Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Monthly Seminars at OSR Headquarters

East Coast USA
Windows Internals and SW Drivers, Dulles (Sterling) VA, 13 November 2017

Kernel Debugging & Crash Analysis for Windows, Nashua (Amherst) NH, 4 December 2017

Writing WDF Drivers I: Core Concepts, Nashua (Amherst) NH, 8 January 2018

WDF Drivers II: Advanced Implementation Techniques, Nashua (Amherst) NH, 15 January 2018


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 4  
01 Dec 17 20:11
weilin jiang
xxxxxx@foxmail.com
Join Date: 30 Nov 2017
Posts To This List: 12
BSOD on ndis.sys

See below for information , How can I find what module causes ndis.sys to BSOD ? Need your help , thanks ! SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff800052c5cb6, The address that the exception occurred at Arg3: fffff880057f9858, Exception Record Address Arg4: fffff880057f90c0, Context Record Address Debugging Details: ------------------ DUMP_CLASS: 1 DUMP_QUALIFIER: 400 BUILD_VERSION_STRING: 7601.23915.amd64fre.win7sp1_ldr.170913-0600 SYSTEM_MANUFACTURER: Main Board SYSTEM_PRODUCT_NAME: MT21B-ZWZN SYSTEM_SKU: To be filled by O.E.M SYSTEM_VERSION: To be filled by O.E.M BIOS_VENDOR: Main Board BIOS_VERSION: NK21B005 BIOS_DATE: 11/14/2017 BASEBOARD_MANUFACTURER: MainBoard BASEBOARD_VERSION: To be filled by O.E.M DUMP_TYPE: 2 BUGCHECK_P1: ffffffffc0000005 BUGCHECK_P2: fffff800052c5cb6 BUGCHECK_P3: fffff880057f9858 BUGCHECK_P4: fffff880057f90c0 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text> FAULTING_IP: nt!KeSetEvent+16 fffff800`052c5cb6 f6037f test byte ptr [rbx],7Fh EXCEPTION_RECORD: fffff880057f9858 -- (.exr 0xfffff880057f9858) ExceptionAddress: fffff800052c5cb6 (nt!KeSetEvent+0x0000000000000016) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 000000000013ee21 Attempt to read from address 000000000013ee21 CONTEXT: fffff880057f90c0 -- (.cxr 0xfffff880057f90c0) rax=fffffa8005449000 rbx=000000000013ee21 rcx=0000000000000001 rdx=0000000000000000 rsi=fffff88001ab1110 rdi=0000000000000000 rip=fffff800052c5cb6 rsp=fffff880057f9a90 rbp=0000000000000080 r8=0000000000000000 r9=0000000000000000 r10=fffff80005251000 r11=0000000000000000 r12=0000000000000000 r13=fffff88001a5e500 r14=0000000000000000 r15=fffff88001ab1110 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!KeSetEvent+0x16: fffff800`052c5cb6 f6037f test byte ptr [rbx],7Fh ds:002b:00000000`0013ee21=?? Resetting default scope CPU_COUNT: 4 CPU_MHZ: a98 CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: 5e CPU_STEPPING: 3 CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: B2'00000000 (cache) B2'00000000 (init) CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text> EXCEPTION_CODE_STR: c0000005 EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 000000000013ee21 FOLLOWUP_IP: ndis!ndisDeleteMiniportOnLastDeref+295 fffff880`01a90bf5 488b5c2440 mov rbx,qword ptr [rsp+40h] BUGCHECK_STR: 0x7E READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800054fd100 Unable to get MmSystemRangeStart GetUlongPtrFromAddress: unable to read from fffff800054fd2e8 GetUlongPtrFromAddress: unable to read from fffff800054fd498 GetPointerFromAddress: unable to read from fffff800054fd0b8 000000000013ee21 ANALYSIS_SESSION_HOST: DESKTOP-VA5NCH5 ANALYSIS_SESSION_TIME: 12-02-2017 08:53:23.0097 ANALYSIS_VERSION: 10.0.15063.468 amd64fre LAST_CONTROL_TRANSFER: from fffff88001a90bf5 to fffff800052c5cb6 STACK_TEXT: fffff880`057f9a90 fffff880`01a90bf5 : fffffa80`0ae9f1a0 00000000`00000000 fffff880`01ab1100 00000000`00000000 : nt!KeSetEvent+0x16 fffff880`057f9b00 fffff880`01adafd4 : 00000000`00000001 00000000`00000000 fffff880`01a5e500 fffffa80`0ae9f1a0 : ndis!ndisDeleteMiniportOnLastDeref+0x295 fffff880`057f9b40 fffff880`01af13eb : fffffa80`13808010 fffff880`01ab1101 fffff880`6f6d444e fffffa80`13808010 : ndis! ?? ::DKGKHJNI::`string'+0x1507 fffff880`057f9b80 fffff880`01a5e5fa : 00000000`00000000 00000000`00000080 fffff880`01ab1110 fffffa80`13808168 : ndis!ndisMQueuedFinishClose+0x18b fffff880`057f9bd0 fffff800`0555c622 : fffffa80`05449040 fffffa80`045b4720 fffff880`057f9c70 fffffa80`05449040 : ndis!ndisWorkerThread+0xba fffff880`057f9c00 fffff800`052b3da6 : fffff880`04b71180 fffffa80`05449040 fffff880`04b7bfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`057f9c40 00000000`00000000 : fffff880`057fa000 fffff880`057f4000 fffff880`057f9750 00000000`00000000 : nt!KiStartSystemThread+0x16 THREAD_SHA1_HASH_MOD_FUNC: 735cec12d5ecae2f0ecf750d80933891c18f2ad7 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 167d696663523452bec0d1a9aac47aa57cba08a0 THREAD_SHA1_HASH_MOD: 60dc341394ccbb3fc971bf4eee9e62e0cf5c4456 FAULT_INSTR_CODE: 245c8b48 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: ndis!ndisDeleteMiniportOnLastDeref+295 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ndis IMAGE_NAME: ndis.sys DEBUG_FLR_IMAGE_TIMESTAMP: 561c7ad7 IMAGE_VERSION: 6.1.7601.19030 STACK_COMMAND: .cxr 0xfffff880057f90c0 ; kb FAILURE_BUCKET_ID: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295 BUCKET_ID: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295 PRIMARY_PROBLEM_CLASS: X64_0x7E_ndis!ndisDeleteMiniportOnLastDeref+295 TARGET_TIME: 2017-11-15T11:43:41.000Z OSBUILD: 7601 OSSERVICEPACK: 1000 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 SUITE_MASK: 272 PRODUCT_TYPE: 1 OSPLATFORM_TYPE: x64 OSNAME: Windows 7 OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2017-09-13 22:55:13 BUILDDATESTAMP_STR: 170913-0600 BUILDLAB_STR: win7sp1_ldr BUILDOSVER_STR: 6.1.7601.23915.amd64fre.win7sp1_ldr.170913-0600 ANALYSIS_SESSION_ELAPSED_TIME: 2fc ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:x64_0x7e_ndis!ndisdeleteminiportonlastderef+295 FAILURE_ID_HASH: {295460f1-1c88-957f-fa3a-99c397d09403}
  Message 2 of 4  
08 Dec 17 15:22
Scott Noone
xxxxxx@osr.com
Join Date:
Posts To This List: 1353
List Moderator
BSOD on ndis.sys

Quickest thing to do is try "!stacks 2 ndis!" and see if there are any other pending calls into an NDIS miniport. Or reboot the system and run !ndiskd.netreport to check to see which miniports are normally loaded. -scott OSR @OSRDrivers
  Message 3 of 4  
13 Dec 17 05:24
weilin jiang
xxxxxx@foxmail.com
Join Date: 30 Nov 2017
Posts To This List: 12
BSOD on ndis.sys

Hi, Snoone , thanks your reply ,! Can I get some help from below message ? 1: kd> !stacks 2 ndis! Proc.Thread .Thread Ticks ThreadState Blocker [fffff8000464e180 Idle] *** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys [fffffa8007580990 System] 4.00005c fffffa8007663660 fffffe07 RUNNING nt!KeAcquireSpinLockRaiseToDpc+0x5b ndis!NdisFOidRequestComplete+0x9e wfplwf!FilterOidRequestComplete+0x123 ndis!ndisOidRequestComplete+0x23f ndis!NdisFOidRequestComplete+0x91 pacer!PcFilterRequestComplete+0x68 ndis!ndisOidRequestComplete+0x23f ndis! ?? ::DKGKHJNI::`string'+0x311a ndis!ndisFQueueRequestOnNext+0x22d ndis!NdisFOidRequest+0xc9 pacer!PcFilterRequest+0x5b ndis!ndisFDoOidRequest+0x21b ndis!ndisFQueueRequestOnNext+0x22d ndis!NdisFOidRequest+0xc9 wfplwf!FilterOidRequest+0x61 ndis!ndisFDoOidRequest+0x21b ndis!ndisQueueRequestOnTop+0x219 ndis!ndisQuerySetMiniportEx+0x143 ndis!ndisQuerySetMiniport+0x1c ndis!ndisQueryCustomGuids+0xa2 ndis!ndisQuerySupportedGuidToOidList+0x1bb ndis!ndisWmiRegister+0x76 ndis!ndisWMIDispatch+0x185 nt!WmipForwardWmiIrp+0x16c nt!WmipSendWmiIrp+0xa2 nt!WmipRegisterOrUpdateDS+0xb4 nt!WmipRegistrationWorker+0x5c nt!ExpWorkerThread+0x111 nt!PspSystemThreadStartup+0x5a nt!KxStartSystemThread+0x16 *** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys 4.00011c fffffa8008052040 ffffff94 Blocked nt!KiSwapContext+0x7a nt!KiCommitThreadWait+0x1d2 nt!KeWaitForSingleObject+0x19f ndis!ndisThreadPoolTimerHandler+0x21 nt!PspSystemThreadStartup+0x5a nt!KxStartSystemThread+0x16 4.000120 fffffa8008052b50 fffffe07 RUNNING nt!KeBugCheckEx nt!PspUnhandledExceptionInSystemThread+0x24 nt! ?? ::NNGAKEGL::`string'+0x223d nt!_C_specific_handler+0x8c nt!RtlpExecuteHandlerForException+0xd nt!RtlDispatchException+0x415 nt!KiDispatchException+0x135 nt!KiExceptionDispatch+0xc2 nt!KiGeneralProtectionFault+0x10a nt!IopOpenOrCreateDeviceRegistryKey+0x44 nt!IoOpenDeviceRegistryKey+0x11 ndis!ndisCheckAdapterBindings+0xaf ndis!ndisPnPNotifyAllTransports+0x1f1 ndis!ndisRestartMiniportFilterStack+0x52f ndis! ?? ::FNODOBFM::`string'+0xcc62 ndis!ndisCheckMiniportFilters+0x125 ndis!ndisQueuedCheckAdapterBindings+0xc9 ndis!ndisWorkerThread+0xba nt!PspSystemThreadStartup+0x5a nt!KxStartSystemThread+0x16 4.000124 fffffa8008058830 ffffff94 Blocked nt!KiSwapContext+0x7a nt!KiCommitThreadWait+0x1d2 nt!KeWaitForSingleObject+0x19f ndis!ndisCmWaitThread+0x2c nt!PspSystemThreadStartup+0x5a nt!KxStartSystemThread+0x16 *** ERROR: Symbol file could not be found. Defaulted to export symbols for igdkmd64.sys - *** ERROR: Module load completed but symbols could not be loaded for iusb3xhc.sys *** ERROR: Module load completed but symbols could not be loaded for RTKVHD64.sys *** ERROR: Module load completed but symbols could not be loaded for iusb3hub.sys *** ERROR: Module load completed but symbols could not be loaded for btmhsf.sys [fffffa80083f3040 smss.exe] [fffffa800aef66b0 csrss.exe] [fffffa800b39db30 wininit.exe] [fffffa800b39c780 csrss.exe] [fffffa800b3deb30 services.exe] [fffffa800b3ebb30 lsass.exe] [fffffa800b3eeb30 lsm.exe] [fffffa800b490b30 svchost.exe] [fffffa800b4b7b30 svchost.exe] [fffffa800b4c2b30 MsMpEng.exe] [fffffa800b55bb30 svchost.exe] [fffffa800b577b30 svchost.exe] [fffffa800b58fb30 svchost.exe] [fffffa800b5afb30 svchost.exe] [fffffa800b610060 igfxCUIService] [fffffa800b828b30 svchost.exe] [fffffa800d58eb30 winlogon.exe] [fffffa800d5bf880 wlanext.exe] [fffffa800d5ceb30 conhost.exe] [fffffa800d559b30 LogonUI.exe] [fffffa800d66fb30 MpCmdRun.exe] [fffffa800d879b30 MpCmdRun.exe] [fffffa800d690b30 conhost.exe] [fffffa800d729920 spoolsv.exe] [fffffa800d57db30 svchost.exe] [fffffa8010e37060 EasiUpdate.exe] [fffffa8014073b30 EvtEng.exe] [fffffa8014081b30 dllhost.exe] [fffffa801409ab30 ibtsiva.exe] [fffffa80140d6b30 taskeng.exe] [fffffa80140af060 IMEDICTUPDATE.] [fffffa80140ce060 userinit.exe] [f��
  Message 4 of 4  
14 Dec 17 12:23
Scott Noone
xxxxxx@osr.com
Join Date:
Posts To This List: 1353
List Moderator
BSOD on ndis.sys

Nothing obvious jumps out. You might want to enable Driver Verifier on ndis and any third party drivers you have in the system. This might result in a better crash that is easier to diagnose. -scott OSR @OSRDrivers
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 16:59.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license