*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: 9ec67864
Arg3: 9ec67440
Arg4: 8ae70f38
Debugging Details:
------------------
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
EXCEPTION_RECORD: 9ec67864 -- (.exr 0xffffffff9ec67864)
ExceptionAddress: 8ae70f38 (Ntfs!NtfsModifySecurity+0x00000207)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 1bff7b0e
Attempt to write to address 1bff7b0e
CONTEXT: 9ec67440 -- (.cxr 0xffffffff9ec67440)
eax=0009ec67 ebx=9ec67a9c ecx=9ec67b0c edx=00000000 esi=97ffe2f0 edi=00000000
eip=8ae70f38 esp=9ec6792c ebp=9ec679bc iopl=0 nv up ei pl nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010213
Ntfs!NtfsModifySecurity+0x207:
8ae70f38 ddb10200397d fnsave [ecx+7D390002h] ds:0023:1bff7b0e=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 1bff7b0e
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82ba184c
Unable to read MiSystemVaType memory at 82b80f00
1bff7b0e
FOLLOWUP_IP:
Ntfs!NtfsModifySecurity+207
8ae70f38 ddb10200397d fnsave [ecx+7D390002h]
FAULTING_IP:
Ntfs!NtfsModifySecurity+207
8ae70f38 ddb10200397d fnsave [ecx+7D390002h]
BUGCHECK_STR: 0x24
MISALIGNED_IP:
Ntfs!NtfsModifySecurity+207
8ae70f38 ddb10200397d fnsave [ecx+7D390002h]
LAST_CONTROL_TRANSFER: from 8ae70f1e to 8ae70f38
STACK_TEXT:
9ec6792c 8ae70f1e 14259245 9be8bdb0 97ffe2f0 Ntfs!NtfsModifySecurity+0x207
9ec679bc 8ae712c4 9ec67a9c 9be8bdb0 97ffe2f0 Ntfs!NtfsModifySecurity+0x1f5
9ec67a24 8aea57ee 9ec67a9c 853faa08 14259171 Ntfs!NtfsCommonSetSecurityInfo+0x290
9ec67a88 8aea587b 9ec67a9c 853faa08 00000001 Ntfs!NtfsFsdDispatchSwitch+0x205
9ec67bbc 82a6ec1e 85fdf020 853faa08 853faa08 Ntfs!NtfsFsdDispatchWait+0x1c
9ec67bd4 8adcf20c 8605bb68 853faa08 00000000 nt!IofCallDriver+0x63
9ec67bf8 8adcf3cb 9ec67c18 8605bb68 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
9ec67c30 82a6ec1e 8605bb68 853faa08 85508580 fltmgr!FltpDispatch+0xc5
9ec67c48 82c9c784 b896e7a8 00000000 00000000 nt!IofCallDriver+0x63
9ec67ca4 82ca0e23 8605bb68 00000000 9ec67cdc nt!IopGetSetSecurityObject+0x257
9ec67cd0 82c3a959 85508501 20000004 9f2c7f20 nt!ObSetSecurityObjectByPointer+0x40
9ec67d20 82a758c6 00001450 20000004 08d1d698 nt!NtSetSecurityObject+0x150
9ec67d20 778f70f4 00001450 20000004 08d1d698 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
0616ece8 00000000 00000000 00000000 00000000 0x778f70f4
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsModifySecurity+207
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xffffffff9ec67440 ; kb
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED_Ntfs.sys
BUCKET_ID: IP_MISALIGNED_Ntfs.sys
Followup: MachineOwner
This is what i got from OSR site, any clue? I can't understand a bit