Bon je pense avoir réussi, mais l'analyse pour moi c'est du charabia ...
Voir ci dessous
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini072108-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Mon Jul 21 19:02:30.343 2008 (GMT+2)
System Uptime: 0 days 0:05:48.906
Loading Kernel Symbols
..........................................................................................................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {ffd101f8, 0, 8054aa32, 0}
Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+237 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffd101f8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054aa32, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
OVERLAPPED_MODULE: Address regions for 'rdbss' and 'wdmaud.sys' overlap
READ_ADDRESS: ffd101f8
FAULTING_IP:
nt!ExFreePoolWithTag+237
8054aa32 668b4efa mov cx,word ptr [esi-6]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: winlogon.exe
LAST_CONTROL_TRANSFER: from 8058b88b to 8054aa32
STACK_TEXT:
f780ec58 8058b88b ffd101fe 00000000 00000212 nt!ExFreePoolWithTag+0x237
f780ec74 8058d211 e27e1050 00000212 e27e1050 nt!CmpCleanUpKcbValueCache+0x51
f780ec88 80654f40 e27e1050 e234db60 e2360560 nt!CmpCleanUpKcbCacheWithLock+0x1a
f780ec98 80654f6e e2360560 f780ecc0 80652b61 nt!CmpCleanUpKCBCacheTable+0x2d
f780eca4 80652b61 e2360560 00000000 00000020 nt!CmpSearchForOpenSubKeys+0xb
f780ecc0 8064c4a3 e234db60 00000020 e2360560 nt!CmUnloadKey+0x32
f780ed58 804de7ec 0006faec 0006fb04 7c91eb94 nt!NtUnloadKey+0x18c
f780ed58 7c91eb94 0006faec 0006fb04 7c91eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006fb04 00000000 00000000 00000000 00000000 0x7c91eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+237
8054aa32 668b4efa mov cx,word ptr [esi-6]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExFreePoolWithTag+237
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711
FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+237
BUCKET_ID: 0x50_nt!ExFreePoolWithTag+237
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffd101f8, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054aa32, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
OVERLAPPED_MODULE: Address regions for 'rdbss' and 'wdmaud.sys' overlap
READ_ADDRESS: ffd101f8
FAULTING_IP:
nt!ExFreePoolWithTag+237
8054aa32 668b4efa mov cx,word ptr [esi-6]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: winlogon.exe
LAST_CONTROL_TRANSFER: from 8058b88b to 8054aa32
STACK_TEXT:
f780ec58 8058b88b ffd101fe 00000000 00000212 nt!ExFreePoolWithTag+0x237
f780ec74 8058d211 e27e1050 00000212 e27e1050 nt!CmpCleanUpKcbValueCache+0x51
f780ec88 80654f40 e27e1050 e234db60 e2360560 nt!CmpCleanUpKcbCacheWithLock+0x1a
f780ec98 80654f6e e2360560 f780ecc0 80652b61 nt!CmpCleanUpKCBCacheTable+0x2d
f780eca4 80652b61 e2360560 00000000 00000020 nt!CmpSearchForOpenSubKeys+0xb
f780ecc0 8064c4a3 e234db60 00000020 e2360560 nt!CmUnloadKey+0x32
f780ed58 804de7ec 0006faec 0006fb04 7c91eb94 nt!NtUnloadKey+0x18c
f780ed58 7c91eb94 0006faec 0006fb04 7c91eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006fb04 00000000 00000000 00000000 00000000 0x7c91eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+237
8054aa32 668b4efa mov cx,word ptr [esi-6]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExFreePoolWithTag+237
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711
FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+237
BUCKET_ID: 0x50_nt!ExFreePoolWithTag+237
Followup: MachineOwner