*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {0, 0, 1, 6e557641}
*** WARNING: Unable to verify timestamp for aswSP.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
[COLOR=#ff0000]Probably caused by : aswSP.SYS[/COLOR] ( aswSP+2caf3 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000000, The caller is requesting a zero byte pool allocation.
Arg2: 00000000, zero.
Arg3: 00000001, the pool type being allocated.
Arg4: 6e557641, the pool tag being used.
Debugging Details:
------------------
BUGCHECK_STR: 0xc2_0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 81a0205d to 819d8b98
STACK_TEXT:
ba7f03ec 81a0205d 000000c2 00000000 00000000 nt!KeBugCheckEx
ba7f0450 90f7caf3 800030f4 00000000 00000000 nt!ExAllocatePoolWithTag+0x57
WARNING: Stack unwind information not available. Following frames may be wrong.
ba7f0460 00000000 ba7f04f0 90f7cb32 00000001 aswSP+0x2caf3
STACK_COMMAND: kb
FOLLOWUP_IP:
aswSP+2caf3
90f7caf3 ?? ???
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: aswSP+2caf3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: aswSP
IMAGE_NAME: aswSP.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 50905821
FAILURE_BUCKET_ID: 0xc2_0_aswSP+2caf3
BUCKET_ID: 0xc2_0_aswSP+2caf3
Followup: MachineOwner
---------
1: kd> lmvm aswSP
start end module name
90f50000 90fa5880 aswSP T (no symbols)
Loaded symbol image file: aswSP.SYS
Image path: \SystemRoot\System32\Drivers\aswSP.SYS
[COLOR=#ff0000] Image name: aswSP.SYS
Timestamp: Wed Oct 31 04:13:45 2012[/COLOR] (50905821)
CheckSum: 000650A2
ImageSize: 00055880
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4