Hilfe bei dmp.Datei auslesen

Hallo,

ich habe nach einem Bluescreen die dmp.Datei ausgelesen und frage euch jetzt mal wo genau der Fehler liegt.
Es betrifft ja wahrscheinlich die ntkrnlmp.exe aber was genau ist das Problem, wie kann ich den Fehler beheben.
Könnt ihr mir sagen wie man so eine Datei richtig ausliest, mache das zum erstenmal.

Vielen Dank,
BDMarder


0: kd> !analyze -v
*

• *
• Bugcheck Analysis *
• *

*

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8000251de22, The address that the exception occurred at
Arg3: fffff8800f95d998, Exception Record Address
Arg4: fffff8800f95d1f0, Context Record Address

Debugging Details:


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

FAULTING_IP:
nt!RtlInterlockedClearBitRunEx+b2
fffff800`0251de22 f0412102 lock and dword ptr [r10],eax

EXCEPTION_RECORD: fffff8800f95d998 -- (.exr 0xfffff8800f95d998)
ExceptionAddress: fffff8000251de22 (nt!RtlInterlockedClearBitRunEx+0x00000000000000b2)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff8800f95d1f0 -- (.cxr 0xfffff8800f95d1f0)
rax=00000000fffdffff rbx=ffffffffffffffff rcx=0000000000000011
rdx=fff1f1f1fff1f1f1 rsi=fff1f1f1fff1f1f1 rdi=0000058000000000
rip=fffff8000251de22 rsp=fffff8800f95dbd8 rbp=fd5d57dffd5d5d30
r8=0000000000000011 r9=0000000000000001 r10=1ffe38be4dc2be4c
r11=fff1f1f1fff1f1f1 r12=0000000000000000 r13=0000000000000001
r14=fffff8800f95dd00 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!RtlInterlockedClearBitRunEx+0xb2:
fffff800`0251de22 f0412102 lock and dword ptr [r10],eax ds:002b:1ffe38be`4dc2be4c=????????
Resetting default scope

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

FOLLOWUP_IP:
nt!RtlInterlockedClearBitRunEx+b2
fffff800`0251de22 f0412102 lock and dword ptr [r10],eax

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from fffff800026ce3db to fffff8000251de22

STACK_TEXT:
fffff880`0f95dbd8 fffff800`026ce3db : ffffffff`ffffffff fffff880`0f95dd00 00000000`00000000 00000000`00000000 : nt!RtlInterlockedClearBitRunEx+0xb2
fffff880`0f95dbe0 fffff800`026d2bb5 : fffff880`0f95dd00 fffff880`00000007 00000000`00000000 fffffa80`00000001 : nt!MmDuplicateMemory+0x8bb
fffff880`0f95dcd0 fffff800`02723e5a : fffffa80`0c9311c0 fffff880`016c177c 00000000`c0000035 fffff8a0`0107ded0 : nt!PopTransitionToSleep+0xd5
fffff880`0f95dd40 fffff800`0247dd26 : fffff800`025ffe80 fffffa80`0c9311c0 fffff800`0260dcc0 fffff880`0d2ea4a0 : nt!PspSystemThreadStartup+0x5a
fffff880`0f95dd80 00000000`00000000 : fffff880`0f95e000 fffff880`0f958000 fffff880`0f95d920 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlInterlockedClearBitRunEx+b2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be

STACK_COMMAND: .cxr 0xfffff8800f95d1f0 ; kb

FAILURE_BUCKET_ID: X64_0x7E_nt!RtlInterlockedClearBitRunEx+b2

BUCKET_ID: X64_0x7E_nt!RtlInterlockedClearBitRunEx+b2

Followup: MachineOwner