Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\041811-18595-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`0364c000 PsLoadedModuleList = 0xfffff800`03889e50
Debug session time: Sun Apr 17 21:36:06.902 2011 (UTC - 4:00)
System Uptime: 0 days 0:13:16.544
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, 80, fffff8800558afc0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceHandler+7c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: 0000000000000080, Address of the instruction which caused the bugcheck
Arg3: fffff8800558afc0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
+0
00000000`00000080 ?? ???
CONTEXT: fffff8800558afc0 -- (.cxr 0xfffff8800558afc0)
rax=000000000000000e rbx=fffffa80037eed20 rcx=fffffa80053795b0
rdx=fffffa8003b05d90 rsi=fffffa80037eed20 rdi=fffffa8003b05d90
rip=0000000000000080 rsp=fffff8800558b998 rbp=fffff8800558bc00
r8=fffffa8000000000 r9=000000000000000e r10=fffff800038379a0
r11=fffffa8003d70280 r12=0000000000000000 r13=0000000000000001
r14=0000000000000001 r15=fffffa800542d690
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
00000000`00000080 ?? ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000080
STACK_TEXT:
fffff880`0558a6f8 fffff800`036bbca9 : 00000000`0000003b 00000000`c0000005 00000000`00000080 fffff880`0558afc0 : nt!KeBugCheckEx
fffff880`0558a700 fffff800`036bb5fc : fffff880`0558b758 fffff880`0558afc0 00000000`00000000 fffff800`036eac90 : nt!KiBugCheckDispatch+0x69
fffff880`0558a840 fffff800`036e240d : fffff800`038dfd50 fffff800`03805ab4 fffff800`0364c000 fffff880`0558b758 : nt!KiSystemServiceHandler+0x7c
fffff880`0558a880 fffff800`036e9a90 : fffff800`0380c1c0 fffff880`0558a8f8 fffff880`0558b758 fffff800`0364c000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0558a8b0 fffff800`036f69ef : fffff880`0558b758 fffff880`0558afc0 fffff880`00000000 fffffa80`03b05d90 : nt!RtlDispatchException+0x410
fffff880`0558af90 fffff800`036bbd82 : fffff880`0558b758 fffffa80`037eed20 fffff880`0558b800 fffffa80`037eed20 : nt!KiDispatchException+0x16f
fffff880`0558b620 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSystemServiceHandler+7c
fffff800`036bb5fc b801000000 mov eax,1
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceHandler+7c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
FAILURE_BUCKET_ID: X64_0x3B_nt!KiSystemServiceHandler+7c
BUCKET_ID: X64_0x3B_nt!KiSystemServiceHandler+7c
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\041811-27877-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`03601000 PsLoadedModuleList = 0xfffff800`03846e90
Debug session time: Mon Apr 18 03:20:29.776 2011 (UTC - 4:00)
System Uptime: 0 days 2:58:19.462
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff8000368b5c0, fffff8800a07afb0, 0}
Probably caused by : ntkrnlmp.exe ( nt!IofCallDriver+50 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000368b5c0, Address of the instruction which caused the bugcheck
Arg3: fffff8800a07afb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!IofCallDriver+50
fffff800`0368b5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
CONTEXT: fffff8800a07afb0 -- (.cxr 0xfffff8800a07afb0)
rax=000000000000000e rbx=fffffa8006350b40 rcx=fffffa80052f5a50
rdx=fffffa8004c9b360 rsi=fffffa8006350b40 rdi=fffffa8004c9b360
rip=fffff8000368b5c0 rsp=fffff8800a07b998 rbp=fffff8800a07bc00
r8=006c006f12020019 r9=000000000000000e r10=fffff88002f63ca0
r11=fffffa8003acb100 r12=0000000000000000 r13=0000000000000001
r14=0000000000000001 r15=fffffa800530c990
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!IofCallDriver+0x50:
fffff800`0368b5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h] ds:002b:006c006f`120200f9=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff8000368b5c0
STACK_TEXT:
fffff880`0a07b998 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x50
FOLLOWUP_IP:
nt!IofCallDriver+50
fffff800`0368b5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!IofCallDriver+50
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
STACK_COMMAND: .cxr 0xfffff8800a07afb0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!IofCallDriver+50
BUCKET_ID: X64_0x3B_nt!IofCallDriver+50
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042211-20155-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`03603000 PsLoadedModuleList = 0xfffff800`03848e90
Debug session time: Fri Apr 22 08:13:21.441 2011 (UTC - 4:00)
System Uptime: 0 days 12:53:54.753
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff8000368d5c0, fffff88009f4ffb0, 0}
Probably caused by : ntkrnlmp.exe ( nt!IofCallDriver+50 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000368d5c0, Address of the instruction which caused the bugcheck
Arg3: fffff88009f4ffb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!IofCallDriver+50
fffff800`0368d5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
CONTEXT: fffff88009f4ffb0 -- (.cxr 0xfffff88009f4ffb0)
rax=000000000000000e rbx=fffffa8006e157e0 rcx=fffffa8004cc7b00
rdx=fffffa800802ddb0 rsi=fffffa8006e157e0 rdi=fffffa800802ddb0
rip=fffff8000368d5c0 rsp=fffff88009f50998 rbp=fffff88009f50c00
r8=0000000000000000 r9=000000000000000e r10=fffff880009e8ca0
r11=fffffa80062f3fc0 r12=0000000000000000 r13=0000000000000001
r14=0000000000000001 r15=fffffa8004cc9e20
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!IofCallDriver+0x50:
fffff800`0368d5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h] ds:002b:00000000`000000e0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff8000368d5c0
STACK_TEXT:
fffff880`09f50998 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x50
FOLLOWUP_IP:
nt!IofCallDriver+50
fffff800`0368d5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!IofCallDriver+50
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
STACK_COMMAND: .cxr 0xfffff88009f4ffb0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!IofCallDriver+50
BUCKET_ID: X64_0x3B_nt!IofCallDriver+50
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042511-18720-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`03663000 PsLoadedModuleList = 0xfffff800`038a8e90
Debug session time: Sun Apr 24 22:22:37.380 2011 (UTC - 4:00)
System Uptime: 0 days 3:32:44.692
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff800036ed5c0, fffff8800883efb0, 0}
Probably caused by : ntkrnlmp.exe ( nt!IofCallDriver+50 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800036ed5c0, Address of the instruction which caused the bugcheck
Arg3: fffff8800883efb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!IofCallDriver+50
fffff800`036ed5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
CONTEXT: fffff8800883efb0 -- (.cxr 0xfffff8800883efb0)
rax=000000000000000e rbx=fffffa80039bc8d0 rcx=fffffa800372ba70
rdx=fffffa800624b900 rsi=fffffa80039bc8d0 rdi=fffffa800624b900
rip=fffff800036ed5c0 rsp=fffff8800883f998 rbp=fffff8800883fc00
r8=0000000072745045 r9=000000000000000e r10=fffff800038569a0
r11=fffffa8003850fc0 r12=0000000000000000 r13=0000000000000001
r14=0000000000000001 r15=fffffa80037089f0
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!IofCallDriver+0x50:
fffff800`036ed5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h] ds:002b:00000000`72745125=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800036ed5c0
STACK_TEXT:
fffff880`0883f998 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x50
FOLLOWUP_IP:
nt!IofCallDriver+50
fffff800`036ed5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!IofCallDriver+50
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
STACK_COMMAND: .cxr 0xfffff8800883efb0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!IofCallDriver+50
BUCKET_ID: X64_0x3B_nt!IofCallDriver+50
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\DMP\042511-19671-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`0360b000 PsLoadedModuleList = 0xfffff800`03850e90
Debug session time: Sun Apr 24 22:28:14.543 2011 (UTC - 4:00)
System Uptime: 0 days 0:04:21.228
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff800036955c0, fffff88009310fb0, 0}
Probably caused by : ntkrnlmp.exe ( nt!IofCallDriver+50 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800036955c0, Address of the instruction which caused the bugcheck
Arg3: fffff88009310fb0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!IofCallDriver+50
fffff800`036955c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
CONTEXT: fffff88009310fb0 -- (.cxr 0xfffff88009310fb0)
rax=000000000000000e rbx=fffffa80039ab730 rcx=fffffa8005a8ec80
rdx=fffffa8006a91310 rsi=fffffa80039ab730 rdi=fffffa8006a91310
rip=fffff800036955c0 rsp=fffff88009311998 rbp=fffff88009311c00
r8=00000000000000a0 r9=000000000000000e r10=fffff800037fe9a0
r11=fffffa80066ed440 r12=0000000000000000 r13=0000000000000001
r14=0000000000000001 r15=fffffa8005a84e20
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!IofCallDriver+0x50:
fffff800`036955c0 49ff64c070 jmp qword ptr [r8+rax*8+70h] ds:002b:00000000`00000180=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800036955c0
STACK_TEXT:
fffff880`09311998 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x50
FOLLOWUP_IP:
nt!IofCallDriver+50
fffff800`036955c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!IofCallDriver+50
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7951a
STACK_COMMAND: .cxr 0xfffff88009310fb0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!IofCallDriver+50
BUCKET_ID: X64_0x3B_nt!IofCallDriver+50
Followup: MachineOwner
---------
nt! ?? ::FNODOBFM::`string'+0x42a70:
fffff800`0368c03c 4c8b442428 mov r8,qword ptr [rsp+28h]
fffff800`0368c041 4883c428 add rsp,28h
fffff800`0368c045 48ffe0 jmp rax
nt! ?? ::FNODOBFM::`string'+0x42a7c:
fffff800`0368c048 4533c9 xor r9d,r9d
fffff800`0368c04b 4533c0 xor r8d,r8d
fffff800`0368c04e 418d4935 lea ecx,[r9+35h]
fffff800`0368c052 e8c9750500 call nt!KiBugCheck3 (fffff800`036e3620)
fffff800`0368c057 cc int 3
nt! ?? ::FNODOBFM::`string'+0x42a8c:
fffff800`0368c058 440fb64001 movzx r8d,byte ptr [rax+1]
fffff800`0368c05d 4180f802 cmp r8b,2
fffff800`0368c061 7417 je nt! ?? ::FNODOBFM::`string'+0x42aae (fffff800`0368c07a)
nt! ?? ::FNODOBFM::`string'+0x42a97:
fffff800`0368c063 4180f803 cmp r8b,3
fffff800`0368c067 7411 je nt! ?? ::FNODOBFM::`string'+0x42aae (fffff800`0368c07a)
nt! ?? ::FNODOBFM::`string'+0x42a9d:
fffff800`0368c069 4c8b4108 mov r8,qword ptr [rcx+8]
fffff800`0368c06d 410fb6c1 movzx eax,r9b
fffff800`0368c071 4883c428 add rsp,28h
fffff800`0368c075 49ff64c070 jmp qword ptr [r8+rax*8+70h]
nt! ?? ::FNODOBFM::`string'+0x42aae:
fffff800`0368c07a 488bca mov rcx,rdx
fffff800`0368c07d 4883c428 add rsp,28h
fffff800`0368c081 e99a1c1500 jmp nt!IopPoHandleIrp (fffff800`037ddd20)
nt!IofCallDriver:
fffff800`036ed570 4883ec28 sub rsp,28h
fffff800`036ed574 488b059d6d2200 mov rax,qword ptr [nt!pIofCallDriver (fffff800`03914318)]
fffff800`036ed57b 4885c0 test rax,rax
fffff800`036ed57e 0f85b8eaf9ff jne nt! ?? ::FNODOBFM::`string'+0x42a70 (fffff800`0368c03c)
nt!IofCallDriver+0x14:
fffff800`036ed584 fe4a43 dec byte ptr [rdx+43h]
fffff800`036ed587 384243 cmp byte ptr [rdx+43h],al
fffff800`036ed58a 0f8eb8eaf9ff jle nt! ?? ::FNODOBFM::`string'+0x42a7c (fffff800`0368c048)
nt!IofCallDriver+0x20:
fffff800`036ed590 488b82b8000000 mov rax,qword ptr [rdx+0B8h]
fffff800`036ed597 4883e848 sub rax,48h
fffff800`036ed59b 488982b8000000 mov qword ptr [rdx+0B8h],rax
fffff800`036ed5a2 440fb608 movzx r9d,byte ptr [rax]
fffff800`036ed5a6 48894828 mov qword ptr [rax+28h],rcx
fffff800`036ed5aa 4180f916 cmp r9b,16h
fffff800`036ed5ae 0f84a4eaf9ff je nt! ?? ::FNODOBFM::`string'+0x42a8c (fffff800`0368c058)
nt!IofCallDriver+0x44:
fffff800`036ed5b4 4c8b4108 mov r8,qword ptr [rcx+8]
fffff800`036ed5b8 410fb6c1 movzx eax,r9b
fffff800`036ed5bc 4883c428 add rsp,28h
fffff800`036ed5c0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
nt!IopPoHandleIrp:
fffff800`037ddd20 fff3 push rbx
fffff800`037ddd22 4883ec20 sub rsp,20h
fffff800`037ddd26 488d542438 lea rdx,[rsp+38h]
fffff800`037ddd2b 488bd9 mov rbx,rcx
fffff800`037ddd2e e8ddfeffff call nt!PoHandleIrp (fffff800`037ddc10)
fffff800`037ddd33 84c0 test al,al
fffff800`037ddd35 751d jne nt!IopPoHandleIrp+0x34 (fffff800`037ddd54)
nt!IopPoHandleIrp+0x17:
fffff800`037ddd37 488b83b8000000 mov rax,qword ptr [rbx+0B8h]
fffff800`037ddd3e 488bd3 mov rdx,rbx
fffff800`037ddd41 488b4828 mov rcx,qword ptr [rax+28h]
fffff800`037ddd45 440fb600 movzx r8d,byte ptr [rax]
fffff800`037ddd49 4c8b4908 mov r9,qword ptr [rcx+8]
fffff800`037ddd4d 43ff54c170 call qword ptr [r9+r8*8+70h]
fffff800`037ddd52 eb04 jmp nt!IopPoHandleIrp+0x38 (fffff800`037ddd58)
nt!IopPoHandleIrp+0x34:
fffff800`037ddd54 8b442438 mov eax,dword ptr [rsp+38h]
nt!IopPoHandleIrp+0x38:
fffff800`037ddd58 4883c420 add rsp,20h
fffff800`037ddd5c 5b pop rbx
fffff800`037ddd5d c3 ret