`45f90a28 ffffe001`ae1c46b0 ffffd000`45f909a0 ffffd000`45f90980 : nt!IopCreateFile+0x3d8
55 ffffd000`45f90690 fffff803`a59d4fa3 : ffffe001`ae1c47d0 ffffd000`45f90738 00000000`00000000 00000000`00000000 : nt!NtOpenFile+0x58
56 ffffd000`45f90720 fffff803`a59cd650 : fffff803`a5d84dd7 00000000`4b505953 fffff803`a5ab922a 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`45f90790)
57 ffffd000`45f90928 fffff803`a5d84dd7 : 00000000`4b505953 fffff803`a5ab922a 00000000`00000000 00000000`00000001 : nt!KiServiceLinkage
58 ffffd000`45f90930 fffff803`a599afa9 : 00000000`00000000 ffffc000`3b744820 00000000`00000000 00000000`00000000 : nt!SiGetDiskPartitionInformation+0x7f
59 ffffd000`45f90a10 fffff803`a5d84b01 : 00000000`0000002e ffffc000`3b747a60 fffff803`00000030 00000000`00000000 : nt!SiValidateSystemPartition+0x11
5a ffffd000`45f90ad0 fffff803`a5d849da : 00000000`00000001 ffffc000`00000000 ffffd000`00000000 ffffc000`00000002 : nt!SiGetFirmwareBootDeviceName+0x109
5b ffffd000`45f90b80 fffff803`a5d8491f : 00000000`00000000 fffff803`a5d849ac 00000000`0000001d 00000000`00000000 : nt!SiGetSystemPartition+0x2e
5c ffffd000`45f90bb0 fffff803`a5d84845 : ffffc000`3b745140 00000000`00000000 00000000`00000000 ffffd000`45f90f10 : nt!SiGetSystemDeviceName+0x6b
5d ffffd000`45f90c40 fffff803`a5d84767 : fffff803`a5d8489c 00000000`00000000 ffffe001`00000000 ffffd000`45f90d14 : nt!IopRetrieveSystemDeviceName+0xb1
5e ffffd000`45f90ca0 fffff803`a5c6ee21 : 00000000`00000062 00000000`00000000 fffff803`a5c1a420 ffffc000`3a83a130 : nt!IoQuerySystemDeviceName+0x27
5f ffffd000`45f90ce0 fffff803`a5c6dcbb : ffffd000`45f91768 ffffd000`45f917e0 00000000`00000000 00000000`00000000 : nt!ExpQuerySystemInformation+0x1071
60 ffffd000`45f91450 fffff803`a59d4fa3 : fffff803`a5ddb050 00000000`000f003f 00000000`00000000 00000000`00000000 : nt!NtQuerySystemInformation+0x2b
61 ffffd000`45f91490 fffff803`a59cd650 : fffff803`a5d7a71c 00000000`80000000 fffff803`a59cd650 00000000`00000010 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`45f91490)
62 ffffd000`45f91628 fffff803`a5d7a71c : 00000000`80000000 fffff803`a59cd650 00000000`00000010 00000000`00000082 : nt!KiServiceLinkage
63 ffffd000`45f91630 fffff803`a5d7a6c4 : ffffd000`45f916d8 fffff803`a5ddd2a0 ffffd000`0000002a ffffd000`45f916c0 : nt!SiQuerySystemPartitionInformation+0x2c
64 ffffd000`45f91670 fffff803`a5d7a648 : 00000000`00000002 ffffd000`45f91728 ffffc655`61ea12ba ffffd000`45f91780 : nt!SyspartGetSystemPartition+0x1c
65 ffffd000`45f916a0 fffff803`a5d7a587 : 00000000`00000002 ffffd000`45f917d8 00000000`00000000 01d13202`f49ae1a1 : nt!BiGetSystemPartition+0x20
66 ffffd000`45f916d0 fffff803`a5d7a416 : 00000000`00000002 00000000`00000000 ffffd000`45f91798 ffffd000`45f91848 : nt!BiGetSystemStorePath+0x43
67 ffffd000`45f91720 fffff803`a5d7aea8 : 00000000`00000002 00000000`00000000 ffffd000`45f91798 00000000`00000000 : nt!BiLoadSystemStore+0x2e
68 ffffd000`45f91760 fffff803`a5d7ade0 : ffffd000`45f91848 ffffc000`00000002 00000000`00000000 ffffffff`800005ec : nt!BiOpenSystemStore+0xb4
69 ffffd000`45f917d0 fffff803`a5dc4b51 : 00000000`00000000 ffffd000`45f918b0 00000000`00000000 00000000`00000086 : nt!BcdOpenSystemStore+0x1c
6a ffffd000`45f91800 fffff803`a5d8aaf9 : 00000000`00000040 00000000`00000000 00000000`00000001 ffffffff`800005ec : nt!PoInitHiberServices+0x35
6b ffffd000`45f91840 fffff803`a59d4fa3 : ffffe001`ad2f4040 ffffffff`80000628 00000000`00000001 ffffd000`45f91b00 : nt!NtInitializeRegistry+0x17d
6c ffffd000`45f918d0 fffff803`a59cd650 : fffff803`a5d8a9be ffffd000`45f91aa8 0000003f`b74aecc8 ffffe001`ad2f4040 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`45f918d0)
6d ffffd000`45f91a68 fffff803`a5d8a9be : ffffd000`45f91aa8 0000003f`b74aecc8 ffffe001`ad2f4040 fffff803`a59d4fa3 : nt!KiServiceLinkage
6e ffffd000`45f91a70 fffff803`a59d4fa3 : ffffe001`ad2f4040 00000000`c0000001 00000000`c0000001 ffffe001`a8166930 : nt!NtInitializeRegistry+0x42
6f ffffd000`45f91b00 00007ffa`5dab6b84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`45f91b00)
70 0000003f`b74aee98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`5dab6b84

1: kd> !stackusage
Stack Usage By Function
=================================================================================

Size Count Module
0x000008D8 5 nt!KiSystemServiceCopyEnd
0x00000820 5 nt!ObpLookupObjectName
0x00000770 1 nt!ExpQuerySystemInformation
0x00000740 4 nt!IopParseDevice
0x000005A0 5 nt!ObOpenObjectByNameEx
0x00000310 1 nt!CmpParseKey
0x000002E0 2 cmdguard
0x000002C0 4 FLTMGR!FltpCreate
0x000002C0 4 nt!IopCreateFile
0x000002A0 3 FLTMGR!FltpCreateInstanceFromName
0x00000280 4 FLTMGR!FltpEnumerateRegistryInstances
0x00000240 3 FLTMGR!FltpInitInstance
0x00000200 4 FLTMGR!FltpDoFilterNotificationForNewVolume
0x00000200 2 FLTMGR!FltpCreateFile
0x00000200 1 nt!MiFlushTbList
0x000001E0 1 nt!MiAllocatePagedPoolPages
0x000001B0 1 nt!CmOpenKey
0x000001A0 2 FLTMGR!FltOpenVolume
0x00000160 2 FLTMGR!FltpCreate
0x00000150 3 FLTMGR!FltpDoInstanceSetupNotification
0x00000140 1 nt!KiBugCheckDispatch
0x00000120 2 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted
0x00000120 1 trufos
0x00000120 1 trufos
0x00000120 2 oodisrh
0x00000120 2 nt!IoCreateFileEx
0x00000110 1 trufos
0x000000F0 1 nt!CmpDoOpen
0x000000E0 1 FLTMGR!FltpCreateInstanceFromName
0x000000E0 1 nt!ExAllocatePoolWithTag
0x000000E0 1 nt!SiGetDiskPartitionInformation
0x000000C0 1 nt!SiValidateSystemPartition
0x000000B0 1 nt!SiGetFirmwareBootDeviceName
0x000000A0 2 FLTMGR!FltQueryVolumeInformation
0x00000090 1 nt!NtOpenFile
0x00000090 1 nt!NtCreateFile
0x00000090 1 nt!SiGetSystemDeviceName
0x00000090 1 nt!NtInitializeRegistry
0x00000090 1 nt!NtInitializeRegistry
0x00000080 1 nt!ObpAllocateObject
0x00000070 1 nt!BiOpenSystemStore
0x00000060 2 oodivdh
0x00000060 2 oodivdh
0x00000060 2 oodivdh
0x00000060 2 oodisrh
0x00000060 2 oodisrh
0x00000060 1 nt!IopRetrieveSystemDeviceName
0x00000050 1 nt!BiGetSystemStorePath
0x00000040 1 nt!NtQuerySystemInformation
0x00000040 1 nt!NtOpenKey
0x00000040 1 nt!BiLoadSystemStore
0x00000040 1 nt!SiQuerySystemPartitionInformation
0x00000040 1 nt!IoQuerySystemDeviceName
0x00000040 1 nt!PoInitHiberServices
0x00000030 1 nt!BiGetSystemPartition
0x00000030 1 nt!SyspartGetSystemPartition
0x00000030 1 nt!BcdOpenSystemStore
0x00000030 1 nt!SiGetSystemPartition
0x00000028 5 nt!KiServiceLinkage
0x00000008 2 nt!KeBugCheckEx

Total Size: 0x00005C48


Stack Usage By Module
=================================================================================

Size Count Module
0x00003E08 62 nt
0x00001510 32 FLTMGR
0x00000350 3 trufos
0x000002E0 2 cmdguard
0x000001E0 6 oodisrh
0x00000120 6 oodivdh

Total Size: 0x00005C48

Weiterlesen...