0x0000035/Driver Verifier

spleenharvester

spleenharvester

spleenharvester

Associate
Joined
4 Dec 2008
Posts
1,812
One of our PCs here is exhibiting some strange behaviour, freezing on shutdown, restarting on shutdown, getting IRQL_NOT_LESS_OR_EQUAL on shutdown etc.

Memtest comes back completely clean. Sfc /scannow found some violations and it freezes on shutdown less now, but still does it. Changing the IRQ of the WiFi card to 7 also helped a bit.

On driver verifier, it gets 0x0000035. Have tried the regedit M$ suggest but still no luck. Any ideas? Am about to analyse a full memory dump of it so shall update when done.

E2140 2.4GHZ 1.1v (does it at stock too)
PNY 2x1Gb PC6400 1:2.66 (stock speeds)
Gigabyte GA-G41M-ES2L
WD1600AAJS
HP DVD400i
Antec Basiq 350W
Netgear WG311v3

Am certain it isn't a hardware problem. It works fine other than shutdown issues as well as this.

Cheers

EDIT:

Code: 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NO_MORE_IRP_STACK_LOCATIONS (35)
A higher level driver has attempted to call a lower level driver through
the IoCallDriver() interface, but there are no more stack locations in the
packet, hence, the lower level driver would not be able to access its
parameters, as there are no parameters for it.  This is a disasterous
situation, since the higher level driver "thinks" it has filled in the
parameters for the lower level driver (something it MUST do before it calls
it), but since there is no stack location for the latter driver, the former
has written off of the end of the packet.  This means that some other memory
has probably been trashed at this point.
Arguments:
Arg1: 8a9fce48, Address of the IRP
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

GetContextState failed, 0x80004002
Unable to read selector for PCR for processor 0
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
Unable to read selector for PCR for processor 0
GetContextState failed, 0x80004002
Unable to read selector for PCR for processor 1
GetContextState failed, 0x80004002
Unable to read selector for PCR for processor 0

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x35

STACK_TEXT:  
GetContextState failed, 0x80004002
Unable to get current machine context, HRESULT 0x80004002


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  CORRUPT_MODULELIST

Followup: MachineOwner
---------

GetContextState failed, 0x80004002
GetContextState failed, 0x80004002
GetContextState failed, 0x80004002

Tricky. I'll try get another one.
 
Last edited:
A friend of mine is getting IRQL_NOT_LESS_OR_EQUAL aswell, and his memtest is also clean.
You say things have helped 'a bit' but not completely fixed the problem. Could that be a bit of placebo?
I would completely remove the wireless card and try a new one.
 
^Nah, used to crash on every shutdown, now it only does say, every other.

Pinpointed the cause of the 0x35:

Code: 
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [G:\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Jun  2 21:20:09.968 2011 (UTC + 1:00)
System Uptime: 0 days 0:00:31.625
Loading Kernel Symbols
...............................................................
..............................................
Loading User Symbols

Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 35, {8b77ee48, 0, 0, 0}

*** ERROR: Module load completed but symbols could not be loaded for RAMDiskXP.sys
Probably caused by : RAMDiskXP.sys ( RAMDiskXP+53b2 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NO_MORE_IRP_STACK_LOCATIONS (35)
A higher level driver has attempted to call a lower level driver through
the IoCallDriver() interface, but there are no more stack locations in the
packet, hence, the lower level driver would not be able to access its
parameters, as there are no parameters for it.  This is a disasterous
situation, since the higher level driver "thinks" it has filled in the
parameters for the lower level driver (something it MUST do before it calls
it), but since there is no stack location for the latter driver, the former
has written off of the end of the packet.  This means that some other memory
has probably been trashed at this point.
Arguments:
Arg1: 8b77ee48, Address of the IRP
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x35

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 804ef186 to 804f9f43

STACK_TEXT:  
b9d07200 804ef186 00000035 8b77ee48 00000000 nt!KeBugCheckEx+0x1b
b9d07218 80659128 8b77eeb0 8b77eed4 8b77ee48 nt!IopfCallDriver+0x18
b9d0723c b91de3b2 8a5b2030 8a6126f8 8a63e000 nt!IovCallDriver+0xa0
WARNING: Stack unwind information not available. Following frames may be wrong.
b9d07260 b91e8131 8a5b2030 8b77eeb8 b9d072a4 RAMDiskXP+0x53b2
b9d07270 804ef19f 8a5b2030 8b77ee48 806e7428 RAMDiskXP+0xf131
b9d07280 80659128 8b77eed4 8b77eef8 8a63e0d8 nt!IopfCallDriver+0x31
b9d072a4 80663b28 8a63e020 8a758cc0 8a5af800 nt!IovCallDriver+0xa0
b9d072b8 804ef19f 8a63e020 8b77ee48 806e7428 nt!ViDriverDispatchGeneric+0x2a
b9d072c8 80659128 8b77ef00 8b77ee48 8a5af8a0 nt!IopfCallDriver+0x31
b9d072ec b9b32902 8a5af7e8 8a6c5160 8a604200 nt!IovCallDriver+0xa0
b9d07318 804ef19f 8a5af7e8 8b77ee48 806e7428 PartMgr!PmDeviceControl+0x8a
b9d07328 80659128 8b77ef1c 8b77ef40 8a604208 nt!IopfCallDriver+0x31
b9d0734c 80663b28 8a604150 8a758cc0 89b3e100 nt!IovCallDriver+0xa0
b9d07360 804ef19f 8a604150 8b77ee48 806e7428 nt!ViDriverDispatchGeneric+0x2a
b9d07370 80659128 8b77ef40 8b77ef64 89b3e160 nt!IopfCallDriver+0x31
b9d07394 b91de909 89b3e0a8 8a6126f8 8b77ee00 nt!IovCallDriver+0xa0
b9d073b4 b91e8138 89b3e0a8 8b77ee48 b9d073f8 RAMDiskXP+0x5909
b9d073c4 804ef19f 89b3e0a8 8b77ee48 806e7428 RAMDiskXP+0xf138
b9d073d4 80659128 8b77ef64 8b77ef88 8b77ee48 nt!IopfCallDriver+0x31
b9d073f8 b9756656 8a58a6d0 8a6c8208 8a62a400 nt!IovCallDriver+0xa0
b9d0742c 804ef19f 8b77ef6c 8b77ee48 806e7428 ftdisk!FtDiskDeviceControl+0x6a4
b9d0743c 80659128 8b77ef88 8b77efac 8a62a438 nt!IopfCallDriver+0x31
b9d07460 80663b28 8a62a380 8a758cc0 89a05e00 nt!IovCallDriver+0xa0
b9d07474 804ef19f 8a62a380 8b77ee48 806e7428 nt!ViDriverDispatchGeneric+0x2a
b9d07484 80659128 8b77efd8 8b77ee48 89a05e38 nt!IopfCallDriver+0x31
b9d074a8 b98d02a6 89a05d80 8a73ff38 8a614200 nt!IovCallDriver+0xa0
b9d074bc 804ef19f 89a05d80 8b77ee48 806e7428 VolSnap!VolSnapDeviceControl+0x152
b9d074cc 80659128 8b77efd0 8b77eff4 8a614218 nt!IopfCallDriver+0x31
b9d074f0 80663b28 8a614160 8a758cc0 00000000 nt!IovCallDriver+0xa0
b9d07504 804ef19f 8a614160 8b77ee48 806e7428 nt!ViDriverDispatchGeneric+0x2a
b9d07514 80659128 8a5a64b8 89a7c118 00000000 nt!IopfCallDriver+0x31
b9d07538 8056d70b 00000000 8904c100 00000000 nt!IovCallDriver+0xa0
b9d0755c 98427a29 8a614160 8a5a64b8 89a7c118 nt!FsRtlBalanceReads+0x4d
b9d075a0 9841ba3c 8a5a64b8 89a7c118 8f684e00 Fastfat!FatCheckDirtyBit+0x8a
b9d07730 98418a93 8a5a64b8 8a614160 89a5e2a8 Fastfat!FatMountVolume+0x720
b9d07750 98418a38 8a5a64b8 8f684e00 8a6eea30 Fastfat!FatCommonFileSystemControl+0x49
b9d0779c 804ef19f 8a6eea30 8f684e00 806e7428 Fastfat!FatFsdFileSystemControl+0x85
b9d077ac 80659128 8f684fd0 8f684ff4 8f684e00 nt!IopfCallDriver+0x31
b9d077d0 b96ded5f 899a7020 899a70d8 8f684e00 nt!IovCallDriver+0xa0
b9d077fc b96dee0f 899a7020 899a70d8 8f684fd8 sr!SrFsControlMount+0x9b
b9d07818 804ef19f 899a70d8 8f684e00 806e7428 sr!SrFsControl+0x4b
b9d07828 80659128 8a58a6d0 8f684e00 899a7020 nt!IopfCallDriver+0x31
b9d0784c 80581bed 00000000 8a58a6d0 806e7a4c nt!IovCallDriver+0xa0
b9d0789c 804f53e6 c000014f b9d07a00 00000000 nt!IopMountVolume+0x1b9
b9d078cc 80582be6 8a6500a8 8a58a6d0 b9d07a00 nt!IopCheckVpbMounted+0x5e
b9d079bc 805bf488 8a58a6d0 00000000 899af3a0 nt!IopParseDevice+0x3d8
b9d07a34 805bba14 00000000 b9d07a74 00000040 nt!ObpLookupObjectName+0x53c
b9d07a88 80576057 00000000 00000000 65907100 nt!ObOpenObjectByName+0xea
b9d07b04 805769ce b9d07c94 00100001 b9d07c5c nt!IopCreateFile+0x407
b9d07b60 8057a1cd b9d07c94 00100001 b9d07c5c nt!IoCreateFile+0x8e
b9d07ba0 8054167c b9d07c94 00100001 b9d07c5c nt!NtOpenFile+0x27
b9d07ba0 8050065d b9d07c94 00100001 b9d07c5c nt!KiFastCallEntry+0xfc
b9d07c30 b98ccf76 b9d07c94 00100001 b9d07c5c nt!ZwOpenFile+0x11
b9d07d68 80576af9 8a614160 8a6ef690 8056485c VolSnap!VspDeleteDiffAreaFilesWorker+0xa0
b9d07d7c 805387cb 8a6ef690 00000000 8a7753c8 nt!IopProcessWorkItem+0x13
b9d07dac 805cffa8 8a6ef690 00000000 00000000 nt!ExpWorkerThread+0xef
b9d07ddc 8054615e 805386dc 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
RAMDiskXP+53b2
b91de3b2 e98a000000      jmp     RAMDiskXP+0x5441 (b91de441)

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  RAMDiskXP+53b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: RAMDiskXP

IMAGE_NAME:  RAMDiskXP.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4dc3637d

FAILURE_BUCKET_ID:  0x35_VRF_RAMDiskXP+53b2

BUCKET_ID:  0x35_VRF_RAMDiskXP+53b2

Followup: MachineOwner
---------

Will uninstall RAMdisk and post back.
 
Could you outline how you came to that conclusion, and what you used to find out it was that, it may help with my friends problem. Thanks
 
fleming222 said:
Could you outline how you came to that conclusion, and what you used to find out it was that, it may help with my friends problem. Thanks
Click to expand...

Create a system restore point (just incase), then Run > Type "verifier" without quotes > Create custom settings (for code developers) > "Select individual settings from a full list" > Tick all > "Automatically select all drivers installed on this computer" > Finish > Reboot

This'll make the computer pretty slow and takes some patience, but do a few reboot cycles on those settings, or whatever in particular will usually bring the BSoD up (unless it's gaming or something, 'cause gaming on driver verifier isn't very fun). At some point, you will hopefully get a BSoD - let it dump the file (oh yeah, make sure it's set to dump files if it isn't already, I prefer full memory dumps but IIRC it does't really matter), then reboot into safe mode and use the system restore point you created earlier (alternatively, "last known good config" should do the trick), to stop it overwriting the dump file and corrupting it like the one in the OP.

If you don't get a BSoD, the problem is probably elsewhere other than drivers.

When you're back in windows, download Debugging Tools for Windows (make sure .NET 4 is installed first if it isn't already), and run WinDbg. Go File > Open Crash Dump > All files > Point it to the dmp file you've got, then click !analyze -v when it shows up. Should give you details like the second dump I posted which point to a faulting driver or module. Fix the driver or module, try driver verifier again, if you get no BSoD then all is good in the world again.

Long guide, but that's basically all of it :p
 
You must log in or register to reply here.
Back
Top Bottom