..................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C4, {60, 0, 128, 1}
Probably caused by : memory_corruption ( nt!MmUnloadSystemImage+16e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000060, A driver has forgotten to free its pool allocations prior to unloading.
Arg2: 00000000, paged bytes
Arg3: 00000128, nonpaged bytes,
Arg4: 00000001, total # of (paged+nonpaged) allocations that weren't freed.
To get the name of the driver at fault, type
dp ViBadDriver l1; dS @$p
Then type !verifier 3 drivername.sys for info on the allocations
that were leaked that caused the bugcheck.
Debugging Details:
------------------
BUGCHECK_STR: 0xc4_60
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: uphclean.exe
LAST_CONTROL_TRANSFER: from 80673b23 to 805373aa
STACK_TEXT:
a5045ad4 80673b23 000000c4 00000060 00000000 nt!KeBugCheckEx+0x1b
a5045afc 805faf02 8984ddc8 89892c98 89892cc0 nt!MiVerifyingDriverUnloading+0x134
a5045b28 805b76da 8984ddc8 89892ca8 89892c88 nt!MmUnloadSystemImage+0x16e
a5045b3c 8056c78f 89892cc0 00000000 89892ca8 nt!IopDeleteDriver+0x39
a5045b58 804e1957 89892cc0 00000000 a5045c30 nt!ObpRemoveObjectRoutine+0xdf
a5045b70 8050f480 a5045c30 a5045cac 80622fac nt!ObfDereferenceObject+0x4c
a5045c14 80622fbb a5045d0c 00000000 a5045c30 nt!IopUnloadDriver+0x288
a5045c24 804dd99f a5045d0c a5045d48 804e470b nt!NtUnloadDriver+0xf
a5045c24 804e470b a5045d0c a5045d48 804e470b nt!KiFastCallEntry+0xfc
a5045ca0 80520bef a5045d0c a5045d64 0056f84c nt!ZwUnloadDriver+0x11
a5045d48 80622fbb 0056f850 00000000 a5045d64 nt!IopUnloadDriver+0xf1
a5045d58 804dd99f 0056f850 0056f85c 7c91eb94 nt!NtUnloadDriver+0xf
a5045d58 7c91eb94 0056f850 0056f85c 7c91eb94 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0056f85c 00000000 00000000 00000000 00000000 0x7c91eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmUnloadSystemImage+16e
805faf02 e94dc3fbff jmp nt!MmUnloadSystemImage+0x16e (805b7254)
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!MmUnloadSystemImage+16e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 48a401b1
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xc4_60_nt!MmUnloadSystemImage+16e
BUCKET_ID: 0xc4_60_nt!MmUnloadSystemImage+16e
Followup: MachineOwner