| Voice Recognition | ||||
| Mode | +Mode | Raw | -Speech | +Raw or Speech |
| Pin | +Pin | Normal | -Burst | +KWS |
| Audio Format | +Audio Format | 32-bit float (Type = Audio, Subtype = IEEE_FLOAT, Sampling Rate = 16 kHz, bits = 32) | Managed by OS audio stack | |
| Mic | +Mic | Mic 0 | -All mics in array | +All mics in array, or mono |
[Boot and UEFI](boot-and-uefi.md)
Provides guidance about the boot process and UEFI implementation requirements for devices that run Windows 10.
Provides guidance about the boot process and UEFI implementation requirements for devices that run Windows 10 and Windows Server 2016.
[Windows ACPI design guide for SoC platforms](windows-acpi-design-guide-for-soc-platforms.md)
The Advanced Configuration and Power Interface Specification, Revision 5.0 ([ACPI 5.0 specification](http://www.acpi.info)), defines a new set of features to support low-power, mobile devices that are based on System on a Chip (SoC) integrated circuits and that implement the connected standby power model. Starting with Windows 8 and Windows 8.1, Windows supports the new ACPI 5.0 features for SoC-based platforms.
The Advanced Configuration and Power Interface Specification, Revision 5.0 ([ACPI 5.0 specification](http://www.acpi.info)), defines a new set of features to support low-power, mobile devices that are based on System on a Chip (SoC) integrated circuits and that implement the connected standby power model. Starting with Windows 8 and Windows 8.1, and Windows Server 2012 and 2012 R2, Windows supports the new ACPI 5.0 features for SoC-based platforms.
[Security](security-overview.md)
Use the topics in this section to learn more about security in Windows 10 Mobile.
Use the topics in this section to learn more about security in Windows 10 Mobile and Windows Server 2016.
[Windows 10 Mobile partition layout](partition-layout.md)
Learn how to configure storage partitions and partitions sizes on Windows 10 Mobile devices.
Driver
[FxCop](http://go.microsoft.com/fwlink/p/?LinkId=190283)
FxCop
FxCop is a static analyzer. It analyzes managed-code assemblies and reports information about the assemblies such as possible design, localization, performance, and security improvements.
Partner apps
[BinScope](http://go.microsoft.com/fwlink/p/?LinkId=190284)
BinScope
The BinScope Binary Analyzer is a verification tool that analyzes binaries to ensure that they have been built in compliance with the SDL requirements and recommendations. BinScope checks that SDL-required compiler/linker flags are being set, strong-named assemblies are in use, up-to-date build tools are in place, and the latest good ATL headers are being used. BinScope also reports on dangerous constructs that are prohibited by SDL.
Drivers and partner applications
[MiniFuzz](http://go.microsoft.com/fwlink/p/?LinkId=190286)
MiniFuzz
The MiniFuzz File Fuzzer is a basic testing tool designed to help detect issues that may expose security vulnerabilities in file-handling code. This tool could be helpful for developers that parse files in their apps.
Drivers and partner applications
[Banned.h](http://go.microsoft.com/fwlink/p/?LinkId=190287)
Banned.h
The banned.h header file is a sanitizing resource that supports the SDL requirement to remove banned functions from code. It lists all banned APIs and allows any developer to locate them in code.
Drivers and partner applications
[ACPI system description tables](acpi-system-description-tables.md)
Implementation of the Advanced Configuration and Power Interface (ACPI) Hardware Specification is not required on SoC-based platforms, but much of the ACPI Software Specification is (or can be) required. ACPI defines a generic, extensible table-passing mechanism, plus specific tables for describing the platform to the operating system.
Implementation of the Advanced Configuration and Power Interface (ACPI) Hardware Specification is not required on SoC-based platforms or Windows Server systems that are BIOS-based, but much of the ACPI Software Specification is (or can be) required. ACPI defines a generic, extensible table-passing mechanism, plus specific tables for describing the platform to the operating system.
[Device management namespace objects](device-management-namespace-objects.md)
| Hardware certification | -Windows Certification Program Testing Agreement v1.0 -Windows Logo License Agreement for Hardware 2017 |
+Windows Hardware Compatibility Program Test Agreement (Required) +Windows Logo License Agreement for Hardware 2017* |
| Software certification | -Windows Certification Program Testing Agreement v1.0 -Windows Logo License Agreement For Software v1.9 |
+Windows Hardware Compatibility Program Test Agreement (Required) +Windows Logo License Agreement For Software v1.9* |
| File driver signing | -Windows Compatibility Program and Driver Quality Attestment Testing Agreement -Windows Certification Program Testing Agreement v1.0 |
+Windows Compatibility Program and Driver Quality Attestment Testing Agreement (Required) |
Private Product ID
The private product ID is the top level identifier that is generated with each new product creation. This ID is most useful for personal reference of specific products, and predicting their URLs.
- +The private product ID is the top level identifier that is generated with each new product creation. This ID is most useful for personal reference of specific products, and predicting their URLs. > [!NOTE] > when you share a driver with someone else, they will be assigned a new private product ID. If you want to communicate about a product, use the Shared Product ID. +
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
| Token | +Allows file names that contain semicolons | +Allows concatenation of additional commands separated by semicolons | +Condenses to single command block | +Allows script arguments | +
|---|---|---|---|---|
$< |
+Yes |
+No |
+No |
+No |
+
$>< |
+Yes |
+No |
+Yes |
+No |
+
$$< |
+No |
+Yes |
+No |
+No |
+
$$>< |
+No |
+Yes |
+Yes |
+No |
+
$$>a< |
+No |
+Yes |
+Yes |
+Yes |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+Multiple target debugging |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+Multiple target debugging |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Acpikd.dll |
+
Windows XP and later |
+Acpikd.dll |
+
| Filter value | +Memory regions displayed | +
|---|---|
VAR |
+Busy regions. These regions include all virtual allocation blocks, the SBH heap, memory from custom allocators, and all other regions of the address space that fall into no other classification. |
+
Free |
+Free memory. This includes all memory that has not been reserved. |
+
Image |
+Memory that is mapped to a file that is part of an executable image. |
+
Stack |
+Memory used for thread stacks. |
+
Teb |
+Memory used for thread environment blocks (TEBs). |
+
Peb |
+Memory used for the process environment block (PEB). |
+
Heap |
+Memory used for heaps. |
+
PageHeap |
+The memory region used for the full-page heap. |
+
CSR |
+CSR shared memory. |
+
Actx |
+Memory used for activation context data. |
+
NLS |
+Memory used for National Language Support (NLS) tables. |
+
FileMap |
+Memory used for memory-mapped files. This filter is applicable only during live debugging. |
+
| Filter value | +Memory regions displayed | +
|---|---|
MEM_IMAGE |
+Memory that is mapped to a file that is part of an executable image. |
+
MEM_MAPPED |
+Memory that is mapped to a file that is not part of an executable image. This includes memory that is mapped to the paging file. |
+
MEM_PRIVATE |
+Private memory. This memory is not shared by any other process, and it is not mapped to any file. |
+
| Filter value | +Memory regions displayed | +
|---|---|
MEM_COMMIT |
+Committed memory. |
+
MEM_FREE |
+Free memory. This includes all memory that has not been reserved. |
+
MEM_RESERVE |
+Reserved memory. |
+
| Filter value | +Memory regions displayed | +
|---|---|
PAGE_NOACCESS |
+Memory that cannot be accessed. |
+
PAGE_READONLY |
+Memory that is readable, but not writable and not executable. |
+
PAGE_READWRITE |
+Memory that is readable and writable, but not executable. |
+
PAGE_WRITECOPY |
+Memory that has copy-on-write behavior. |
+
PAGE_EXECUTE |
+Memory that is executable, but not readable and not writeable. |
+
PAGE_EXECUTE_READ |
+Memory that is executable and readable, but not writable. |
+
PAGE_EXECUTE_READWRITE |
+Memory that is executable, readable, and writable. |
+
PAGE_EXECUTE_WRITECOPY |
+Memory that is executable and has copy-on-write behavior. |
+
PAGE_GUARD |
+Memroy that acts as a guard page. |
+
PAGE_NOCACHE |
+Memory that is not cached. |
+
PAGE_WRITECOMBINE |
+Memory that has write-combine access enabled. |
+
| Option | +Output format | +
|---|---|
csv |
+Displays the output as comma-separated values. |
+
tsv |
+Displays the output as tab-separated values. |
+
1 |
+Displays the output in bare format. This format works well when !address is used as input to [.foreach](-foreach.md). |
+
| Placeholder | +Output field | +
|---|---|
%1 |
+Base address |
+
%2 |
+End address + 1 |
+
%3 |
+Region size |
+
%4 |
+Type |
+
%5 |
+State |
+
%6 |
+Protection |
+
%7 |
+Usage |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode and kernel mode |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Modes |
+user mode and kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| Flag | +Meaning | +
|---|---|
A |
+Asynchronous evaluation |
+
N |
+Nested evaluation |
+
Q |
+In the ready queue |
+
C |
+Needs a callback |
+
R |
+Running |
+
W |
+Ready |
+
T |
+Time-out |
+
D |
+Timer dispatch |
+
P |
+Timer pending |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode and kernel mode |
+
Targets |
+live target only |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
| Flag | +Meaning | +
|---|---|
S |
+Range is shared |
+
C |
+Range in conflict |
+
B |
+Range is boot-allocated |
+
D |
+Range is driver-exclusive |
+
A |
+Range alias |
+
P |
+Range positive decode |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
| Display when set | +Display when clear | +Meaning | +
|---|---|---|
V |
+- |
+Commit. |
+
G |
+- |
+Not accessed. |
+
E |
+- |
+Execute. |
+
W |
+R |
+Writeable or read-only. |
+
L |
+- |
+Locked. The ATE is locked, therefore, any faults on the page that contain the ATE will be retried until the current fault is satisfied. This can happen on multi-processor systems. |
+
Z |
+- |
+Fill zero. |
+
N |
+- |
+No access. |
+
C |
+- |
+Copy on Write. |
+
I |
+- |
+PTE indirect. This ATE indirectly references another physical page. The page that contains the ATE might have two conflicting ATE attributes. |
+
P |
++ | Reserved. |
+
Windows 2000 |
++Kdextx86.dll +Ntsdexts.dll | +
Windows XP and later |
+Exts.dll |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable (see Remarks section) |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Exts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
-a |
+Attaches a new user-mode debugger to the process specified by PID. The user-mode debugger runs on the target machine. |
+
-s |
+Adds a breakpoint that occurs in the WinLogon process immediately before the break in the user-mode process specified by PID. This allows the user to verify the request before attempting the action. |
+
-w |
+Stores the request in the memory in the target computer. The target system can then repeat the request, but this is not usually necessary. |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+kernel mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
| Flag | +Description | +
|---|---|
0x1 |
+Display segment information. |
+
0x2 |
+Display subsection information. |
+
0x4 |
+Display the list of mapped views. (Windows 7 and later) |
+
0x8 |
+Display compact (single line) output. |
+
0x10 |
+Display file-backed control areas. |
+
0x20 |
+Display control areas backed by the page file. |
+
0x40 |
+Display image control areas. |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+kernel mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+x86 and x64 only |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kext.dll |
+
Windows XP and later |
+Kext.dll |
+
Windows 2000 |
++Kext.dll +Kdextx86.dll | +
Windows XP and later |
+Kext.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+x86, x64, and Itanium only |
+
| Log option | +Information included in the log file | +
|---|---|
v |
+The virtual address of the mismatch |
+
r |
+The offset (relative address) of the mismatch within the module |
+
s |
+The symbol that corresponds to the address of the mismatch |
+
S |
+The name of the section that contains the mismatch |
+
e |
+The correct value that was expected at the mismatch location |
+
w |
+The incorrect value that was at the mismatch location |
+
| Log option | +Effect | +
|---|---|
o |
+If a file that has the name LogFile already exists, the existing file is overwritten. By default, the debugger appends new information to the end of any existing file. |
+
tString |
+Adds an extra column to the log file. Each entry in this column contains String. The tString option is useful if you are appending new information to an existing log file and you have to distinguish the new records from the old. You cannot add space between t and String. If you use the tIString option, it must be the final option in LogOptions, because String is taken to include all of the characters that are present before the next space. |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP |
+Unavailable |
+
Windows Vista and later |
+Dbghelp.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+kernel mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+kernel mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Windows 2000 |
+Ntsdexts.dll |
+
Windows XP and later |
+Ntsdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Exts.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
++Kext.dll +Kdextx86.dll | +
Windows XP and later |
+Kext.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| TypeCode | +Object | +
|---|---|
PCI |
+(Windows 2000 only) PCI device extension |
+
ISAPNP |
+ISA PnP device extension |
+
PCMCIA |
+PCMCIA device extension |
+
HID |
+HID device extension |
+
USBD |
+(Windows 2000 only) USB bus driver extension |
+
UHCD |
+(Windows 2000 only) UHCD host controller extension |
+
OpenHCI |
+(Windows 2000 only) Open HCI host controller extension |
+
USBHUB |
+(Windows 2000 only) USB hub extension |
+
MF |
+(Windows 2000 only) MF device extension |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
++Dbghelp.dll +Kdextx86.dll +Ntsdexts.dll | +
Windows XP and later |
+Dbghelp.dll |
+
Windows 2000 |
+Kext.dll |
+
Windows XP and later |
+Kext.dll |
+
Windows 2000 |
++Kdextx86.dll +Ntsdexts.dll | +
Windows XP and later |
+Exts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Ntsdexts.dll |
+
Windows XP and later |
+Ntsdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP |
+Unavailable |
+
Windows Server 2003 and later |
+Kdexts.dll |
+
Windows 2000 |
+Ntsdexts.dll |
+
Windows XP and later |
+Ntsdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable |
+
| Column | +Meaning | +
|---|---|
Base |
+The starting address of the device driver code, in hexadecimal. When the memory address used by the code that causes a stop falls between the base address for a driver and the base address for the next driver in the list, that driver is frequently the cause of the fault. For instance, the base for Ncrc810.sys is 0x80654000. Any address between that and 0x8065a000 belongs to this driver. |
+
Code Size |
+The size, in kilobytes, of the driver code, in both hexadecimal and decimal. |
+
Data Size |
+The amount of space, in kilobytes, allocated to the driver for data, in both hexadecimal and decimal. |
+
Locked |
+(Only when Flag 0x2 is used) The amount of memory locked by the driver. |
+
Resident |
+(Only when Flag 0x1 or 0x2 is used) The amount of the driver's memory that actually resides in physical memory. |
+
Standby |
+(Only when Flag 0x1 or 0x2 is used) The amount of the driver's memory that is on standby. |
+
Loader Entry |
+(Only when Flag 0x2 is used) The loader entry address. |
+
Driver Name |
+The driver file name. |
+
Creation Time |
+The link date of the driver. Do not confuse this with the file date of the driver, which can be set by external tools. The link date is set by the compiler when a driver or executable file is compiled. It should be close to the file date, but it is not always the same. |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Ntsdexts.dll |
+
Windows XP and later |
+Ntsdexts.dll |
+
| FullOption | +Effect | +
y |
+Adds AVX register information to the dump file. | +
| MiniOption | +Effect | +
|---|---|
a |
+Creates a minidump with all optional additions. The /ma option is equivalent to /mfFhut -- it adds full memory data, handle data, unloaded module information, basic memory information, and thread time information to the minidump. Any failure to read inaccessable memory results in termination of the minidump generation. |
+
A |
+The /mA option is equivalent to /ma except that it ignores any failure to read inaccessable memory and continues generating the minidump. |
+
f |
+Adds full memory data to the minidump. All accessible committed pages owned by the target application will be included. |
+
F |
+Adds all basic memory information to the minidump. This adds a stream to the minidump that contains all basic memory information, not just information about valid memory. This allows the debugger to reconstruct the complete virtual memory layout of the process when the minidump is being debugged. |
+
h |
+Adds data about the handles associated with the target application to the minidump. |
+
u |
+Adds unloaded module information to the minidump. This is available only in Windows Server 2003 and later versions of Windows. |
+
t |
+Adds additional thread information to the minidump. This includes thread times, which can be displayed by using the [!runaway](-runaway.md) extension or the [.ttime (Display Thread Times)](-ttime--display-thread-times-.md) command when debugging the minidump. |
+
i |
+Adds secondary memory to the minidump. Secondary memory is any memory referenced by a pointer on the stack or backing store, plus a small region surrounding this address. |
+
p |
+Adds process environment block (PEB) and thread environment block (TEB) data to the minidump. This can be useful if you need access to Windows system information regarding the application's processes and threads. |
+
w |
+Adds all committed read-write private pages to the minidump. |
+
d |
+Adds all read-write data segments within the executable image to the minidump. |
+
c |
+Adds code sections within images. |
+
r |
+Deletes from the minidump those portions of the stack and store memory that are not useful for recreating the stack trace. Local variables and other data type values are deleted as well. This option does not make the minidump smaller (because these memory sections are simply zeroed), but it is useful if you want to protect the privacy of other applications. |
+
R |
+Deletes the full module paths from the minidump. Only the module names will be included. This is a useful option if you want to protect the privacy of the user's directory structure. |
+
y |
+Adds AVX register information to the dump file. |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Modes |
+User mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
++Kext.dll +Kdextx86.dll | +
Windows XP and later |
+Kext.dll |
+
Windows 2000 |
+Kext.dll |
+
Windows XP and later |
+Kext.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+Kernel mode only |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode only |
+
Targets |
+Crash dump only (minidumps only) |
+
Platforms |
+All |
+
Machine type |
+Description |
+
. |
+Use the processor mode of the target computer's native processor mode. |
+
# |
+Use the processor mode of the code that is executing for the most recent event. |
+
x86 |
+Use an x86-based processor mode. |
+
amd64 |
+Use an x64-based processor mode. |
+
ebc |
+Use an EFI byte code processor mode. |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+Kernel mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Exts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP |
+Unavailable |
+
Windows Server 2003 |
+Unavailable |
+
Windows Vista and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP |
+Unavailable |
+
Windows Server 2003 |
+Unavailable |
+
Windows Vista and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Uext.dll |
+
Windows XP and later |
+Uext.dll |
+
Windows 2000 |
++Kext.dll +Kdextx86.dll | +
Windows XP and later |
+Kext.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+User mode only |
+
Targets |
+Crash dump only (minidumps only) |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Uext.dll |
+
Windows XP and later |
+Uext.dll |
+
Windows 10 and later |
+Kdexts.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Crash dump only (minidump only) |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
| Alias | +Data type | +Value | +
|---|---|---|
@#SymbolName |
+string |
+The symbol name. |
+
@#SymbolAddress |
+ULONG64 |
+The symbol address. |
+
@#ModName |
+string |
+The module name. |
+
@#FunctionName |
+string |
+The function name. |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
| Alias | +Data type | +Value | +
|---|---|---|
@#FileVersion |
+string |
+The file version of the module. |
+
@#ProductVersion |
+string |
+The product version of the module. |
+
@#ModuleIndex |
+ULONG |
+The module number. Modules are enumerated consecutively, starting with zero. |
+
@#ModuleName |
+string |
+The module name. This name is typically the file name without the file name extension. In some situations, the module name differs significantly from the file name. |
+
@#ImageName |
+string |
+The name of the executable file, including the file name extension. Typically, the full path is included in user mode but not in kernel mode. |
+
@#LoadedImageName |
+string |
+Unless Microsoft CodeView symbols are present, this alias is the same as the image name. |
+
@#MappedImageName |
+string |
+In most situations, this alias is NULL. If the debugger is mapping an image file (for example, during minidump debugging), this alias is the name of the mapped image. |
+
@#SymbolFileName |
+string |
+The path and name of the symbol file. If you have not loaded any symbols, this alias is the name of the executable file instead. |
+
@#ModuleNameSize |
+ULONG |
+The string length of the module name string, plus one. |
+
@#ImageNameSize |
+ULONG |
+The string length of the image name string, plus one. |
+
@#LoadedImageNameSize |
+ULONG |
+The string length of the loaded image name string, plus one. |
+
@#MappedImageNameSize |
+ULONG |
+The string length of the mapped image name string, plus one. |
+
@#SymbolFileNameSize |
+ULONG |
+The string length of the symbol file name string, plus one. |
+
@#Base |
+ULONG64 |
+The address of the start of the image. |
+
@#Size |
+ULONG |
+The size of the image, in bytes. |
+
@#End |
+ULONG64 |
+The address of the end of the image. |
+
@#TimeDateStamp |
+ULONG |
+The time and date stamp of the image. If you want to expand this time and date stamp into a readable date, use the [.formats (Show Number Formats)](-formats--show-number-formats-.md) command. |
+
| + | + | + |
@#Checksum |
+ULONG |
+The checksum of the module. |
+
@#Flags |
+ULONG |
+The module flags. For a list of the DEBUG_MODULE_Xxx values, see Dbgeng.h. |
+
@#SymbolType |
+USHORT |
+The symbol type. For a list of the DEBUG_SYMTYPE_Xxx values, see Dbgeng.h. |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
| Flag | +Effect | +
|---|---|
b |
+Sets fUseBP equal to TRUE. |
+
e |
+Sets fUseSEH equal to TRUE. |
+
n |
+Sets cbFrame equal to FRAME_NONFPO. (By default, cbFrame is set to FRAME_FPO.) |
+
l Term |
+Sets cdwLocals equal to Term. Term should specify the local DWORD count that you want. |
+
p Term |
+Sets cdwParams equal to Term. Term should specify the parameter DWORD count that you want. |
+
r Term |
+Sets cbRegs equal to Term. Term should specify the register count that you want. |
+
s Term |
+Sets cbProcSize equal to Term. Term should specify the procedure size that you want. |
+
t Term |
+Sets cbFrame equal to Term. Term should specify one of the following frame types: +
|
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 10 and later |
+Kdexts.dll |
+
Windows 2000 |
+Ntsdexts.dll |
+
Windows XP and later |
+Ntsdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Gdikdx.dll |
+
Windows XP and later |
+Unavailable |
+
Windows 2000 |
++Kdextx86.dll +Ntsdexts.dll | +
Windows XP and later |
+Exts.dll |
+
| Value | +Name | +Description | +
|---|---|---|
0x00000001 |
+"soe" |
+Stop on exception. |
+
0x00000002 |
+"sls" |
+Show loader snaps. |
+
0x00000004 |
+"dic" |
+Debug initial command. |
+
0x00000008 |
+"shg" |
+Stop if the GUI stops responding (that is, hangs). |
+
0x00000010 |
+"htc" |
+Enable heap tail checking. |
+
0x00000020 |
+"hfc" |
+Enable heap free checking. |
+
0x00000040 |
+"hpc" |
+Enable heap parameter checking. |
+
0x00000080 |
+"hvc" |
+Enable heap validation on call. |
+
0x00000100 |
+"ptc" |
+Enable pool tail checking. |
+
0x00000200 |
+"pfc" |
+Enable pool free checking. |
+
0x00000400 |
+"ptg" |
+Enable pool tagging. |
+
0x00000800 |
+"htg" |
+Enable heap tagging. |
+
0x00001000 |
+"ust" |
+Create a user-mode stack trace DB. |
+
0x00002000 |
+"kst" |
+Create a kernel-mode stack trace DB. |
+
0x00004000 |
+"otl" |
+Maintain a list of objects for each type. |
+
0x00008000 |
+"htd" |
+Enable heap tagging by DLL. |
+
0x00010000 |
+"idp" |
+Unused. |
+
0x00020000 |
+"d32" |
+Enable debugging of the Microsoft Win32 subsystem. |
+
0x00040000 |
+"ksl" |
+Enable loading of kernel debugger symbols. |
+
0x00080000 |
+"dps" |
+Disable paging of kernel stacks. |
+
0x00100000 |
+"scb" |
+Enable critical system breaks. |
+
0x00200000 |
+"dhc" |
+Disable heap coalesce on free. |
+
0x00400000 |
+"ece" |
+Enable close exception. |
+
0x00800000 |
+"eel" |
+Enable exception logging. |
+
0x01000000 |
+"eot" |
+Enable object handle type tagging. |
+
0x02000000 |
+"hpa" |
+Put heap allocations at the end of pages. |
+
0x04000000 |
+"dwl" |
+Debug WINLOGON. |
+
0x08000000 |
+"ddp" |
+Disable kernel-mode DbgPrint and KdPrint output. |
+
0x10000000 |
+NULL |
+Unused. |
+
0x20000000 |
+"sue" |
+Stop on unhandled user-mode exception |
+
0x40000000 |
+NULL |
+Unused. |
+
0x80000000 |
+"dpd" |
+Disable protected DLL verification. |
+
Windows 2000 |
++Ext.dll +Ntsdexts.dll | +
Windows XP and later |
+Ext.dll |
+
| Flag | +Description | +
|---|---|
0x1 |
+Displays the pin table. |
+
0x2 |
+Displays the Enable and Mask registers. |
+
0x4 |
+If bit 0 (0x1) is set and this flag (0x4) is set, the display includes unconfigured pins. |
+
| Flag | +Description | +
|---|---|
0x1 |
+For each controller, displays detailed information including all of its banks. |
+
0x2 |
+If bit 0 (0x1) is set and this flag (0x2) is set, displays the Enable and Mask registers for each bank. |
+
0x4 |
+If bit 0 (0x1) is set and this flag (0x4) is set, the display includes unconfigured pins. |
+
| Flag | +Description | +
|---|---|
0x1 |
+Displays the pin table for each bank. |
+
0x2 |
+If bit 0 (0x1) is set and this flag (0x2) is set, the display includes the Enable and Mask registers for each bank. |
+
0x4 |
+If bit 0 (0x1) is set and this flag (0x4) is set, the display includes unconfigured pins. |
+
| Flag | +Description | +
|---|---|
0x1 |
+Not used by this command. |
+
0x2 |
+Not used by this command. |
+
0x4 |
+The display includes unconfigured pins. |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
++Kdextx86.dll +Uext.dll +Ntsdexts.dll | +
Windows XP and later |
++Kdexts.dll +Uext.dll +Ntsdexts.dll | +
| Option | +Effect | +
|---|---|
-v |
+Verifies all data blocks. |
+
-b BucketSize |
+Specifies the bucket size. The default is 1024 bits. |
+
-d DumpBlockSize |
+Specifies the bucket size. |
+
-a |
+Dumps all heap blocks. |
+
-c |
+Specifies that the contents of each block should be displayed. |
+
| Option | +Effect | +
|---|---|
-v |
+Causes the debugger to validate the specified heap. +
+Note This option does not detect low fragmentation heap (LFH) corruption. Use -triage instead.
+
+
+
+ |
+
-a |
+Causes the display to include all information for the specified heap. Size, in this case, is rounded up to the heap granularity. (Running !heap with the -a option is equivalent to running it with the three options -h -f -m, which can take a long time.) |
+
-h |
+Causes the display to include all non-LFH entries for the specified heap. |
+
-hl |
+Causes the display to include all the entries for the specified heap(s), including LFH entries. |
+
-f |
+Causes the display to include all the free list entries for the specified heap. |
+
-m |
+Causes the display to include all the segment entries for the specified heap. |
+
-t |
+Causes the display to include the tag information for the specified heap. |
+
-T |
+Causes the display to include the pseudo-tag entries for the specified heap. |
+
-g |
+Causes the display to include the global tag information. Global tags are associated with each untagged allocation. |
+
-s |
+Causes the display to include summary information for the specified heap. |
+
-k |
+(x86-based targets only) Causes the display to include the stack backtrace associated with each entry. |
+
| Option | +Effect | +
|---|---|
-D |
+Disables validate-on-call for the specified heap. |
+
-E |
+Enables validate-on-call for the specified heap. |
+
-d |
+Disables heap checking for the specified heap. |
+
-e |
+Enables heap checking for the specified heap. |
+
| Option | +Effect | +
|---|---|
-h Handle |
+Causes the debugger to display detailed information about a page heap with handle Handle. |
+
-a Address |
+Causes the debugger to find the page heap whose block contains Address. Full details of how this address relates to full-page heap blocks will be included, such as whether this address is part of a page heap, its offset inside the block, and whether the block is allocated or was freed. Stack traces are included whenever available. When using this option, size is displayed in multiples of the heap allocation granularity. |
+
-t[c|s] [Traces] |
+Causes the debugger to display the collected traces of the heavy heap users. Traces specifies the number of traces to display; the default is four. If there are more traces than the specified number, the earliest traces are displayed. If -t or -tc is used, the traces are sorted by count usage. If -ts is used, the traces are sorted by size. (The -tc and -ts options are supported in Windows XP only; the -t option is supported only in Windows XP and earlier versions of Windows.) |
+
-fi [Traces] |
+Causes the debugger to display the most recent fault injection traces. Traces specifies the quantity to be displayed; the default is 4. |
+
-all |
+Causes the debugger to display detailed information about all page heaps. |
+
-? |
+Causes the debugger to display page heap help, including a diagram of heap blocks. (These diagrams can also be seen in the following Remarks section.) |
+
| Option | +Effect | +
|---|---|
-b |
+The pattern is one BYTE in size. |
+
-w |
+The pattern is one WORD in size. |
+
-d |
+The pattern is one DWORD in size. |
+
-q |
+The pattern is one QWORD in size. |
+
| Option | +Effect | +
|---|---|
s Size |
+Limits the display to include only heaps of the specified size. |
+
r SizeMin SizeMax |
+Limits the display to include only heaps within the specified size range. |
+
| Option | +Effect | +
|---|---|
A |
+Displays the usage statistics according to allocation size. |
+
B |
+Displays the usage statistics according to block count. |
+
S |
+Displays the usage statistics according to the total size of each allocation. |
+
Windows XP and later |
++Ext.dll +Exts.dll | +
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Dbghelp.dll |
+
Windows XP and later |
+Dbghelp.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
++Kdexts.dll +Ntsdexts.dll | +
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+Kernel mode only |
+
Targets |
+Dump file debugging only |
+
Platforms |
+All |
+
Windows 2000 |
+Ntsdexts.dll |
+
Windows XP and later |
+Unavailable |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows XP and later |
+Kdexts.dll |
+
| Major Function Code | +Hexadecimal Code | +
|---|---|
IRP_MJ_CREATE |
+0x00 |
+
IRP_MJ_CREATE_NAMED_PIPE |
+0x01 |
+
IRP_MJ_CLOSE |
+0x02 |
+
IRP_MJ_READ |
+0x03 |
+
IRP_MJ_WRITE |
+0x04 |
+
IRP_MJ_QUERY_INFORMATION |
+0x05 |
+
IRP_MJ_SET_INFORMATION |
+0x06 |
+
IRP_MJ_QUERY_EA |
+0x07 |
+
IRP_MJ_SET_EA |
+0x08 |
+
IRP_MJ_FLUSH_BUFFERS |
+0x09 |
+
IRP_MJ_QUERY_VOLUME_INFORMATION |
+0x0A |
+
IRP_MJ_SET_VOLUME_INFORMATION |
+0x0B |
+
IRP_MJ_DIRECTORY_CONTROL |
+0x0C |
+
IRP_MJ_FILE_SYSTEM_CONTROL |
+0x0D |
+
IRP_MJ_DEVICE_CONTROL |
+0x0E |
+
| +IRP_MJ_INTERNAL_DEVICE_CONTROL +IRP_MJ_SCSI | +0x0F |
+
IRP_MJ_SHUTDOWN |
+0x10 |
+
IRP_MJ_LOCK_CONTROL |
+0x11 |
+
IRP_MJ_CLEANUP |
+0x12 |
+
IRP_MJ_CREATE_MAILSLOT |
+0x13 |
+
IRP_MJ_QUERY_SECURITY |
+0x14 |
+
IRP_MJ_SET_SECURITY |
+0x15 |
+
IRP_MJ_POWER |
+0x16 |
+
IRP_MJ_SYSTEM_CONTROL |
+0x17 |
+
IRP_MJ_DEVICE_CHANGE |
+0x18 |
+
IRP_MJ_QUERY_QUOTA |
+0x19 |
+
IRP_MJ_SET_QUOTA |
+0x1A |
+
| +IRP_MJ_PNP +IRP_MJ_MAXIMUM_FUNCTION | +0x1B |
+
| Minor Function Code | +Hexadecimal Code | +
|---|---|
IRP_MN_START_DEVICE |
+0x00 |
+
IRP_MN_QUERY_REMOVE_DEVICE |
+0x01 |
+
IRP_MN_REMOVE_DEVICE |
+0x02 |
+
IRP_MN_CANCEL_REMOVE_DEVICE |
+0x03 |
+
IRP_MN_STOP_DEVICE |
+0x04 |
+
IRP_MN_QUERY_STOP_DEVICE |
+0x05 |
+
IRP_MN_CANCEL_STOP_DEVICE |
+0x06 |
+
IRP_MN_QUERY_DEVICE_RELATIONS |
+0x07 |
+
IRP_MN_QUERY_INTERFACE |
+0x08 |
+
IRP_MN_QUERY_CAPABILITIES |
+0x09 |
+
IRP_MN_QUERY_RESOURCES |
+0x0A |
+
IRP_MN_QUERY_RESOURCE_REQUIREMENTS |
+0x0B |
+
IRP_MN_QUERY_DEVICE_TEXT |
+0x0C |
+
IRP_MN_FILTER_RESOURCE_REQUIREMENTS |
+0x0D |
+
IRP_MN_READ_CONFIG |
+0x0F |
+
IRP_MN_WRITE_CONFIG |
+0x10 |
+
IRP_MN_EJECT |
+0x11 |
+
IRP_MN_SET_LOCK |
+0x12 |
+
IRP_MN_QUERY_ID |
+0x13 |
+
IRP_MN_QUERY_PNP_DEVICE_STATE |
+0x14 |
+
IRP_MN_QUERY_BUS_INFORMATION |
+0x15 |
+
IRP_MN_DEVICE_USAGE_NOTIFICATION |
+0x16 |
+
IRP_MN_SURPRISE_REMOVAL |
+0x17 |
+
IRP_MN_QUERY_LEGACY_BUS_INFORMATION |
+0x18 |
+
| Minor Function Code | +Hexadecimal Code | +
|---|---|
IRP_MN_QUERY_ALL_DATA |
+0x00 |
+
IRP_MN_QUERY_SINGLE_INSTANCE |
+0x01 |
+
IRP_MN_CHANGE_SINGLE_INSTANCE |
+0x02 |
+
IRP_MN_CHANGE_SINGLE_ITEM |
+0x03 |
+
IRP_MN_ENABLE_EVENTS |
+0x04 |
+
IRP_MN_DISABLE_EVENTS |
+0x05 |
+
IRP_MN_ENABLE_COLLECTION |
+0x06 |
+
IRP_MN_DISABLE_COLLECTION |
+0x07 |
+
IRP_MN_REGINFO |
+0x08 |
+
IRP_MN_EXECUTE_METHOD |
+0x09 |
+
| Minor Function Code | +Hexadecimal Code | +
|---|---|
IRP_MN_WAIT_WAKE |
+0x00 |
+
IRP_MN_POWER_SEQUENCE |
+0x01 |
+
IRP_MN_SET_POWER |
+0x02 |
+
IRP_MN_QUERY_POWER |
+0x03 |
+
| Minor Function Code | +Hexadecimal Code | +
|---|---|
IRP_MN_SCSI_CLASS |
+0x01 |
+
| Criteria | +Match | +
|---|---|
arg |
+Finds all IRPs with a stack location where one of the arguments equals Data. |
+
device |
+Finds all IRPs with a stack location where DeviceObject equals Data. |
+
fileobject |
+Finds all IRPs whose Irp.Tail.Overlay.OriginalFileObject equals Data. |
+
mdlprocess |
+Finds all IRPs whose Irp.MdlAddress.Process equals Data. |
+
thread |
+Finds all IRPs whose Irp.Tail.Overlay.Thread equals Data. |
+
userevent |
+Finds all IRPs whose Irp.UserEvent equals Data. |
+
Windows 2000 |
+Unavailable |
+
Windows XP |
+Unavailable |
+
Windows Server 2003 and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+Kernel mode only |
+
Targets |
+Live debugging only |
+
Platforms |
+x86-based and Itanium-based processors only |
+
Version |
+Supported in Windows XP and later versions of the Windows operating system. |
+
Modes |
+kernel mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Version |
+Versions:(Kernel mode) Supported in Windows Server 2003 and later. |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Parameter |
+Meaning |
+
DeviceState |
+The state that the pin was requested to enter. If different from ClientState, this is the state that the minidriver will transition to next. |
+
ClientState |
+The state that the minidriver is actually in. This reflects the state of the pipe. |
+
ResetState |
+Indicates whether or not the object is in the middle of a flush. +KSRESET_BEGIN indicates a flush. +KSRESET_END indicates no flush. |
+
State |
+The internal state of the pin's transport to non-AVStream filters. |
+
Size |
+Explanation |
+
d |
+Device |
+
r |
+Request |
+
s |
+Stream |
+
f |
+Filter. If the filter size is 0, the filter is single instance. If it is greater than 0, it is multi-instance. |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
+winxp\Ks.dll |
+
Windows XP and later |
+Ks.dll |
+
Windows 2000 |
++Kdextx86.dll +Ntsdexts.dll | +
Windows XP and later |
+Exts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Dbghelp.dll |
+
Windows XP and later |
+Dbghelp.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdexts.dll |
+
Windows XP +Windows Server 2003 |
+Kdexts.dll |
+
Windows Vista and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Ntsdexts.dll |
+
Windows XP and later |
+Ntsdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Logexts.dll |
+
Windows XP and later |
+Logexts.dll |
+
Windows 2000 |
+Logexts.dll |
+
Windows XP and later |
+Logexts.dll |
+
Windows 2000 |
+Logexts.dll |
+
Windows XP and later |
+Logexts.dll |
+
Windows 2000 |
+Logexts.dll |
+
Windows XP and later |
+Logexts.dll |
+
Windows 2000 |
+Logexts.dll |
+
Windows XP and later |
+Logexts.dll |
+
Windows 2000 |
+Logexts.dll |
+
Windows XP and later |
+Logexts.dll |
+
Windows 2000 |
+Logexts.dll |
+
Windows XP and later |
+Logexts.dll |
+
Windows 2000 |
+Logexts.dll |
+
Windows XP and later |
+Logexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
DLL |
+Kdexts.dll | +
Windows 2000 |
+Kdextx86.dll |
+
Windows XP +Windows Server 2003 |
+Kdexts.dll |
+
Modes |
+User mode only |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Windows 2000 |
+Uext.dll |
+
Windows XP and later |
+Uext.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdexts.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Minipkd.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Minipkd.dll |
+
| Flag | +Meaning | +
|---|---|
c |
+Claimed. Indicates that the device has a driver on it. |
+
m |
+Missing. Indicates that the device was present on the bus in a prior scan but was not present during the latest scan. |
+
e |
+Enumerated. Indicates that the device has been reported to the Plug and Play manager. |
+
v |
+Visible. Indicates that the device has been enumerated by the system. This flag is more significant when it is not present for a device. |
+
p |
+Paging. Indicates that the device is in the paging path. |
+
d |
+Dump. Indicates that the device is in the crash dump path and will be used for a crash dump. |
+
h |
+Hibernate. Indicates that the device is hibernating. |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Minipkd.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Minipkd.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Minipkd.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Minipkd.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Minipkd.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Minipkd.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows XP |
+Unavailable |
+
Windows Vista and later |
+Exts.dll |
+
Modes |
+User mode only |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Value |
+Meaning |
+
INIT |
+Traces adapter initialization. |
+
CONFIG |
+Traces adapter configuration. |
+
SEND |
+Traces sending data over the network. |
+
RECV |
+Traces receiving data from the network. |
+
PROTOCOL |
+Traces protocol operations. |
+
BIND |
+Traces binding operations. |
+
BUS_QUERY |
+Traces bus queries. |
+
REGISTRY |
+Traces registry operations. |
+
MEMORY |
+Traces memory management. |
+
FILTER |
+Traces filter operations. |
+
REQUEST |
+Traces requests. |
+
WORK_ITEM |
+Traces work-item operations. |
+
PNP |
+Traces Plug and Play operations. |
+
PM |
+Traces Power Management operations. |
+
OPEN |
+Traces operations that open reference objects. |
+
LOCKS |
+Traces locking operations. |
+
RESET |
+Traces resetting operations. |
+
WMI |
+Traces Windows Management Instrumentation operations. |
+
NDIS_CO |
+Traces Connection-Oriented NDIS. |
+
REFERENCE |
+Traces reference operations. |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
++Ext.dll +Kdextx86.dll | +
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
| Parameter | +Meaning | +
|---|---|
Sequence |
+Represents the order of operations. |
+
+/- |
+Indicates a reference or a dereference operation. ++1 indicates a reference operation. +-1 indicates a dereference operation. ++/- n indicates multiple reference/dereference operations. |
+
Modes |
+User mode only |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Crash dump only (but you can use this command if other sessions are running) |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
| Value | +Default setting | +Description | +
|---|---|---|
1 |
+On |
+Normal output |
+
2 |
+On |
+Error output |
+
4 |
+On |
+Warnings |
+
8 |
+Off |
+Additional output |
+
0x10 |
+On |
+Prompt output |
+
0x20 |
+On |
+Register dump before prompt |
+
0x40 |
+On |
+Warnings that are specific to extension operation |
+
0x80 |
+On |
+Debug output from the target (for example, OutputDebugString or DbgPrint) |
+
0x100 |
+On |
+Debug input expected by the target (for example, DbgPrompt) |
+
0x200 |
+On |
+Symbol messages (for example, !sym noisy) |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+Kernel mode only (but not during local kernel debugging) |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Version |
+Supported in Windows XP and later versions of Windows. |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
++Kext.dll +Kdextx86.dll | +
Windows XP and later |
+Kext.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP +Windows Server 2003 |
+Kdexts.dll |
+
Windows Vista and later |
+Unavailable |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable (see Remarks section) |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
++Kdextx86.dll +Ntsdexts.dll | +
Windows XP and later |
+Exts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 10 and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
| Option | +Type of message | +Title of colors in Options dialog box | +
|---|---|---|
/od |
+debuggee |
+Debuggee level command window |
+
/oD |
+debuggee prompt |
+Debuggee prompt level command window |
+
/oe |
+error |
+Error level command window |
+
/on |
+normal |
+Normal level command window |
+
/op |
+prompt |
+Prompt level command window |
+
/oP |
+prompt registers |
+Prompt registers level command window |
+
/os |
+symbols |
+Symbol message level command window |
+
/ov |
+verbose |
+Verbose level command window |
+
/ow |
+warning |
+Warning level command window |
+
| Character | +Argument type | +Argument | +Text printed | +
|---|---|---|---|
%p |
+ULONG64 |
+A pointer in the target's virtual address space. |
+The value of the pointer. |
+
%N |
+DWORD_PTR (32 or 64 bits, depending on the host's architecture) |
+A pointer in the host's virtual address space. |
+The value of the pointer. (This is equivalent to the standard C %p character.) |
+
%ma |
+ULONG64 |
+The address of a NULL-terminated ASCII string in the target's virtual address space. |
+The specified string. |
+
%mu |
+ULONG64 |
+The address of a NULL-terminated Unicode string in the target's virtual address space. |
+The specified string. |
+
%msa |
+ULONG64 |
+The address of an ANSI_STRING structure in the target's virtual address space. |
+The specified string. |
+
%msu |
+ULONG64 |
+The address of a UNICODE_STRING structure in the target's virtual address space. |
+The specified string. |
+
%y |
+ULONG64 |
+The address of a debugger symbol in the target's virtual address space. |
+A string containing the name of the specified symbol (and displacement, if any). |
+
%ly |
+ULONG64 |
+The address of a debugger symbol in the target's virtual address space. |
+A string containing the name of the specified symbol (and displacement, if any), as well as any available source line information. |
+
Modes |
+Kernel mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
| Element | +Meaning | +
|---|---|
Process address |
+The eight-character hexadecimal number after the word PROCESS is the address of the EPROCESS block. In the final entry in the preceding example, the process address is 0x809258E0. |
+
Process ID (PID) |
+The hexadecimal number after the word Cid. In the final entry in the preceding example, the PID is 0x44, or decimal 68. |
+
Process Environment Block (PEB) |
+The hexadecimal number after the word Peb is the address of the process environment block. In the final entry in the preceding example, the PEB is located at address 0x7FFDE000. |
+
Parent process PID |
+The hexadecimal number after the word ParentCid is the PID of the parent process. In the final entry in the preceding example, the parent process PID is 0x26, or decimal 38. |
+
Image |
+The name of the module that owns the process. In the final entry in the preceding example, the owner is spoolss.exe. In the first entry, the owner is the operating system itself. |
+
Process object address |
+The hexadecimal number after the word ObjectTable. In the final entry in the preceding example, the address of the process object is 0x80925c68. |
+
| Element | +Meaning | +
|---|---|
| WAIT | +The parenthetical comment after this heading gives the reason for the wait. The command [dt nt!_KWAIT_REASON](dt--display-type-.md) will display a list of all wait reasons. | +
ElapsedTime |
+Lists the amount of time that has elapsed since the process was created. This is displayed in units of Hours:Minutes:Seconds.Milliseconds. |
+
UserTime |
+Lists the amount of time the process has been running in user mode. If the value for UserTime is exceptionally high, it might identify a process that is depleting system resources. Units are the same as those of ElapsedTime. |
+
KernelTime |
+Lists the amount of time the process has been running in kernel mode. If the value for KernelTime is exceptionally high, it might identify a process that is depleting system resources. Units are the same as those of ElapsedTime. |
+
Working Set sizes |
+Lists the current, minimum and maximum working set size for the process, in pages. An exceptionally large working set size can be a sign of a process that is leaking memory or depleting system resources. |
+
QuotaPoolUsage entries |
+Lists the paged and nonpaged pool used by the process. On a system with a memory leak, looking for excessive nonpaged pool usage on all the processes can tell you which process has the memory leak. |
+
Clone |
+Indicates whether or not the process was created by the POSIX or Interix subsystems. |
+
Private |
+Indicates the number of private (non-sharable) pages currently being used by the process. This includes both paged in and paged out memory. |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable (see the Remarks section) |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
| Bit | +Display when set | +Display when clear | +Meaning | +
|---|---|---|---|
0x200 |
+C |
+- |
+Copy on write. |
+
0x100 |
+G |
+- |
+Global. |
+
0x80 |
+L |
+- |
+Large page. This only occurs in PDEs, never in PTEs. |
+
0x40 |
+D |
+- |
+Dirty. |
+
0x20 |
+A |
+- |
+Accessed. |
+
0x10 |
+N |
+- |
+Cache disabled. |
+
0x8 |
+T |
+- |
+Write-through. |
+
0x4 |
+U |
+K |
+Owner (user mode or kernel mode). |
+
0x2 |
+W |
+R |
+Writeable or read-only. Only on multiprocessor computers and any computer running Windows Vista or later. |
+
0x1 |
+V |
++ | Valid. |
+
| + | E |
+- |
+Executable page. For platforms that do not support a hardware execute/noexecute bit, including many x86 systems, the E is always displayed. |
+
| Display when set | +Display when clear | +Meaning | +
|---|---|---|
V |
++ | Valid. |
+
U |
+K |
+Owner (user mode or kernel mode). |
+
D |
+- |
+Dirty. |
+
A |
+- |
+Accessed. |
+
W |
+R |
+Writeable or read-only. Only on multiprocessor computers and any computer running Windows Vista or later. |
+
E |
+- |
+Execute. |
+
C |
+- |
+Copy on write. |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+Kernel mode only |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+x64-based only |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+Kernel mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode only |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Rpcexts.dll |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Rpcexts.dll |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Rpcexts.dll |
+
Windows XP and later |
+Rpcexts.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Windows 2000 |
++Uext.dll +Ntsdexts.dll | +
Windows XP and later |
++Uext.dll +Ntsdexts.dll | +
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+Kernel mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| + | [.scriptload](-scriptload--load-script-.md) | +.scriptrun | +
| root | +yes | +yes | +
| initializeScript | +yes | +yes | +
| invokeScript | ++ | yes | +
| uninitializeScript | ++ | + |
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Scsikd.dll |
+
Windows XP and later |
+Scsikd.dll |
+
Windows 2000 |
+Scsikd.dll |
+
Windows XP and later |
+Scsikd.dll |
+
Windows 2000 |
+Scsikd.dll |
+
Windows XP and later |
+Scsikd.dll |
+
Windows 2000 |
+Scsikd.dll |
+
Windows XP and later |
+Scsikd.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+kernel mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+controlling the user-mode debugger from the kernel debugger |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Exts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Targets |
+all |
+
-1 |
+Use current session. This is the default. |
+
-2 |
+Use [session context](changing-contexts.md#session-context). |
+
-4 |
+Display all processes by session. |
+
0x0 |
+Display minimal information. |
+
Bit 0 (0x1) |
+Display time and priority statistics. |
+
Bit 1 (0x2) |
+Adds to the display a list of threads and events associated with the process and the wait states of the threads. |
+
Bit 2 (0x4) |
+Adds to the display a list of threads associated with the process. If this bit is used without Bit 1 (0x2), each thread is displayed on a single line. If this is included with Bit 1, each thread is displayed with a stack trace. |
+
Bit 3 (0x8) |
+Adds to the display of each function the return address, the stack pointer and, on Itanium-based systems, the bsp register value. It suppresses the display of function arguments. |
+
Bit 4 (0x10) |
+Display only the return address of each function. Suppress the arguments and stack pointers. |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
0 |
+Displays a summary of the current kernel stacks. This is the default value. |
+
1 |
+Displays stacks that are currently paged out, as well as the current kernel stacks. |
+
2 |
+Displays the full parameters for all stacks, as well as stacks that are currently paged out and the current kernel stacks. |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Exts.dll |
+
Windows 8 and later |
+Storagekd.dll |
+
Windows 8 and later |
+Storagekd.dll |
+
Windows 8 and later |
+Storagekd.dll |
+
Windows 8 and later |
+Storagekd.dll |
+
Windows 8 and later |
+Storagekd.dll |
+
Windows 8 and later |
+Storagekd.dll |
+
Windows 8 and later |
+Storagekd.dll |
+
Windows 8 and later |
+Storagekd.dll |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
Modes |
+kernel mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Dbghelp.dll |
+
Windows XP and later |
+Dbghelp.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Dbghelp.dll |
+
Windows XP and later |
+Dbghelp.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP base system +Windows 2003 base system |
+Unavailable |
+
Windows XP, Service Pack 2 and later +Windows 2003, Service Pack 1 and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+kernel mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| Parameter | +Meaning | +
|---|---|
Thread address |
+The hexadecimal number after the word THREAD is the address of the ETHREAD block. In the preceding example, the thread address is 0xffffcb088f0a4480 . |
+
Thread ID |
+The two hexadecimal numbers after the word Cid are the process ID and the thread ID: process ID.thread ID. In the preceding example, the process ID is 0x0e34, and the thread ID is 0x3814. |
+
Thread Environment Block (TEB) |
+The hexadecimal number after the word Teb is the address of the thread environment block (TEB). |
+
System Service Dispatch Table |
+The hexadecimal number after the word Win32Thread is the address of the system service dispatch table. |
+
Thread State |
+The thread state is displayed at the end of the line that begins with the word RUNNING. |
+
Owning Process |
+The hexadecimal number after the words Owning Process is the address of the EPROCESS for the process that owns this thread. |
+
Start Address |
+The hexadecimal number after the words Start Address is the thread start address. This might appear in symbolic form. |
+
User Thread Function |
+The hexadecimal number after the words Win32 Start Address is the address of the user thread function. |
+
Priority |
+The priority information for the thread follows the word Priority. |
+
Stack trace |
+A stack trace for the thread appears at the end of this display. |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable (see the Remarks section) |
+
Windows 2000 |
+Ntsdexts.dll |
+
Windows XP and later |
+Unavailable |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+user mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Exts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable (see the Remarks section) |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Exts.dll |
+
Modes |
+kernel mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+kernel mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+x86 only |
+
Modes |
+user mode only |
+
Targets |
+live, crash dump |
+
Platforms |
+x86 only |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Modes |
+User mode only |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Uext.dll |
+
Windows XP and later |
+Uext.dll |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Ext.dll |
+
Windows XP and later |
+Ext.dll |
+
DLL |
+Kdextx86.dll (Windows 2000); +Kdexts.dll (Windows XP and later) | +
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Uext.dll |
+
Windows XP and later |
+Uext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
| Parameter | +Meaning | +
|---|---|
physical memory |
+Total physical memory in the system. |
+
available pages |
+Number of pages of memory available on the system, both virtual and physical. |
+
nonpaged pool usage |
+The amount of pages allocated to the nonpaged pool. The nonpaged pool is memory that cannot be swapped out to the paging file, so it must always occupy physical memory. If this number is too large, this is usually an indication that there is a memory leak somewhere in the system. |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
++Uext.dll +Ntsdexts.dll | +
Windows XP and later |
+Uext.dll |
+
Modes |
+controlling the user-mode debugger from the kernel debugger |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
DLL |
+Wdfkd.dll | +
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Kdexts.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP |
+Unavailable |
+
Windows Server 2003 |
+Unavailable |
+
Windows Vista and later |
+Kdexts.dll |
+
| Value | +Description | +
|---|---|
report |
+When a Windows Runtime error occurs, the error and related text are displayed in the debugger, but execution contunues. This is the default mode. |
+
break |
+When a Windows Runtime error occurs, the error and related text are displayed in the debugger, and execution stops. |
+
quiet |
+When a Windows Runtime error occurs, nothing is displayed in the debugger, and execution continues. |
+
| Prefix variable identifier | +Variable type | +Description | +
|---|---|---|
%1 |
+string |
+The friendly name of the message GUID of the trace message. By default, the friendly name of a message GUID is the name of the directory in which the trace provider was built. |
+
%2 |
+string |
+Source file and line number. +This variable represents the friendly name of the trace message. By default, the friendly name of a trace message is the name of the source file and the line number of the code that generated the trace message. |
+
%3 |
+ULONG |
+Thread ID. +Identifies the thread that generated the trace message. |
+
%4 |
+string |
+Time stamp of the time that the trace message was generated. |
+
%5 |
+string |
+Kernel time. +Displays the elapsed execution time for kernel-mode instruction, in CPU ticks, at the time that the trace message was generated. |
+
%6 |
+string |
+User time. +Displays the elapsed execution time for user-mode instruction, in CPU ticks, at the time that the trace message was generated. |
+
%7 |
+LONG |
+Sequence number. +Displays the local or global sequence number of the trace message. Local sequence numbers, which are unique only to this trace session, are the default. |
+
%8 |
+ULONG |
+Process ID. +Identifies the process that generated the trace message. |
+
%9 |
+ULONG |
+CPU number. +Identifies the CPU on which the trace message was generated. |
+
%!FUNC! |
+string |
+Function name. +Displays the name of the function that generated the trace message. |
+
%!FLAGS% |
+string |
+Displays the name of the trace flags that enable the trace message. |
+
%!LEVEL! |
+string |
+Displays the value of the trace level that enables the trace message. |
+
%!COMPNAME! |
+string |
+Component name. +Displays the name of the component of the provider that generated the trace message. The component name appears only if it is specified in the tracing code. |
+
%!SUBCOMP! |
+string |
+Subcomponent name. +Displays the name of the subcomponent of the provider that generated the trace message. The subcomponent name appears only if it is specified in the tracing code. |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP with UMDF version 1.7 and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP with UMDF version 1.7 and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP with UMDF version 1.7 and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP with UMDF version 1.7 and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP with UMDF version 1.7 and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP with UMDF version 1.7 and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP with UMDF version 1.7 and later |
+Wudfext.dll |
+
Windows 2000 |
+Unavailable |
+
Windows XP with UMDF version 1.7 and later |
+Wudfext.dll |
+
Windows 2000 |
+Kdextx86.dll |
+
Windows XP and later |
+Unavailable |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
| Prefix | +Name | +Address types | +
|---|---|---|
% |
+flat |
+32-bit addresses (also 16-bit selectors that point to 32-bit segments) and 64-bit addresses on 64-bit systems. |
+
& |
+virtual 86 |
+Real-mode addresses. x86-based only. |
+
# |
+plain |
+Real-mode addresses. x86-based only. |
+
| Syntax | +Meaning | +
|---|---|
offset |
+The absolute address in virtual memory space, with a type that corresponds to the current execution mode. For example, if the current execution mode is 16 bit, the offset is 16 bit. If the execution mode is 32-bit segmented, the offset is 32-bit segmented. |
+
&[[ segment:]] offset |
+The real address. x86-based and x64-based. |
+
%segment:[[ offset]] |
+A segmented 32-bit or 64-bit address. x86-based and x64-based. |
+
%[[ offset]] |
+An absolute address (32-bit or 64-bit) in virtual memory space. x86-based and x64-based. |
+
name[[ +|− ]] offset |
+A flat 32-bit or 64-bit address. name can be any symbol. offset specifies the offset. This offset can be whatever address mode its prefix indicates. No prefix specifies a default mode address. You can specify the offset as a positive (+) or negative (−) value. |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live, crash dump |
+
Platforms |
+All |
+
| Option | +Action | +
|---|---|
e (execute) |
+Breaks into the debugger when the CPU retrieves an instruction from the specified address. |
+
r (read/write) |
+Breaks into the debugger when the CPU reads or writes at the specified address. |
+
w (write) |
+Breaks into the debugger when the CPU writes at the specified address. |
+
i (i/o) |
+(Microsoft Windows XP and later versions, kernel mode only, x86-based systems only) Breaks into the debugger when the I/O port at the specified Address is accessed. |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
| Topic | +Description | +
|---|---|
[!bthkd.bthdevinfo](-bthkd-bthdevinfo.md) |
+The [!bthkd.bthdevinfo](-bthkd-bthdevinfo.md) command displays the information about a given BTHENUM created device PDO. |
+
[!bthkd.bthenuminfo](-bthkd-bthenuminfo.md) |
+The [!bthkd.bthenuminfo](-bthkd-bthenuminfo.md) command displays information about the BTHENUM FDO. |
+
[!bthkd.bthinfo](-bthkd-bthinfo-.md) |
+The [!bthkd.bthinfo](-bthkd-bthinfo-.md) command displays details about the BTHPORT FDO. This command is a good starting point for Bluetooth investigations as it displays address information that can be used to access many of the other Bluetooth debug extension commands. |
+
[!bthkd.bthhelp](-bthkd-bthhelp.md) |
+The [!bthkd.bthhelp](-bthkd-bthhelp.md) command displays help for the Bluetooth debug extension commands. |
+
[!bthkd.bthtree](-bthkd-bthtree.md) |
+The [!bthkd.bthtree](-bthkd-bthtree.md) command displays the complete Bluetooth device tree. |
+
[!bthkd.bthusbtransfer](-bthkd-bthusbtransfer.md) |
+The [!bthkd.bthusbtransfer](-bthkd-bthusbtransfer.md) command displays the Bluetooth usb transfer context including Irp, Bip and transfer buffer information. |
+
[!bthkd.dibflags](-bthkd-dibflags.md) |
+The [!bthkd.dibflags](-bthkd-dibflags.md) command displays DEVICE_INFO_BLOCK.DibFlags dumps flags set in _DEVICE_INFO_BLOCK.DibFlags. |
+
[!bthkd.hcicmd](-bthkd-hcicmd.md) |
+The [!bthkd.hcicmd](-bthkd-hcicmd.md) command displays a list of the currently pending commands. |
+
[!bthkd.hciinterface](-bthkd-hciinterface.md) |
+The [!bthkd.hciinterface](-bthkd-hciinterface.md) command displays the bthport!_HCI_INTERFACE structure. |
+
[!bthkd.l2capinterface](-bthkd-l2capinterface-.md) |
+The [!bthkd.l2capinterface](-bthkd-l2capinterface-.md) command displays information about the L2CAP interface. |
+
[!bthkd.rfcomminfo](-bthkd-rfcomminfo.md) |
+The [!bthkd.rfcomminfo](-bthkd-rfcomminfo.md) command displays information about the RFCOMM FDO and the TDI Device Object. |
+
[!bthkd.rfcommconnection](-bthkd-rfcommconnection.md) |
+The [!bthkd.rfcommconnection](-bthkd-rfcommconnection.md) command displays information about a given RFCOMM connection object. |
+
[!bthkd.rfcommchannel](-bthkd-rfcommchannel.md) |
+The [!bthkd.rfcommchannel](-bthkd-rfcommchannel.md) command displays information about a given RFCOMM channel CB. |
+
[!bthkd.sdpinterface](-bthkd-sdpinterface.md) |
+The [!bthkd.sdpinterface](-bthkd-sdpinterface.md) command displays information about the SDP interface. |
+
[!bthkd.scointerface](-bthkd-scointerface-.md) |
+The [!bthkd.scointerface](-bthkd-scointerface-.md) command displays information about the SCO interface. |
+
[!bthkd.sdpnode](-bthkd-sdpnode.md) |
+The [!bthkd.sdpnode](-bthkd-sdpnode.md) command displays information about a node in an sdp tree. |
+
[!bthkd.sdpstream](-bthkd-sdpstream.md) |
+The [!bthkd.sdpstream](-bthkd-sdpstream.md) command displays the contents of a SDP stream. |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Modes |
+User mode, kernel mode |
+
Targets |
+Live debugging only |
+
Platforms |
+All |
+
Abbreviation |
+ddp |
+
Hexadecimal value |
+0x08000000 |
+
Symbolic Name |
+FLG_DISABLE_DBGPRINT |
+
Destination |
+System-wide registry entry, kernel flag |
+
| Parameter | +Description | +
|---|---|
| 1 | +The subtype of the bugcheck. +0x0 : Machine Check Exception +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +Parameter 3 - High order 32-bits of the MCi_STATUS value. +Parameter 4 - Low order 32-bits of the MCi_STATUS value. +0x1 : Corrected Machine Check +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0x2 : Corrected Platform Error +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0x3 : Non-maskable Interrupt +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0x4 : PCI Express Error +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0x5 : Generic Error +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0x6 : INIT Error +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0x7 : BOOT Error +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0x8 : SCI Generic Error +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0x9 : Itanium Machine Check Abort +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +Parameter 3 - Length in bytes of the SAL log. +Parameter 4 - Address of the SAL log. +0xa : Itanium Corrected Machine Check +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. +0xb : Itanium Corrected Platform Error +Parameter 2 - Address of the WHEA_ERROR_RECORD structure. |
+
| 2 | +Pointer to the NMI Handle | +
| 3 | +Pointer to the expected type, when available | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +The subtype of the bugcheck. +0x1 : Invalid pool. Pool is at an invalid state. +Parameter 2 - Pointer to memory block or MDL. +Parameter 3 - Pointer to page. +Parameter 4 - Pointer to CPU pool. +0x2 : Invalid MDL. MDL is at an invalid state. +Parameter 2 - Pointer to MDL. +Parameter 3 - Pointer to CPU pool. +Parameter 4 - Pointer to pool header. |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
1 |
+The address of the system function (system call) or worker routine. |
+
2 |
+The value of the current thread's ApcStateIndex field. | +
3 |
+The value of current thread's CombinedApcDisable field. This field consists of two separate 16-bit fields: (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable. |
+
4 |
+Call type (0 - system call, 1 - worker routine). |
+
| Parameter | +Description | +
|---|---|
1 |
+3 |
+
2 |
+The size of the loader black extension |
+
3 |
+The major version of the loader block |
+
4 |
+The minor version of the loader block |
+
| Parameter | +Description | +
|---|---|
1 |
+Clock interrupt time-out interval, in nominal clock ticks |
+
2 |
+0 |
+
3 |
+The address of the processor control block (PRCB) for the unresponsive processor |
+
4 |
+0 |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of error | +
|---|---|---|---|---|
0x1 |
+The address of the pending IRP. |
+The address of the file object whose file context could not be found. |
+The address of the device object. |
+The MUP could not locate the file context that corresponds to a file object. This typically indicates that the MUP is seeing an I/O request for a file object for which MUP did not see a corresponding IRP_MJ_CREATE request. The likely cause of this bug check is a filter driver error. |
+
0x2 |
+The address of the expected file context. |
+The address that was actually retrieved from the file object. |
+Reserved |
+A file context is known to exist for the file object, but was not what was expected (for example, it might be NULL). |
+
0x3 |
+The address of the IRP context. |
+The IRP completion status code. |
+The driver object of the UNC provider that completed the IRP (might be NULL). |
+The IRP completion status was unexpected or invalid. +This bug check occurs only when you are using a Checked Build of Windows and should only be caused by file system filter drivers that are attached to legacy network redirectors. Legacy redirectors use FsRtlRegisterUncProvider to register with MUP. This bug check detects filter drivers that return an NTSTATUS that is not STATUS_SUCCESS in IRP_MJ_CLEANUP or IRP_MJ_CLOSE requests. |
+
0x4 |
+Address of the IRP |
+Address of the file object |
+The file context for the file object |
+An I/O operation was started on a file object before the create request for the file object was completed. |
+
| Parameter | +Description | +
|---|---|
1 |
+Offset (in ULONG) within the AGP verifier page to the first ULONG data that is corrupted |
+
2 |
+0 |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The base address (virtual) of the GART |
+
2 |
+The offset into the GART where the corruption occurred |
+
3 |
+The base address (virtual) of the GART cache (a copy of the GART) |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The originally programmed AGP command register value |
+
2 |
+The current command register value |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+Identifies the file system that failed. Possible values include: +1: Polyserve (Psfs.sys) |
+
2 |
+The address of the exception record. |
+
3 |
+The address of the context record. |
+
4 |
+Reserved. |
+
| Parameter | +Description | +
|---|---|
1 |
+Reserved |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+The type of the corrupted region. (See the following table later on this page.) |
+
| Parameter 4 | +Type of Corrupted Region, Type of Corruption, or Type of Action Taken That Caused the Corruption | +
|---|---|
0x0 |
+A generic data region |
+
0x1 |
+A function modification or the Itanium-based function location |
+
0x2 |
+A processor interrupt dispatch table (IDT) |
+
0x3 |
+A processor global descriptor table (GDT) |
+
0x4 |
+A type-1 process list corruption |
+
0x5 |
+A type-2 process list corruption |
+
0x6 |
+A debug routine modification |
+
0x7 |
+A critical MSR modification |
+
0x8 |
+Object type |
+
0x9 |
+A processor IVT |
+
0xA |
+Modification of a system service function |
+
0xB |
+A generic session data region |
+
0xC |
+Modification of a session function or .pdata |
+
0xD |
+Modification of an import table |
+
0xE |
+Modification of a session import table |
+
0xF |
+Ps Win32 callout modification |
+
0x10 |
+Debug switch routine modification |
+
0x11 |
+IRP allocator modification |
+
0x12 |
+Driver call dispatcher modification |
+
0x13 |
+IRP completion dispatcher modification |
+
0x14 |
+IRP deallocator modification |
+
0x15 |
+A processor control register |
+
0x16 |
+Critical floating point control register modification |
+
0x17 |
+Local APIC modification |
+
0x18 |
+Kernel notification callout modification |
+
0x19 |
+Loaded module list modification |
+
0x1A |
+Type 3 process list corruption |
+
0x1B |
+Type 4 process list corruption |
+
0x1C |
+Driver object corruption |
+
0x1D |
+Executive callback object modification |
+
0x1E |
+Modification of module padding |
+
0x1F |
+Modification of a protected process |
+
0x20 |
+A generic data region |
+
0x21 |
+A page hash mismatch |
+
0x22 |
+A session page hash mismatch |
+
0x23 |
+Load config directory modification |
+
0x24 |
+Inverted function table modification |
+
0x25 |
+Session configuration modification |
+
0x26 |
+An extended processor control register |
+
0x27 |
+Type 1 pool corruption |
+
0x28 |
+Type 2 pool corruption |
+
0x29 |
+Type 3 pool corruption |
+
0x101 |
+General pool corruption |
+
0x102 |
+Modification of win32k.sys |
+
| Parameter | +Description | +
|---|---|
1 |
+The type of violation. (See the following table later on this page for more details). |
+
2 |
+0 |
+
3 |
+The address of the ECP. |
+
4 |
+The starting address of the ECP list. |
+
| Parameter 1 | +Type of Violation | +
|---|---|
0x1 |
+The ECP signature is invalid, due to either a bad pointer or memory corruption. |
+
0x2 |
+The ECP has undefined flags set. |
+
0x3 |
+The ECP was not allocated by the FsRtl. |
+
0x4 |
+The ECP has flags set that are illegal for a parameter passed by a create caller. |
+
0x5 |
+The ECP is corrupted; its size is smaller than the header size. |
+
0x6 |
+The ECP that is being freed has non-empty list pointers; it might still be part of an ECP list. |
+
0x11 |
+The ECP list signature is invalid, due to either a bad pointer or memory corruption. |
+
0x12 |
+The ECP list has undefined flags set. |
+
0x13 |
+The ECP list was not allocated by the FsRtl. |
+
0x14 |
+The ECP list has flags set that are illegal for a parameter list passed by a create caller. |
+
0x15 |
+The ECP list passed by the create caller is empty. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Cause of Error | +
|---|---|---|---|
0x1 |
+Pointer to a WDF_POWER_ROUTINE_TIMED_OUT_DATA structure |
+Reserved |
+A framework-based driver has timed out during a power operation. This typically means that the device stack did not set the DO_POWER_PAGABLE bit and a driver attempted a pageable operation after the paging device stack was powered down. |
+
0x2 |
+Reserved |
+Reserved |
+An attempt is being made to acquire a lock that is currently being held. |
+
0x3 |
+WDFREQUEST handle |
+The number of outstanding references that remain on both buffers |
+Windows Driver Framework Verifier has encountered a fatal error. In particular, an I/O request was completed, but a framework request object cannot be deleted because there are outstanding references to the input buffer, the output buffer, or both. |
+
0x4 |
+Reserved |
+The caller's address |
+A NULL parameter was passed to a function that required a non-NULL value. |
+
0x5 |
+The handle value passed in |
+Reserved |
+A framework object handle of the incorrect type was passed to a framework object method. |
+
0x6 |
++ | + | See table below. |
+
0x7 |
+The handle of the framework object |
+Reserved |
+A driver attempted to delete a framework object incorrectly by calling WdfObjectDereference to delete a handle instead of calling WdfObjectDelete. |
+
0x8 |
+The handle of the DMA transaction object |
+Reserved |
+An operation occurred on a DMA transaction object while it was not in the correct state. |
+
0x9 |
++ | + | Currently unused. |
+
0xA |
+A pointer to a WDF_QUEUE_FATAL_ERROR_DATA structure |
+Reserved |
+A fatal error has occurred while processing a request that is currently in the queue. |
+
0xB |
++ | + | See table below. |
+
0xC |
+WDFDEVICE handle |
+Pointer to new PnP IRP |
+A new state-changing PnP IRP arrived while the driver was processing another state-changing PnP IRP. |
+
0xD |
+WDFDEVICE handle |
+Pointer to power IRP |
+A device's power policy owner received a power IRP that it did not request. There might be multiple power policy owners, but only one is allowed. A KMDF driver can change power policy ownership by calling WdfDeviceInitSetPowerPolicyOwnership. |
+
0xE |
+IRQL at which the event callback function was called. |
+IRQL at which the event callback function returned. |
+An event callback function did not return at the same IRQL at which it was called. The callback function changed the IRQL directly or indirectly (for example, by acquiring a spinlock, which raises IRQL to DISPATCH_LEVEL, but not releasing the spinlock). |
+
0xF |
+Address of an event callback function. |
+Reserved |
+An event callback function entered a critical region, but it did not leave the critical region before returning. |
+
| Parameter 2 | +Parameter 3 | +Cause of Error | +
|---|---|---|
0x1 |
+The address of the IRP |
+No more I/O stack locations are available to format the underlying IRP. |
+
0x2 |
+The WDF request handle value |
+An attempt was made to format a framework request object that did not contain an IRP. |
+
0x3 |
+The WDF request handle value |
+The driver attempted to send a framework request that has already been sent to an I/O target. |
+
0x4 |
+A pointer to a WDR_REQUEST_FATAL_ERROR_INFORMATION_LENGTH_MISMATCH_DATA structure that contains a pointer to the IRP, a WDF request handle value, an IRP major function, and the number of bytes attempted to be written |
+The driver has completed a framework request, but has written more bytes to the output buffer than are specified in the IRP. |
+
| Parameter 2 | +Parameter 3 | +Cause of Error | +
|---|---|---|
The handle value |
+0x0 |
+A handle passed to WdfObjectAcquireLock or WdfObjectReleaseLock represents an object that does not support synchronization locks. |
+
A WDF spin lock handle |
+0x1 |
+The spin lock is being released by a thread that did not acquire it. |
+
| Parameter 1 | +Cause of Error | +
|---|---|
0x1 |
+An attempt was made to rotate a non-rotate range. |
+
0x2 |
+An attempt was made to destroy a non-empty process heap. |
+
0x3 |
+An attempt to unmap from an aperture segment failed. |
+
0x4 |
+A rotation in a must-succeed path failed. |
+
0x5 |
+A deferred command failed. |
+
0x6 |
+An attempt was made to reallocate resources for an allocation that was having its eviction canceled. |
+
0x7 |
+An invalid attempt was made to defer free usage. |
+
0x8 |
+The split direct memory access (DMA) buffer contains an invalid reference. |
+
0x9 |
+An attempt to evict an allocation failed. |
+
0xA |
+An invalid attempt to use a pinned allocation was made. |
+
0xB |
+A driver returned an invalid error code from BuildPagingBuffer. |
+
0xC |
+A resource leak was detected in a segment. |
+
0xD |
+A segment is being used improperly. |
+
0xE |
+An attempt to map an allocation into an aperture segment failed. |
+
0xF |
+A driver returned an invalid error code from AcquireSwizzlingRange. |
+
0x10 |
+A driver returned an invalid error code from ReleaseSwizzlingRange. |
+
0x11 |
+An invalid attempt to use an aperture segment was made. |
+
0x12 |
+A driver overflowed the provided DMA buffer. |
+
0x13 |
+A driver overflowed the provided private data buffer. |
+
0x14 |
+An attempt to purge all segments failed. |
+
0x15 |
+An attempt was made to free a virtual address descriptor (VAD) that was still in the rotated state |
+
0x16 |
+A driver broke the guaranteed DMA buffer model contract. |
+
0x17 |
+An unexpected system command failure occurred. |
+
0x18 |
+An attempt to release a pinned allocation's resource failed. |
+
0x19 |
+A driver failed to patch a DMA buffer. |
+
0x1A |
+The owner of a shared allocation was freed. |
+
0x1B |
+An attempt was made to release an aperture range that is still in use. |
+
0x25 |
+The GPU attempted to write over an undefined area of the aperture. |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the exception record |
+
2 |
+The address of the context record |
+
3 |
+The address of the exception code |
+
4 |
+The address of the resource manager |
+
| Parameter 1 | +Parameter 2 | +Cause of Error | +
|---|---|---|
0x01 |
+The exception code |
+A non-continuable exception was continued by the caller. |
+
0x02 |
+The error |
+The advanced local procedure call (ALPC) returned an invalid error. |
+
0x03 |
+The session to the server |
+The caller unloaded the Microsoft remote procedure call (MSRPC) driver while it was still in use. It is likely that open binding handles remain. |
+
0x04 and +0x05 |
+The session to the server |
+An invalid close command was received from the ALPC. |
+
0x06 |
+The binding handle |
+An attempt was made to bind a remote procedure call (RPC) handle a second time. |
+
0x07 |
+The binding handle |
+An attempt was made to perform an operation on a binding handle that was not bound. |
+
0x08 |
+The binding handle |
+An attempt was made to set security information on a binding handle that was already bound. |
+
0x09 |
+The binding handle |
+An attempt was made to set an option on a binding handle that was already bound. |
+
0x0A |
+The call object |
+An attempt was made to cancel an invalid asynchronous remote procedure call. |
+
0x0B |
+The call object |
+An attempt was made to push on an asynchronous pipe call when it was not expected. |
+
0x0C and +0x0E |
+The pipe object |
+An attempt was made to push on an asynchronous pipe without waiting for notification. |
+
0x0F |
+The pipe object |
+An attempt was made to synchronously terminate a pipe a second time. |
+
0x15 |
+The object closest to the error |
+An RPC internal error occurred. |
+
0x16 |
+Reserved |
+Two causally ordered calls were issued in an order that cannot be enforced by the RPC. |
+
0x17 |
+The call object |
+A server manager routine did not unsubscribe from notifications prior to completing the call. |
+
0x18 |
+The async handle |
+An invalid operation on the asynchronous handle occurred. |
+
| Parameter | +Description | +
|---|---|
1 |
+The pointer to the internal TDR recovery context, if available. |
+
2 |
+A pointer into the responsible device driver module (for example, the owner tag). |
+
3 |
+The error code of the last failed operation, if available. |
+
4 |
+Internal context dependent data, if available. |
+
| Parameter | +Description | +
|---|---|
1 |
+The pointer to the internal TDR recovery context, if available. |
+
2 |
+A pointer into the responsible device driver module (for example, the owner tag). |
+
3 |
+The secondary driver-specific bucketing key. |
+
4 |
+Internal context dependent data, if available. |
+
| Parameter 1 | +Cause of Error | +
|---|---|
0x1 |
+The driver has reported an invalid fence ID. |
+
0x2 |
+The driver failed upon the submission of a command. |
+
0x3 |
+The driver failed upon patching the command buffer. |
+
0x4 |
+The driver reported an invalid flip capability. |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the IRP that was canceled (might not be valid). |
+
2 |
+The address of the cancel routine. |
+
| Parameter | +Description | +
|---|---|
1 |
+Virtual address for the attempted write |
+
2 |
+PTE contents |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The unexpected interrupt |
+
2 |
+The unknown floating-point exception |
+
3 |
+The enabled and asserted status bits. See the processor definition for details. |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Describes the type of violation |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of error | +
|---|---|---|---|---|
0x1 |
+Size of memory |
+Error source count |
+0 |
+Failed to allocate enough memory for all the error sources in the hardware error source table. |
+
0x2 |
+Number of processors |
+0 |
+0 |
+Failed to allocate enough memory for a WHEA information block for each processor. |
+
0x5 |
+Status |
+Phase (The initialization phase for the bug check) |
+0 |
+WHEA failed to allocate enough memory for the error sources, or the error source enumeration failed. |
+
0x6 |
+Status |
+Phase |
+Error source type |
+Failed to initialize the error source (Parameter 4) during the phase specified by Parameter 3. |
+
0x7 |
+Status |
+0 |
+0 |
+Failed to allocate enough memory. |
+
0x8 |
+Number of error sources |
+0 |
+0 |
+Failed to allocate enough memory for all the error source descriptors. |
+
0x9 |
+Error source type |
+Source ID |
+0 |
+WHEA received an uncorrected error source from an invalid error source. |
+
0xA |
+Error source type |
+Source ID |
+0 |
+Failed to allocate an error record for an uncorrected error. |
+
0xB |
+Error source type |
+Source ID |
+0 |
+Failed to populate the error record for an uncorrected error. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of error | +
|---|---|---|---|---|
0x0 |
+Address of WHEA_ERROR_RECORD structure. |
+High 32 bits of MCi_STATUS MSR for the MCA bank that had the error. |
+Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error. |
+A machine check exception occurred. +These parameter descriptions apply if the processor is based on the x64 architecture, or the x86 architecture that has the MCA feature available (for example, Intel Pentium Pro, Pentium IV, or Xeon). |
+
0x1 |
+Address of WHEA_ERROR_RECORD structure. |
+Reserved. |
+Reserved. |
+A corrected machine check exception occurred. |
+
0x2 |
+Address of WHEA_ERROR_RECORD structure. |
+Reserved. |
+Reserved. |
+A corrected platform error occurred. |
+
0x3 |
+Address of WHEA_ERROR_RECORD structure. |
+Reserved. |
+Reserved. |
+A nonmaskable Interrupt (NMI) error occurred. |
+
0x4 |
+Address of WHEA_ERROR_RECORD structure. |
+Reserved |
+Reserved. |
+An uncorrectable PCI Express error occurred. |
+
0x5 |
+Address of WHEA_ERROR_RECORD structure. |
+Reserved. |
+Reserved. |
+A generic hardware error occurred. |
+
0x6 |
+Address of WHEA_ERROR_RECORD structure |
+Reserved. |
+Reserved. |
+An initialization error occurred. |
+
0x7 |
+Address of WHEA_ERROR_RECORD structure. |
+Reserved. |
+Reserved. |
+A BOOT error occurred. |
+
0x8 |
+Address of WHEA_ERROR_RECORD structure |
+Reserved. |
+Reserved. |
+A Scalable Coherent Interface (SCI) generic error occurred. |
+
0x9 |
+Address of WHEA_ERROR_RECORD structure. |
+Length, in bytes, of the SAL log. |
+Address of the SAL log. |
+An uncorrectable Itanium-based machine check abort error occurred. |
+
0xA |
+Address of WHEA_ERROR_RECORD structure |
+Reserved. |
+Reserved. |
+A corrected Itanium-based machine check error occurred. |
+
0xB |
+Address of WHEA_ERROR_RECORD structure. |
+Reserved. |
+Reserved. |
+A corrected Itanium platform error occurred. |
+
| Parameter | +Description | +
|---|---|
1 |
+Virtual address that maps the corrupted page |
+
2 |
+Physical page number |
+
3 |
+Zero (Reserved) |
+
4 |
+Zero (Reserved) |
+
| Parameter | +Description | +
|---|---|
| 1 | +Address of worker routine +Use the [ln (List Nearest Symbols)](ln--list-nearest-symbols-.md) command on this address to find the offending driver. |
+
| 2 | +Current Paging IoPrioirity value | +
| 3 | +Workitem parameter | +
| 4 | +Workitem address | +
| Parameter | +Description | +
|---|---|
| 1 | +The subtype of the bugcheck
+ 0x1 : Windows did not find any installed language packs during phase I initialization. +Parameter 2 - NT status code that describes the reason of failure. +0x2 : Windows did not find any installed, licensed language packs for the system default UI language during kernel cache creation. +Parameter 2 - NT status code that describes the reason of failure. +. |
+
| 2 | +See parameter 1 | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
1 |
+Virtual address maps to the corrupted page |
+
2 |
+Physical page number |
+
3 |
+Zero (Reserved) |
+
4 |
+Zero (Reserved) |
+
| Parameter | +Description | +
|---|---|
1 |
+Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") determine the source file by its identifier number. The low 16 bits determine the source line in the file where the bug check occurred. |
+
2 |
+If FppExceptionFilter is on the stack, this parameter specifies the address of the exception record. |
+
3 |
+If FppExceptionFilter is on the stack, this parameter specifies the address of the context record. |
+
4 |
+Reserved. |
+
| Parameter | +Description | +
|---|---|
| 1 | +Action that failed +1 : Couldn't extract VHD information from boot device. +2 : Timeout waiting for VHD parent device to surface. +3 : VHD path string memory allocation error. +4 : VHD path construction failed. +5 : VHD boot device mount failed. +6 : Disable sleep states failed. +7 : VHD information memory allocation error. +8 : VHD information construction failed. |
+
| 2 | +NT status code | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0 |
+The DPC time count (in ticks) |
+The DPC time allotment (in ticks). |
+Reserved |
+A single DPC or ISR exceeded its time allotment. The offending component can usually be identified with a stack trace. |
+
1 |
+The watchdog period |
+Reserved |
+Reserved |
+The system cumulatively spent an extended period of time at IRQL DISPATCH_LEVEL or above. The offending component can usually be identified with a stack trace. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
1 |
+GSIV |
+Reserved |
+Reserved |
+The GPIO controller managing the specific GSIV is not registered. |
+
2 |
+Context value |
+Reserved |
+Reserved |
+A client driver specified an invalid context to a lock or unlock request. |
+
3 |
+Indicates whether a critical transition is being requested. |
+Indicates whether the bank is already in F1 due to a non-critical transition. |
+Indicates whether the bank is already in F1 due to a critical transition. |
+PoFx requested that the GPIO controller send a bank through an inappropriate F1 power state and/or a critical transition. |
+
4 |
+Indicates whether a critical transition is being requested. |
+Indicates whether the bank is in F1 due to a non-critical transition. |
+Indicates whether the bank is in F1 due to a critical transition. |
+PoFx requested that the GPIO controller send a bank through an inappropriate F0 power state and/or a critical transition. |
+
5 |
+NTSTATUS |
+GPIO device extension |
+GPIO interrupt parameters |
+An on-Soc GPIO interrupt operation failed. |
+
6 |
+NTSTATUS |
+GPIO device extension |
+GPIO IO parameters |
+An on-Soc GPIO IO operation failed. |
+
7 |
+Revision ID |
+Function Index |
+Reserved |
+A _DSM method returned malformed data. |
+
| Parameter | +Description | +
|---|---|
| 1 | +Type of corruption detected +0x3 : A corrupt entry header was detected. +0x4 : Multiple corrupt entry headers were detected. +0x5 : A corrupt entry header in a large allocation was detected. +0x6 : A corruption was detected with features consistent with a buffer overrun. +0x7 : A corruption was detected with features consistent with a buffer underrun. +0x8 : A free block was passed to an operation that is only valid for busy blocks. +0x9 : An invalid argument was specified for the current operation. +0xA : A corruption was detected with features consistent with a use-after-free error. +0xB : The wrong heap was specified for the current operation. +0xC : A corrupt free list was detected. +0xD : The heap detected list corruption in a list other than the free list. |
+
| 2 | +Address of the heap that reported the corruption | +
| 3 | +Address at which the corruption was detected | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +Type of error detected +0x1 : A driver tried to acquire an interrupt spinlock but passed in a passive-level interrupt object. |
+
| 2 | +Address of the KINTERRUPT object for the passive-level interrupt. | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +2 - Power Engine Plugin (PEP) returned invalid processor idle state | +
| 2 | +Type of invalid state +0x0 : PEP requested too many processors for coordinated idle state +Parameter 3 - Number of processors requested to participate in coordinated idle transitions +Parameter 4 - Pointer to processor device context (FDO_DATA) +0x1 : PEP requested processor to be in an invalid idle state +Parameter 3 - Idle state index requested +Parameter 4 - Pointer to processor device context (FDO_DATA) corresponding to the invalid idle state +0x2 : PEP requested the platform to be in an invalid idle state +Parameter 3 - Platform idle state index requested +Parameter 4 - Pointer to processor device context (FDO_DATA) corresponding to the invalid idle state |
+
| 3 | +Refer to parameter 2 | +
| 4 | +Refer to parameter 2 | +
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of error | +
|---|---|---|---|---|
0x1 |
+Optional. Pointer to the IRP used to resend the URB |
+Pointer to the URB |
+Pointer to the client driver's device object |
+A client driver used an URB that it had previously sent to the core stack. |
+
0x2 |
+Pointer to the physical device object (PDO) for the boot device |
+Reserved |
+Reserved |
+A boot or paging device failed re-enumeration. |
+
0x3 |
+Optional. Pointer to the IRP used to send the URB |
+Pointer to the corrupted URB |
+Pointer to the client driver's device object |
+A client driver sent a corrupted URB to the core stack. This can happen because the client driver did not allocate the URB using USBD_xxxUrbAllocate or because the client driver did a buffer underrun for the URB. |
+
0x800 |
+IRQL at which the Open Static Streams request was sent |
+Pointer to the Open Static Streams IRP |
+Pointer to the client driver's device object |
+An Open Static Streams request was sent at IRQL > PASSIVE LEVEL. |
+
0x801 |
+Pointer to the Open Static Streams IRP |
+Pointer to the Open Static Streams URB |
+Pointer to the client driver's device object |
+A client driver attempted to open static streams before querying for streams capability. A client driver cannot open a static stream until after it successfully queries for the streams capability. For more information, see Remarks. |
+
0x802 |
+Number of static streams that the client driver tried to open |
+Number of static streams that were granted to the client driver |
+Pointer to the client driver's device object |
+A Client driver tried to open an invalid number of static streams. The number of streams cannot be 0 and cannot be greater than the value returned to the client driver in the query USB capability call. |
+
0x803 |
+Pointer to the Open Static Streams IRP |
+Pointer to the Open Static Streams URB |
+Pointer to the client driver's device object |
+A client driver attempted to open static streams for an endpoint that already had static streams open. Before opening static streams, the client driver must close the previously opened static streams. |
+
0x804 |
+The leaked handle context. Run !usbanalyze -v to get information about the leaked handle and URBs. You must enable Driver Verifier for the client driver. |
+Device object passed to [USBD_CreateHandle](https://msdn.microsoft.com/library/windows/hardware/hh406241). |
+Reserved |
+A client driver forgot to close a handle it created earlier using [USBD_CreateHandle](https://msdn.microsoft.com/library/windows/hardware/hh406241) or forgot to free an URB it allocated. |
+
0x805 |
+[WDFREQUEST](https://msdn.microsoft.com/library/windows/hardware/ff542962) handle for the Close Static Streams URB |
+Pointer to the Close Static Streams URB |
+Pointer to the client driver's device object |
+A client driver sent a Close Static Streams URB in an invalid state (for example, after processing D0 Exit). |
+
0x806 |
+Pointer to the IRP |
+Pointer to the URB |
+Pointer to the client driver's device object |
+A client driver attempted to send a chained [MDL](https://msdn.microsoft.com/library/windows/hardware/ff554414) before querying for chained MDL capability. A client driver cannot send a chained MDL until after it successfully queries for the chained MDL capability. For more information, see Remarks. |
+
0x807 |
+Pointer to the chained [MDL](https://msdn.microsoft.com/library/windows/hardware/ff554414) |
+Pointer to the URB |
+Pointer to the client driver's device object if available |
+A client driver sent an URB to the core stack with a transfer buffer length longer than the byte count (returned by [MmGetMdlByteCount](https://msdn.microsoft.com/library/windows/hardware/ff554530)) of the [MDL](https://msdn.microsoft.com/library/windows/hardware/ff554414) passed in. For more information, see Remarks. |
+
0x1001 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The xHCI controller asserted the HSE bit, which indicates a host system error. |
+
0x1002 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The xHCI controller asserted the HCE bit, which indicates a host controller error. |
+
0x1003 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The xHCI stop endpoint command returned an unhandled completion code. |
+
0x1004 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The xHCI endpoint state received a context state error after an xHCI endpoint stop command was issued. |
+
0x1005 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Set dequeue pointer failed during an attempt to clear stall on control endpoint. |
+
0x1006 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Reset EP failed during an attempt to clear stall on control endpoint. |
+
0x1007 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The reset of the xHCI controller failed during reset recovery. |
+
0x1008 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The restart of the xHCI controller failed during reset recovery. |
+
0x1009 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+An xHCI controller command failed to complete after the command timeout abort. |
+
0x100A |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Set dequeue pointer failed during an attempt to set the dequeue pointer after endpoint stop completion. |
+
0x100B |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The stop of the xHCI controller failed during reset recovery. |
+
0x100C |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The firmware in the xHCI controller is not supported. The xHCI driver will not load on this controller unless the firmware is updated. |
+
0x100D |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The controller was detected to be physically removed. |
+
0x100E |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The driver detect an error on a stream enabled endpoint. |
+
0x100F |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The firmware in the xHCI controller is outdated. The xHCI driver will continue working with this controller but may run into some issues. A firmware update is recommended. |
+
0x1010 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+A transfer event TRB completed with an unhandled completion code. |
+
0x1011 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The controller reported that the event ring became full. The controller is also known to drop events when this happens. |
+
0x1012 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The controller completed a command out of order. |
+
0x1013 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+After command abort completion, the command ring dequeue pointer reported by the controller is incorrect. |
+
0x1014 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+After enable slot completion, controller gave us a bad slot id. |
+
0x1015 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Controller failed a SetAddress command with BSR1. That is unexpected. |
+
0x1016 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Controller failed to enable a slot during a usbdevice reset. This is unexpected. |
+
0x1017 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Controller failed an endpoints configure command where we were deconfiguring the endpoints. That is unexpected. |
+
0x1018 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Controller failed a disable slot command. That is unexpected. |
+
0x1019 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Controller failed a USB device reset command. That is unexpected. |
+
0x101A |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+After endpoint reset, Set Dequeue Pointer command failed. |
+
0x101B |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The xHCI reset endpoint command returned an unhandled completion code. |
+
0x101C |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The D0Entry for xHCI failed. |
+
0x101D |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Temporarily dropping and adding a stream endpoint (as two commands) failed, when using the Configure Endpoint command instead of Set Dequeue Pointer during request cancellation. |
+
0x101E |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The controller indicated a transfer completion that was not pending on the controller. EventData == 1 (dereferencing the Transfer Event TRB's pointer would have caused a bugcheck) |
+
0x101F |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The controller indicated a transfer completion that was not pending on the controller. EventData == 0 (logical address in transfer event TRB not matched) |
+
0x1020 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+The controller indicated a transfer completion that was not pending on the controller. EventData == 0 (logical address in transfer event TRB not matched) The Transfer Event TRB may be redundant (points somewhere near a recently completed request). |
+
0x1021 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Temporarily dropping and adding a stream endpoint (as two commands) failed, when using the Configure Endpoint command as part of resetting an endpoint that was not Halted. |
+
0x1022 |
+XHCI_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+Dropping and adding the same endpoint (as one command) failed. |
+
0x3000 |
+USBHUB3_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+A misbehaving hub was successfully reset by the hub driver. |
+
0x3001 |
+USBHUB3_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+A misbehaving hub failed to be reset successfully by the hub driver. |
+
0x3002 |
+USBHUB3_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+A non-function SuperSpeed hub was disabled by the hub driver. |
+
0x3003 |
+USBHUB3_LIVEDUMP_CONTEXT |
+Reserved |
+Reserved |
+A USB device failed enumeration. |
+
| Parameter | +Description | +
|---|---|
| 1 | +0 : A kernel WMI entry reference count was incremented from 0. +Parameter 2: Pointer to the kernel WMI entry. +1 : A kernel WMI datasource was removed prematurely. +Parameter 2: Pointer to the kernel WMI datasource. |
+
| 2 | +See parameter 1 | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
1 |
+Address of an [SOC_SUBSYSTEM_FAILURE_DETAILS](https://msdn.microsoft.com/library/windows/hardware/dn376404) structure. |
+
2 |
+Reserved. |
+
3 |
+Reserved. |
+
4 |
+Optional. Address of a vendor-supplied data block. |
+
Minimum supported client |
+Windows 8 |
+
Minimum supported server |
+Windows Server 2012 |
+
| Parameter | +Description | +
|---|---|
| 1 | +Client ID of the hung component. | +
| 2 | +Client type of the hung component. +0x1 : A notification client failed to respond. +Parameter 3: Pointer to the notification client (PDC_NOTIFICATION_CLIENT). +Parameter 4: Pointer to a pdc!PDC_14F_TRIAGE structure. +0x2 : A resiliency client failed to respond. +Parameter 3: Pointer to the resiliency client (PDC_RESILIENCY_CLIENT). +Parameter 4: Pointer to a pdc!PDC_14F_TRIAGE structure. +0x3 : An activator client held a reference for too long. +Parameter 3: Pointer to the activation client (pdc!_PDC_ACTIVATOR_CLIENT). +Parameter 4: Pointer to a pdc!PDC_14F_TRIAGE structure. +0x100 : Win32k did not complete a monitor-on request in a timely manner. +Parameter 3: The most recent POWER_MONITOR_REQUEST_REASON value for this request. +Parameter 4: A value indicating the internal path taken to initiate the request. |
+
| 3 | +See parameter 2 | +
| 4 | +See parameter 2 | +
| Parameter | +Description | +
|---|---|
| 1 | +The address of the thread | +
| 2 | +The address of the entry that was not freed | +
| 3 | +A status code indicating the state of the entry +0x1 : Lock pointer was not NULL +0x2 : Thread pointer reserved bits were set +0x3 : Thread pointer was corrupted +0x4 : The entry had residual IO or CPU boosts left |
+
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +AFD endpoint pointer (!afdkd.endp <ptr>) | +
| 2 | +Transport endpoint type +0x1 : UDP datagram +0x2 : RAW datagram +0x3 : TCP listener +0x4 : TCP endpoint |
+
| 3 | +Number of buffered send bytes for datagram endpoints | +
| 4 | +afd!NETIO_SUPER_TRIAGE_BLOCK | +
| Parameter | +Description | +
|---|---|
| 1 | +The address of the thread | +
| 2 | +The target priority value | +
| 3 | +A status code indicating the nature of the violation +0x1 : The priority counter for the target priority over-flowed +0x2 : The priority counter for the target priority under-flowed +0x3 : The target priority value was illegal |
+
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +Client ID of the hung component. | +
| 2 | +Client type of the hung component. +0x1 : A notification client failed to respond. +3 - Pointer to the notification client (pdc!_PDC_NOTIFICATION_CLIENT). +4 - Pointer to a pdc!PDC_14F_TRIAGE structure. +0x2 : A resiliency client failed to respond. +3 - Pointer to the resiliency client (pdc!_PDC_RESILIENCY_CLIENT). +4 - Pointer to a pdc!PDC_14F_TRIAGE structure. +0x3 : An activator client held a reference for too long +3 - Pointer to the activation client (pdc!_PDC_ACTIVATOR_CLIENT). +4 - Pointer to a pdc!PDC_14F_TRIAGE structure. |
+
| 3 | +See parameter 2 | +
| 4 | +See parameter 2 | +
| Parameter | +Description | +
|---|---|
1 |
+Address of an [SOC_SUBSYSTEM_FAILURE_DETAILS](https://msdn.microsoft.com/library/windows/hardware/dn376404) structure. |
+
2 |
+Reserved. |
+
3 |
+Reserved. |
+
4 |
+Optional. Address of a vendor-supplied data block. |
+
Minimum supported client |
+Windows 8 |
+
Minimum supported server |
+Windows Server 2012 |
+
| Parameter 1 | +Parameter 1 Value and Cause of Error | +Parameter 2 | +Parameter 3 | +Parameter 4 | +
|---|---|---|---|---|
0x01 |
+NDIS_BUGCHECK_MINIPORT_FATAL_ERROR +A miniport driver has encountered a fatal error and requested re-enumeration. |
+The address of the miniport block. Run [!ndiskd.minidriver](-ndiskd-minidriver.md) with this address for more information. |
+The address of the miniport's Physical Device Object (PDO) |
+The fatal error that caused this live dump to be taken. Possible values: +
|
+
0x25 |
+NDIS_BUGCHECK_WATCHDOG +An attempt to manage the network stack has taken too long. When NDIS calls out into other drivers, NDIS starts a watchdog timer to ensure the call completes promptly. If the call takes too long, NDIS injects a bugcheck. +This can be caused by a simple deadlock. Look with "!stacks 2 ndis" or similar to see if any threads look suspicious. Pay special attention to the PrimaryThread from the NDIS_WATCHDOG_TRIAGE_BLOCK. +This can be caused by lost NBLs, in which case [!ndiskd.pendingnbls](-ndiskd-pendingnbls.md) may help. Check for OIDs that are stuck using [!ndiskd.oid](-ndiskd-oid.md). |
+The operation that took too long. Possible values: +
|
+Cast to ndis!NDIS_WATCHDOG_TRIAGE_BLOCK. Useful fields: +
|
+The value of Parameter 4 depends on the value of Parameter 2. Each number in this list corresponds to the same number in Parameter 2. +
|
+
0x30 |
+NDIS_BUGCHECK_STUCK_NBL +A miniport driver has not returned a NBL back to the stack for some time. |
+The address of the miniport block. Run [!ndiskd.minidriver](-ndiskd-minidriver.md) with this address for more information. |
+0 |
+0 |
+
| Parameter | +Description | +
|---|---|
| 1 | +CS watchdog subcode +0x1 : DRIPS watchdog timeout. The system has been in the resiliency phase of connected standby with no activators active and no device constraints unsatisfied for too long without entering DRIPS (deepest runtime idle platform state). +2 - A pointer to additional information (nt!POP_DRIPS_WATCHDOG_METRICS) +3 - Non-DRIPS duration in milliseconds +4 - Reserved +0x2 : DRIPS watchdog device constraint timeout. The system has been in the resiliency phase of connected standby for too long without entering DRIPS (deepest runtime idle platform state) due to an unsatisfied device constraint with no activators active. +2 - nt!TRIAGE_POP_FX_DEVICE Device +3 - Component index +4 - Reserved +0x3 : DRIPS watchdog preveto timeout. The system has been in the resiliency phase of connected standby for too long without entering DRIPS (deepest runtime idle platform state) due to an active PEP pre-veto with no unsatisfied device constraint and with no activators active. +2 - Veto code +3 - A pointer to the veto name string (PWSTR) +4 - A pointer to the PEP PPM callback +0x4 : Deep Sleep Watchdog +2 - Metrics +3 -NonDeepSleepDurationMs +4 - Reserved +0x5 : Deep Sleep Power Setting Watchdog +2 - Metrics +3 -NonDeepSleepDurationMs +4 - Reserved |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +1 - Type of the failure. +0x1 : REGION_VALIDATION_FAILURE- Region is out of surface bounds. +2 - Pointer to DC +3 - Pointer to SURFACE +4 - Pointer to REGION +0x2 : OPERATOR_NEW_USED - Operator "new" is used to allocate memory. +2 - Reserved +3 - Reserved +4 - Reserved + +0x3 : CRITICAL_APISET_EXTENSIONS_MISSING - Critical extension APISET API is missing. +2 - wchar_t* to the name of the missing function +3 - Reserved +4 - Reserved +0x4 : GDI_SPRITE_SURFACE_INVALID_DELETE - GDI sprite's shape is being deleted without deleting the sprite. +2 - Handle to the SURFACE +3 - Reference count to the SURFACE +4 - PID of the SURFACE owner +0x5 : POINTER_DEVICE_EXCLUSIVE_OPEN_FAILED - Failed to open Pointer device. + +2 - UNICODE_STRING of the device +3 - Reserved +4 - Reserved +0x8 : PUBLIC_DC_INVALID_PRIVATE_MEMBER - A public DC has a pointer to an object owned by a specific process. +2 - Pointer to DC +3 - Process id that owns the object +4 - Reserved +0xA : TTFD_INVOKE_ILLEGAL_ID - Invalid function table index is being used in TTFD. +2 - Reserved +3 - Reserved +4 - Reserved +0xB : OTFD_INVOKE_ILLEGAL_ID - Invalid function table index is being used in ATMFD. +2 - Reserved +3 - Reserved +4 - Reserved +0xC : GFPE_INVOKE_ILLEGAL_ID - Invalid function table index is being used in a PALETTE. +2 - Pointer to the PALETTE +3 - The invalid index +4 - Maximum valid index + 1 +0x10 : USER_SAS_REGISTRATION_FAILED - SAS key registration has failed. +2 - vkey +3 - modifiers +4 - flags |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +Type of the failure.
+ 0x0 : TPM attestation could not be revoked +2 - Pointer to the BDCB_IMAGE_INFORMATION structure for the driver being inspected +3 - TBS_RESULT failure code +0x10000 : ELAM-vendor defined failure +2 - (Optional) ELAM vendor supplied value +3 - (Optional) ELAM vendor supplied value |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +(Optional) ELAM vendor supplied general purpose data block | +
| Parameter | +Description | +
|---|---|
1 |
+Object type of the object whose reference count is being lowered. |
+
2 |
+Object whose reference count is being lowered. |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
| 1 | +Reason Code.
+ 0x1 : DWM failed to initialize after retries, stopping display adapters and falling back to BDD |
+
| 2 | +Reserved | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +Reason Code +0x1 : Cache purge on oplock downgrade to none has failed +2- address of CSVFS!_SCB +0x2 : Cache purge on oplock upgrade from none has failed +2- address of CSVFS!_SCB +0x3 : Cache purge on set purge failure mode +2- address of CSVFS!_SCB +0x4 : Cache flush on oplock downgrade to none failed +2- address of CSVFS!_SCB |
+
| 2 | +See parameter 1 | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +Pointer to bad OBJECT_HEADER | +
| 2 | +Pointer to the resulting OBJECT_TYPE based on the TypeIndex in the OBJECT_HEADER | +
| 3 | +Type of corruption. +0x0 : The type index is corrupt +0x1 : The object security descriptor is invalid |
+
| 4 | +Reserved | +
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x2 |
+The pool entry being checked |
+The size of the pool block |
+0 |
+The special pool pattern check failed. +(The owner has likely corrupted the pool block.) |
+
0x3 |
+The pool entry being checked |
+The read-back flink freelist value |
+The read-back blink freelist value |
+The pool freelist is corrupt. +(In a healthy list, the values of Parameters 2, 3, and 4 should be identical.) |
+
0x5 |
+One of the pool entries |
+Reserved |
+The other pool entry |
+A pair of adjacent pool entries have headers that contradict each other. At least one of them is corrupt. |
+
0x6 |
+One incorrectly-calculated entry |
+Reserved |
+The bad entry that caused the miscalculation |
+The pool block header's previous size is too large. |
+
0x7 |
+0 |
+Reserved |
+The bad pool entry |
+The pool block header size is corrupt. |
+
0x8 |
+0 |
+Reserved |
+The bad pool entry |
+The pool block header size is zero. |
+
0x9 |
+One incorrectly-calculated entry |
+Reserved |
+The bad entry that caused the miscalculation |
+The pool block header size is corrupted (it is too large). |
+
0xA |
+The pool entry that should have been found |
+Reserved |
+The virtual address of the page that should have contained the pool entry |
+The pool block header size is corrupt. |
+
0xD, 0xE, 0xF, 0x23, 0x24, 0x25 |
+Reserved |
+Reserved |
+Reserved |
+The pool header of a freed block has been modified after it was freed. This is not typically the fault of the prior owner of the freed block; instead it is usually (but not always) due to the block preceding the freed block being overrun. |
+
0x20 |
+The pool entry that should have been found |
+The next pool entry |
+Reserved |
+The pool block header size is corrupt. |
+
0X21 |
+The pool pointer being freed |
+The number of bytes allocated for the pool block |
+The corrupted value found following the pool block |
+The data following the pool block being freed is corrupt. Typically this means the consumer (call stack) has overrun the block. |
+
0X22 |
+The address being freed |
+Reserved |
+Reserved |
+An address being freed does not have a tracking entry. This is usually because the call stack is trying to free a pointer that either has already been freed or was never allocated to begin with. |
+
| Parameter | +Description | +
|---|---|
| 1 | +Type of the failure +0x1 : REGION_VALIDATION_FAILURE - Region is out of surface bounds. +2- Pointer to DC +3- Pointer to SURFACE +4- Pointer to REGION +0x2 : OPERATOR_NEW_USED - Operator "new" is used to allocate memory. +2 - Reserved +3 - Reserved +4 - Reserved |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +Reason Code +0x100 Internal |
+
| 2 | +Reserved | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +0x1 : An I/O failed to complete in a reasonable amount of time. +2 - Pointer to the I/O's SRV2_WORK_ITEM |
+
| 2 | +See parameter 1 | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
| 1 | +Failure type +0x1 : An objects handle entry didn't point back to the object. +2 - Pointer to the object type +3 - Pointer to the object handle entry +4 - Expected object |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +Failure type +0x1 : A class driver failed to activate the bus. +2 - Mask of enumerated child PDOs +3 - Mask of activated child PDOs +4 - Reserved |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +Failure type +0x1 : An terminal object could not be generated. +2 - The NT status code of the failure +3 - Reserved +4 - Reserved |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +Failure type (win32kbase!POWER_WATCHDOG_TYPE) +
+```
+ 0x10 : The power request queue is not making progress
+ 2 - Pointer to the thread processing power requests, if any
+ 3 - Pointer to the win32k user lock
+ 4 - Pointer to the power request (win32kbase!PPOWERREQUEST) being
+ processed, if any
+ 0x20 : Calling PO to set power state
+ 2 - Pointer to the power request worker thread
+ 3 - Reserved
+ 4 - Reserved
+ 0x30 : Calling GDI to power on
+ 2 - Pointer to the power request worker thread
+ 3 - Reserved
+ 4 - Reserved
+ 0x40 : Calling DWM to render
+ 2 - Pointer to the power request worker thread
+ 3 - Reserved
+ 4 - Reserved
+ 0x50 : Calling monitor driver to power on
+ 2 - Pointer to the power request worker thread
+ 3 - Reserved
+ 4 - Reserved
+```
+ |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +Reason code +0x1 : Mounting a Shared Virtual disk has failed +2 - Address of Svhdxflt!_SVHDX_VIRTUALDISK_CONTEXT +3 - Address of nt!_FILE_OBJECT +4 - NTSTATUS |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter 1 | +Cause of Error | +
|---|---|
0x1 |
+The fork clone block reference count is corrupt. (This only occurs on checked builds of Windows.) |
+
0x31 |
+The image relocation fix-up table or code stream has been corrupted. This is probably a hardware error. |
+
0x403 |
+The page table and PFNs are out of sync . This is probably a hardware error, especially if parameters 3 & 4 differ by only a single bit. |
+
0x411 |
+A page table entry (PTE) has been corrupted. Parameter 2 is the address of the PTE. |
+
0x777 |
+The caller is unlocking a system cache address that is not currently locked. (This address was either never mapped or is being unlocked twice.) |
+
0x778 |
+The system is using the very last system cache view address, instead of preserving it. |
+
0x780 +0x781 |
+The PTEs mapping the argument system cache view have been corrupted. |
+
0x1000 |
+A caller of MmGetSystemAddressForMdl* tried to map a fully-cached physical page as non-cached. This action would cause a conflicting hardware translation buffer entry, and so it was refused by the operating system. Since the caller specified "bug check on failure" in the requesting MDL, the system had no choice but to issue a bug check in this instance. |
+
0x1010 |
+The caller is unlocking a pageable section that is not currently locked. (This section was either never locked or is being unlocked twice.) |
+
0x1233 |
+A driver tried to map a physical memory page that was not locked. This is illegal because the contents or attributes of the page can change at any time. This is a bug in the code that made the mapping call. Parameter 2 is the page frame number of the physical page that the driver attempted to map. |
+
0x1234 |
+The caller is trying lock a nonexistent pageable section. |
+
0x1235 |
+The caller is trying to protect an MDL with an invalid mapping. |
+
0x3451 |
+The PTEs of a kernel thread stack that has been swapped out are corrupted. |
+
0x5003 |
+The working set free list is corrupt. This is probably a hardware error. |
+
0x5100 |
+The allocation bitmap is corrupt. The memory manager is about to overwrite a virtual address that was already in use. |
+
0x8884 |
+(Windows 7only). Two pages on the standby list that were supposed to have identical page priority values do not, in fact, have identical page priority values. The differing values are captured in parameter 4. |
+
0x8888 +0x8889 |
+Internal memory management structures are corrupted. |
+
0x888A |
+Internal memory management structures (likely the PTE or PFN) are corrupted. |
+
0x41283 |
+The working set index encoded in the PTE is corrupted. |
+
0x41284 |
+A PTE or the working set list is corrupted. |
+
0x41286 |
+The caller is trying to free an invalid pool address. |
+
0x41785 |
+The working set list is corrupted. |
+
0x41287 |
+An illegal page fault occurred while holding working set synchronization. Parameter 2 contains the referenced virtual address. |
+
0x41790 |
+A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs. |
+
0x41792 |
+A corrupted PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE. |
+
0x61940 |
+A PDE has been unexpectedly invalidated. |
+
0x61946 |
+The MDL being created is flawed. This almost always means the driver calling MmProbeAndLockPages is at fault. Typically the driver is attempting to create a Write MDL when it is being asked to process a paging Read. |
+
0x03030303 |
+The boot loader is broken. (This value applies only to Intel Itanium machines.) |
+
Other |
+An unknown memory management error occurred. |
+
| Parameter | +Description | +
|---|---|
| 1 | +The subclass of driver violation. +
+```
+ 0x00081001: ID of the 'KsDeviceMutex' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00081002: ID of the 'KsStreamPointerClone' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00081003: ID of the 'KsStreamPointerLock' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00081004: ID of the 'KsStreamPointerUnlock' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00081005: ID of the 'KsCallbackReturn' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00081006: ID of the 'KsIrqlDeviceCallbacks' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00081007: ID of the 'KsIrqlFilterCallbacks' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00081008: ID of the 'KsIrqlPinCallbacks' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00081009: ID of the 'KsIrqlDDIs' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0008100A: ID of the 'KsFilterMutex' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0008100B: ID of the 'KsProcessingMutex' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00082001: ID of the 'KsTimedPinSetDeviceState' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00082002: ID of the 'KsTimedDeviceCallbacks' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00082003: ID of the 'KsTimedFilterCallbacks' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00082004: ID of the 'KsTimedPinCallbacks' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00082005: ID of the 'KsTimedProcessingMutex' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00071001: ID of the 'PcIrqlDDIs' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00071003: ID of the 'PcIrqlIport' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00071004: ID of the 'PcUnmapAllocatedPages' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00071005: ID of the 'PcAllocatedPages' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00071006: ID of the 'PcRegisterAdapterPower' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00071007: ID of the 'PcAddAdapterDevice' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00071008: ID of the 'PcPropertyRequest' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00071009: ID of the 'PcAllocateAndMapPages' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0007100A: ID of the 'PcPoRequestPowerIrp' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00072001: ID of the 'PcTimedWaveRtStreamSetState' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00020002: ID of the 'IrqlApcLte' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020003: ID of the 'IrqlDispatch' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020004: ID of the 'IrqlExAllocatePool' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020005: ID of the 'IrqlExApcLte1' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020006: ID of the 'IrqlExApcLte2' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020007: ID of the 'IrqlExApcLte3' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020008: ID of the 'IrqlExPassive' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020009: ID of the 'IrqlIoApcLte' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002000A: ID of the 'IrqlIoPassive1' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002000B: ID of the 'IrqlIoPassive2' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002000C: ID of the 'IrqlIoPassive3' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002000D: ID of the 'IrqlIoPassive4' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002000E: ID of the 'IrqlIoPassive5' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002000F: ID of the 'IrqlKeApcLte1' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020010: ID of the 'IrqlKeApcLte2' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020011: ID of the 'IrqlKeDispatchLte' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020015: ID of the 'IrqlKeReleaseSpinLock' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020016: ID of the 'IrqlKeSetEvent' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020019: ID of the 'IrqlMmApcLte' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002001A: ID of the 'IrqlMmDispatch' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002001B: ID of the 'IrqlObPassive' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002001C: ID of the 'IrqlPsPassive' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002001D: ID of the 'IrqlReturn' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0002001E: ID of the 'IrqlRtlPassive' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0002001F: ID of the 'IrqlZwPassive' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00020022: ID of the 'IrqlIoDispatch' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00040003: ID of the 'CriticalRegions' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00040006: ID of the 'QueuedSpinLock' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00040007: ID of the 'QueuedSpinLockRelease' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00040009: ID of the 'SpinLock' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0004000A: ID of the 'SpinlockRelease' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0004000E: ID of the 'GuardedRegions' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0004100B: ID of the 'RequestedPowerIrp' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x0004100F: ID of the 'IoSetCompletionExCompleteIrp' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00043006: ID of the 'PnpRemove' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00091001: ID of the 'NdisOidComplete' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00091002: ID of the 'NdisOidDoubleComplete' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0009100E: ID of the 'NdisOidDoubleRequest' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00092003: ID of the 'NdisTimedOidComplete' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0009200D: ID of the 'NdisTimedDataSend' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0009200F: ID of the 'NdisTimedDataHang' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00092010: ID of the 'NdisFilterTimedPauseComplete' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00092011: ID of the 'NdisFilterTimedDataSend' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00092012: ID of the 'NdisFilterTimedDataReceive' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00093004: ID of the 'WlanAssociation' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00093005: ID of the 'WlanConnectionRoaming' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00093006: ID of the 'WlanDisassociation' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00093101: ID of the 'WlanAssert' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Reserved
+ Parameter 4 - Reserved
+
+ 0x00094007: ID of the 'WlanTimedAssociation' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00094008: ID of the 'WlanTimedConnectionRoaming' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x00094009: ID of the 'WlanTimedConnectRequest' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0009400B: ID of the 'WlanTimedLinkQuality' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+
+ 0x0009400C: ID of the 'WlanTimedScan' rule that was violated.
+ Parameter 2 - A pointer to the string describing the violated rule condition.
+ Parameter 3 - Address of internal rule state (second argument to !ruleinfo).
+ Parameter 4 - Address of supplemental states (third argument to !ruleinfo).
+```
+ |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +Pool Number. +0x0 : ExPoolUntrusted |
+
| 2 | +Pointer to the PEX_WORK_QUEUE | +
| 3 | +Reserved | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
1 |
+The exception code that was not handled |
+
2 |
+The address at which the exception occurred |
+
3 |
+Parameter 0 of the exception |
+
4 |
+Parameter 1 of the exception |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the APC found pending during exit |
+
2 |
+The thread's APC disable count |
+
3 |
+The current IRQL |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The process that was initially charged, if available. |
+
2 |
+The quota type. For the list of all possible quota type values, see the header file Ps.h in the Windows Driver Kit (WDK). |
+
3 |
+The initial charged amount of quota to return. |
+
4 |
+The remaining amount of quota that was not returned. |
+
| Parameter | +Description | +
|---|---|
1 |
+Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. |
+
2 |
+If FatExceptionFilter is on the stack, this parameter specifies the address of the exception record. |
+
3 |
+If FatExceptionFilter is on the stack, this parameter specifies the address of the context record. |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. |
+
2 |
+If NtfsExceptionFilter is on the stack, this parameter specifies the address of the exception record. |
+
3 |
+If NtfsExceptionFilter is on the stack, this parameter specifies the address of the context record. |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. |
+
2 |
+If CdExceptionFilter is on the stack, this parameter specifies the address of the exception record. |
+
3 |
+If CdExceptionFilter is on the stack, this parameter specifies the address of the context record. |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The high 16 bits (the first four hexadecimal digits after the "0x") identify the type of problem. Possible values include: +0xCA550000 RDBSS_BUG_CHECK_CACHESUP +0xC1EE0000 RDBSS_BUG_CHECK_CLEANUP +0xC10E0000 RDBSS_BUG_CHECK_CLOSE +0xBAAD0000 RDBSS_BUG_CHECK_NTEXCEPT + |
+
2 |
+If RxExceptionFilter is on the stack, this parameter specifies the address of the exception record. |
+
3 |
+If RxExceptionFilter is on the stack, this parameter specifies the address of the context record. |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the IRP that was found to be inconsistent |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The trap frame |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Virtual address that caused the fault |
+
2 |
+Physical address that caused the fault |
+
3 |
+Processor status register (PSR) |
+
4 |
+Faulting instruction register (FIR) |
+
| Parameter | +Description | +
|---|---|
1 |
+The new stack pointer |
+
2 |
+The old stack pointer |
+
3 |
+The trap frame address |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The NT status code that describes why the system initialization failed |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Address of the IRP |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the device object |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the worker routine that caused the error. |
+
2 |
+The parameter passed to the worker routine. |
+
3 |
+The address of the work item. |
+
4 |
+Reserved. |
+
| Parameter | +Description | +
|---|---|
1 |
+The exception that caused the bug check |
+
2 |
+The address of the instruction that caused the bug check |
+
3 |
+The address of the context record for the exception that caused the bug check |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+0: system expansion PTE type +1: nonpaged pool expansion PTE type |
+
2 |
+Size of memory request |
+
3 |
+Total free system PTEs |
+
4 |
+Total system PTEs |
+
| Parameter | +Description | +
|---|---|
1 |
+The size of the request that could not be satisfied |
+
2 |
+The number of pages used from nonpaged pool |
+
3 |
+The number of requests from nonpaged pool larger than PAGE_SIZE |
+
4 |
+The number of pages available |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the IRP |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+A pointer to the IRP |
+
2 |
+The cancel routine set by the driver |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the system function (system call routine) |
+
2 |
+The current IRQL |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The total number of dirty pages |
+
2 |
+The number of dirty pages destined for the page file |
+
3 |
+Windows XP and Windows 2000: The size of the nonpaged pool available at the time the bug check occurred +Windows Server 2003 and later: Reserved |
+
4 |
+Windows 2000: The number of transition pages that are currently stranded +Windows XP and later: The most recent modified write error status. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x01 |
+The ListHead value that was corrupted |
+The number of pages available |
+0 |
+The list head was corrupted. |
+
0x02 |
+The entry in the list that is being removed |
+The highest physical page number |
+The reference count of the entry being removed |
+A list entry was corrupted. |
+
0x07 |
+The page frame number |
+The current share count |
+0 |
+A driver has unlocked a certain page more times than it locked it. |
+
0x8D |
+The page frame number whose state is inconsistent |
+0 |
+0 |
+The page-free list is corrupted. This error code most likely indicates a hardware issue. |
+
0x8F |
+New page number |
+Old page number |
+0 |
+The free or zeroed page listhead is corrupted. |
+
0x99 |
+Page frame number |
+Current page state |
+0 |
+A page table entry (PTE) or PFN is corrupted. |
+
0x9A |
+Page frame number |
+Current page state |
+The reference count of the entry that is being removed |
+A driver attempted to free a page that is still locked for IO. |
+
| Parameter | +Description | +
|---|---|
1 |
+The pointer to the dispatcher object for the target process, or if the thread is already attached, the pointer to the object for the original process. |
+
2 |
+The pointer to the dispatcher object of the process that the current thread is currently attached to. |
+
3 |
+The value of the thread's APC state index. |
+
4 |
+A non-zero value indicates that a DPC is running on the current processor. |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory address referenced |
+
2 |
+0: Read operation +1: Write operation |
+
3 |
+Address that referenced memory (if known) |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Reserved |
+
2 |
+Reserved |
+
3 |
+The pointer to the hive (if available) |
+
4 |
+If the hive is corrupt, the return code of HvCheckHive (if available) |
+
| Parameter | +Description | +
|---|---|
1 |
+Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Reserved |
+
2 |
+The location selector |
+
3 |
+The NT status code |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The NT status code that caused the failure |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The NT status code that caused the initialization failure |
+
2 |
+0 |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The NT status code that caused the Windows operating system to conclude that initialization failed |
+
2 |
+0 |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The NT status code that caused the Windows operating system to conclude that initialization failed |
+
2 |
+0 |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The NT status code that caused the Windows operating system to conclude that initialization failed |
+
2 |
+0 |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The NT status code that caused the Windows operating system to conclude that initialization failed |
+
2 |
+0 |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+1 |
+
2 |
+The NT status code that led the Windows operating system to assume that it failed to load the hive |
+
3 |
+The index of the hive in the hive list |
+
4 |
+A pointer to a UNICODE_STRING structure that contains the file name of the hive |
+
| Parameter | +Description | +
|---|---|
1 |
+Reserved |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+The NT status code (if it is available) |
+
| Parameter | +Description | +
|---|---|
1 |
+1 |
+
2 |
+The NT status code that led the Windows operating system to assume that it had failed to convert the hive |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of error | +
|---|---|---|---|---|
0x00 |
+The pointer to the process object |
+The number of locked pages |
+The pointer to driver stacks (if they are enabled). Otherwise, this parameter is zero. |
+The process being terminated has locked memory pages. The driver must unlock any memory that it might have locked in a process, before the process terminates. |
+
0x01 |
+MDL specified by the driver |
+Current number of locked memory pages in that process |
+A pointer to driver stacks for that process (if they are enabled). Otherwise, this parameter is zero. |
+The driver is attempting to unlock process memory pages that are not locked. |
+
| Parameter | +Description | +
|---|---|
1 |
+0: The page of kernel data was retrieved from page cache. +1: The page was retrieved from a disk. +2: The page was retrieved from a disk, the storage stack returned SUCCESS, but Status.Information is not equal to PAGE_SIZE. |
+
2 |
+The value that appears in the stack where the signature should be. |
+
3 |
+0 |
+
4 |
+The address of the signature on the kernel stack |
+
| Parameter | +Description | +
|---|---|
1 |
+The status code |
+
2 |
+The I/O status code |
+
3 |
+The page file number |
+
4 |
+The offset into page file |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause. | +
|---|---|---|---|---|
0x1 |
+The major processor control block (PRCB) level of Ntoskrnl.exe. |
+The major PRCB level of Hal.dll. |
+Reserved |
+The PRCB release levels are mismatched. (Something is out of date.) |
+
0x2 |
+The build type of Ntoskrnl.exe. |
+The build type of Hal.dll. |
+Reserved |
+The build types are mismatched. |
+
0x3 |
+The size of the loader parameter extension. |
+The major version of the loader parameter extension. |
+The minor version of the loader parameter extension. |
+The loader (ntldr) and HAL versions are mismatched. |
+
| Parameter | +Description | +
|---|---|
1 |
+The lock type that was held (1, 2, or 3) |
+
2 |
+The error status (usually an I/O status code) |
+
3 |
+If Lock Type is 1: the current process +If Lock Type is 2 or 3: 0 |
+
4 |
+The virtual address that could not be paged into memory |
+
| Parameter | +Description | +
|---|---|
1 |
+The lock type that was held (3 or 4) |
+
2 |
+The error status (typically an I/O status code) |
+
3 |
+The address of the InPageSupport structure |
+
4 |
+The faulting address |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the page table entry (PTE) |
+
2 |
+The error status (usually an I/O status code) |
+
3 |
+The PTE contents |
+
4 |
+The faulting address |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of a UNICODE_STRING structure, or the address of the device object that could not be mounted |
+
2 |
+0 |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter 1 | +Parameter 1 Value and Cause of Error | +Parameter 2 | +Parameter 3 | +Parameter 4 | +
|---|---|---|---|---|
0x01 |
+NDIS_BUGCHECK_ALLOCATE_SHARED_MEM_HIGH_IRQL +A driver called [NdisMAllocateSharedMemory](https://msdn.microsoft.com/library/windows/hardware/ff562782) at a raised IRQL. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The length of the requested shared memory |
+The current IRQL |
+
0x02 |
+NDIS_BUGCHECK_SHARED_MEM_CORRUPTION +During a call to [NdisMAllocateSharedMemory](https://msdn.microsoft.com/library/windows/hardware/ff562782), NDIS detected that a previously-allocated shared memory page had been corrupted. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The shared memory page that was corrupted |
+The address of a NDIS_WRAPPER_CONTEXTE that keeps track of shared memory allocations by the driver |
+
0x03 |
+NDIS_BUGCHECK_FREE_INVALID_SHARED_MEM +A miniport driver called [NdisMFreeSharedMemory](https://msdn.microsoft.com/library/windows/hardware/ff563589) (Async) with a shared memory address that had already been freed. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The page from which this shared memory was allocated |
+The virtual address of the shared memory |
+
0x04 |
+NDIS_BUGCHECK_UNLOAD_DRIVER_INVALID_PARAMETER +[AddDevice](https://msdn.microsoft.com/library/windows/hardware/ff540521) was called with a driver that is not on the list of drivers that are registered with NDIS. +Enabled only on special instrumented NDIS. |
+The address of the NDIS_M_DRIVER_BLOCK |
+The address of the DRIVER_OBJECT |
+0 |
+
0x05 |
+NDIS_BUGCHECK_RECVD_PACKET_IN_USE_BAD_STACK_LOCATION +An Ethernet driver indicated that it received a packet using a packet descriptor that was currently in use by the protocol stack. +Caught by checking stack packet location. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the packet descriptor used by the driver. Run [!ndiskd.pkt](-ndiskd-pkt.md) with this address for more information. |
+The address of the packet array that contained this packet descriptor |
+
0x06 |
+NDIS_BUGCHECK_RECVD_PACKET_IN_USE_BAD_REF_COUNT +An Ethernet driver indicated that it received a packet using a packet descriptor that was currently in use by the protocol stack. +Caught by checking packet reference count. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the packet descriptor used by the driver. Run [!ndiskd.pkt](-ndiskd-pkt.md) with this address for more information. |
+The address of the packet array that contained this packet descriptor |
+
0x07 |
+An FDDI driver indicated that it received a packet by using a packet descriptor that was currently in use by the protocol stack. +Caught by checking reference count. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the packet descriptor used by the driver. Run [!ndiskd.pkt](-ndiskd-pkt.md) with this address for more information. |
+The address of the packet array that contained this packet descriptor |
+
0x08 |
+NDIS_BUGCHECK_HALT_WITHOUT_INTERRUPT_DEREGISTER +A miniport driver did not deregister its interrupt during the halt process. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the NDIS_MINIPORT_INTERRUPT |
+0 |
+
0x09 |
+NDIS_BUGCHECK_HALT_WITHOUT_CANCEL_TIMER +A miniport driver stopped without successfully canceling all its timers. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) |
+0 |
+
0x0A |
+NDIS_BUGCHECK_DRIVER_UNLOAD_UNEXPECTED +A miniport driver is getting unloaded prematurely. |
+The address of the NDIS_M_DRIVER_BLOCK |
+The address of the DRIVER_OBJECT |
+The reference count for the miniport driver |
+
0x0B |
+NDIS_BUGCHECK_INIT_FAILED_WITHOUT_INTERRUPT_DEREGISTER +A miniport driver failed its initialization without deregistering its interrupt. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the NDIS_MINIPORT_INTERRUPT |
+0 |
+
0x0C |
+NDIS_BUGCHECK_INIT_FAILED_WITHOUT_CANCEL_TIMER +A miniport driver failed its initialization without successfully canceling all its timers. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) |
+0 |
+
0x0D |
+NDIS_BUGCHECK_HALT_INIT_WITHOUT_INTERRUPT_DEREGISTER +A miniport driver did not deregister its interrupt during the halt process. +The halt was called from the initialize routine after the miniport driver returned success from its initialize handler. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the NDIS_MINIPORT_INTERRUPT |
+0 |
+
0x0E |
+NDIS_BUGCHECK_HALT_INIT_WITHOUT_CANCEL_TIMER +A miniport driver stopped without successfully canceling all its timers. +The halt was called from the initialize routine after the miniport driver returned success from its initialize handler. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) |
+0 |
+
0x0F |
+NDIS_BUGCHECK_RESET_COMPLETE_UNEXPECTED +A miniport driver called [NdisMResetComplete](https://msdn.microsoft.com/library/windows/hardware/ff563663) without any pending reset request. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The reset status |
+AddressingReset (BOOLEAN) |
+
0x10 |
+NDIS_BUGCHECK_PM_INIT_FAILED_NO_INT_DEREGISTER +After resuming from a low-power state, a miniport driver failed its initialization without deregistering its interrupt. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the NDIS_MINIPORT_INTERRUPT |
+0 |
+
0x11 |
+NDIS_BUGCHECK_PM_INIT_FAILED_NO_CANCEL_TIMER +After resuming from a low-power state, a miniport driver failed its initialization without successfully canceling all its timers. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the miniport driver's timer queue (NDIS_MINIPORT_TIMER) |
+0 |
+
0x12 |
+NDIS_BUGCHECK_NFILTER_RECVD_PACKET_BAD_REF_COUNT +A miniport driver indicated that it received a packet using a packet descriptor that was currently in use by the protocol stack. +Caught by checking packet reference count. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the packet descriptor used by the driver. Run [!ndiskd.pkt](-ndiskd-pkt.md) with this address for more information. |
+The address of the packet array that contained this packet descriptor |
+
0x13 |
+NDIS_BUGCHECK_TFILTER_RECVD_PACKET_BAD_REF_COUNT +A Token-Ring miniport driver indicated that it received a packet using a packet descriptor that was currently in use by the protocol stack. +Caught by checking packet reference count. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The address of the packet descriptor used by the driver. Run [!ndiskd.pkt](-ndiskd-pkt.md) with this address for more information. |
+The address of the packet array that contained this packet descriptor |
+
0x14 |
+NDIS_BUGCHECK_WAIT_EVENT_HIGH_IRQL +An NDIS driver called [NdisWaitEvent](https://msdn.microsoft.com/library/windows/hardware/ff564651) at an illegal IRQL |
+The actual IRQL |
+0 |
+0 |
+
0x15 |
+NDIS_BUGCHECK_INVALID_NDIS5_CALL +A miniport driver called an API that is reserved for older drivers. The driver should only call NDIS 6.x APIs. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+0 |
+0 |
+
0x16 |
+NDIS_BUGCHECK_INVALID_OPEN_IN_BIND_CONTEXT +A protocol driver improperly opened an adapter during binding. |
+The address of the specific protocol. Run [!ndiskd.protocol](-ndiskd-protocol.md) with this address for more information. |
+The address of the context area that is allocated by the protocol driver. +Cast to ndis!NDIS_BIND_CONTEXT. |
+The address of the open handle. Run [!ndiskd.mopen](-ndiskd-mopen.md) with this address for more information. |
+
0x17 |
+NDIS_BUGCHECK_IFPROVIDER_DEREGISTER_UNEXPECTED +An Interface Provider called [NdisIfDeregisterProvider](https://msdn.microsoft.com/library/windows/hardware/ff562703) without first removing all its Interfaces. |
+The address of the interface provider handle. Run [!ndiskd.ifprovider](-ndiskd-ifprovider.md) with this address for more information. |
+0 |
+0 |
+
0x1B |
+NDIS_BUGCHECK_IF_STACK_TABLE_LOOP +A driver attempted to add an Interface to the ifStackTable, but doing so would cause a cycle. The ifStackTable must not have cycles. Run [!ndiskd.ifstacktable](-ndiskd-ifstacktable.md) to see the current table (prior to this call to [NdisIfAddIfStackEntry](https://msdn.microsoft.com/library/windows/hardware/ff562693)). |
+The HigherLayerIfIndex being added to the table |
+The LowerLayerIfIndex being added to the table |
+0 |
+
0x1C |
+NDIS_BUGCHECK_MINIPORT_FAILED_OID_WHICH_MUST_SUCCEED +A miniport driver failed an OID request that must not fail. Doing so would leak memory or other resources. |
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+The OID that was failed. Use [!ndiskd.help](-ndiskd-help.md) to find the name of this OID. |
+The failure status code (NDIS_STATUS_XXX) with which the OID request was completed |
+
0x1D |
+NDIS_BUGCHECK_OID_REQUEST_INVALID_BUFFER +A miniport driver or filter driver has completed an OID request illegally. Check that BytesWritten is not greater than the entire length of the buffer. |
+The address of the specific miniport adapter or filter module block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) or [!ndiskd.filter](-ndiskd-filter.md) with this address for more information. |
+The address to the [NDIS_OID_REQUEST](https://msdn.microsoft.com/library/windows/hardware/ff566710) that was completed illegally. Inspect it with [!ndiskd.oid](-ndiskd-oid.md). |
+0 |
+
0x1E |
+NDIS_BUGCHECK_REFCOUNT_IMBALANCE +NDIS has detected an error in an internal refcount. This can be caused by a refcount underflow (more dereferences than references), or by a tag mismatch. |
+0 |
+Internal handle. Use [!ndiskd.ndisref](-ndiskd-ndisref.md) or cast to ndis!NDIS_REFCOUNT_BLOCK. |
+The current reftag value |
+
0x1F |
+NDIS_BUGCHECK_ILLEGAL_MINIPORT_STATE_TRANSITION +A miniport driver completed a state transition illegally. |
+What failed. Possible values: +
|
+The address of the specific miniport adapter block. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) with this address for more information. |
+0 |
+
0x20 |
+NDIS_BUGCHECK_STATUS_INDICATION_INVALID_BUFFER +A miniport driver or filter driver indicated an illegal [NDIS_STATUS_INDICATION](https://msdn.microsoft.com/library/windows/hardware/ff567373). |
+The type of the status indication. Run [!ndiskd.help](-ndiskd-help.md) with this code for more information. |
+The handle of the driver instance that indicated this illegal status indication. Run [!ndiskd.netadapter](-ndiskd-netadapter.md) or [!ndiskd.filter](-ndiskd-filter.md) with this handle for more information. |
+The address of the status indication payload. Its interpretation depends on the type of status indication. |
+
0x21 |
+NDIS_BUGCHECK_INVALID_OBJECT_HEADER +A driver created an invalid [NDIS_OBJECT_HEADER](https://msdn.microsoft.com/library/windows/hardware/ff566588). |
+The handle of the driver that indicated the illegal status indication. Run [!ndiskd.minidriver](-ndiskd-minidriver.md) or [!ndiskd.filterdriver](-ndiskd-filterdriver.md) with this handle for more information. |
+The object with the malformed header. Its interpretation depends on the API being called. For example, if the driver called NdisAllocateCloneOidRequest, then cast the object to ndis!NDIS_OID_REQUEST. |
+0 |
+
0x22 |
+NDIS_BUGCHECK_ILLEGAL_NET_PNP_EVENT +A miniport driver or filter driver indicated an illegal [NET_PNP_EVENT_NOTIFICATION](https://msdn.microsoft.com/library/windows/hardware/ff568752). |
+The handle of the driver that indicated the illegal status indication. Run [!ndiskd.minidriver](-ndiskd-minidriver.md) or [!ndiskd.filterdriver](-ndiskd-filterdriver.md) with this handle for more information. |
+Cast to NET_PNP_EVENT_NOTIFICATION |
+0 |
+
0x23 |
+NDIS_BUGCHECK_PD_ERROR +An error was detected in the Packet Direct datapath. |
+The subtype of the bugcheck. Possible values: +
|
+The value of Parameter 3 depends on the value of Parameter 2. Each number in this list corresponds to the same number in Parameter 2. +
|
+The value of Parameter 4 depends on the value of Parameter 2. Each number in this list corresponds to the same number in Parameter 2. +
|
+
0x24 |
+NDIS_BUGCHECK_UNEXPECTED_FAILURE +An internal operation failed unexpectedly. This is likely to be a bug in NDIS.SYS itself. |
+The operation that failed. Possible values: +0x01 : NDIS_BUGCHECK_UNEXPECTED_FAILURE_KEWAITFORSINGLEOBJECT +A call to KeWaitForSingleObject failed. |
+The failure status code |
+0 |
+
0x25 |
+NDIS_BUGCHECK_WATCHDOG +An attempt to manage the network stack has taken too long. When NDIS calls out into other drivers, NDIS starts a watchdog timer to ensure the call completes promptly. If the call takes too long, NDIS injects a bugcheck. +This can be caused by a simple deadlock. Look with "!stacks 2 ndis" or similar to see if any threads look suspicious. Pay special attention to the PrimaryThread from the NDIS_WATCHDOG_TRIAGE_BLOCK. +This can be caused by lost NBLs, in which case [!ndiskd.pendingnbls](-ndiskd-pendingnbls.md) may help. Check for OIDs that are stuck using [!ndiskd.oid](-ndiskd-oid.md). |
+The operation that took too long. Possible values: +
|
+Cast to ndis!NDIS_WATCHDOG_TRIAGE_BLOCK. Useful fields: +
|
+The value of Parameter 4 depends on the value of Parameter 2. Each number in this list corresponds to the same hexadecimal value in Parameter 2. +
|
+
0x26 |
+NDIS_BUGCHECK_INVALID_OID_COMPLETION +A miniport driver attempted to complete an OID request that is not currently pending on that miniport driver. This can be caused by the driver trying to complete the same request more than one time. |
+The miniport driver handle that caused the bugcheck. Run [!ndiskd.minidriver](-ndiskd-minidriver.md) with this handle for more information. |
+The NDIS OID request the miniport driver was trying to complete. You can try to run [!ndiskd.oid](-ndiskd-oid.md) with this request but the memory might not be valid at this point. |
+0 |
+
0x27 |
+NDIS_BUGCHECK_LEAKED_NBL +A driver has leaked a [NET_BUFFER_LIST](https://msdn.microsoft.com/library/windows/hardware/ff568388) structure. Check with [!ndiskd.pendingnbls](-ndiskd-pendingnbls.md) to see any NBLs that are still pending on this driver. |
+Where the leak was detected. Possible values: +
|
+0 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The number of physical pages that are found |
+
2 |
+The lowest physical page |
+
3 |
+The highest physical page |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The exception code that was not handled |
+
2 |
+The address where the exception occurred |
+
3 |
+The address of the exception record |
+
4 |
+The address of the context record |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Cause | +
|---|---|---|---|
0x0 |
+0 |
+0 |
+The OEM HAL font is not a valid .fon format file, so setup cannot display text. +This cause indicates that Vgaxxx.fon on the boot floppy or CD is damaged. |
+
0x1 |
+The precise video initialization failure: +0:NtCreateFile of \device\video0 +1: IOCTL_VIDEO_QUERY_NUM_AVAIL_MODES +2: IOCTL_VIDEO_QUERY_AVAIL_MODES +3: The desired video mode is not supported. This value indicates an internal setup error. +4: IOCTL_VIDEO_SET_CURRENT_MODE (unable to set video mode) +5: IOCTL_VIDEO_MAP_VIDEO_MEMORY +6: IOCTL_VIDEO_LOAD_AND_SET_FONT |
+The status code from the NT API call, if appropriate |
+Video initialization failed. +This failure might indicate that the disk that contains Vga.sys (or another video driver that is appropriate to the computer) is damaged or that the computer has video hardware that the Microsoft Windows operating system cannot communicate with. + |
+
0x2 |
+0 |
+0 |
+Out of memory. + |
+
0x3 |
+The precise keyboard initialization failure: +0:NtCreateFile of \device\KeyboardClass0 failed. (Setup did not find a keyboard connected to the computer.) +1: Unable to load keyboard layout DLL. (Setup could not load the keyboard layout file. This failure indicates that the CD or floppy disk is missing a file, such as Kbdus.dll for the U.S. release or another layout DLL for localized releases.) |
+0 |
+Keyboard initialization failed. +This failure might indicate that the disk that contains the keyboard driver (I8042prt.sys or Kbdclass.sys) is damaged or that the computer has keyboard hardware that Windows cannot communicate with. This failure might also mean that the keyboard layout DLL could not be loaded. + |
+
0x4 |
+0 |
+0 |
+Setup could not resolve the ARC device path name of the device that setup was started from. +This error is an internal setup error. |
+
0x5 |
+Reserved |
+Reserved |
+Partitioning sanity check failed. +This error indicates a bug in a disk driver. + |
+
| Parameter | +Description | +
|---|---|
1 |
+The disk signature from MBR |
+
2 |
+The MBR checksum that the OS Loader calculates |
+
3 |
+The MBR checksum that the system calculates |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The exception code that was not handled |
+
2 |
+The address where the exception occurred |
+
3 |
+The trap frame |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The base address of the driver |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The handle that is passed to NtClose |
+
2 |
+0: The caller tried to close a protected handle +1: The caller tried to close an invalid handle |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the queue entry whose flink or blink field is NULL. |
+
2 |
+The address of the queue that is being referenced. Typically, this queue is an ExWorkerQueue. |
+
3 |
+The base address of the ExWorkerQueue array. (This address helps you determine if the queue in question is indeed an ExWorkerQueue. If the queue is an ExWorkerQueue, the offset from this parameter will isolate the queue.) |
+
4 |
+Assuming the queue is an ExWorkerQueue, this value is the address of the worker routine that would have been called if the work item had been valid. (You can use this address to isolate the driver that is misusing the work queue.) |
+
| Parameter | +Description | +
|---|---|
1 |
+The low-order 32 bits of the product expiration date |
+
2 |
+The high-order 32 bits of the product expiration date |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|---|
0x00 |
+0: The product should be WinNT +1: The product should be LanmanNT or ServerNT |
+A partial serial number |
+The first two characters of the product type from the product options |
+Offline product type changes have been attempted. |
+
0x01 |
+The registered evaluation time from source 1 |
+A partial serial number |
+The registered evaluation time from an alternate source |
+Offline changes to the Microsoft Windows evaluation unit time period have been attempted. |
+
0x02 |
+The status code that is associated with the open failure |
+0 |
+0 |
+The setup key could not be opened. |
+
0x03 |
+The status code that is associated with the key lookup failure |
+0 |
+0 |
+The SetupType or SetupInProgress value from the setup key is missing, so setup mode could not be detected. |
+
0x04 |
+The status code that is associated with the key lookup failure |
+0 |
+0 |
+The SystemPrefix value from the setup key is missing. |
+
0x05 |
+(See the setup code) |
+An invalid value was found in licensed processors |
+The officially licensed number of processors |
+Offline changes to the number of licensed processors have been attempted. |
+
0x06 |
+The status code that is associated with the open failure |
+0 |
+0 |
+The ProductOptions key could not be opened. |
+
0x07 |
+The status code that is associated with the read failure |
+0 |
+0 |
+The ProductType value could not be read. |
+
0x08 |
+The status code that is associated with the Change Notify failure |
+0 |
+0 |
+Change Notify on ProductOptions failed. |
+
0x09 |
+The status code that is associated with the Change Notify failure |
+0 |
+0 |
+Change Notify on SystemPrefix failed. |
+
0x0A |
+0 |
+0 |
+0 |
+An NTW system was converted to an NTS system. |
+
0x0B |
+The status code that is associated with the change failure |
+0 |
+0 |
+The reference of the setup key failed. |
+
0x0C |
+The status code that is associated with the change failure |
+0 |
+0 |
+The reference of the product options key failed. |
+
0x0D |
+The status code that is associated with the failure |
+0 |
+0 |
+The attempt to open ProductOptions in the worker thread failed. |
+
0x0F |
+The status code that is associated with the failure |
+0 |
+0 |
+The attempt to open the setup key failed. |
+
0x10 |
+The status code that is associated with the failure |
+0: set value failed +1: Change Notify failed |
+0 |
+A failure occurred in the setup key worker thread. |
+
0x11 |
+The status code that is associated with the failure |
+0: set value failed +1: Change Notify failed |
+0 |
+A failure occurred in the product options key worker thread. |
+
0x12 |
+The status code that is associated with the failure |
+0 |
+0 |
+Unable to open the LicenseInfoSuites key for the suite. |
+
0x13 |
+The status code that is associated with the failure |
+0 |
+0 |
+Unable to query the LicenseInfoSuites key for the suite. |
+
0x14 |
+The size of the memory allocation |
+0 |
+0 |
+Unable to allocate memory. |
+
0x15 |
+The status code that is associated with the failure |
+Reserved |
+0 |
+Unable to reset the ConcurrentLimit value for the suite key. |
+
0x16 |
+The status code that is associated with the failure |
+0 |
+0 |
+Unable to open the license key for a suite product. |
+
0x17 |
+The status code that is associated with the failure |
+0 |
+0 |
+Unable to reset the ConcurrentLimit value for a suite product. |
+
0x18 |
+The status code that is associated with the open failure |
+Reserved |
+0 |
+Unable to start the Change Notify for the LicenseInfoSuites. |
+
0x19 |
+0 |
+0 |
+0 |
+A suite is running on a system that must be PDC. |
+
0x1A |
+The status code that is associated with the failure |
+0 |
+0 |
+A failure occurred when enumerating the suites. |
+
0x1B |
+0 |
+0 |
+0 |
+Changes to the policy cache were attempted. |
+
| Parameter | +Description | +
|---|---|
1 |
+The source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. |
+
2 |
+If UdfExceptionFilter is on the stack, this parameter specifies the address of the exception record. |
+
3 |
+If UdfExceptionFilter is on the stack, this parameter specifies the address of the context record. |
+
4 |
+Reserved. |
+
| Parameter | +Description | +
|---|---|
1 |
+The low 32 bits of P5_MC_TYPE Machine Service Report (MSR) |
+
2 |
+The address of the MCA_EXCEPTION structure |
+
3 |
+The high 32 bits of P5_MC_ADDR MSR |
+
4 |
+The low 32 bits of P5_MC_ADDR MSR |
+
| Parameter | +Description | +
|---|---|
1 |
+The bank number |
+
2 |
+The address of the MCA_EXCEPTION structure |
+
3 |
+The high 32 bits of MCi_STATUS MSR for the MCA bank that had the error |
+
4 |
+The low 32 bits of MCi_STATUS MSR for the MCA bank that had the error |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|---|
0x1 |
+The address of the log |
+The size of the log |
+0 |
++ |
0x2 |
+The address of the log |
+The size of the log |
+The error code |
+The system abstraction layer (SAL) returned an error for SAL_GET_STATEINFO while processing MCA. |
+
0x3 |
+The address of the log |
+The size of the log |
+The error code |
+SAL returned an error for SAL_CLEAR_STATEINFO while it processed MCA. |
+
0x4 |
+The address of the log |
+The size of the log |
+0 |
+Firmware (FW) reported a fatal MCA. |
+
0x5 |
+The address of the log |
+The size of the log |
+0 |
+There are two possible causes: +
|
+
0xB |
+The address of the log |
+The size of the log |
+0 |
++ |
0xC |
+The address of the log |
+The size of the log |
+The error code |
+SAL returned an error for SAL_GET_STATEINFO while processing an INIT event. |
+
0xD |
+The address of the log |
+The size of the log |
+The error code |
+SAL returned an error for SAL_CLEAR_STATEINFO while it processed an INIT event. |
+
0xE |
+The address of the log |
+The size of the log |
+0 |
++ |
| Parameter | +Description | +
|---|---|
1 |
+The process that failed to satisfy a health check in the configured time-out |
+
2 |
+The health monitoring time-out, in seconds |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|---|
0x1 |
+The device object |
+Reserved |
+Reserved |
+The device object that is being freed still has an outstanding power request that it has not completed. |
+
0x2 |
+The target device's device object, if it is available |
+The device object |
+The driver object, if it is available |
+The device object completed the I/O request packet (IRP) for the system power state request, but it did not call PoStartNextPowerIrp. |
+
0x3 |
+The physical device object (PDO) of the stack |
+The functional device object (FDO) of the stack. In Windows 7 and later, nt!TRIAGE_9F_POWER. |
+The blocked IRP |
+A device object has been blocking an IRP for too long a time. |
+
0x4 |
+Time-out value, in seconds. |
+The thread currently holding onto the Plug-and-Play (PnP) lock. |
+In Windows 7 and later, nt!TRIAGE_9F_POWER. |
+The power state transition timed out waiting to synchronize with the PnP subsystem. |
+
0x500 |
+Reserved |
+The target device's device object, if available |
+Device object |
+The device object completed the IRP for the system power state request, but it did not call PoStartNextPowerIrp. |
+
| Parameter | +Description | +
|---|---|
1 |
+The virtual memory address that could not be accessed. +Use [!pool](-pool.md) on this address to see whether it's Paged pool. These commands, may also be useful in gathering information about the failure: [!pte](-pte.md), [!address](-address.md), and [ln (List Nearest Symbols)](ln--list-nearest-symbols-.md). |
+
2 |
+IRQL at time of the fault. +VALUES: +2 : The IRQL was DISPATCH_LEVEL at the time of the fault. END_VALUES |
+
3 |
+Bitfield describing the operation that caused the fault. +Bit 0: +VALUES: +0: Read operation +1: Write operation +Bit 3: (Only available on chipsets that support this level of reporting.) +VALUES: +0: Not an execute operation +1: Execute operation +Bit 0 and Bit 3 combined values: +0x0 : Fault trying to READ from the address in parameter 1. +0x1 : Fault trying to WRITE to the address in parameter 1. +0x8 : Fault trying to EXECUTE code from the address in parameter 1. +This value is usually caused by: +
|
+
4 |
+The instruction pointer at the time of the fault. +Use the [ln (List Nearest Symbols)](ln--list-nearest-symbols-.md) command on this address to see the name of the function. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|---|
0x1 |
+1: A device has overrun its maximum number of reference counts. +2, 3, or 4: (Windows Server 2003, Windows XP, and Windows 2000 only) Too many inrush power IRPs have been queued. +5: (Windows Server 2003, Windows XP, and Windows 2000 only) The power IRP has been sent to a passive level device object. +6: The system has failed to allocate a necessary power IRP. |
+If Parameter 2 has a value of 1, the maximum number of references allowed. +If Parameter 2 has a value of 2, 3, or 4, the maximum number of pending IRPs allowed. +If Parameter 2 has a value of 6, the target device object. |
+If Parameter 2 has value of 6, indicates whether this is a system (0x0) or device (0x1) power IRP. | +An error occurred during the handling of the power I/O request packet (IRP). |
+
0x2 |
+Reserved |
+Reserved |
+Reserved |
+An internal failure has occurred while attempting to process a power event. For more information, see [Debugging bug check 0xA0 when parameter 1 equals 0x2](#parameter-1-equals-0x2). |
+
0x3 |
+The expected checksum |
+The actual checksum |
+The line number of the failure |
+The checksum for a hibernation context page does not match its expected checksum. |
+
0x4 |
+The expected checksum |
+The actual checksum |
+The line number of the failure |
+The checksum for a page about to be written to the hibernation file does not match its expected checksum. |
+
0x5 |
+Reserved |
+Reserved |
+Reserved |
+An unknown shutdown code has been sent to the system shutdown handler. |
+
0x7 |
+Reserved |
+Reserved |
+Reserved |
+An unhandled exception has occurred. For more information, see [Debugging bug check 0xA0 when parameter 1 equals 0x7](#parameter-1-equals-0x7). |
+
0x8 |
+This parameter is always set to 0x100. |
+The device object |
+POWER_CHANNEL_SUMMARY + |
+A fatal error occurred while processing a system power event. |
+
0x9 |
+Status code |
+Mirroring phase |
+Reserved |
+A fatal error occured while preparing the hibernate file. |
+
0xA |
+0: A bug check was requested immediately upon resuming. +1: A bug check was requested during resume after all non-pageable devices had been powered on. +2: A bug check was requested during resume after all devices had been powered on. |
+Reserved |
+Reserved |
+A bug check was requested when waking for debugging purposes. |
+
0xB |
+Size of the hibernation file. |
+Hibernation progress before running out of space +0: HIBERFILE_PROGRESS_FREE_MAP +1: HIBERFILE_PROGRESS_RESUME_CONTEXT +2: HIBERFILE_PROGRESS_PROCESSOR_STATEE +3: HIBERFILE_PROGRESS_MEMORY_RANGES +4: HIBERFILE_PROGRESS_TABLE_PAGES +5: HIBERFILE_PROGRESS_MEMORY_IMAGE |
+Size of the remaining memory ranges. |
+The hibernation file is too small. |
+
0xC |
+Status code |
+Dump stack context |
+Reserved |
+The dump stack failed to initialize. |
+
0x101 |
+Reserved |
+Exception pointer. |
+Reserved |
+An unhandled exception occured while processing a system power event. For more information, see [Debugging bug check 0xA0 when parameter 1 equals 0x101](#parameter-1-equals-0x101). |
+
0x102 |
+Reserved |
+DUMP_INITIALIZATION_CONTEXT |
+POP_HIBER_CONTEXT |
+The hibernation working buffer size is not page aligned. |
+
0x103 |
+Reserved |
+POP_HIBER_CONTEXT |
+Reserved |
+All working pages have failed to be accounted for during the hibernation process. |
+
0x104 |
+Reserved |
+POP_HIBER_CONTEXT |
+Reserved |
+An attempt was made to map internal hibernation memory while the internal memory structures were locked. |
+
0x105 |
+Reserved |
+POP_HIBER_CONTEXT |
+Reserved |
+An attempt was made to map internal hibernation memory with an unsupported memory type flag. |
+
0x106 |
+Reserved |
+The memory descriptor list (MDL) |
+Reserved |
+A memory descriptor list was created during the hibernation process which describes memory that is not paged-aligned. |
+
0x107 |
+Reserved |
+POP_HIBER_CONTEXT |
+PO_MEMORY_RANGE_ARRAY |
+A data mismatch has occurred in the internal hibernation data structures. |
+
0x108 |
+Reserved |
+POP_HIBER_CONTEXT |
+Reserved |
+The disk subsystem failed to properly write part of the hibernation file. |
+
0x109 |
+Reserved |
+Expected checksum |
+Actual checksum |
+The checksum for the processor state data does not match its expected checksum. |
+
0x10A |
+Reserved |
+POP_HIBER_CONTEXT |
+NTSTATUS |
+The disk subsystem failed to properly read or write part of the hibernation file. |
+
0x10B |
+Reserved |
+Current hibernation progress |
+Reserved |
+An attempt was made to mark pages for the boot phase of hibernation at the wrong time using the PoSetHiberRange API. |
+
0x10C |
+Reserved |
+Flags provided to the API |
+Length to mark |
+The PoSetHiberRange API was called with invalid parameters. |
+
0x200 |
+Reserved |
+DEVICE_OBJECT |
+DEVICE_OBJECT_POWER_EXTENSION |
+An unknown device type is being checked for an idle state. |
+
0x300 |
+Reserved |
+DEVICE_OBJECT |
+IRP |
+An unknown status was returned from a battery power IRP. |
+
0x301 |
+Reserved |
+DEVICE_OBJECT |
+IRP |
+The battery has entered an unknown state. |
+
0x400 |
+Reserved |
+IO_STACK_LOCATION |
+DEVICE_OBJECT |
+A device has overrun its maximum number of reference counts. |
+
0x401 |
+Reserved |
+Pending IRP list |
+DEVICE_OBJECT |
+Too many inrush power IRPs have been queued. |
+
0x402 |
+Reserved |
+Pending IRP list |
+DEVICE_OBJECT |
+Too many inrush power IRPs have been queued. |
+
0x403 |
+Reserved |
+Pending IRP list |
+DEVICE_OBJECT |
+Too many inrush power IRPs have been queued. |
+
0x404 |
+Reserved |
+IO_STACK_LOCATION |
+DEVICE_OBJECT |
+A power IRP has been sent to a passive-level device object. |
+
0x500 |
+Reserved |
+IRP |
+DEVICE_OBJECT |
+An unknown status was returned from a thermal power IRP. |
+
0x600 |
+DEVICE_OBJECT PDO |
+Reserved |
+Reserved |
+A driver has attempted a duplicate registration with the Power Runtime Framework. |
+
0x601 |
+POP_FX_DEVICE device |
+PEP_DEVICE_REGISTER PEP |
+Reserved |
+No Power Engine Plugins accepted device registration. |
+
0x602 |
+DEVICE_NODE device node |
+Sleep count |
+Reserved |
+Device node sleep count does not match its activation count. |
+
0x603 |
+POP_FX_PLUGIN |
+Work request type |
+Reserved |
+A Power Engine Plugin made an invalid work request. |
+
0x605 |
+Notification ID |
+POP_FX_PLUGIN |
+Reserved |
+A Power Engine Plugin failed to accept mandatory device power management notification. |
+
0x606 |
+POP_FX_COMPONENT |
+POP_FX_COMPONENT_FLAGS |
+New condition for the component |
+A Power Engine Plugin attempted to transition a critical system resource component to an Active (or Idle) condition when the resource was already Active (or Idle). |
+
0x607 |
+POP_FX_DEVICE |
+NTSTATUS |
+Reserved |
+The acquisition of a runtime power management framework device-removal lock failed when it was required to succeed. |
+
0x608 |
+POP_FX_COMPONENT |
+POP_FX_COMPONENT_FLAGS |
+Reserved |
+A driver has attempted to transition a component to idle without a preceding active request. |
+
0x609 |
+POP_FX_PLUGIN |
+POP_FX_DEVICE |
+Duplicate Request Type +0: DevicePowerRequired +1: DevicePowerNotRequired |
+A Power Engine Plugin has requested either device power required or device power not required without an intervening request of the opposite type. |
+
0x610 |
+POP_FX_PLUGIN |
+POP_FX_DEVICE |
+Reserved |
+A Power Engine Plugin has requested device power not required while a previous device power required request is outstanding. |
+
0x611 |
+POP_FX_PLUGIN |
+POP_FX_DEVICE |
+Invalid component index |
+A Power Engine Plugin has requested an operation on an invalid component. |
+
0x612 |
+POP_FX_PLUGIN PowerEnginePlugin |
+Reserved |
+Reserved |
+A Power Engine Plugin has requested additional work to be done in the context of a device notification where no buffer was supplied by PO for the request. |
+
0x613 |
+POP_FX_DEVICE |
+Component index |
+Operation +0: Complete device power not required +1: Report device powered on +2: Complete idle condition |
+A driver has attempted to complete a request when no such outstanding request is pending. |
+
0x614 |
+POP_FX_DEVICE |
+Component index |
+Illegal parameter +0: PO_FX_FLAG_BLOCKING used at IRQL >= DISPATCH_LEVEL +1: PO_FX_FLAG_BLOCKING and PO_FX_FLAG_ASYNC_ONLY both specified +2: Invalid component index |
+A driver has requested an active/idle transition on a component with an illegal parameter. |
+
0x615 |
+POP_FX_PLUGIN |
+POP_FX_COMPONENT |
+Illegal Action +0: Component not in idle state 0 +1:Component is already active +2: No outstanding activation request +3: Outstanding idle state transition |
+A Power Engine Plugin has illegally indicated the completion of a component activation. |
+
0x616 |
+POP_FX_PLUGIN |
+POP_FX_COMPONENT |
+Illegal Action +0: Invalid idle state +1: Component is already in the requested state +2: Requested a non-zero idle state without passing through idle state 0 |
+A Power Engine Plugin has illegally requested a component idle state transition. |
+
0x666 |
+PPOP_PEP_ACTIVITY |
+New activity type +0: DevicePowerOn +1: ComponentIdleStateChange +2: ComponentActivating +3: ComponentActive +4: DevicePowerOff +5: DeviceSuspend |
+Conflicting activity type +0: DevicePowerOn +1: ComponentIdleStateChange +2: ComponentActivating +3: ComponentActive +4: DevicePowerOff +5: DeviceSuspend |
+The default Power Engine Plugin has attempted to trigger a new activity that conflicts with another activity. |
+
0x667 |
+POP_PEP_ACTIVITY |
+Activity type +0: DevicePowerOn +1: ComponentIdleStateChange +2: ComponentActivating +3: ComponentActive +4: DevicePowerOff +5: DeviceSuspend |
+POP_PEP_ACTIVITY_STATUS |
+Default Power Engine Plugin has attempted to complete an activity that is not running. |
+
0x700 |
+PEPHANDLE |
+PEP_PPM_IDLE_SELECT |
+Reserved |
+A Power Engine Plugin has specified invalid processor idle dependencies. |
+
0x701 |
+The index of the selected idle state of the hung processor |
+The PRCB address of the hung processor |
+The index of the hung processor |
+A processor was not able to complete an idle transition within the allocated interval. This indicates the specified processor is hung. |
+
0x702 |
+The index of the selected idle state of the processor |
+The idle synchronization state of the processor |
+The PRCB address of the hung processor |
+A processor woke up from a non-interruptible state without the the OS initiating an explicit wake through the PEP (using the necessary PPM idle synchronization). |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|---|
0x02 |
+If Parameter 3 is zero: The page number in the table page that failed +If Parameter 3 is nonzero: The page number with the failing page run index |
+Zero, or the index that failed to match the run |
+0 |
+A table page check failure occurred. |
+
0x03 |
+The starting physical page number of the range |
+The length (in pages) of the range |
+The page number of the table page that contains this run |
+The checksum for the range of memory listed is incorrect. |
+
| Parameter | +Description | +
|---|---|
1 |
+Reserved |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|---|
0x01 |
+ACPI's deviceExtension |
+ACPI's ResourceList |
+0: No resource list is found +1: No IRQ resource is found in list |
+ACPI cannot find the System Control Interrupt (SCI) vector in the resources that are handed to it when ACPI is started. |
+
0x02 |
++ | + | + | (See the table later on this page) |
+
0x03 |
+The ACPI object that was being run |
+The return value from the interpreter |
+The name of the control method (in ULONG format) |
+ACPI tried to run a control method while creating device extensions to represent the ACPI namespace, but this control method failed. |
+
0x04 |
+The ACPI extension that _PRW belongs to |
+A pointer to the method |
+The DataType returned (see Amli.h) |
+ACPI evaluated a _PRW and expected to find an integer as a package element. |
+
0x05 |
+The ACPI extension that _PRW belongs to |
+Aointer to the _PRW |
+The number of elements in the _PRW |
+ACPI evaluated a _PRW, and the package that came back failed to contain at least two elements. The ACPI specification requires that two elements always be present in a _PRW. |
+
0x06 |
+The ACPI extension that _PRx belongs to |
+A pointer to the _PRx |
+A pointer to the name of the object to look for |
+ACPI tried to find a named object, but it could not find the object. |
+
0x07 |
+The ACPI extension that the method belongs to |
+A pointer to the method |
+The DataType returned (see Amli.h) |
+ACPI evaluated a method and expected to receive a buffer in return. However, the method returned some other data type. |
+
0x08 |
+The ACPI extension that the method belongs to |
+A pointer to the method |
+The DataType returned (see Amli.h) |
+ACPI evaluated a method and expected to receive an integer in return. However, the method returned some other data type. |
+
0x09 |
+The ACPI extension that the method belongs to |
+A pointer to the method |
+The DataType returned (see Amli.h) |
+ACPI evaluated a method and expected to receive a package in return. However, the method returned some other data type. |
+
0x0A |
+The ACPI extension that the method belongs to |
+A pointer to the method |
+The DataType returned (see Amli.h) |
+ACPI evaluated a method and expected to receive a string in return. However, the method returned some other data type. |
+
0x0B |
+The ACPI extension that _EJD belongs to |
+The status that the interpreter returns |
+The name of the object that ACPI is trying to find |
+ACPI cannot find the object that an _EJD string references. |
+
0x0C |
+The ACPI extension that ACPI found a dock device for |
+A pointer to the _EJD method |
+0: BIOS does not claim system is dockage +1: Duplicate device extensions for dock device |
+ACPI provides faulty or insufficient information for dock support. |
+
0x0D |
+The ACPI extension that ACPI needs the object for |
+The (ULONG) name of the method that ACPI looked for |
+0: Base case +1: Conflict |
+ACPI could not find a required method or object in the namespace This bug check code is used if there is no _HID or _ADR present. |
+
0x0E |
+The NS PowerResource that ACPI needs the object for |
+The (ULONG) name of the method that ACPI looked for |
+0: Base case |
+ACPI could not find a required method or object in the namespace for a power resource (or entity other than a "device"). This bug check code is used if there is no _ON, _OFF, or _STA present for a power resource. |
+
0x0F |
+The current buffer that ACPI was parsing |
+The buffer's tag |
+The specified length of the buffer |
+ACPI could not parse the resource descriptor. |
+
0x10 |
++ | + | + | (See the table later on this page) |
+
0x11 |
++ | + | + | (See the table later on this page) |
+
0x14 |
+The current buffer that ACPI was parsing |
+The buffer's tag |
+A pointer to a variable that contains the ULONGLONG length of the buffer |
+ACPI could not parse the resource descriptor. The length exceeds MAXULONG. |
+
0x15 |
+The ACPI Machine Language (AML) context |
+1: Failed to load table +2: The Parameter Path String Object was not found +3: Failed to insert Parameter Data into the ParameterPath String Object +4: Out of system memory |
+The NT status code |
+ACPI had a fatal error when attempting to load a table. |
+
0x16 |
+A pointer to the parent NSOBJ |
+A pointer to the illegal child ACPI namespace object |
+Reserved |
+ACPI had a fatal error when processing an xSDT. An object was declared as a child of a parent that cannot have children. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|---|
0x2001 |
+InterruptModel (integer) |
+The return value from the interpreter |
+A pointer to the PIC control method |
+ACPI tried to evaluate the PIC control method but failed. |
+
0x10001 |
+A pointer to the device object |
+A pointer to the parent of the device object |
+A pointer to the _PRT object +(See the following Comments section) |
+ACPI tried to do interrupt routing, but failed. |
+
0x10002 |
+A pointer to the device object |
+A pointer to the string name that ACPI was looking for but could not find |
+A pointer to the _PRT object +(See the following Comments section) |
+ACPI could not find the link node referenced in a _PRT. |
+
0x10003 |
+A pointer to the device object |
+The device ID or function number. +This DWORD is encoded as follows: bits 5:0 are the PCI device number, and bits 8:6 are the PCI function number |
+A pointer to the _PRT object +(See the following Comments section) |
+ACPI could not find a mapping in the _PRT package for a device. |
+
0x10005 |
+A pointer to the _PRT object +(See the following Comments section) |
+A pointer to the current _PRT element. +(This pointer is an index into the _PRT.) |
+The device ID or function number. +This DWORD is encoded as follows: bits 15:0 are the PCI function number, and bits 31:16 are the PCI device number |
+ACPI found an entry in the _PRT that the function ID is not all F's for. +(The generic format for a _PRT entry is that the device number is specified, but the function number is not.) |
+
0x10006 |
+A pointer to the link node. +(This device is missing the _DIS method.) |
+0 |
+0 |
+ACPI found a link node, but it cannot disable the node. +(Link nodes must be disabled to allow for reprogramming.) |
+
0x10007 |
+The vector that could not be found |
+0 |
+0 |
+The _PRT contained a reference to a vector that is not described in the I/O APIC entry's MAPIC table. |
+
0x10008 |
+The invalid interrupt level. |
+0 |
+0 |
+The ACPI SCI interrupt level is invalid. + |
+
0x10009 |
+0 |
+0 |
+0 |
+The Fixed ACPI Description Table (FADT) could not be located. |
+
0x1000A |
+0 |
+0 |
+0 |
+The Root System Description Pointer (RSDP) or Extended System Description Table (XSDT) could not be located + |
+
0x1000B |
+The ACPI table signature |
+A pointer to the ACPI table |
+0 |
+The length of the ACPI table is not consistent with the table revision. |
+
0x20000 |
+The I/O port in the Fixed Table |
+0 |
+0 |
+The PM_TMR_BLK entry in the Fixed ACPI Description Table doesn't point to a working ACPI timer block. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|---|
0x20000 |
+The I/O port in the Fixed Table |
+0 |
+0 |
+The PM_TMR_BLK entry in the Fixed ACPI Description Table does not point to a working ACPI timer block. |
+
| Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|
The ACPI extension for the PCI bus |
+0x0 |
+A pointer to the QUERY_RESOURCES IRP |
+ACPI cannot convert the BIOS' resource list into the proper format. This probably represents an error in the BIOS' list encoding procedure. |
+
The ACPI extension for the PCI bus |
+0x1 |
+A pointer to the QUERY_RESOURCE_REQUIREMENTS IRP |
+ACPI cannot convert the BIOS' resource list into the proper format. This probably represents an error in the BIOS' list encoding procedure. |
+
The ACPI extension for the PCI bus |
+0x2 |
+0 |
+ACPI found an empty resource list. |
+
The ACPI extension for the PCI bus |
+0x3 |
+A pointer to the PNP CRS descriptor |
+ACPI could not find the current bus number in the CRS. |
+
The ACPI extension for the PCI bus |
+A pointer to the resource list for PCI |
+A pointer to the E820 memory table |
+The list of resources that PCI claims to decode overlaps with the list of memory regions that the E820 BIOS interface reports. (This kind of conflict is never permitted.) |
+
| Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|
The ACPI extension whose mapping is needed |
+0x0 |
+The DEVICE_POWER_STATE (this is "x+1") |
+_PRx was mapped back to a non-supported S-state. |
+
The ACPI extension whose mapping is needed |
+0x1 |
+The SYSTEM_POWER_STATE that cannot be mapped |
+ACPI cannot find a D-state to associate with the S-state. |
+
The ACPI extension whose mapping is needed |
+0x2 |
+The SYSTEM_POWER_STATE that cannot be mapped |
+The device claims to be able to wake the system when the system is in this S-state, but the system does not actually support this S-state. |
+
| Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause | +
|---|---|---|---|
0x0 |
+0 |
+0 |
+The system could not initialize the AML interpreter. |
+
0x1 |
+0 |
+0 |
+The system could not find RSDT. |
+
0x2 |
+0 |
+0 |
+The system could not allocate critical driver structures. |
+
0x3 |
+0 |
+0 |
+The system could not load RSDT. |
+
0x4 |
+0 |
+0 |
+The system could not load DDBs. |
+
0x5 |
+0 |
+0 |
+The system cannot connect the Interrupt vector. |
+
0x6 |
+0 |
+0 |
+SCI_EN never becomes set in PM1 Control Register. |
+
0x7 |
+A pointer to the table that had a bad checksum |
+Creator revision |
+The table checksum is incorrect. |
+
0x8 |
+A pointer to the table that ACPI failed to load |
+Creator revision |
+ACPI failed to load DDB. |
+
0x9 |
+FADT version |
+0 |
+Unsupported firmware version. |
+
0xA |
+0 |
+0 |
+The system could not find MADT. |
+
0xB |
+0 |
+0 |
+The system could not find any valid Local SAPIC structures in the MADT. |
+
| Parameter | +Description | +
|---|---|
1 |
+The session ID. |
+
2 |
+The number of paged pool bytes that are leaking. |
+
3 |
+The number of nonpaged pool bytes that are leaking. |
+
4 |
+The total number of paged and nonpaged allocations that are leaking. (The number of nonpaged allocations are in the upper half of this word, and paged allocations are in the lower half of this word.) |
+
| Parameter | +Description | +
|---|---|
1 |
+The allocation size |
+
2 |
+0 |
+
3 |
+A pointer to a string that contains the file name |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Driver-specific |
+
2 |
+Driver-specific |
+
3 |
+Driver-specific |
+
4 |
+The number of all reports that have been requested since boot time |
+
| Parameter | +Description | +
|---|---|
1 |
+The original thread causing the failure |
+
2 |
+The new thread |
+
3 |
+The stack address of the original thread |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The session ID |
+
2 |
+The number of mapped views that are leaking |
+
3 |
+The address of this session's mapped views table |
+
4 |
+The size of this session's mapped views table |
+
| Parameter | +Description | +
|---|---|
1 |
+The part of network initialization that failed. Possible values are: +1: Failure while updating the registry. +2: Failure while starting the network stack. Windows sends IOCTLs to the redirector and datagram receiver, then waits for the redirector to be ready. If it is not ready within a certain period of time, this error is issued. +3: Failure while sending the DHCP IOCTL to TCP. This is how Windows informs the transport of its IP address. |
+
2 |
+The failure status |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The IP address, shown as a DWORD. An address of the form aa.bb.cc.dd will appear as 0xDDCCBBAA. |
+
2 |
+The hardware address of the other machine. (For an Ethernet connection, see the following note.) |
+
3 |
+The hardware address of the other machine. (For an Ethernet connection, see the following note.) |
+
4 |
+The hardware address of the other machine. (For an Ethernet connection, this will be zero.) |
+
| Parameter | +Description | +
|---|---|
| 1 | +Hardware that was invalid. +1 : Number of installed processors is less than before the hibernation +Value in Param 2: Number of processors before hibernation +Value in Param 3: Number of processors after hibernation |
+
| 2 | +Per Parameter 1 | +
| 3 | +Per Parameter 1 | +
| 4 | +Reserved | +
| Parameter | +Description | +
|---|---|
1 |
+Virtual address of attempted write |
+
2 |
+PTE contents |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the mutex |
+
2 |
+The thread that caused the error |
+
3 |
+0 |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
| 1 | +The subtype of the Bluetooth verifier fault. +
+```
+ 0x1 : An attempt was made to submit a Bluetooth Request Block that is already in use
+ 2 - Brb pointer
+ 3 - Reserved
+ 4 - Reserved
+ 0x2 : An attempt was made to free a Bluetooth Request Block that is in use
+ 2 - Brb pointer
+ 3 - Reserved
+ 4 - Reserved
+ 0x3 : An attempt was made to allocate or initialize an invalid BRB type
+ 2 - Brb pointer
+ 3 - pdo extension (if available)
+ 4 - Reserved
+ 0x4 : Invalid Bluetooth Request Block pointer was submitted
+ 2 - Brb pointer
+ 3 - Reserved
+ 4 - Reserved
+ 0x5 : A Bluetooth Request Block with an invalid size was submitted
+ 2 - Brb pointer
+ 3 - Actual Size
+ 4 - Expected Size
+ 0x6 : The IOCTL_BTH_GET_DEVICE_INFO was called with invalid parameters
+ 2 - Reserved
+ 3 - Reserved
+ 4 - Reserved
+ 0x7 : BRB_L2CA_UNREGISTER_SERVER was submitted with an invalid server handle
+ 2 - Server handle
+ 3 - Reserved
+ 4 - Reserved
+ 0x8 : BRB_L2CA_CLOSE_CHANNEL was submitted with an invalid channel handle
+ 2 - Brb pointer
+ 3 - Channel handle
+ 4 - Reserved
+ 0x9 : BRB_SCO_UNREGISTER_SERVER was submitted with an invalid server handle
+ 2 - Server handle
+ 3 - Reserved
+ 4 - Reserved
+```
+ |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
| 1 | +The subtype of the Bluetooth verifier fault. +
+```
+ 0x1 : An attempt was made to return a packet with type that mis-matched its original request.
+ 2 - Returned packet type
+ 3 - Expected packet type
+ 4 - Reserved
+ 0x2 : An attempt was made to return an unexpected status code and caused the packet to be discarded.
+ 2 - Unexpected return status
+ 3 - Reserved
+ 4 - Reserved
+ 0x3 : Incorrect output buffer size was returned to indicate number of bytes written by the lower transport driver.
+ 2 - Unexpected buffer size
+ 3 - Expected buffer size
+ 4 - Reserved
+```
+ |
+
| 2 | +See parameter 1 | +
| 3 | +See parameter 1 | +
| 4 | +See parameter 1 | +
| Parameter | +Description | +
|---|---|
1 |
+Address of the name of the registry hive that could not be loaded. |
+
2 |
+Zero (Reserved) |
+
3 |
+Zero (Reserved) |
+
4 |
+Zero (Reserved) |
+
| Parameter | +Description | +
|---|---|
1 |
+A string that identifies the problem |
+
2 |
+The error code |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
Address that the driver tried to free |
+Reserved |
+0 |
+0x20 |
+A driver attempted to free pool which was not allocated. |
+
Address that the driver tried to free |
+Bytes requested |
+Bytes calculated (actually given to the caller) |
+0x21, +0x22 |
+A driver attempted to free a bad address. |
+
Address that the driver tried to free |
+Address where bits are corrupted |
+Reserved |
+0x23 |
+A driver freed an address, but nearby bytes within the same page have been corrupted. |
+
Address that the driver tried to free |
+Address where bits are corrupted |
+Reserved |
+0x24 |
+A driver freed an address, but bytes occurring after the end of the allocation have been overwritten. |
+
Current IRQL |
+Pool type |
+Number of bytes |
+0x30 |
+A driver attempted to allocate pool at an incorrect IRQL. |
+
Current IRQL |
+Pool type |
+Address that the driver tried to free |
+0x31 |
+A driver attempted to free pool at an incorrect IRQL. |
+
Address that the driver tried to free |
+Address where one bit is corrupted |
+Reserved |
+0x32 |
+A driver freed an address, but nearby bytes within the same page have a single bit error. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x00 |
+0 |
+Pool type |
+Pool tag |
+The current thread requested a zero-byte pool allocation. |
+
0x01, +0x02, +0x04 |
+Pointer to pool header |
+First part of pool header contents |
+0 |
+The pool header has been corrupted. |
+
0x06 |
+Reserved |
+Pointer to pool header |
+Pool header contents |
+The current thread attempted to free the pool, which was already freed. |
+
0x07 |
+Reserved |
+Pool header contents |
+Address of the block of pool being freed |
+The current thread attempted to free the pool, which was already freed. |
+
0x08 |
+Current IRQL |
+Pool type |
+Size of allocation, in bytes |
+The current thread attempted to allocate the pool at an invalid IRQL. |
+
0x09 |
+Current IRQL |
+Pool type |
+Address of pool |
+The current thread attempted to free the pool at an invalid IRQL. |
+
0x0A |
+Address of pool |
+Allocator's tag |
+Tag being used in the attempted free |
+The current thread attempted to free pool memory by using the wrong tag. +(The memory might belong to another component.) |
+
0x0B, +0x0C, +or 0x0D |
+Address of pool |
+Pool allocation's tag |
+Bad quota process pointer |
+The current thread attempted to release a quota on a corrupted pool allocation. |
+
0x40 |
+Starting address |
+Start of system address space |
+0 |
+The current thread attempted to free the kernel pool at a user-mode address. |
+
0x41 |
+Starting address |
+Physical page frame |
+Highest physical page frame |
+The current thread attempted to free a non-allocated nonpaged pool address. |
+
0x42 +or 0x43 |
+Address being freed |
+0 |
+0 |
+The current thread attempted to free a virtual address that was never in any pool. |
+
0x44 |
+Starting address |
+Reserved |
+0 |
+The current thread attempted to free a non-allocated nonpaged pool address. |
+
0x46 |
+Starting address |
+0 |
+0 |
+The current thread attempted to free an invalid pool address. |
+
0x47 |
+Starting address |
+Physical page frame |
+Highest physical page frame |
+The current thread attempted to free a non-allocated nonpaged pool address. |
+
0x48 |
+Starting address |
+Reserved |
+Reserved |
+The current thread attempted to free a non-allocated paged pool address. |
+
0x50 |
+Starting address |
+Start offset, in pages, from beginning of paged pool |
+Size of paged pool, in bytes |
+The current thread attempted to free a non-allocated paged pool address. |
+
0x60 |
+Starting address |
+0 |
+0 |
+The current thread attempted to free an invalid contiguous memory address. +(The caller of MmFreeContiguousMemory is passing a bad pointer.) |
+
0x99 |
+Address that is being freed |
+0 |
+0 |
+The current thread attempted to free pool with an invalid address. +(This code can also indicate corruption in the pool header.) |
+
0x9A |
+Pool type |
+Number of bytes requested |
+Pool tag |
+The current thread marked an allocation request MUST_SUCCEED. +(This pool type is no longer supported.) |
+
0x9B |
+Pool type |
+Number of bytes requested |
+Caller's address |
+The current thread attempted to allocate a pool with a tag of 0 +(This would be untrackable, and possibly corrupt the existing tag tables.) |
+
0x9C |
+Pool type |
+Number of bytes requested |
+Caller's address |
+The current thread attempted to allocate a pool with a tag of "BIG". +(This would be untrackable and could possibly corrupt the existing tag tables.) |
+
0x9D |
+Incorrect pool tag used |
+Pool type |
+Caller's address |
+The current thread attempted to allocate a pool with a tag that does not contain any letters or digits. Using such tags makes tracking pool issues difficult. |
+
0x41286 |
+Reserved |
+Reserved |
+Start offset from the beginning of the paged pool, in pages |
+The current thread attempted to free a paged pool address in the middle of an allocation. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x00 |
+Current IRQL |
+Pool type |
+0 |
+The driver requested a zero-byte pool allocation. |
+
0x01 |
+Current IRQL |
+Pool type |
+Size of allocation, in bytes |
+The driver attempted to allocate paged memory with IRQL > APC_LEVEL. |
+
0x02 |
+Current IRQL |
+Pool type |
+Size of allocation, in bytes |
+The driver attempted to allocate nonpaged memory with IRQL > DISPATCH_LEVEL. |
+
0x10 |
+Bad Address |
+0 |
+0 |
+The driver attempted to free an address that was not returned from an allocate call. |
+
0x11 |
+Current IRQL |
+Pool type |
+Address of pool |
+The driver attempted to free paged pool with IRQL > APC_LEVEL. |
+
0x12 |
+Current IRQL |
+Pool type |
+Address of pool |
+The driver attempted to free nonpaged pool with IRQL > DISPATCH_LEVEL. |
+
0x13 or +0x14 |
+Reserved |
+Pointer to pool header |
+Pool header contents |
+The driver attempted to free memory pool which was already freed. |
+
0x16 |
+Reserved |
+Pool address |
+0 |
+The driver attempted to free pool at a bad address, or the driver passed invalid parameters to a memory routine. |
+
0x30 |
+Current IRQL |
+Requested IRQL |
+0 |
+The driver passed an invalid parameter to [KeRaiseIrql](https://msdn.microsoft.com/library/windows/hardware/ff553079). +(The parameter was either a value lower than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.) |
+
0x31 |
+Current IRQL |
+Requested IRQL |
+0: New IRQL is bad +1: New IRQL is invalid inside a DPC routine |
+The driver passed an invalid parameter to [KeLowerIrql](https://msdn.microsoft.com/library/windows/hardware/ff552968). +(The parameter was either a value higher than the current IRQL, or a value higher than HIGH_LEVEL. This may be the result of using an uninitialized parameter.) |
+
0x32 |
+Current IRQL |
+Spin lock address |
+0 |
+The driver called [KeReleaseSpinLock](https://msdn.microsoft.com/library/windows/hardware/ff553145) at an IRQL other than DISPATCH_LEVEL. +(This may be due to a double-release of a spin lock.) |
+
0x33 |
+Current IRQL |
+Fast mutex address |
+0 |
+The driver attempted to acquire fast mutex with IRQL > APC_LEVEL. |
+
0x34 |
+Current IRQL |
+Fast mutex address |
+0 |
+The driver attempted to release fast mutex at an IRQL other than APC_LEVEL. |
+
0x35 |
+Current IRQL |
+Spin lock address |
+Old IRQL |
+The kernel released a spin lock with IRQL not equal to DISPATCH_LEVEL. |
+
0x36 |
+Current IRQL |
+Spin lock number |
+Old IRQL |
+The kernel released a queued spin lock with IRQL not equal to DISPATCH_LEVEL. |
+
0x37 |
+Current IRQL |
+Thread APC disable count |
+Resource |
+The driver tried to acquire a resource, but APCs are not disabled. |
+
0x38 |
+Current IRQL |
+Thread APC disable count |
+Resource |
+The driver tried to release a resource, but APCs are not disabled. |
+
0x39 |
+Current IRQL |
+Thread APC disable count |
+Mutex |
+The driver tried to acquire a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry. |
+
0x3A |
+Current IRQL |
+Thread APC disable count |
+Mutex |
+The driver tried to release a mutex "unsafe" with IRQL not equal to APC_LEVEL on entry. |
+
0x3C |
+Handle passed to routine |
+Object type |
+0 |
+The driver called [ObReferenceObjectByHandle](https://msdn.microsoft.com/library/windows/hardware/ff558679) with a bad handle. |
+
0x3D |
+0 |
+0 |
+Address of the bad resource |
+The driver passed a bad (unaligned) resource to [ExAcquireResourceExclusive](https://msdn.microsoft.com/library/windows/hardware/ff544345). |
+
0x3E |
+0 |
+0 |
+0 |
+The driver called [KeLeaveCriticalRegion](https://msdn.microsoft.com/library/windows/hardware/ff552964) for a thread that is not currently in a critical region. |
+
0x3F |
+Object address |
+New object reference count. +-1: dereference case +1: reference case |
+0 |
+The driver applied [ObReferenceObject](https://msdn.microsoft.com/library/windows/hardware/ff558678) to an object that has a reference count of zero, or the driver applied [ObDereferenceObject](https://msdn.microsoft.com/library/windows/hardware/ff557724) to an object that has a reference count of zero. |
+
0x40 |
+Current IRQL |
+Spin lock address |
+0 |
+The driver called [KeAcquireSpinLockAtDpcLevel](https://msdn.microsoft.com/library/windows/hardware/ff551921) with IRQL < DISPATCH_LEVEL. |
+
0x41 |
+Current IRQL |
+Spin lock address |
+0 |
+The driver called [KeReleaseSpinLockFromDpcLevel](https://msdn.microsoft.com/library/windows/hardware/ff553150) with IRQL < DISPATCH_LEVEL. |
+
0x42 |
+Current IRQL |
+Spin lock address |
+0 |
+The driver called [KeAcquireSpinLock](https://msdn.microsoft.com/library/windows/hardware/ff551917) with IRQL > DISPATCH_LEVEL. |
+
0x51 |
+Base address of allocation |
+Address of the reference beyond the allocation |
+Number of charged bytes |
+The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active. |
+
0x52 |
+Base address of allocation |
+Reserved |
+Number of charged bytes |
+The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active. |
+
0x53, +0x54, +or 0x59 |
+Base address of allocation |
+Reserved |
+Reserved |
+The driver attempted to free memory after having written past the end of the allocation. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active. |
+
0x60 |
+Bytes allocated from paged pool |
+Bytes allocated from nonpaged pool |
+Total number of allocations that were not freed |
+The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active. |
+
0x61 |
+Bytes allocated from paged pool |
+Bytes allocated from nonpaged pool |
+Total number of allocations that were not freed |
+A driver thread is attempting to allocate pool memory while the driver is unloading. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active. |
+
0x62 |
+Name of the driver |
+Reserved |
+Total number of allocations that were not freed, including both paged and nonpaged pool |
+The driver is unloading without first freeing its pool allocations. A bug check with this parameter occurs only when the Pool Tracking option of Driver Verifier is active. |
+
0x70 |
+Current IRQL |
+MDL address |
+Access mode |
+The driver called [MmProbeAndLockPages](https://msdn.microsoft.com/library/windows/hardware/ff554664) with IRQL > DISPATCH_LEVEL. |
+
0x71 |
+Current IRQL |
+MDL address |
+Process address |
+The driver called MmProbeAndLockProcessPages with IRQL > DISPATCH_LEVEL. |
+
0x72 |
+Current IRQL |
+MDL address |
+Process address |
+The driver called MmProbeAndLockSelectedPages with IRQL > DISPATCH_LEVEL. |
+
0x73 |
+Current IRQL |
+In 32-bit Windows: Low 32 bits of the physical address +In 64-bit Windows: the 64-bit physical address |
+Number of bytes |
+The driver called [MmMapIoSpace](https://msdn.microsoft.com/library/windows/hardware/ff554618) with IRQL > DISPATCH_LEVEL. |
+
0x74 |
+Current IRQL |
+MDL address |
+Access mode |
+The driver called [MmMapLockedPages](https://msdn.microsoft.com/library/windows/hardware/ff554622) in kernel mode with IRQL > DISPATCH_LEVEL. |
+
0x75 |
+Current IRQL |
+MDL address |
+Access mode |
+The driver called [MmMapLockedPages](https://msdn.microsoft.com/library/windows/hardware/ff554622) in user mode with IRQL > APC_LEVEL. |
+
0x76 |
+Current IRQL |
+MDL address |
+Access mode |
+The driver called [MmMapLockedPagesSpecifyCache](https://msdn.microsoft.com/library/windows/hardware/ff554629) in kernel mode with IRQL > DISPATCH_LEVEL. |
+
0x77 |
+Current IRQL |
+MDL address |
+Access mode |
+The driver called [MmMapLockedPagesSpecifyCache](https://msdn.microsoft.com/library/windows/hardware/ff554629) in user mode with IRQL > APC_LEVEL. |
+
0x78 |
+Current IRQL |
+MDL address |
+0 |
+The driver called [MmUnlockPages](https://msdn.microsoft.com/library/windows/hardware/ff556381) with IRQL > DISPATCH_LEVEL. |
+
0x79 |
+Current IRQL |
+Virtual address being unmapped |
+MDL address |
+The driver called [MmUnmapLockedPages](https://msdn.microsoft.com/library/windows/hardware/ff556391) in kernel mode with IRQL > DISPATCH_LEVEL. |
+
0x7A |
+Current IRQL |
+Virtual address being unmapped |
+MDL address |
+The driver called [MmUnmapLockedPages](https://msdn.microsoft.com/library/windows/hardware/ff556391) in user mode with IRQL > APC_LEVEL. |
+
0x7B |
+Current IRQL |
+Virtual address being unmapped |
+Number of bytes |
+The driver called [MmUnmapIoSpace](https://msdn.microsoft.com/library/windows/hardware/ff556387) with IRQL > APC_LEVEL. |
+
0x7C |
+MDL address |
+MDL flags |
+0 |
+The driver called [MmUnlockPages](https://msdn.microsoft.com/library/windows/hardware/ff556381), and passed an MDL whose pages were never successfully locked. |
+
0x7D |
+MDL address |
+MDL flags |
+0 |
+The driver called [MmUnlockPages](https://msdn.microsoft.com/library/windows/hardware/ff556381), and passed an MDL whose pages are from nonpaged pool. +(These should never be unlocked.) |
+
0x7E |
+Current IRQL |
+DISPATCH_LEVEL |
+0 |
+The driver called [MmAllocatePagesForMdl](https://msdn.microsoft.com/library/windows/hardware/ff554482), [MmAllocatePagesForMdlEx](https://msdn.microsoft.com/library/windows/hardware/ff554489), or [MmFreePagesFromMdl](https://msdn.microsoft.com/library/windows/hardware/ff554521) with IRQL > DISPATCH_LEVEL. |
+
0x7F |
+Current IRQL |
+MDL address |
+MDL flags |
+The driver called [BuildMdlForNonPagedPool](https://msdn.microsoft.com/library/windows/hardware/ff554498) and passed an MDL whose pages are from paged pool. |
+
0x80 |
+Current IRQL |
+Event address |
+0 |
+The driver called [KeSetEvent](https://msdn.microsoft.com/library/windows/hardware/ff553253) with IRQL > DISPATCH_LEVEL. |
+
0x81 |
+MDL address |
+MDL flags |
+0 |
+The driver called [MmMapLockedPages](https://msdn.microsoft.com/library/windows/hardware/ff554622). +(You should use [MmMapLockedPagesSpecifyCache](https://msdn.microsoft.com/library/windows/hardware/ff554629) instead, with the BugCheckOnFailure parameter set to FALSE.) |
+
0x82 |
+MDL address |
+MDL flags |
+0 |
+The driver called [MmMapLockedPagesSpecifyCache](https://msdn.microsoft.com/library/windows/hardware/ff554629) with the BugCheckOnFailure parameter equal to TRUE. +(This parameter should be set to FALSE.) |
+
0x83 |
+Start of physical address range to map |
+Number of bytes to map |
+First page frame number that isn't locked down |
+The driver called [MmMapIoSpace](https://msdn.microsoft.com/library/windows/hardware/ff554618) without having locked down the MDL pages. The physical pages represented by the physical address range being mapped must have been locked down prior to making this call. |
+
0x85 |
+MDL address |
+Number of pages to map |
+First page frame number that isn't locked down |
+The driver called [MmMapLockedPages](https://msdn.microsoft.com/library/windows/hardware/ff554622) without having locked down the MDL pages. |
+
0x89 |
+MDL address |
+Pointer to the non-memory page in the MDL |
+The non-memory page number in the MDL |
+An MDL is not marked as "I/O", but it contains non-memory page addresses. |
+
0x91 |
+Reserved |
+Reserved |
+Reserved |
+The driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using [KeExpandKernelStackAndCallout](https://msdn.microsoft.com/library/windows/hardware/ff552030). |
+
0xA0 (Windows Server 2003 and later operating systems only) |
+Pointer to the IRP making the read or write request |
+Device object of the lower device |
+Number of the sector in which the error was detected |
+A cyclic redundancy check (CRC) error was detected on a hard disk. A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active. |
+
0xA1 (Windows Server 2003 and later operating systems only) |
+Copy of the IRP making the read or write request. (The actual IRP has been completed.) |
+Device object of the lower device |
+Number of the sector in which the error was detected |
+A CRC error was detected on a sector (asynchronously). A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active. |
+
0xA2 (Windows Server 2003 and later operating systems only) |
+IRP making the read or write request, or a copy of this IRP |
+Device object of the lower device |
+Number of the sector in which the error was detected |
+The CRCDISK checksum copies don't match. This could be a paging error. A bug check with this parameter occurs only when the Disk Integrity Checking option of Driver Verifier is active. |
+
0xB0 (Windows Vista and later operating systems only) |
+MDL address |
+MDL flags |
+Incorrect MDL flags |
+The driver called [MmProbeAndLockPages](https://msdn.microsoft.com/library/windows/hardware/ff554664) for an MDL with incorrect flags. For example, the driver passed an MDL created by [MmBuildMdlForNonPagedPool](https://msdn.microsoft.com/library/windows/hardware/ff554498) to MmProbeAndLockPages. |
+
0xB1 (Windows Vista and later operating systems only) |
+MDL address |
+MDL flags |
+Incorrect MDL flags |
+The driver called MmProbeAndLockProcessPages for an MDL with incorrect flags. For example, the driver passed an MDL created by [MmBuildMdlForNonPagedPool](https://msdn.microsoft.com/library/windows/hardware/ff554498) to MmProbeAndLockProcessPages. |
+
0xB2 (Windows Vista and later operating systems only) |
+MDL address |
+MDL flags |
+Incorrect MDL flags |
+The driver called [MmMapLockedPages](https://msdn.microsoft.com/library/windows/hardware/ff554622) for an MDL with incorrect flags. For example, the driver passed an MDL that is already mapped to a system address or that was not locked to MmMapLockedPages. |
+
0xB3 (Windows Vista and later operating systems only) |
+MDL address |
+MDL flags |
+Missing MDL flags (at least one was expected) |
+The driver called [MmMapLockedPages](https://msdn.microsoft.com/library/windows/hardware/ff554622) for an MDL with incorrect flags. For example, the driver passed an MDL that is not locked to MmMapLockedPages. |
+
0xB4 (Windows Vista and later operating systems only) |
+MDL address |
+MDL flags |
+Unexpected partial MDL flag |
+The driver called [MmUnlockPages](https://msdn.microsoft.com/library/windows/hardware/ff556381) for a partial MDL. A partial MDL is one that was created by [IoBuildPartialMdl](https://msdn.microsoft.com/library/windows/hardware/ff548324). |
+
0xB8 (Windows Vista and later operating systems only) |
+MDL address |
+MDL flags |
+Reserved |
+The pages that are described by the MDL are still mapped. The driver must unmap the pages before calling IoFreeMdl. + |
+
0xC0 (Windows Vista and later operating systems only) |
+Address of the IRP |
+Reserved |
+Reserved |
+The driver called [IoCallDriver](https://msdn.microsoft.com/library/windows/hardware/ff548336) with interrupts disabled. |
+
0xC1 (Windows Vista and later operating systems only) |
+Address of the driver dispatch routine |
+Reserved |
+Reserved |
+A driver dispatch routine was returned with interrupts disabled. |
+
0xC2 (Windows Vista and later operating systems only) |
+Reserved |
+Reserved |
+Reserved |
+The driver called a Fast I/O dispatch routine after interrupts were disabled. |
+
0xC3 (Windows Vista and later operating systems only) |
+Address of the driver Fast I/O dispatch routine |
+Reserved |
+Reserved |
+A driver Fast I/O dispatch routine was returned with interrupts disabled. |
+
0xC5 (Windows Vista and later operating systems only) |
+Address of the driver dispatch routine |
+The current thread's APC disable count |
+The thread's APC disable count prior to calling the driver dispatch routine |
+A driver dispatch routine has changed the thread's APC disable count. +The APC disable count is decremented each time a driver calls [KeEnterCriticalRegion](https://msdn.microsoft.com/library/windows/hardware/ff552021), [FsRtlEnterFileSystem](https://msdn.microsoft.com/library/windows/hardware/ff545900), or acquires a mutex. +The APC disable count is incremented each time a driver calls [KeLeaveCriticalRegion](https://msdn.microsoft.com/library/windows/hardware/ff552964), [KeReleaseMutex](https://msdn.microsoft.com/library/windows/hardware/ff553140), or [FsRtlExitFileSystem](https://msdn.microsoft.com/library/windows/hardware/ff545908). +Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true. |
+
0xC6 (Windows Vista and later operating systems only) |
+Address of the driver Fast I/O dispatch routine |
+Current thread's APC disable count |
+The thread's APC disable count prior to calling the Fast I/O driver dispatch routine |
+A driver Fast I/O dispatch routine has changed the thread's APC disable count. +The APC disable count is decremented each time a driver calls [KeEnterCriticalRegion](https://msdn.microsoft.com/library/windows/hardware/ff552021), [FsRtlEnterFileSystem](https://msdn.microsoft.com/library/windows/hardware/ff545900), or acquires a mutex. +The APC disable count is incremented each time a driver calls [KeLeaveCriticalRegion](https://msdn.microsoft.com/library/windows/hardware/ff552964), [KeReleaseMutex](https://msdn.microsoft.com/library/windows/hardware/ff553140), or [FsRtlExitFileSystem](https://msdn.microsoft.com/library/windows/hardware/ff545908). +Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true. |
+
0xCA (Windows Vista and later operating systems only) |
+Address of the lookaside list |
+Reserved |
+Reserved |
+The driver has attempted to re-initialize a lookaside list. |
+
0xCB (Windows Vista and later operating systems only) |
+Address of the lookaside list |
+Reserved |
+Reserved |
+The driver has attempted to delete an uninitialized lookaside list. |
+
0xCC (Windows Vista and later operating systems only) |
+Address of the lookaside list |
+Starting address of the pool allocation |
+Size of the pool allocation |
+The driver has attempted to free a pool allocation that contains an active lookaside list. |
+
0xCD (Windows Vista and later operating systems only) |
+Address of the lookaside list |
+Block size specified by the caller |
+Minimum supported block size |
+The driver has attempted to create a lookaside list with an allocation block size that is too small. |
+
0xD0 (Windows Vista and later operating systems only) |
+Address of the ERESOURCE structure |
+Reserved |
+Reserved |
+The driver has attempted to re-initialize an ERESOURCE structure. |
+
0xD1 (Windows Vista and later operating systems only) |
+Address of the ERESOURCE structure |
+Reserved |
+Reserved |
+The driver has attempted to delete an uninitialized ERESOURCE structure. |
+
0xD2 (Windows Vista and later operating systems only) |
+Address of the ERESOURCE structure |
+Starting address of the pool allocation |
+Size of the pool allocation |
+The driver has attempted to free a pool allocation that contains an active ERESOURCE structure. |
+
0xD5 (Windows Vista and later operating systems only) |
+Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver |
+Current [IoReleaseRemoveLock](https://msdn.microsoft.com/library/windows/hardware/ff549560) tag |
+Reserved |
+The current [IoReleaseRemoveLock](https://msdn.microsoft.com/library/windows/hardware/ff549560) tag does not match the previous [IoAcquireRemoveLock](https://msdn.microsoft.com/library/windows/hardware/ff548204) tag. If the driver calling IoReleaseRemoveLock is not in a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when the I/O Verification option of Driver Verifier is active. |
+
0xD6 (Windows Vista and later operating systems only) |
+Address of the IO_REMOVE_LOCK structure created by the checked build version of the driver |
+Tag that does not match previous [IoAcquireRemoveLock](https://msdn.microsoft.com/library/windows/hardware/ff548204) tag |
+Previous [IoAcquireRemoveLock](https://msdn.microsoft.com/library/windows/hardware/ff548204) tag |
+The current [IoReleaseRemoveLockAndWait](https://msdn.microsoft.com/library/windows/hardware/ff549567) tag does not match the previous [IoAcquireRemoveLock](https://msdn.microsoft.com/library/windows/hardware/ff548204) tag. If the driver calling [IoReleaseRemoveLock](https://msdn.microsoft.com/library/windows/hardware/ff549560) is not a checked build, Parameter 2 is the address of the shadow IO_REMOVE_LOCK structure created by Driver Verifier on behalf of the driver. In this case, the address of the IO_REMOVE_LOCK structure used by the driver is not used at all, because Driver Verifier is replacing the lock address for all the remove lock APIs. A bug check with this parameter occurs only when the I/O Verification option of Driver Verifier is active. |
+
0xD7 (Windows 7 operating systems and later only) |
+Address of the checked build Remove Lock structure that is used internally by Driver Verifier |
+Address of the Remove Lock structure that is specified by the driver |
+Reserved |
+A Remove Lock cannot be re-initialized, even after it calls [IoReleaseRemoveLockAndWait](https://msdn.microsoft.com/library/windows/hardware/ff549567), because other threads might still be using that lock (by calling [IoAcquireRemoveLock](https://msdn.microsoft.com/library/windows/hardware/ff548204)). The driver should allocate the Remove Lock inside its device extension, and initialize it a single time. The lock will be deleted together with the device extension. |
+
0xDA (Windows Vista and later operating systems only) |
+Starting address of the driver |
+WMI callback address inside the driver |
+Reserved |
+An attempt was made to unload a driver that has not deregistered its WMI callback function. |
+
0xDB (Windows Vista and later operating systems only) |
+Address of the device object |
+Reserved |
+Reserved |
+An attempt was made to delete a device object that was not deregistered from WMI. |
+
0xDC (Windows Vista and later operating systems only) |
+Reserved |
+Reserved |
+Reserved |
+An invalid RegHandle value was specified as a parameter of the function [EtwUnregister](https://msdn.microsoft.com/library/windows/hardware/ff545613). |
+
0xDD (Windows Vista and later operating systems only) |
+Address of the call to EtwRegister |
+Starting address of the unloading driver |
+For Windows 8Windows 8 and later versions, this parameter is the ETW RegHandle value. |
+An attempt was made to unload a driver without calling [EtwUnregister](https://msdn.microsoft.com/library/windows/hardware/ff545613). |
+
0xDF (Windows 7 operating systems and later only) |
+Synchronization object address |
++ | + | The synchronization object is in session address space. Synchronization objects are not allowed in session address space because they can be manipulated from another session or from system threads that have no session virtual address space. |
+
0xE0 (Windows Vista and later operating systems only) |
+User-mode address that is used as a parameter |
+Size ,in bytes, of the address range that is used as a parameter |
+Reserved |
+A call was made to an operating system kernel function that specified a user-mode address as a parameter. |
+
0xE1 (Windows Vista and later operating systems only) |
+Address of the synchronization object |
+Reserved |
+Reserved |
+A synchronization object was found to have an address that was either invalid or pageable. |
+
0xE2 (Windows Vista and later operating systems only) |
+Address of the IRP |
+User-mode address present in the IRP |
+Reserved |
+An IRP with Irp->RequestorMode set to KernelMode was found to have a user-mode address as one of its members. |
+
0xE3 (Windows Vista and later operating systems only) |
+Address of the call to the API |
+User-mode address used as a parameter in the API |
+Reserved |
+A driver has made a call to a kernel-mode ZwXxx routine with a user-mode address as a parameter. |
+
0xE4 (Windows Vista and later operating systems only) |
+Address of the call to the API |
+Address of the malformed UNICODE_STRING structure |
+Reserved |
+A driver has made a call to a kernel-mode ZwXxx routine with a malformed UNICODE_STRING structure as a parameter. |
+
0xE5 (Windows Vista and later operating systems only) |
+Current IRQL |
+Reserved |
+Reserved |
+A call was made to a Kernel API at the incorrect IRQL. |
+
0xE6 (Windows Vista and later operating systems only) |
+Address inside the driver making the Zw API call |
+Current IRQL |
+Special kernel APCs. |
+Kernel Zw API was not called at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled. |
+
0xEA (Windows Vista and later operating systems only) |
+Current IRQL |
+The thread's APC disable count |
+Address of the pushlock |
+A driver has attempted to acquire a pushlock while APCs are enabled. |
+
0xEB (Windows Vista and later operating systems only) |
+Current IRQL |
+The thread's APC disable count |
+Address of the pushlock |
+A driver has attempted to release a pushlock while APCs are enabled. |
+
0xF0 (Windows Vista and later operating systems only) |
+Address of the destination buffer |
+Address of the source buffer |
+Number of bytes to copy |
+A driver called the memcpy function with overlapping source and destination buffers. |
+
0xF5 (Windows Vista and later operating systems only) |
+Address of the NULL handle |
+Object type |
+Reserved |
+A driver passed a NULL handle to [ObReferenceObjectByHandle](https://msdn.microsoft.com/library/windows/hardware/ff558679). |
+
0xF6 (Windows 7 operating systems and later) |
+Handle value being referenced |
+Address of the current process |
+Address inside the driver that performs the incorrect reference |
+A driver references a user-mode handle as kernel mode. |
+
0xF7 (Windows 7 operating systems and later) |
+Handle value specified by the caller |
+Object type specified by the caller |
+AccessMode specified by the caller |
+A driver is attempting a user-mode reference for a kernel handle in the context of the system process. |
+
0xFA (Windows 7 operating systems and later) |
+Completion routine address. |
+IRQL value before it calls the completion routine |
+Current IRQL value, after it calls the completion routine |
+The IRP completion routine returned at an IRQL that was different from the IRQL the routine was called at. |
+
0xFB (Windows 7 operating systems and later) |
+Completion routine address |
+Current thread's APC disable count |
+The thread's APC disable count before it calls the IRP completion routine |
+The thread's APC disable count was changed by the driver's IRP completion routine. +The APC disable count is decremented each time a driver calls [KeEnterCriticalRegion](https://msdn.microsoft.com/library/windows/hardware/ff552021), [FsRtlEnterFileSystem](https://msdn.microsoft.com/library/windows/hardware/ff545900), or acquires a mutex. +The APC disable count is incremented each time a driver calls [KeLeaveCriticalRegion](https://msdn.microsoft.com/library/windows/hardware/ff552964), [KeReleaseMutex](https://msdn.microsoft.com/library/windows/hardware/ff553140), or [FsRtlExitFileSystem](https://msdn.microsoft.com/library/windows/hardware/ff545908). +Because these calls should always be in pairs, the APC disable count should be zero whenever a thread is exited. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true. |
+
0x105 +(Windows 7 operating systems and later) |
+Address of the IRP |
++ | + | The driver uses ExFreePool instead of IoFreeIrp to release the IRP. |
+
0x10A +(Windows 7 operating systems and later) |
++ | + | + | The driver attempts to charge pool quota to the Idle process. |
+
0x10B +(Windows 7 operating systems and later) |
++ | + | + | The driver attempts to charge pool quota from a DPC routine. This is incorrect because the current process context is undefined. |
+
0x110 +(Windows 7 operating systems and later) |
+Address of the Interrupt Service Routine |
+Address of the extended context that was saved before it executed the ISR |
+Address of the extended context was saved after it executed the ISR |
+The interrupt service routine (ISR) for the driver has corrupted the extended thread context. |
+
0x111 +(Windows 7 operating systems and later) |
+Address of the Interrupt Service Routine |
+IRQL before executing ISR |
+IRQL after executing ISR |
+The interrupt Service Routine returned a changed IRQL. |
+
0x115 +(Windows 7 operating systems and later) |
+The address of the thread that is responsible for the shutdown, which might be deadlocked |
++ | + | Driver Verifier detected that the system has taken longer than 20 minutes and shutdown is not complete. |
+
0x11A +(Windows 7 operating systems and later) |
+Current IRQL |
++ | + | The driver calls KeEnterCriticalRegion at IRQL > APC_LEVEL. |
+
0x11B +(Windows 7 operating systems and later) |
+Current IRQL |
++ | + | The driver calls KeLeaveCriticalRegion at IRQL > APC_LEVEL. |
+
0x120 +(Windows 7 operating systems and later) |
+Address of the IRQL value |
+Address of the Object to wait on |
+Address of Timeout value |
+The thread waits at IRQL > DISPATCH_LEVEL. Callers of KeWaitForSingleObject or KeWaitForMultipleObjects must run at IRQL <= DISPATCH_LEVEL. |
+
0x121 +(Windows 7 operating systems and later) |
+Address of the IRQL value |
+Address of the Object to wait on |
+Address of Timeout value |
+The thread waits at IRQL equals DISPATCH_LEVEL and the Timeout is NULL. Callers of KeWaitForSingleObject or KeWaitForMultipleObjects can run at IRQL <= DISPATCH_LEVEL. If a NULL pointer is supplied for Timeout, the calling thread remains in a wait state until the Object is signaled. |
+
0x122 +(Windows 7 operating systems and later) |
+Address of the IRQL value |
+Address of the Object to wait on |
+Address of the Timeout value |
+The thread waits at DISPATCH_LEVEL and Timeout value is not equal to zero (0). If the Timeout != 0, the callers of KeWaitForSingleObject or KeWaitForMultipleObjects must run at IRQL <= APC_LEVEL. |
+
0x123 +(Windows 7 operating systems and later) |
+Address of the Object to wait on |
++ | + | The caller of KeWaitForSingleObject or KeWaitForMultipleObjects specified the wait as UserMode, but the Object is on the kernel stack. |
+
0x130 +(Windows 7 operating systems and later) |
+Address of work item |
++ | + | The work item is in session address space. Work items are not allowed in session address space because they can be manipulated from another session or from system threads that have no session virtual address space. |
+
0x131 +(Windows 7 operating systems and later) |
+Address of work item |
++ | + | The work item is in pageable memory. Work items have to be in nonpageable memory because the kernel uses them at DISPATCH_LEVEL. |
+
0x135 |
+Address of IRP |
+Number of milliseconds allowed between the [IoCancelIrp](https://msdn.microsoft.com/library/windows/hardware/ff548338) call and the completion for this IRP |
++ | The canceled IRP did not completed in the expected time The driver took longer than expected to complete the canceled IRP. |
+
0x13A |
+Address of the pool block being freed |
+Incorrect value |
+Address of the incorrect value |
+The driver has called [ExFreePool](https://msdn.microsoft.com/library/windows/hardware/ff544590) and Driver Verifier detects an error in one of the internal values that is used to track pool usage. |
+
0x13B |
+Address of the pool block being freed |
+Address of the incorrect value |
+Address of a pointer to the incorrect memory page |
+The driver has called [ExFreePool](https://msdn.microsoft.com/library/windows/hardware/ff544590) and Driver Verifier detects an error in one of the internal values that is used to track pool usage. |
+
0x13C |
+Address of the pool block being freed |
+Incorrect value |
+Address of the incorrect value |
+The driver has called [ExFreePool](https://msdn.microsoft.com/library/windows/hardware/ff544590) and Driver Verifier detects an error in one of the internal values that is used to track pool usage. |
+
0x13D |
+Address of the pool block being freed |
+Address of the incorrect value |
+Correct value that was expected |
+The driver has called [ExFreePool](https://msdn.microsoft.com/library/windows/hardware/ff544590) and Driver Verifier detects an error in one of the internal values that is used to track pool usage. |
+
0x13E |
+Pool block address specified by the caller |
+Pool block address tracked by Driver Verifier |
+Pointer to the pool block address that is tracked by Driver Verifier |
+The pool block address specified by the caller of [ExFreePool](https://msdn.microsoft.com/library/windows/hardware/ff544590) is different from the address tracked by Driver Verifier. |
+
0x13F |
+Address of the pool block being freed |
+Number of bytes being freed |
+Pointer to the number of bytes tracked by Driver Verifier |
+The number of bytes of memory being freed in the call to [ExFreePool](https://msdn.microsoft.com/library/windows/hardware/ff544590) is different from the number of bytes tracked by Driver Verifier. |
+
0x140 |
+Current IRQL |
+MDL address |
+Associated virtual address with this MDL |
+A non-locked MDL was constructed from either pageable or tradable memory. |
+
0x1000 (Windows XP and later operating systems only) |
+Address of the resource |
+Reserved |
+Reserved |
+Self-deadlock: The current thread has tried to recursively acquire a resource. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active. |
+
0x1001 (Windows XP and later operating systems only) |
+Address of the resource that was the final cause of the deadlock |
+Reserved |
+Reserved |
+Deadlock: A lock hierarchy violation has been found. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active. +(Use the [!deadlock](-deadlock.md) extension for further information.) |
+
0x1002 (Windows XP and later operating systems only) |
+Address of the resource |
+Reserved |
+Reserved |
+Uninitialized resource: A resource has been acquired without having been initialized first. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active. |
+
0x1003 (Windows XP and later operating systems only) |
+Address of the resource that is being released deadlocked |
+Address of the resource that should have been released first |
+Reserved |
+Unexpected release: A resource has been released in an incorrect order. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active. |
+
0x1004 (Windows XP and later operating systems only) |
+Address of the resource |
+Address of the thread that acquired the resource |
+Address of the current thread |
+Unexpected thread: The wrong thread releases a resource. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active. |
+
0x1005 (Windows XP and later operating systems only) |
+Address of the resource |
+Reserved |
+Reserved |
+Multiple initialization: A resource is initialized more than one time. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active. |
+
0x1007 (Windows XP and later operating systems only) |
+Address of the resource |
+Reserved |
+Reserved |
+Unacquired resource: A resource is released before it has been acquired. A bug check with this parameter occurs only when the Deadlock Detection option of Driver Verifier is active. |
+
0x1008 +(Windows 7 operating systems and later) |
+Lock address |
+Driver Verifier internal data |
+Driver Verifier internal data |
+The driver tried to acquire a lock by using an API that is mismatched for this lock type. |
+
0x1009 +(Windows 7 operating systems and later) |
+Lock address |
+Driver Verifier internal data |
+Driver Verifier internal data |
+The driver tried to release a lock by using an API that is mismatched for this lock type. |
+
0x100A +(Windows 7 operating systems and later) |
+Owner thread address |
+Driver Verifier internal data |
++ | The terminated thread owns the lock. |
+
0x100B +(Windows 7 operating systems and later) |
+Lock address |
+Owner thread address |
+Driver Verifier internal address |
+The deleted lock is still owned by a thread. |
+
0xA001 +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+A pointer to the virtual switch object (if NON-NULL) |
+Reserved (unused) |
+VM Switch: The SourceHandle for the caller-supplied NetBufferList must be set. See the [AllocateNetBufferListForwardingContext](https://msdn.microsoft.com/library/windows/hardware/hh598134) routine. |
+
0xA002 +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+A pointer to the virtual switch object (if NON-NULL). |
+Reserved (unused) |
+VM Switch: The caller supplied NetBufferList's forwarding detail is not zero. See the [AllocateNetBufferListForwardingContext](https://msdn.microsoft.com/library/windows/hardware/hh598134) routine. |
+
0xA003 +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+A pointer to the virtual switch object (if NON-NULL). |
+Reserved (unused) |
+VM Switch: The caller supplied a NetBufferList with packet header or routing context that is NULL. See [Packet Management Guidelines for the Extensible Switch Data Path](https://msdn.microsoft.com/library/windows/hardware/hh582270). |
+
0xA004 +(Windows 8.1 operating systems and later) |
+ID of invalid port |
+NIC Index |
+A pointer to the virtual switch object (if NON-NULL). |
+VM Switch: The caller specified an invalid Port and NIC index combination. See [Hyper-V Extensible Switch Port and Network Adapter States](https://msdn.microsoft.com/library/windows/hardware/hh598182). |
+
0xA005 +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+A pointer to the Destination list. |
+A pointer to the virtual switch object (if NON-NULL). |
+VM Switch: The caller supplied an invalid destination. See [AddNetBufferListDestination](https://msdn.microsoft.com/library/windows/hardware/hh598133) and [UpdateNetBufferListDestinations](https://msdn.microsoft.com/library/windows/hardware/hh598303). |
+
0xA006 +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+A pointer to the virtual switch object (if NON-NULL). |
+Reserved (unused) |
+VM Switch: The caller supplied an invalid source NIC or Port object. See [Hyper-V Extensible Switch Port and Network Adapter States](https://msdn.microsoft.com/library/windows/hardware/hh598182). |
+
0xA007 +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+A pointer to the virtual switch object (if NON-NULL). |
+Reserved (unused) |
+VM Switch: The caller supplied an invalid destination list. See [AddNetBufferListDestination](https://msdn.microsoft.com/library/windows/hardware/hh598133) and [UpdateNetBufferListDestinations](https://msdn.microsoft.com/library/windows/hardware/hh598303). |
+
0xA008 +(Windows 8.1 operating systems and later) |
+Parent NIC object |
+NIC index |
+A pointer to the virtual switch object (if NON-NULL). |
+VM Switch: Attempting to reference a NIC when not allowed. See [Hyper-V Extensible Switch Port and Network Adapter States](https://msdn.microsoft.com/library/windows/hardware/hh598182). |
+
0xA009 +(Windows 8.1 operating systems and later) |
+Port being referenced |
+A pointer to the virtual switch object (if NON-NULL) |
+Reserved (unused) |
+VM Switch: Attempt to reference a port when not allowed. See [Hyper-V Extensible Switch Port and Network Adapter States](https://msdn.microsoft.com/library/windows/hardware/hh598182). |
+
0xA00A +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+ContextTypeInfo object |
+Reserved (unused) |
+VM Switch: Failure context is already set. See [SetNetBufferListSwitchContext](https://msdn.microsoft.com/library/windows/hardware/hh846223). |
+
0xA00B +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+NDIS_SWITCH_REPORT_FILTERED_NBL_FLAGS_* |
+A pointer to the virtual switch object (if NON-NULL) |
+VM Switch: Invalid direction provided for dropped NetBufferList. See [ReportFilteredNetBufferLists](https://msdn.microsoft.com/library/windows/hardware/hh598297). |
+
0xA00C +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+Send Flags value |
+A pointer to the virtual switch object (if NON-NULL) |
+VM Switch: NetBufferList chain has multiple source ports when NDIS_SEND_FLAGS_SWITCH_SINGLE_SOURCE flag is set. See [Hyper-V Extensible Switch Send and Receive Flags](https://msdn.microsoft.com/library/windows/hardware/hh598186). |
+
0xA00D +(Windows 8.1 operating systems and later) |
+A pointer to the NetBufferList object |
+A pointer to the virtual switch context |
+A pointer to the virtual switch object (if NON-NULL) |
+VM Switch: One or more NetBufferLists in chain have invalid destination when NDIS_RECEIVE_FLAGS_SWITCH_DESTINATION_GROUP flag is set. See [Hyper-V Extensible Switch Send and Receive Flags](https://msdn.microsoft.com/library/windows/hardware/hh598186). |
+
| + | + | + | + | + |
0x2000 +(Windows 7 operating systems and later) |
+The first argument passed to the [StorPortInitialize](https://msdn.microsoft.com/library/windows/hardware/ff567108) routine. This parameter is a pointer to the driver object that the operating system passed to the miniport driver in the first argument of the miniport driver's [DriverEntry](https://msdn.microsoft.com/library/windows/hardware/ff544113) routine. |
+The second argument passed to the [StorPortInitialize](https://msdn.microsoft.com/library/windows/hardware/ff567108) routine. This parameter is a pointer to context information that the operating system passed to the miniport driver in the second argument of the miniport driver's [DriverEntry](https://msdn.microsoft.com/library/windows/hardware/ff544113) routine. |
+Reserved |
+The Storport miniport driver passed a bad argument (a NULL pointer) to the [StorPortInitialize](https://msdn.microsoft.com/library/windows/hardware/ff567108) routine. + |
+
0x00020002 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlApcLte](https://msdn.microsoft.com/library/windows/hardware/ff547740). The rule specifies that the driver must call [ObGetObjectSecurity](https://msdn.microsoft.com/library/windows/hardware/ff557738) and [ObReleaseObjectSecurity](https://msdn.microsoft.com/library/windows/hardware/ff558695) only when IRQL <= APC_LEVEL. |
+
0x00020003 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlDispatch](https://msdn.microsoft.com/library/windows/hardware/ff547743). The IrqlDispatch rule specifies that the driver must call certain routines only when IRQL = DISPATCH_LEVEL |
+
0x00020004 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlExAllocatePool](https://msdn.microsoft.com/library/windows/hardware/ff547747). The IrqlExAllocatePool rule specifies that the driver calls [ExAllocatePoolWithTag](https://msdn.microsoft.com/library/windows/hardware/ff544520) and [ExAllocatePoolWithTagPriority](https://msdn.microsoft.com/library/windows/hardware/ff544523) only when at IRQL<=DISPATCH_LEVEL. |
+
0x00020005 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlExApcLte1](https://msdn.microsoft.com/library/windows/hardware/ff547748). The IrqlExApcLte1 rule specifies that the driver calls ExAcquireFastMutex and ExTryToAcquireFastMutex only at IRQL <= APC_LEVEL. |
+
0x00020006 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlExApcLte2](https://msdn.microsoft.com/library/windows/hardware/ff547751). The IrqlExApcLte2 rule specifies that the driver calls certain routines only when IRQL <= APC_LEVEL. |
+
0x00020007 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlExApcLte3](https://msdn.microsoft.com/library/windows/hardware/ff547753). The IrqlExApcLte3 rule specifies that the driver must call certain executive support routines only when IRQL <= APC_LEVEL. |
+
0x00020008 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlExPassive](https://msdn.microsoft.com/library/windows/hardware/ff547756). The IrqlExPassive rule specifies that the driver must call certain executive support routines only when IRQL = PASSIVE_LEVEL. |
+
0x00020009 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlIoApcLte](https://msdn.microsoft.com/library/windows/hardware/ff547759). The IrqlIoApcLte rule specifies that the driver must call certain I/O manager routines only when IRQL <= APC_LEVEL. |
+
0x0002000A +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlIoPassive1](https://msdn.microsoft.com/library/windows/hardware/ff547763). The IrqlIoPassive1 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL. |
+
0x0002000B +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlIoPassive2](https://msdn.microsoft.com/library/windows/hardware/ff547766). The IrqlIoPassive2 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL. |
+
0x0002000C +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlIoPassive3](https://msdn.microsoft.com/library/windows/hardware/ff547780). The IrqlIoPassive3 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL. |
+
0x0002000D +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlIoPassive4](https://msdn.microsoft.com/library/windows/hardware/ff547787). The IrqlIoPassive4 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL. |
+
0x0002000E +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlIoPassive5](https://msdn.microsoft.com/library/windows/hardware/ff547796). The IrqlIoPassive5 rule specifies that the driver must call certain I/O manager routines only when IRQL = PASSIVE_LEVEL. |
+
0x0002000F +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlKeApcLte1](https://msdn.microsoft.com/library/windows/hardware/ff547803). The IrqlKeApcLte1 rule specifies that the driver must call certain kernel routines only when IRQL <= APC_LEVEL. |
+
0x00020010 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlKeApcLte2](https://msdn.microsoft.com/library/windows/hardware/ff547806). The IrqlKeApcLte2 rule specifies that the driver must call certain kernel routines only when IRQL <= APC_LEVEL. |
+
0x00020011 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlKeDispatchLte](https://msdn.microsoft.com/library/windows/hardware/ff547812). The IrqlKeDispatchLte rule specifies that the driver must call certain kernel routines only when IRQL <= DISPATCH_LEVEL. |
+
0x00020015 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlKeReleaseSpinLock](https://msdn.microsoft.com/library/windows/hardware/ff547830). The IrqlKeReleaseSpinLock rule specifies that the driver must call KeReleaseSpinLock only when IRQL = DISPATCH_LEVEL. |
+
0x00020016 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlKeSetEvent](https://msdn.microsoft.com/library/windows/hardware/ff547835). The IrqlKeSetEvent rule specifies that the [KeSetEvent](https://msdn.microsoft.com/library/windows/hardware/ff553253) routine is only called at IRQL <= DISPATCH_LEVEL when Wait is set to FALSE, and at IRQL <= APC_LEVEL when Wait is set to TRUE. |
+
0x00020019 +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlMmApcLte](https://msdn.microsoft.com/library/windows/hardware/ff547855). The IrqlMmApcLte rule specifies that the driver must call certain memory manager routines only when IRQL <= APC_LEVEL. |
+
0x0002001A +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlMmDispatch](https://msdn.microsoft.com/library/windows/hardware/hh975186). The IrqlMmDispatch rule specifies that the driver must call [MmFreeContiguousMemory](https://msdn.microsoft.com/library/windows/hardware/ff554503) only when IRQL = DISPATCH_LEVEL. |
+
0x0002001B +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlObPassive](https://msdn.microsoft.com/library/windows/hardware/ff547873). The IrqlObPassive rule specifies that the driver must call [ObReferenceObjectByHandle](https://msdn.microsoft.com/library/windows/hardware/ff558679) only when IRQL = PASSIVE_LEVEL. |
+
0x0002001C +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlPsPassive](https://msdn.microsoft.com/library/windows/hardware/ff547882). The IrqlPsPassive rule specifies that the driver must call certain process and thread manager routines only when IRQL = PASSIVE_LEVEL. |
+
0x0002001D +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [IrqlReturn](https://msdn.microsoft.com/library/windows/hardware/ff547886). |
+
0x0002001E +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlRtlPassive](https://msdn.microsoft.com/library/windows/hardware/ff547893). The IrqlRtlPassive rule specifies that the driver must call [RtlDeleteRegistryValue](https://msdn.microsoft.com/library/windows/hardware/ff561829) only when IRQL = PASSIVE_LEVEL. |
+
0x0002001F +(Windows 8 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Optional pointer to the rule state variable(s). |
+Reserved |
+The driver violated the DDI compliance rule [IrqlZwPassive](https://msdn.microsoft.com/library/windows/hardware/ff547897). The IrqlZwPassive rule specifies that the driver must call [ZwClose](https://msdn.microsoft.com/library/windows/hardware/ff566417) only when IRQL = PASSIVE_LEVEL. |
+
0x00020022 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Reserved (unused) |
+Reserved (unused) |
+The driver violated the DDI compliance rule [IrqlIoDispatch](https://msdn.microsoft.com/library/windows/hardware/jj157234). |
+
0x00040003 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [CriticalRegions](https://msdn.microsoft.com/library/windows/hardware/ff543603). |
+
0x00040006 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [QueuedSpinLock](https://msdn.microsoft.com/library/windows/hardware/ff551494). |
+
0x00040007 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [QueuedSpinLockRelease](https://msdn.microsoft.com/library/windows/hardware/ff551496). |
+
0x00040009 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [SpinLock](https://msdn.microsoft.com/library/windows/hardware/ff551861). |
+
0x0004000B +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [SpinlockRelease](https://msdn.microsoft.com/library/windows/hardware/ff552780). |
+
0x0004000E +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [GuardedRegions](https://msdn.microsoft.com/library/windows/hardware/hh975150). |
+
0x0004100B +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Reserved |
+Reserved |
+The driver violated the DDI compliance rule [RequestedPowerIrp](https://msdn.microsoft.com/library/windows/hardware/ff551613). |
+
0x0004100F +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [IoSetCompletionExCompleteIrp](https://msdn.microsoft.com/library/windows/hardware/hh975178). |
+
0x00043006 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Reserved |
+Reserved |
+The driver violated the DDI compliance rule [PnpRemove](https://msdn.microsoft.com/library/windows/hardware/dn322052). |
+
0x00091001 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [NdisOidComplete](https://msdn.microsoft.com/library/windows/hardware/dn305115). |
+
0x00091002 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [NdisOidDoubleComplete](https://msdn.microsoft.com/library/windows/hardware/dn305116). |
+
0x0009100E +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the DDI compliance rule [NdisOidDoubleRequest](https://msdn.microsoft.com/library/windows/hardware/dn305117). |
+
0x00092003 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [NdisTimedOidComplete](https://msdn.microsoft.com/library/windows/hardware/dn305120). |
+
0x0009200D +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [NdisTimedDataSend](https://msdn.microsoft.com/library/windows/hardware/dn305119). |
+
0x0009200F +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [NdisTimedDataHang](https://msdn.microsoft.com/library/windows/hardware/dn305118). |
+
0x00093004 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [WlanAssociation](https://msdn.microsoft.com/library/windows/hardware/dn305122). |
+
0x00093005 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [WlanConnectionRoaming](https://msdn.microsoft.com/library/windows/hardware/dn305123). |
+
0x00093006 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [WlanDisassociation](https://msdn.microsoft.com/library/windows/hardware/dn305124). |
+
0x00094007 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [WlanTimedAssociation](https://msdn.microsoft.com/library/windows/hardware/dn305125). |
+
0x00094008 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [WlanTimedConnectionRoaming](https://msdn.microsoft.com/library/windows/hardware/dn305126). |
+
0x00094009 +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [WlanTimedConnectRequest](https://msdn.microsoft.com/library/windows/hardware/dn305127). |
+
0x0009400B +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [WlanTimedLinkQuality](https://msdn.microsoft.com/library/windows/hardware/dn305128). |
+
0x0009400C +(Windows 8.1 operating systems and later) |
+Pointer to the string that describes the violated rule condition. |
+Address of internal rule state (second argument to !ruleinfo). |
+Address of supplemental states (third argument to !ruleinfo). |
+The driver violated the NDIS/WIFI verification rule [WlanTimedScan](https://msdn.microsoft.com/library/windows/hardware/dn305129). |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory referenced |
+
2 |
+IRQL at time of reference |
+
3 |
+0: Read +1: Write |
+
4 |
+Address that referenced memory |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory referenced |
+
2 |
+0: Read +1: Write |
+
3 |
+0: Kernel mode +1: User mode |
+
4 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of error | +
|---|---|---|---|---|
0x0 |
+Address of the timer object |
+Start of memory range being checked |
+End of memory range being checked |
+The timer object was found in a block of memory where a timer object is not permitted. . |
+
0x1 |
+Address of the DPC object |
+Start of memory range being checked |
+End of memory range being checked |
+The DPC object was found in a block of memory where a DPC object is not permitted. |
+
0x2 |
+Address of the DPC routine |
+Start of memory range being checked |
+End of memory range being checked |
+The DPC routine was found in a block of memory where a DPC object is not permitted. |
+
0x3 |
+Address of the DPC object |
+Processor number |
+Number of processors in the system |
+The processor number for the DPC object is not correct. |
+
0x4 |
+Address of the DPC routine |
+The thread's APC disable count before the kernel calls the DPC routine |
+The thread's APC disable count after the DPC routine is called |
+The thread's APC disable count was changed during DPC routine execution. +The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex. +The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. |
+
0x5 |
+Address of the DPC routine |
+The thread's APC disable count before the kernel calls the DPC routine |
+The thread's APC disable count after the DPC routine is called |
+The thread's APC disable count was changed during the execution of timer DPC routine. +The APC disable count is decremented each time a driver calls KeEnterCriticalRegion, FsRtlEnterFileSystem, or acquires a mutex. +The APC disable count is incremented each time a driver calls KeLeaveCriticalRegion, KeReleaseMutex, or FsRtlExitFileSystem. |
+
| Parameter | +Description | +
|---|---|
1 |
+The value of the following bit computation: +(Current IRQL << 16) | (Expected IRQL << 8) | UniqueValue |
+
2 |
+Zero, or APC->KernelRoutine |
+
3 |
+Zero, or APC |
+
4 |
+Zero, or APC->NormalRoutine |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x01 |
+Address of IRP being freed |
+0 |
+0 |
+The driver attempted to free an object whose type is not IO_TYPE_IRP. |
+
0x02 |
+Address of IRP being freed |
+0 |
+0 |
+The driver attempted to free an IRP that is still associated with a thread. |
+
0x03 |
+Address of IRP being sent |
+0 |
+0 |
+The driver passed IoCallDriver an IRP Type not equal to IRP_TYPE. |
+
0x04 |
+Address of device object |
+0 |
+0 |
+The driver passed IoCallDriver an invalid device object. |
+
0x05 |
+Address of device object associated with offending driver |
+IRQL before IoCallDriver |
+IRQL after IoCallDriver |
+The IRQL changed during a call to the driver dispatch routine. |
+
0x06 |
+IRP status |
+Address of IRP being completed |
+0 |
+The driver called IoCompleteRequest with a status marked as pending (or equal to -1). |
+
0x07 |
+Address of cancel routine |
+Address of IRP being completed |
+0 |
+The driver called IoCompleteRequest while its cancel routine was still set. |
+
0x08 |
+Address of device object |
+IRP major function code |
+Exception status code |
+The driver passed IoBuildAsynchronousFsdRequest an invalid buffer. |
+
0x09 |
+Address of device object |
+I/O control code |
+Exception status code |
+The driver passed IoBuildDeviceIoControlRequest an invalid buffer. |
+
0x10 |
+Current IRQL |
+Reserved |
+Reserved |
+IoCallDriver was called above DISPATCH_LEVEL. |
+
0x11 |
+Driver fast I/O dispatch routine address |
+IRQL before calling driver dispatch routine |
+Current IRQL |
+IoCallDriver was called above DISPATCH_LEVEL. |
+
0x12 |
+Driver dispatch routine address |
+IRQL before calling driver dispatch routine |
+Current IRQL |
+IoCallDriver was called above DISPATCH_LEVEL. |
+
0x0A |
+Address of device object |
+0 |
+0 |
+The driver passed IoInitializeTimer a device object with an already-initialized timer. |
+
0x0C |
+Address of I/O status block |
+0 |
+0 |
+The driver passed an I/O status block to an IRP, but this block is allocated on a stack which has already unwound past that point. |
+
0x0D |
+Address of user event object |
+0 |
+0 |
+The driver passed a user event to an IRP, but this event is allocated on a stack which has already unwound past that point. |
+
0x0E |
+Current IRQL |
+Address of IRP |
+0 |
+The driver called IoCompleteRequest with IRQL > DISPATCH_LEVEL. |
+
0x0F |
+Address of the device object to which the IRP is being sent |
+Pointer to the IRP |
+Pointer to file object |
+The driver sent a create request with a file object that has been closed, or that had its open canceled. |
+
| I/O Error Code | +Severity | +Cause of Error | +
|---|---|---|
0x200 |
+Unknown |
+This code covers all unknown I/O Verification errors. |
+
0x201 |
+Fatal error |
+A device is deleting itself while there is another device beneath it in the driver stack. This may be because the caller has forgotten to call IoDetachDevice first, or the lower driver may have incorrectly deleted itself. |
+
0x202 |
+Fatal error |
+A driver has attempted to detach from a device object that is not attached to anything. This may occur if detach was called twice on the same device object. (Device object specified.) |
+
0x203 |
+Fatal error |
+A driver has called IoCallDriver without setting the cancel routine in the IRP to NULL. (IRP specified.) |
+
0x204 |
+Fatal error |
+The caller has passed in NULL as a device object. This is fatal. (IRP specified.) |
+
0x205 |
+Fatal error |
+The caller is forwarding an IRP that is currently queued beneath it. The code handling IRPs returning STATUS_PENDING in this driver appears to be broken. (IRP specified.) |
+
0x206 |
+Fatal error |
+The caller has incorrectly forwarded an IRP (control field not zeroed). The driver should use IoCopyCurrentIrpStackLocationToNext or IoSkipCurrentIrpStackLocation. (IRP specified.) |
+
0x207 |
+Fatal error |
+The caller has manually copied the stack and has inadvertently copied the upper layer's completion routine. The driver should use IoCopyCurrentIrpStackLocationToNext. (IRP specified.) |
+
0x208 |
+Fatal error |
+This IRP is about to run out of stack locations. Someone may have forwarded this IRP from another stack. (IRP specified.) |
+
0x209 |
+Fatal error |
+The caller is completing an IRP that is currently queued beneath it. The code handling IRPs returning STATUS_PENDING in this driver appears to be broken. (IRP specified.) |
+
0x20A |
+Fatal error |
+The caller of IoFreeIrp is freeing an IRP that is still in use. (Original IRP and IRP in use specified.) |
+
0x20B |
+Fatal error |
+The caller of IoFreeIrp is freeing an IRP that is still in use. (IRP specified.) |
+
0x20C |
+Fatal error |
+The caller of IoFreeIrp is freeing an IRP that is still queued against a thread. (IRP specified.) |
+
0x20D |
+Fatal error |
+The caller of IoInitializeIrp has passed an IRP that was allocated with IoAllocateIrp. This is illegal and unnecessary, and has caused a quota leak. Check the documentation for IoReuseIrp if this IRP is being recycled. |
+
0x20E |
+Non-fatal error |
+A PNP IRP has an invalid status. (Any PNP IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.) |
+
0x20F |
+Non-fatal error |
+A Power IRP has an invalid status. (Any Power IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.) |
+
0x210 |
+Non-fatal error |
+A WMI IRP has an invalid status. (Any WMI IRP must have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.) |
+
0x211 |
+Non-fatal error |
+The caller has forwarded an IRP while skipping a device object in the stack. The caller is probably sending IRPs to the PDO instead of to the device returned by IoAttachDeviceToDeviceStack. (IRP specified.) |
+
0x212 |
+Non-fatal error |
+The caller has trashed or has not properly copied the IRP's stack. (IRP specified.) |
+
0x213 |
+Non-fatal error |
+The caller has changed the status field of an IRP it does not understand. (IRP specified.) |
+
0x214 |
+Non-fatal error |
+The caller has changed the information field of an IRP it does not understand. (IRP specified.) |
+
0x215 |
+Non-fatal error |
+A non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_PNP is being passed down stack. (IRP specified.) Failed PNP IRPs must be completed. |
+
0x216 |
+Non-fatal error |
+The previously-set IRP_MJ_PNP status has been converted to STATUS_NOT_SUPPORTED. (IRP specified.) This failure status is reserved for use by the operating system. Drivers cannot fail a PnP IRP with this value. |
+
0x217 |
+Non-fatal error |
+The driver has not handled a required IRP. The driver must update the status of the IRP to indicate whether or not it has been handled. (IRP specified.) |
+
0x218 |
+Non-fatal error |
+The driver has responded to an IRP that is reserved for other device objects elsewhere in the stack. (IRP specified.) |
+
0x219 |
+Non-fatal error |
+A non-successful non-STATUS_NOT_SUPPORTED IRP status for IRP_MJ_POWER is being passed down stack. (IRP specified.) Failed POWER IRPs must be completed. |
+
0x21A |
+Non-fatal error |
+The previously-set IRP_MJ_POWER status has been converted to STATUS_NOT_SUPPORTED. (IRP specified.) |
+
0x21B |
+Non-fatal error |
+A driver has returned a suspicious status. This is probably due to an uninitialized variable bug in the driver. (IRP specified.) |
+
0x21C |
+Warning |
+The caller has copied the IRP stack but not set a completion routine. This is inefficient -- use IoSkipCurrentIrpStackLocation instead. (IRP specified.) |
+
0x21D |
+Fatal error |
+An IRP dispatch handler has not properly detached from the stack below it upon receiving a remove IRP. (Device object, dispatch routine, and IRP specified.) |
+
0x21E |
+Fatal error |
+An IRP dispatch handler has not properly deleted its device object upon receiving a remove IRP. (Device object, dispatch routine, and IRP specified.) |
+
0x21F |
+Non-fatal error |
+A driver has not filled out a dispatch routine for a required IRP major function. (IRP specified.) |
+
0x220 |
+Non-fatal error |
+IRP_MJ_SYSTEM_CONTROL has been completed by someone other than the ProviderId. This IRP should either have been completed earlier or should have been passed down. (IRP specified, along with the device object where it was targeted.) |
+
0x221 |
+Fatal error |
+An IRP dispatch handler for a PDO has deleted its device object, but the hardware has not been reported as missing in a bus relations query. (Device object, dispatch routine, and IRP specified.) |
+
0x222 |
+Fatal error |
+A Bus Filter's IRP dispatch handler has detached upon receiving a remove IRP when the PDO is still alive. Bus Filters must clean up in FastIoDetach callbacks. (Device object, dispatch routine, and IRP specified.) |
+
0x223 |
+Fatal error |
+An IRP dispatch handler for a bus filter has deleted its device object, but the PDO is still present. Bus filters must clean up in FastIoDetach callbacks. (Device object, dispatch routine, and IRP specified.) |
+
0x224 |
+Fatal error |
+An IRP dispatch handler has returned a status that is inconsistent with the IRP's IoStatus.Status field. (Dispatch handler routine, IRP, IRP's IoStatus.Status, and returned Status specified.) |
+
0x225 |
+Non-fatal error |
+An IRP dispatch handler has returned a status that is illegal (0xFFFFFFFF). This is probably due to an uninitialized stack variable. To debug this error, use the [ln (List Nearest Symbols)](ln--list-nearest-symbols-.md) command with the specified address. |
+
0x226 |
+Fatal error |
+An IRP dispatch handler has returned without passing down or completing this IRP, or someone forgot to return STATUS_PENDING. (IRP specified.) |
+
0x227 |
+Fatal error |
+An IRP completion routine is in pageable code. (This is never permitted.) (Routine and IRP specified.) |
+
0x228 |
+Non-fatal error |
+A driver's completion routine has not marked the IRP pending if the PendingReturned field was set in the IRP passed to it. This may cause Windows to hang, especially if an error is returned by the stack. (Routine and IRP specified.) |
+
0x229 |
+Fatal error |
+A cancel routine has been set for an IRP that is currently being processed by drivers lower in the stack, possibly stomping their cancel routine. (Routine and IRP specified.) |
+
0x22A |
+Non-fatal error |
+The physical device object (PDO) has not responded to a required IRP. (IRP specified.) |
+
0x22B |
+Non-fatal error |
+The physical device object (PDO) has forgotten to fill out the device relation list with the PDO for the TargetDeviceRelation query. (IRP specified.) |
+
0x22C |
+Fatal error |
+The code implementing the TargetDeviceRelation query has not called ObReferenceObject on the PDO. (IRP specified.) |
+
0x22D |
+Non-fatal error |
+The caller has completed a IRP_MJ_PNP it didn't understand instead of passing it down. (IRP specified.) |
+
0x22E |
+Non-fatal error |
+The caller has completed a successful IRP_MJ_PNP instead of passing it down. (IRP specified.) |
+
0x22F |
+Non-fatal error |
+The caller has completed an untouched IRP_MJ_PNP (instead of passing the IRP down), or non-PDO has failed the IRP using illegal value of STATUS_NOT_SUPPORTED. (IRP specified.) |
+
0x230 |
+Non-fatal error |
+The caller has completed an IRP_MJ_POWER it didn't understand instead of passing it down. (IRP specified.) |
+
0x231 |
+Fatal error |
+The caller has completed a successful IRP_MJ_POWER instead of passing it down. (IRP specified.) |
+
0x232 |
+Non-fatal error |
+The caller has completed an untouched IRP_MJ_POWER (instead of passing the IRP down), or non-PDO has failed the IRP using illegal value of STATUS_NOT_SUPPORTED. (IRP specified.) |
+
0x233 |
+Non-fatal error |
+The version field of the query capabilities structure in a query capabilities IRP was not properly initialized. (IRP specified.) |
+
0x234 |
+Non-fatal error |
+The size field of the query capabilities structure in a query capabilities IRP was not properly initialized. (IRP specified.) |
+
0x235 |
+Non-fatal error |
+The address field of the query capabilities structure in a query capabilities IRP was not properly initialized to -1. (IRP specified.) |
+
0x236 |
+Non-fatal error |
+The UI Number field of the query capabilities structure in a query capabilities IRP was not properly initialized to -1. (IRP specified.) |
+
0x237 |
+Fatal error |
+A driver has sent an IRP that is restricted for system use only. (IRP specified.) |
+
0x238 |
+Warning |
+The caller of IoInitializeIrp has passed an IRP that was allocated with IoAllocateIrp. This is illegal, unnecessary, and negatively impacts performance in normal use. If this IRP is being recycled, see IoReuseIrp in the Windows Driver Kit. |
+
0x239 |
+Warning |
+The caller of IoCompleteRequest is completing an IRP that has never been forwarded via a call to IoCallDriver or PoCallDriver. This may be a bug. (IRP specified.) |
+
0x23A |
+Fatal error |
+A driver has forwarded an IRP at an IRQL that is illegal for this major code. (IRP specified.) |
+
0x23B |
+Non-fatal error |
+The caller has changed the status field of an IRP it does not understand. (IRP specified.) |
+
| I/O Error Code | +Severity | +Cause of Error | +
|---|---|---|
0x23C |
+Fatal error |
+A driver has completed an IRP without setting the cancel routine in the IRP to NULL. (IRP specified.) |
+
0x23D |
+Non-fatal error |
+A driver has returned STATUS_PENDING but did not mark the IRP pending via a call to IoMarkIrpPending. (IRP specified.) |
+
0x23E |
+Non-fatal error |
+A driver has marked an IRP pending but didn't return STATUS_PENDING. (IRP specified.) |
+
0x23F |
+Fatal error |
+A driver has not inherited the DO_POWER_PAGABLE bit from the stack it has attached to. (Device object specified.) |
+
0x240 |
+Fatal error |
+A driver is attempting to delete a device object that has already been deleted via a prior call to IoDeleteDevice. |
+
0x241 |
+Fatal error |
+A driver has detached its device object during a surprise remove IRP. (IRP and device object specified.) |
+
0x242 |
+Fatal error |
+A driver has deleted its device object during a surprise remove IRP. (IRP and device object specified.) |
+
0x243 |
+Fatal error |
+A driver has failed to clear the DO_DEVICE_INITIALIZING flag at the end of AddDevice. (Device object specified.) |
+
0x244 |
+Fatal error |
+A driver has not copied either the DO_BUFFERED_IO or the DO_DIRECT_IO flag from the device object it is attaching to. (Device object specified.) |
+
0x245 |
+Fatal error |
+A driver has set both the DO_BUFFERED_IO and the DO_DIRECT_IO flags. These flags are mutually exclusive. (Device object specified.) |
+
0x246 |
+Fatal error |
+A driver has failed to copy the DeviceType field from the device object it is attaching to. (Device object specified.) |
+
0x247 |
+Fatal error |
+A driver has failed an IRP that cannot legally be failed. (IRP specified.) |
+
0x248 |
+Fatal error |
+A driver has added a device object that is not a PDO to a device relations query. (IRP and device object specified.) |
+
0x249 |
+Non-fatal error |
+A driver has enumerated two child PDOs that returned identical Device IDs. (Both device objects specified.) |
+
0x24A |
+Fatal error |
+A driver has mistakenly called a file I/O function with IRQL not equal to PASSIVE_LEVEL. |
+
0x24B |
+Fatal error |
+A driver has completed an IRP_MN_QUERY_DEVICE_RELATIONS request of type TargetDeviceRelation as successful, but did not properly fill out the request or forward the IRP to the underlying hardware stack. (Device object specified.) |
+
0x24C |
+Non-fatal error |
+A driver has returned STATUS_PENDING but did not mark the IRP pending by a call to IoMarkIrpPending. (IRP specified.) |
+
0x24D |
+Fatal error |
+A driver has passed an invalid device object to a function that requires a PDO. (Device object specified.) |
+
0x300 |
+Non-fatal error |
+A driver has returned a suspicious status. This is probably due to an uninitialized variable bug in the driver. |
+
0x301 |
+Non-fatal error |
+A driver has forwarded an IRP at IRQL > DISPATCH_LEVEL. (IRQL value specified) |
+
0x302 |
+Non-fatal error |
+A driver has forwarded an IRP at IRQL >= APC_LEVEL. +The I/O Manager will need to queue an APC to complete this request. The APC will not be able to run because the caller is already at APC level, so the caller is likely to deadlock. (IRQL value specified) |
+
0x306 |
+Non-fatal error |
+The driver is completing an IRP_MJ_PNP (major) and IRP_MN_REMOVE_DEVICE (minor) request with a failure status code. |
+
0x307 |
+Non-fatal error |
+The driver issued an I/O request with an event that was already signaled and received a STATUS_PENDING response. This can result in unwinding before the I/O is complete. |
+
0x310 |
+Non-fatal error |
+The driver is reinitializing an IRP that is still in use. |
+
0x311 |
+Non-fatal error |
+The driver is reinitializing an IRP that was created with IoMakeAssociatedIrp, IoBuildAsynchronousFsdRequest, IoBuildSynchronousFsdRequest, IoBuildDeviceIoControlRequest. |
+
0x312 |
+Non-fatal error |
+The caller provided the IRP Status Information field with a value that is greater than the output section of the system buffer. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x1 |
+Address of newly-reported PDO |
+Address of older PDO which has been duplicated |
+Reserved |
+Duplicate PDO: A specific instance of a driver has enumerated multiple PDOs with identical device ID and unique IDs. |
+
0x2 |
+Address of purported PDO |
+Address of driver object |
+Reserved |
+Invalid PDO: An API which requires a PDO has been called with random memory, or with an FDO, or with a PDO which hasn't been initialized. +(An uninitialized PDO is one that has not been returned to Plug and Play by QueryDeviceRelation or QueryBusRelations.) |
+
0x3 |
+Address of PDO whose IDs were queried |
+Address of ID buffer |
+1: DeviceID +2: UniqueID +3: HardwareIDs +4: CompatibleIDs |
+Invalid ID: An enumerator has returned an ID which contains illegal characters or isn't properly terminated. (IDs must contain only characters in the ranges 0x20 - 0x2B and 0x2D - 0x7F.) |
+
0x4 |
+Address of PDO with DOE_DELETE_PENDING set |
+Reserved |
+Reserved |
+Invalid enumeration of deleted PDO: An enumerator has returned a PDO which it had previously deleted using IoDeleteDevice. |
+
0x5 |
+Address of PDO |
+Reserved |
+Reserved |
+PDO freed while linked in devnode tree: The object manager reference count on a PDO dropped to zero while the devnode was still linked in the tree. (This usually indicates that the driver is not adding a reference when returning the PDO in a query IRP.) |
+
0x8 |
+Address of PDO whose stack returned the invalid bus relation |
+Total number of PDOs returned as bus relations |
+The index (zero-based) at which the first NULL PDO was found |
+NULL pointer returned as a bus relation: One or more of the devices present on the bus is a NULL PDO. |
+
0x9 |
+Connection type that was passed |
+Reserved |
+Reserved |
+Invalid connection type passed to IoDisconnectInterruptEx: A driver has passed an invalid connection type to IoDisconnectInterruptEx. The connection type passed to this routine must match the one returned by a corresponding successful call to IoConnectInterruptEx. |
+
0xA |
+Driver object |
+IRQL after returning from driver callback |
+Combined APC disable count after returning from driver callback |
+Incorrect notify callback behavior: A driver failed to preserve IRQL or combined APC disable count across a Plug 'n' Play notification. |
+
0xB |
+Related PDO |
+Removal relations |
+Reserved |
+Deleted PDO reported as relation: One of the removal relations for the device being removed has already been deleted. |
+
| Parameter | +Description | +
|---|---|
1 |
+Calling address in the driver that locked the pages |
+
2 |
+Caller of the calling address in driver that locked the pages |
+
3 |
+Address of the MDL containing the locked pages |
+
4 |
+Number of locked pages |
+
| Parameter | +Description | +
|---|---|
1 |
+Address of the dispatch routine of the top driver on the stack to which the IRP was sent |
+
2 |
+Address of the device object of the top driver on the stack to which the IRP was sent |
+
3 |
+Address of the MDL containing the locked pages |
+
4 |
+Number of locked pages |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory address referenced |
+
2 |
+0: Read +1: Write |
+
3 |
+Address that referenced memory (if known) |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory address referenced |
+
2 |
+0: Read +1: Write |
+
3 |
+Address that referenced memory (if known) |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory address referenced |
+
2 |
+0: Read +1: Write |
+
3 |
+Address that referenced memory (if known) |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory address referenced |
+
2 |
+0: Read +1: Write |
+
3 |
+Address that referenced memory (if known) |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory referenced |
+
2 |
+IRQL at time of reference |
+
3 |
+0: Read +1: Write |
+
4 |
+Address that referenced memory |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory referenced |
+
2 |
+IRQL at time of reference |
+
3 |
+0: Read +1: Write +8: Execute |
+
4 |
+Address that referenced memory |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Message and Cause | +
|---|---|---|---|---|
Address of the miniport block |
+Number of bytes requested |
+0 |
+1 |
+Allocating shared memory at raised IRQL. A driver called NdisMAllocateSharedMemory with IRQL >= DISPATCH_LEVEL. |
+
Address of the miniport block |
+The Status value submitted to NdisMResetComplete |
+The AddressingReset value submitted to NdisMResetComplete |
+0 |
+Completing reset when one is not pending. A driver called NdisMResetComplete, but no reset was pending. |
+
Address of the miniport block |
+Memory page containing address being freed |
+Address of shared memory signature |
+Virtual address being freed |
+Freeing shared memory not allocated. A driver called NdisMFreeSharedMemory or NdisMFreeSharedMemoryAsync with an address that is not located in NDIS shared memory. |
+
Address of the miniport block |
+Address of the packet that is incorrectly included in the packet array |
+Address of the packet array |
+Number of packets in the array |
+Indicating packet not owned by it. The miniport's packet array is corrupt. |
+
Address of the MiniBlock |
+Address of the driver object |
+0 |
+0 |
+NdisAddDevice: AddDevice called with a MiniBlock that is not on the NdisMiniDriverList. |
+
Address of the MiniBlock |
+The MiniBlock's reference count |
+0 |
+0 |
+NdisMUnload: MiniBlock is getting unloaded but it is still on NdisMiniDriverList. |
+
Address of the miniport block |
+Memory page |
+Wrapper context |
+Address of shared memory signature |
+Overwrote past allocated shared memory. The address being written to is not located in NDIS shared memory. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Message and Cause | +
|---|---|---|---|---|
Address of the miniport block |
+Address of the miniport interrupt |
+Address of the miniport timer queue |
+1 |
+Unloading without deregistering interrupt. A miniport driver failed its initialization without deregistering its interrupt. |
+
Address of the miniport block |
+Address of the miniport timer queue |
+Address of the miniport interrupt |
+2 |
+Unloading without deregistering interrupt. A miniport driver did not deregister its interrupt during the halt process. |
+
Address of the miniport block |
+Address of the miniport interrupt |
+Address of the miniport timer queue |
+1 |
+Unloading without deregistering timer. A miniport driver failed its initialization without successfully canceling all its timers. |
+
Address of the miniport block |
+Address of the miniport timer queue |
+Address of the miniport interrupt |
+2 |
+Unloading without deregistering timer. A miniport driver halted without successfully canceling all its timers. |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory referenced |
+
2 |
+IRQL at time of reference |
+
3 |
+0: Read +1: Write |
+
4 |
+Address that referenced memory |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory referenced |
+
2 |
+IRQL at time of reference |
+
3 |
+0: Read +1: Write |
+
4 |
+Address that referenced memory |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory address referenced |
+
2 |
+0: Read +1: Write |
+
3 |
+Address that referenced memory (if known) |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory address referenced |
+
2 |
+0: Read +1: Write |
+
3 |
+Address that referenced memory (if known) |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Virtual address to unmap |
+
2 |
+1: The view is being unmapped +2: The view is being committed |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+Pointer to the name of the driver that caused the error (Unicode string), or zero |
+
2 |
+Number of PTEs used by the driver that caused the error (if Parameter 1 is nonzero) |
+
3 |
+Total free system PTEs |
+
4 |
+Total system PTEs |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x01 |
+The address of the internal lock tracking structure |
+The address of the memory descriptor list |
+The number of pages locked for the current process |
+The MDL is being inserted twice on the same process list. |
+
0x02 |
+The address of the internal lock tracking structure |
+The address of the memory descriptor list |
+The number of pages locked for the current process |
+The MDL is being inserted twice on the systemwide list. |
+
0x03 |
+The address of the first internal tracking structure found |
+The address of the internal lock tracking structure |
+The address of the memory descriptor list |
+The MDL was found twice in the process list when being freed. |
+
0x04 |
+The address of the internal lock tracking structure |
+The address of the memory descriptor list |
+0 |
+The MDL was found in the systemwide list on free after it was removed. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x01 |
+The address of the internal lock tracking structure |
+The address of the memory descriptor list |
+The address of the duplicate internal lock tracking structure |
+The mapping being freed is a duplicate. |
+
0x02 |
+The address of the internal lock tracking structure |
+The number of mappings that the system expects to free |
+The number of mappings that the driver is requesting to free |
+The number of mappings being freed is incorrect. |
+
0x03 |
+The address of the first internal tracking structure found |
+The mapping address that the system expects to free |
+The mapping address that the driver is requesting to free |
+The mapping address being freed is incorrect. |
+
0x04 |
+The address of the internal lock tracking structure |
+The page frame number that the system expects should be first in the MDL |
+The page frame number that is currently first in the MDL |
+The first page of the mapped MDL has changed since the MDL was mapped. |
+
0x05 |
+The address of the first internal tracking structure found |
+The virtual address that the system expects to free |
+The virtual address that the driver is requesting to free |
+The start virtual address in the MDL being freed has changed since the MDL was mapped. |
+
0x06 |
+The MDL specified by the driver |
+The virtual address specified by the driver |
+The number of mappings to free (specified by the driver) |
+The MDL being freed was never (or is currently not) mapped. |
+
0x07 |
+The initial mapping |
+The number of mappings |
+Reserved |
+(Windows 2000 only) The mapping range is being double-allocated. |
+
0x08 |
+The initial mapping |
+The number of mappings the caller is freeing |
+The number of mappings the system thinks should be freed |
+(Windows 2000 only) The caller is asking to free an incorrect number of mappings. |
+
0x09 |
+The initial mapping |
+The number of mappings that the caller is freeing |
+The mapping index that the system thinks is already free |
+(Windows 2000 only) The caller is asking to free several mappings, but at least one of them is not allocated. |
+
0x0A |
+1: The driver requested "bug check on failure" in the MDL. +0: The driver did not request "bug check on failure" in the MDL. |
+The number of mappings that the caller is allocating |
+The type of mapping pool requested |
+(Windows 2000 only) The caller is asking to allocate zero mappings. |
+
0x0B |
+The corrupt mapping |
+The number of mappings that the caller is allocating |
+The type of mapping pool requested |
+(Windows 2000 only) The mapping list was already corrupt at the time of this allocation. The corrupt mapping is located below the lowest possible mapping address. |
+
0x0C |
+The corrupt mapping |
+The number of mappings that the caller is allocating |
+The type of mapping pool requested |
+(Windows 2000 only) The mapping list was already corrupt at the time of this allocation. The corrupt mapping is located above the lowest possible mapping address. |
+
0x0D |
+The initial mapping |
+The number of mappings that the caller is freeing |
+The type of mapping pool |
+(Windows 2000 only) The caller is trying to free zero mappings. |
+
0x0E |
+The initial mapping |
+The number of mappings that the caller is freeing |
+The type of mapping pool |
+(Windows 2000 only) The caller is trying to free mappings, but the guard mapping has been overwritten. |
+
0x0F |
+The non-existent mapping |
+The number of mappings that the caller is trying to free |
+The type of mapping pool being freed |
+(Windows 2000 only) The caller is trying to free a non-existent mapping. The non-existent mapping is located below the lowest possible mapping address. |
+
0x10 |
+The non-existent mapping |
+The number of mappings the caller is trying to free |
+The type of mapping pool being freed |
+(Windows 2000 only) The caller is trying to free a non-existent mapping. The non-existent mapping is located above the highest possible mapping address. |
+
0x11 |
+The non-existent mapping |
+The number of mappings that the caller is trying to free |
+The type of mapping pool being freed |
+(Windows 2000 only) The caller is trying to free a non-existent mapping. The non-existent mapping is at the base of the mapping address space. |
+
0x100 |
+The number of mappings being requested |
+The caller's identifying tag |
+The address of the routine that called the caller of this routine |
+(Windows XP and later only) The caller requested 0 mappings. |
+
0x101 |
+The first mapping address |
+The caller's identifying tag |
+The owner's identifying tag |
+(Windows XP and later only) A caller is trying to free a mapping address range that it does not own. |
+
0x102 |
+The first mapping address |
+The caller's identifying tag |
+Reserved |
+(Windows XP and later only) The mapping address space that the caller is trying to free is apparently empty. |
+
0x103 |
+The address of the invalid mapping |
+The caller's identifying tag |
+The number of mappings in the mapping address space |
+(Windows XP and later only) The mapping address space that the caller is trying to free is still reserved. [MmUnmapReservedMapping](https://msdn.microsoft.com/library/windows/hardware/ff556392) +must be called before [MmFreeMappingAddress](https://msdn.microsoft.com/library/windows/hardware/ff554512). |
+
0x104 |
+The first mapping address |
+The caller's identifying tag |
+The owner's identifying tag |
+(Windows XP and later only) The caller is attempting to map an MDL to a mapping address space that it does not own. |
+
0x105 |
+The first mapping address |
+The caller's identifying tag |
+Reserved |
+(Windows XP and later only) The caller is attempting to map an MDL to an invalid mapping address space. The caller has mostly likely specified an invalid address. |
+
0x107 |
+The first mapping address |
+The address of the non-empty mapping |
+The last mapping address |
+(Windows XP and later only) The caller is attempting to map an MDL to a mapping address space that has not been properly reserved. The caller should have called [MmUnmapReservedMapping](https://msdn.microsoft.com/library/windows/hardware/ff556392) prior to calling [MmMapLockedPagesWithReservedMapping](https://msdn.microsoft.com/library/windows/hardware/ff554640) |
+
0x108 |
+The first mapping address |
+The caller's identifying tag |
+The owner's identifying tag |
+(Windows XP and later only) The caller is attempting to unmap a locked mapping address space that it does not own. |
+
0x109 |
+The first mapping address |
+The caller's identifying tag |
+Reserved |
+(Windows XP and later only) The caller is attempting to unmap a locked virtual address space that is apparently empty. |
+
0x10A |
+The first mapping address |
+The number of mappings in the locked mapping address space |
+The number of mappings to unmap |
+(Windows XP and later only) The caller is attempting to unmap more mappings than actually exist in the locked mapping address space. |
+
0x10B |
+The first mapping address |
+The caller's identifying tag |
+The number of mappings to unmap |
+(Windows XP and later only) The caller is attempting to unmap a portion of a locked virtual address space that is not currently mapped. |
+
0x10C |
+The first mapping address |
+The caller's identifying tag |
+The number of mappings to unmap |
+(Windows XP and later only) The caller is not unmapping the entirety of the locked mapping address space. |
+
0x200 |
+The first mapping address |
+0 |
+0 |
+(Windows XP and later only) The caller is attempting to reserve a mapping address space that contains no mappings. |
+
0x201 +0x202 |
+The first mapping address to reserve |
+The address of the mapping that has already been reserved |
+The number of mappings to reserve |
+(Windows XP and later only) One of the mappings that the caller is attempting to reserve has already been reserved. |
+
0x300 |
+The first mapping address to release |
+0 |
+0 |
+(Windows XP and later only) The caller is attempting to release a mapping address space that contains no mappings. |
+
0x301 |
+The address of the mapping |
+0 |
+0 |
+(Windows XP and later only) The caller is attempting to release a mapping that it is not permitted to release. |
+
0x302 |
+The address that the caller is trying to release. |
+Reserved |
+Reserved |
+The caller is attempting to release a system address that is not currently mapped. |
+
0x303 |
+The first mapping address |
+The number of mappings to release |
+0 |
+(Windows XP and later only) The caller is attempting to release a mapping address range that was not reserved. |
+
0x304 |
+The first mapping address |
+The number of mappings to release |
+0 |
+(Windows XP and later only) The caller is attempting to release a mapping address range that begins in the middle of a different allocation. |
+
0x305 |
+The first mapping address |
+The number of mappings that the caller is trying to release |
+The number of mappings that should be released |
+(Windows XP and later only) The caller is attempting to release the wrong number of mappings. |
+
0x306 |
+The first mapping address |
+The free mapping address |
+The number of mappings to release |
+(Windows XP and later only) One of the mappings that the caller is attempting to release is already free. |
+
0x400 |
+The base address of the I/O space mapping |
+The number of pages to be freed |
+0 |
+(Windows XP and later only) The caller is trying to free an I/O space mapping that the system is unaware of. |
+
| Parameter | +Description | +
|---|---|
1 |
+Memory referenced |
+
2 |
+IRQL |
+
3 |
+0: Read +1: Write |
+
4 |
+Address in code which referenced memory |
+
| Parameter | +Description | +
|---|---|
1 |
+The worker routine that caused this error |
+
2 |
+The parameter passed to this worker routine |
+
3 |
+A pointer to the work item |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Address of the worker routine |
+
2 |
+IRQL that the worker thread returned at |
+
3 |
+Work item parameter |
+
4 |
+Work item address |
+
| Parameter | +Description | +
|---|---|
1 |
+Address of resource |
+
2 |
+Address of thread |
+
3 |
+Address of owner table (if it exists) |
+
4 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x0 |
+Address of work item |
+Start of pool block |
+End of pool block |
+An active worker item was freed. |
+
0x1 |
+Address of work item |
+Queue number |
+0 |
+An active worker item was queued. |
+
0x2 |
+Address of work item |
+Address of I/O worker routine |
+0 |
+A queued I/O worker item was freed. |
+
0x3 |
+Address of work item |
+Address of invalid object |
+0 |
+An attempt was made to initialize an I/O worker item with an invalid object. |
+
0x5 |
+Address of work item |
+Queue number |
+NUMA Node targeted or -1 if all NODES were searched for. |
+An attempt was made to queue a work item before Worker Queued was initialized. |
+
0x6 |
+Address of work item |
+Queue number |
+0 |
+Invalid queue type was provided. |
+
0x7 |
+Address of work item |
+Queue number |
+0 |
+An attempt was made to queue a work item with an invalid worker routine address. |
+
| Parameter 1 | +Cause of Error and Debugger Message | +
|---|---|
0x00 |
+This code can represent two kinds of errors: +1. The driver tried to flush too many bytes to the end of the map register file. The number of bytes permitted and the number of bytes attempted are displayed. +2. Windows has run out of contiguous map registers. The number of map registers needed and the largest block of contiguous map registers is displayed. |
+
0x01 |
+The performance counter has decreased. The old and new values of the counter are displayed. |
+
0x02 |
+The performance counter has increased too fast. The counter value is displayed in the debugger. |
+
0x03 |
+The driver freed too many DMA common buffers. Usually this means it freed the same buffer two times. |
+
0x04 |
+The driver freed too many DMA adapter channels. Usually this means it freed the same adapter channel two times. |
+
0x05 |
+The driver freed too many DMA map registers. Usually this means it freed the same map register two times. The number of active map registers is displayed. |
+
0x06 |
+The driver freed too many DMA scatter/gather lists. Usually this means it freed the same scatter/gather list two times. The number of lists allocated and the number of lists freed is displayed. |
+
0x07 |
+The driver tried to release the adapter without first freeing all its common buffers. The adapter address and the number of remaining buffers is displayed. |
+
0x08 |
+The driver tried to release the adapter without first freeing all adapter channels, common buffers, or scatter/gather lists. The adapter address and the number of remaining items is displayed. |
+
0x09 |
+The driver tried to release the adapter without first freeing all map registers. The adapter address and the number of remaining map registers is displayed. |
+
0x0A |
+The driver tried to release the adapter without first freeing all its scatter/gather lists. The adapter address and the number of remaining scatter/gather lists is displayed. |
+
0x0B |
+HV_TOO_MANY_ADAPTER_CHANNELSThe driver has allocated too many adapter channels at the same time. . (Only one adapter channel is permitted per adapter.) |
+
0x0C |
+The driver tried to allocate too many map registers at the same time. The number requested and the number allowed are displayed. |
+
0x0D |
+The driver did not flush its adapter buffers. The number of bytes that the driver tried to map and the maximum number of bytes allowed are displayed. |
+
0x0E |
+The driver tried a DMA transfer without locking the buffer. The buffer in question was in paged memory. The address of the MDL is displayed. |
+
0x0F |
+The driver or the hardware wrote outside its allocated DMA buffer. The nature of the error (overrun or underrun) is displayed, as well as the relevant addresses. |
+
0x10 |
+The driver tried to free its map registers while some were still mapped. The number of map registers still mapped is displayed. |
+
0x11 |
+The driver has too many outstanding reference counts for the adapter. The number of reference counts and the adapter address are displayed. |
+
0x13 |
+The driver called a DMA routine at an improper IRQL. The required IRQL and the actual IRQL are displayed. |
+
0x14 |
+The driver called a DMA routine at an improper IRQL. The required IRQL and the actual IRQL are displayed. |
+
0x15 |
+The driver tried to allocate too many map registers. The number requested and the number allowed are displayed. |
+
0x16 |
+The driver tried to flush a buffer that is not mapped. The address of the buffer is displayed. |
+
0x18 |
+The driver tried a DMA operation by using an adapter that was already released and no longer exists. The adapter address is displayed. |
+
0x19 |
+The driver passed a null DMA_ADAPTER value to a HAL routine. |
+
0x1B |
+The driver passed an address and MDL to a HAL routine. However, this address is not within the bounds of this MDL. The address passed and the address of the MDL are displayed. |
+
0x1D |
+The driver tried to map an address range that was already mapped. The address range and the current mapping for that range are displayed. |
+
0x1E |
+The driver called HalGetAdapter. This function is obsolete -- you must use IoGetDmaAdapter instead. |
+
0x1F |
+HV_BAD_MDLThe driver referenced an invalid system address -- either before the first MDL, or after the end of the first MDL, or by using a transfer length that is longer than the MDL buffer and crosses a page boundary within the MDL. . Either the invalid address and the first MDL address, or the MDL address and the extra transfer length are displayed. |
+
0x20 |
+The driver tried to flush a map register that hasn't been mapped. The map register base, flushing address, and MDL are displayed. |
+
0x21 |
+The driver tried to map a zero-length buffer for transfer. |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Cause of Error | +
|---|---|---|---|
0x0 |
+The flags field |
+0 |
+The saved context flags field is invalid. Either FLOAT_SAVE_VALID is not set, or some reserved bits are nonzero. |
+
0x1 |
+The saved IRQL |
+The current IRQL |
+The current processor's IRQL is not the same as when the floating-point context was saved. |
+
0x2 |
+The saved address of the thread that owns this floating-point context |
+The current thread |
+The saved context does not belong to the current thread. |
+
| Parameter | +Description | +
|---|---|
1 |
+The file object passed to IoCancelFileOpen |
+
2 |
+The device object passed to IoCancelFileOpen |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The exiting ETHREAD |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+A pointer to the stuck thread object |
+
2 |
+A pointer to the DEFERRED_WATCHDOG object |
+
3 |
+A pointer to the offending driver name |
+
4 |
+In the kernel debugger: The number of times the "intercepted" bug check 0xEA was hit +On the blue screen: 1 |
+
| Parameter | +Description | +
|---|---|
1 |
+The total number of dirty pages |
+
2 |
+The number of dirty pages destined for the page file |
+
3 |
+Windows Server 2003 only: The size of the nonpaged pool available at the time of the bug check (in pages) +Windows Vista and later versions: Reserved |
+
4 |
+Windows Server 2003 only: The number of transition pages that are currently stranded +Windows Vista and later versions: The most recent modified write error status |
+
| Parameter | +Description | +
|---|---|
1 |
+The session ID |
+
2 |
+The number of special pool pages that are leaking |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The device object of the boot volume |
+
2 |
+The status code from the file system that describes why it failed to mount the volume |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+The process object |
+
2 |
+Reserved |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x1000 |
+First argument passed |
+Second argument passed |
+Reserved |
+The miniport driver passed bad arguments to ScsiPortInitialize. |
+
0x1001 |
+Delay, in microseconds |
+Reserved |
+Reserved |
+The miniport driver called ScsiPortStallExecution and specified a delay greater than 0.1 second, stalling the processor too long. |
+
0x1002 |
+Address of routine that took too long |
+Address of miniport's HW_DEVICE_EXTENSION |
+Duration of the routine, in microseconds |
+A miniport routine called by the port driver took longer than 0.5 second to execute. +(0.5 seconds is the limit for most routines. However, the HwInitialize routine is allowed 5 seconds, and the FindAdapter routine is exempt.) |
+
0x1003 |
+Address of miniport's HW_DEVICE_EXTENSION |
+Address of the SRB |
+Reserved |
+The miniport driver completed a request more than once. |
+
0x1004 |
+Address of the SRB |
+Address of miniport's HW_DEVICE_EXTENSION |
+Reserved |
+The miniport driver completed a request with an invalid SRB status. |
+
0x1005 |
+Address of miniport's HW_DEVICE_EXTENSION |
+Address of LOGICAL_UNIT_EXTENSION |
+Reserved |
+The miniport driver called ScsiPortNotification to ask for NextLuRequest, but an untagged request is still active. |
+
0x1006 |
+Address of miniport's HW_DEVICE_EXTENSION |
+Invalid virtual address |
+Reserved |
+The miniport driver passed an invalid virtual address to ScsiPortGetPhysicalAddress. +(This usually means the address supplied doesn't map to the common buffer area.) |
+
0x1007 |
+Address of ADAPTER_EXTENSION |
+Address of miniport's HW_DEVICE_EXTENSION |
+Reserved |
+The reset hold period for the bus ended, but the miniport driver still has outstanding requests. |
+
0x2001 |
+Delay, in microseconds |
+Reserved |
+Reserved |
+The Storport miniport driver called [StorPortStallExecution](https://msdn.microsoft.com/library/windows/hardware/ff567508) and specified a delay longer than 0.1 second, stalling the processor for an excessive length of time. |
+
0x2002 |
+Reserved |
+Reserved |
+Reserved |
+[StorPortGetUncachedExtension](https://msdn.microsoft.com/library/windows/hardware/ff567103) was not called from the miniport driver's [HwStorFindAdapter](https://msdn.microsoft.com/library/windows/hardware/ff557390) routine. The StorPortGetUncachedExtension routine can only be called from the miniport driver's HwStorFindAdapter routine and only for a bus-master adapter. A Storport miniport driver must set the SrbExtensionSize of the [HW_INITIALIZATION_DATA](https://msdn.microsoft.com/library/windows/hardware/ff557459) (Storport) structure before calling StorPortGetUncachedExtension. |
+
0x2003 |
+Reserved |
+Reserved |
+Reserved |
+An invalid address was passed to the [StorPortGetDeviceBase](https://msdn.microsoft.com/library/windows/hardware/ff567080) routine. The StorPortGetDeviceBase routine supports only those addresses that were assigned to the driver by the system Plug and Play (PnP) manager. |
+
0x2004 |
+Reserved |
+Reserved |
+Reserved |
+The Storport miniport driver completed the same I/O request more than once. |
+
0x2005 |
+Reserved |
+Reserved |
+Reserved |
+The Storport miniport driver passed an invalid virtual address to one of the StorPortReadxxx or StorPortWritexxx routines. This usually means the address supplied doesn't map to the common buffer area. The specified Register or Port must be in mapped memory-space range returned by [StorPortGetDeviceBase](https://msdn.microsoft.com/library/windows/hardware/ff567080) routine. |
+
| Parameter | +Description | +
|---|---|
1 |
+The total number of dirty pages |
+
2 |
+The number of dirty pages destined for the page file |
+
3 |
+Windows Server 2003 only: The size of the nonpaged pool available at the time of the bug check (in pages) +Windows Vista and later: Reserved |
+
4 |
+Windows Server 2003 only: The current shut down stage +Windows Vista and later: The most recent modified write error status |
+
| Parameter | +Description | +
|---|---|
1 |
+The terminating object type: +0x3: Process +0x6: Thread |
+
2 |
+The terminating object |
+
3 |
+The process image file name |
+
4 |
+Pointer to an ASCII string containing an explanatory message |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of error | +
|---|---|---|---|---|
0x66 |
+Pointer to the callback data structure for the operation. |
+0 |
+0 |
+The minifilter returned FLT_PREOP_SUCCESS_WITH_CALLBACK or FLT_PREOP_SYNCHRONIZE from a preoperation callback, but did not register a corresponding postoperation callback. |
+
0x67 |
+Pointer to the callback data structure for the operation. |
+0 |
+Error NTSTATUS code for the operation |
+An internal object ran out of space, and the system is unable to allocate new space. |
+
0x68 |
+Reserved |
+Address of the FLT_FILE_NAME_INFORMATIONN structure |
+Reserved |
+A FLT_FILE_NAME_INFORMATION structure was dereferenced too many times. |
+
0x6A |
+File object pointer for the file. |
+0 |
+0 |
+The file-open or file-create request could not be canceled, because one or more handles have been created for the file. |
+
0x6B |
+Frame ID |
+0 |
+Thread |
+Invalid BACKPOCKET IRPCTRL state. |
+
0x6C |
+Frame ID |
+BackPocket List |
+Thread |
+Too many nested PageFaults for BACKPOCKETED IRPCTR. |
+
0x6D |
+Address of the minifilter's context structure |
+Address of the CONTEXT_NODE structure |
+0 |
+The context structure was dereferenced too many times. This means that the reference count on the Filter Manager's CONTEXT_NODE structure went to zero while it was still attached to its associated object. |
+
0x6E |
+Address of the minifilter's context structure |
+Address of the CONTEXT_NODE structure |
+0 |
+The context structure was referenced after being freed. |
+
| Parameter 1 | +Cause of Error | +
|---|---|
0x01 |
+An active bridge was reprogrammed by the BIOS during a docking event. |
+
0x02 |
+The PMCSR register was not updated within the spec-mandated time. |
+
0x03 |
+A driver has written to Windows-controlled portions of a PCI device's configuration space. |
+
| Parameter | +Description | +
|---|---|
1 |
+The actual security check cookie from the stack |
+
2 |
+The expected security check cookie |
+
3 |
+The bit-complement of the expected security check cookie |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+Indicates the cause of the failure. +1: No LoaderXIPRom descriptor was found in the loader memory list. +2: Unable to open the RAM disk driver (ramdisk.sys or \Device\Ramdisk). +3: FSCTL_CREATE_RAM_DISK failed. +4: Unable to create GUID string from binary GUID. +5: Unable to create symbolic link pointing to the RAM disk device. |
+
2 |
+NTSTATUS code |
+
3 |
+0 |
+
4 |
+0 |
+
| Parameter | +Description | +
|---|---|
1 |
+The device object that was opened |
+
2 |
+The device object to which the IRP_MJ_CREATE request was issued |
+
3 |
+Address of the Unicode string containing the new name of the file (to be reparsed) |
+
4 |
+Information returned by the driver for the IRP_MJ_CREATE request |
+
| Parameter 1 | +Parameter 2 | +Parameter 3 | +Parameter 4 | +Cause of Error | +
|---|---|---|---|---|
0x1 |
+Address of work item |
+Name of the file that contains the work item check |
+Line number of the work item check within the file |
+A work item is invalid. This will eventually result in thread pool corruption and an access violation. |
+
| Parameter | +Description | +
|---|---|
1 |
+The virtual address whose execution was attempted |
+
2 |
+The contents of the page table entry (PTE) |
+
3 |
+Reserved |
+
4 |
+Reserved |
+
| Parameter | +Description | +
|---|---|
1 |
+Total number of dirty pages |
+
2 |
+Number of non-writeable dirty pages |
+
3 |
+Reserved |
+
4 |
+Most recently modified write-error status |
+
| Time-out code | +Meaning | +
|---|---|
0 |
+Non-fatal time-out |
+
1 |
+Failed resuming a suspended port. |
+
2 |
+Timed out waiting for a reset, initiated by a client driver, to complete before suspending the port. |
+
3 |
+Timed out waiting for the port to complete resume before suspending it. |
+
4 |
+Timed out waiting for the port-change state machine to be disabled prior to suspending the port. |
+
5 |
+Timed out waiting for a suspend-port request to complete. |
+
6 |
+Timed out waiting for the port-change state machine to be disabled. |
+
7 |
+Timed out waiting for the port-change state machine to be closed. |
+
8 |
+Timed out waiting for the hub to resume from selective suspend. |
+
9 |
+Timed out waiting for the hub to resume from selective suspend prior to system suspend. |
+
10 |
+Timed out waiting for port-change state machine to become idle. |
+
| Parameter | +Description | +
|---|---|
1 |
+The address of the reserve queue |
+
2 |
+The size of the reserve queue |
+
3 |
+0 |
+
4 |
+0 |
+
| Value | +Versions of Windows | +
|---|---|
_NT_TARGET_VERSION_WIN2K |
+ Windows 2000 and later. |
+
_NT_TARGET_VERSION_WINXP |
+ Windows XP and later. |
+
_NT_TARGET_VERSION_WS03 |
+ Windows Server 2003 and later. |
+
_NT_TARGET_VERSION_LONGHORN |
+ Windows Vista and later. |
+
| Operator | +Meaning | +
|---|---|
Expression // Comment |
+Ignore all subsequent text |
+
Class :: Member +Class ::~Member +:: Name |
+Member of class +Member of class (destructor) +Global |
+
Structure . Field +Pointer -> Field +Name [integer] +LValue ++ +LValue -- +dynamic_cast <type>(Value) +static_cast <type>(Value) +reinterpret_cast <type>(Value) +const_cast <type>(Value) |
+Field in a structure +Field in referenced structure +Array subscript +Increment (after evaluation) +Decrement (after evaluation) +Typecast (always performed) +Typecast (always performed) +Typecast (always performed) +Typecast (always performed) |
+
(type) Value +sizeof value +sizeof( type ) +++ LValue +-- LValue +~ Value +! Value +Value ++ Value +& LValue +* Value |
+Typecast (always performed) +Size of expression +Size of data type +Increment (before evaluation) +Decrement (before evaluation) +Bit complement +Not (Boolean) +Unary minus +Unary plus +Address of data type +Dereference |
+
Structure . * Pointer +Pointer -> * Pointer |
+Pointer to member of structure +Pointer to member of referenced structure |
+
Value * Value +Value / Value +Value % Value |
+Multiplication +Division +Modulus |
+
Value + Value +Value - Value |
+Addition +Subtraction |
+
Value << Value +Value >> Value |
+Bitwise shift left +Bitwise shift right |
+
Value < Value +Value <= Value +Value > Value +Value >= Value |
+Less than (comparison) +Less than or equal (comparison) +Greater than (comparison) +Greater than or equal (comparison) |
+
Value == Value +Value != Value |
+Equal (comparison) +Not equal (comparison) |
+
Value & Value |
+Bitwise AND |
+
Value ^ Value |
+Bitwise XOR (exclusive OR) |
+
Value | Value |
+Bitwise OR |
+
Value && Value |
+Logical AND |
+
Value || Value |
+Logical OR |
+
LValue =Value +LValue *= Value +LValue /= Value +LValue %=Value +LValue +=Value +LValue -= Value +LValue <<= Value +LValue >>= Value +LValue &= Value +LValue |= Value +LValue ^= Value |
+Assign +Multiply and assign +Divide and assign +Modulo and assign +Add and assign +Subtract and assign +Shift left and assign +Shift right and assign +AND and assign +OR and assign +XOR and assign |
+
Value ? Value : Value |
+Conditional evaluation |
+
Value , Value |
+Evaluate all values, and then discard all except the rightmost value |
+
| Macro | +Return Value | +
|---|---|
#CONTAINING_RECORD(Address, Type, Field) |
+Returns the base address of an instance of a structure, given the type of the structure and the address of a field within the structure. |
+
#FIELD_OFFSET(Type, Field) |
+Returns the byte offset of a named field in a known structure type. |
+
#RTL_CONTAINS_FIELD (Struct, Size, Field) |
+Indicates whether the given byte size includes the desired field. |
+
#RTL_FIELD_SIZE(Type, Field) |
+Returns the size of a field in a structure of known type, without requiring the type of the field. |
+
#RTL_NUMBER_OF(Array) |
+Returns the number of elements in a statically sized array. |
+
#RTL_SIZEOF_THROUGH_FIELD(Type, Field) |
+Returns the size of a structure of known type, up through and including a specified field. |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| Value | +Constant | +Meaning | +
|---|---|---|
0 |
+NONE |
+Do not break on any errors. |
+
1 |
+ERROR |
+Break on ERROR level debugging events. |
+
2 |
+MINORERROR |
+Break on MINORERROR and ERROR level debugging events. |
+
3 |
+WARNING |
+Break on WARNING, MINORERROR, and ERROR level debugging events. |
+
| Value | +Constant | +Meaning | +
|---|---|---|
0 |
+NONE |
+Do not display any errors. |
+
1 |
+ERROR |
+Display ERROR level debugging events. |
+
2 |
+MINORERROR |
+Display MINORERROR and ERROR level debugging events. |
+
3 |
+WARNING |
+Display WARNING, MINORERROR, and ERROR level debugging events. |
+
| Feature | +[ADPlus](adplus.md) | +[Windows Error Reporting](windows-error-reporting.md) | +[CDB and WinDbg](cdb-and-windbg.md) | +[UserDump](userdump.md) | +
|---|---|---|---|---|
Creating a dump file when an application crashes (postmortem debugging) |
+Yes |
+Yes |
+Yes |
+Yes |
+
Creating a dump file when an application "hangs" (stops responding but does not actually crash) |
+Yes |
+No |
+Yes |
+Yes |
+
Creating a dump file when an application encounters an exception |
+Yes |
+Yes |
+Yes |
+Yes |
+
Creating a dump file while an application is running normally |
+No |
+No |
+Yes |
+No |
+
Creating a dump file from an application that fails during startup |
+No |
+No |
+Yes |
+Yes |
+
Shrinking an existing dump file |
+No |
+No |
+Yes |
+No |
+
| Address | +Contents of memory | +
|---|---|
0x1000 |
+Base address of the module |
+
0x2000 |
+Beginning of FunctionOne |
+
0x203F |
+End of FunctionOne |
+
0x3000 |
+Beginning of FunctionSix |
+
0x305F |
+End of FunctionSix |
+
0x7FFF |
+End of the module in memory |
+
| Address | +Contents of memory | +
|---|---|
0x1000 |
+Base address of the module |
+
0x2000 |
+Beginning of FunctionOne |
+
0x203F |
+End of FunctionOne |
+
0x2040 |
+Beginning of FunctionTwo |
+
0x3000 |
+Beginning of FunctionSix |
+
0x305F |
+End of FunctionSix |
+
0x3060 |
+Beginning of FunctionSeven |
+
0x7FFF |
+End of the module in memory |
+
| Engine API interface | +ExtExtension member | +
|---|---|
[IDebugAdvanced](https://msdn.microsoft.com/library/windows/hardware/ff549798) |
+m_Advanced |
+
[IDebugClient](https://msdn.microsoft.com/library/windows/hardware/ff549827) |
+m_Client |
+
[IDebugControl](https://msdn.microsoft.com/library/windows/hardware/ff550508) |
+m_Control |
+
[IDebugDataSpaces](https://msdn.microsoft.com/library/windows/hardware/ff550528) |
+m_Data |
+
[IDebugRegisters](https://msdn.microsoft.com/library/windows/hardware/ff550825) |
+m_Registers |
+
[IDebugSymbols](https://msdn.microsoft.com/library/windows/hardware/ff550856) |
+m_Symbols |
+
[IDebugSystemObjects](https://msdn.microsoft.com/library/windows/hardware/ff550875) |
+m_System |
+
| Engine API interface | +ExtExtension member | +
|---|---|
IDebugAdvanced2 |
+m_Advanced2 |
+
IDebugAdvanced3 |
+m_Advanced3 |
+
IDebugClient2 |
+m_Client2 |
+
IDebugClient3 |
+m_Client3 |
+
IDebugClient4 |
+m_Client4 |
+
IDebugClient5 |
+m_Client5 |
+
IDebugControl2 |
+m_Control2 |
+
IDebugControl3 |
+m_Control3 |
+
IDebugControl4 |
+m_Control4 |
+
IDebugData2 |
+m_Data2 |
+
IDebugData3 |
+m_Data3 |
+
IDebugData4 |
+m_Data4 |
+
IDebugRegisters2 |
+m_Registers2 |
+
IDebugSymbols2 |
+m_Symbols2 |
+
IDebugSymbols3 |
+m_Symbols3 |
+
IDebugSystemObjects2 |
+m_System2 |
+
IDebugSystemObjects3 |
+m_System3 |
+
IDebugSystemObjects4 |
+m_System4 |
+
| REG_DWORDl | +Description | +
| LogLevel | +By default, SymProxy doesn’t log an extensive amount of information about its use of SymSrv.dll. Creating REG_DWORD:"LogLevel " with a value of 5 (Analytic) or 6 (Debug), enables the additional logging. |
+
| NoInternetProxy | +When running as a service, SymSrv.dll uses WinHTTP instead of WinInet to make HTTP requests. Consequently, you may need to set up HTTP proxy settings so that the service can access outside network resources. You can do this using the netsh program. Type “netsh.exe winhttp -?” for instructions. +By default, SymProxy uses the designated HTTP proxy. If no HTTP proxy is configured, SymProxy will use a dummy proxy. This allows secure access to HTTP sites within your intranet. As a side effect, this prevents SymProxy from directly connecting to non-secure sites. +Creating the REG_DWORD:"NoInternetProxy" value configures SymProxy to operate without a proxy, allowing a direct connection. |
+
| NoFilePointers | +By default, for symbols that don’t exist, SymProxy will look for a file.ptr file next to the requested file (in the local cache). If found, it will return the location specified by the file.ptr file. This ability is only required when the local cache is being populated by SymStore.exe. +Create the REG_DWORD:"NoFilePointers" value to skip the lookup. |
+
| NoUncompress | +By default, SymProxy will decompress downloaded symbols before returning the file to the caller. This reduces CPU at the client, but increases I/O. +Create the REG_DWORD:"NoUncompress" value to skip the decompression. |
+
| NoCache | +By default, SymProxy will cache downloaded symbols to the local file system, defined by the virtual directory’s path. +Create the REG_DWORD:"NoCache" value to skip the download and to provide the remote path of the file to the client instead. |
+
| MissTimeout | +Timeout period, in seconds, for which missing symbols are reported as missing without re-querying the upstream symbol servers. +A miss is associated with a UTC based time. Subsequent requests for the file are immediately rejected for N seconds. +The first request for the file after N seconds causes the upstream symbol stores to be re-queried. +On success, the symbol file is returned and the miss is deleted. +On failure, the miss is moved forward to the current time (in UTC) to start a new timeout period. +Use the “Miss Cache *” counters to monitor the misses. +• Unspecified - (default) 300 seconds/5 minutes +• 0 – Feature disabled +• N – Timeout lasts N seconds |
+
| MissAgeCheck | +Period between Miss Age checks. The Miss cache is scanned and records older than MissAgeTimeout seconds are removed. +The current statistics are saved to the Event Log using Event ID 4. +• Unspecified - (default) 3600 seconds / 1 hour +• 0 – Feature disabled +• N – Period between checks in N seconds |
+
| MissFileCache | +By default, SymProxy does not save miss information to disk. Create the REG_DWORD:"MissFileCache" value to cache miss information in the symbol folder tree. Create the REG_DWORD:"MissFileCache" value to cache miss information in the symbol folder tree. +Enable MissFileCache when miss informarion needs to be shared across an IIS farm. Enabling MissFileCache also makes worker process recycling more efficient. +MissFileCache causes an I/O operation on the first request for a missing symbol (Miss File Read), the download of a symbol (Miss File Delete), and a failed symbol lookup (Miss File Write). +Use the “Miss File XXX/sec” counters to monitor the operations. +It is safe to delete .miss files while the SymProxy is running: +C:\> del C:\SymStore\Symbols\*.miss /s |
+
| MissFileThreads | +By default, SymProxy performs up to 16 concurrent asynchronous file I/O operations for the Miss File feature. Creating the REG_DWORD:" MissFileThreads" value overrides the default limit. Values can be between 1 and 64. +Use the “Miss File Queue Depth” counter to monitor the load. |
+
FailureTimeout +FailureCount +FailurePeriod +FailureBlackout |
+The Blackout feature is used to termporarly disable upstream symbol stores that are unresponsive. The Blackout feature uses 4 REG_DWORD values to define the behaviour. By default, the feature is disabled. +For each upstream symbol store defined in a Symbol Path, failures are individually recorded. If a request takes longer than FailureTimeout (msec), the failure count is incremented. +The Symbol Path is marked as dead after FailureCount failures in FailurePeriod seconds. At this time, all requests are ignored until FailureBlackout seconds have elapsed. The first caller after the timeout tests the upstream symbol store. On success, the timeout is removed and requests are allowed. On failure, the time is set to Now+FailureBlackout seconds. After that time, the upstream symbol store is tested again. |
+
| Entry | +Description | +
|---|---|
$u0: value ... $u9: value |
+Assign values to fixed-name aliases. You can specify numeric values n or 0xn or any other string. See [Using Aliases](using-aliases.md) for details. No command-line equivalent. |
+
DebugChildren: flag |
+TRUE or FALSE. If TRUE, CDB debugs the specified application as well as any child processes that it might spawn. Command-line equivalent is -o. |
+
DebugOutput: flag |
+TRUE or FALSE. If TRUE, CDB sends output and receives input through a terminal. If FALSE, output goes to the user screen. The command-line option -d is similar but not identical. |
+
IniFile: file |
+Specifies the name of the script file that CDB or KD takes commands from at startup. The default is the ntsd.ini file in the current directory. Command-line equivalent is -cf. For details, see [Using Script Files](using-script-files.md). |
+
LazyLoad: flag |
+TRUE or FALSE. If TRUE, CDB performs lazy symbol loading; that is, symbols are not loaded until required. Command-line equivalent is -s. +For details, and other methods of setting this option, see [Deferred Symbol Loading](deferred-symbol-loading.md). |
+
SetDll: filename |
+Set extension DLL. The .dll filename extension should be omitted. Default is userexts.dll. Command-line equivalent is -a. +For details, and other methods of setting this default, see [Loading Debugger Extension DLLs](loading-debugger-extension-dlls.md). |
+
StopFirst: flag |
+TRUE or FALSE. If true, CDB stops on the breakpoint at the end of the image-loading process. Command-line equivalent is -g. |
+
StopOnProcessExit: flag |
+TRUE or FALSE. If TRUE, CDB stops when it receives a process termination notification. Command-line equivalent is -G. |
+
| +sxd: event +sxe: event | +Sets the debugger response and the handling status for the specified exception or event. +Exceptions and events may be specified in the following ways: + +*: Default exception +n: Exception n (decimal) +0xn: Exception 0xn (hexadecimal) +(other): Event code +See [Controlling Exceptions and Events](controlling-exceptions-and-events.md) for details of this process and for other methods of controlling these settings. |
+
VerboseOutput: flag |
+TRUE or FALSE. If TRUE, CDB will display detailed information about symbol handling, event notification, and other run-time occurrences. Command-line equivalent is -v. |
+
lines: flag |
+TRUE or FALSE. The lines flag enables or disables support for source-line information. |
+
srcopt: options |
+Sets the source line options that control source display and program stepping options. For more information see [l+, l- (Set Source Options)](l---l---set-source-options-.md). |
+
srcpath: directory |
+Sets the source file search path. For more information see [.srcpath, .lsrcpath (Set Source Path)](-srcpath---lsrcpath--set-source-path-.md). |
+
enable_unicode: flag |
+TRUE or FALSE. The enable_unicode flag specifies whether the debugger displays USHORT pointers and arrays as Unicode strings. |
+
force_radix_output: flag |
+TRUE or FALSE. The force_radix_output flag specifies whether integers are displayed in decimal format or in the default radix. |
+
col_mode: flag |
+TRUE or FALSE. The col_mode flag controls the color mode setting. When color mode is enabled the debugger can produce colored output. By default, most colors are not set and instead default to the current console colors. |
+
col: name colspec |
+The name indicates the element that you are coloring. The colspec is a three-letter RGB indicator of the form [rR-][gG-][bB-]. A lower-case letter indicates darker, an upper-case letter indicates brighter and a dash indicates no color component contribution. Due to console color limitations, bright is not actually per-component, but applies to all components if any request bright. In other words, rgB is the same as RGB. For this reason, it is recommended that all caps be used if any caps are going to be used. +Example usage: +col: emphfg R-- |
+
| Value | +Description | +
|---|---|
DEBUG_BREAK_READ |
+The breakpoint will be triggered when the CPU reads memory in the breakpoint's memory block. |
+
DEBUG_BREAK_WRITE |
+The breakpoint will be triggered when the CPU writes memory in the breakpoint's memory block. |
+
| +DEBUG_BREAK_READ +| DEBUG_BREAK_WRITE | +The breakpoint will be triggered when the CPU reads or writes memory in the breakpoint's memory block. |
+
DEBUG_BREAK_EXECUTE |
+The breakpoint will be triggered when the CPU fetches the instruction in the breakpoint's memory block. |
+
DEBUG_BREAK_IO |
+The breakpoint will be triggered when the I/O port in the breakpoints memory block is accessed. (Windows XP and Microsoft Windows Server 2003 only, kernel mode only, x86 only) |
+
| Command | +Status name | +Description | +
|---|---|---|
| +SXE +or +-xe | +Break +(Enabled) |
+When this exception occurs, the target immediately breaks into the debugger. This break in occurs before any other error handlers are activated. This method is called first-chance handling. |
+
| +SXD +or +-xd | +Second chance break +(Disabled) |
+The debugger does not break in for this kind of first-chance exception (although a message is displayed). If other error handlers cannot address this exception, execution stops and the target breaks into the debugger. This method is called second-chance handling. |
+
| +SXN +or +-xn | +Output +(Notify) |
+When this exception occurs, the target application does not break into the debugger at all. However, a message is displayed that informs the user of this exception. |
+
| +SXI +or +-xi | +Ignore |
+When this exception occurs, the target application does not break into the debugger, and no message is displayed. |
+
| Command | +Status name | +Description | +
|---|---|---|
SXE |
+Handled |
+The event is considered handled when execution resumes. |
+
SXD,SXN,SXI |
+Not Handled |
+The event is considered not handled when execution resumes. |
+
| Event code | +Meaning | +Default break status | +
|---|---|---|
asrt |
+Assertion failure |
+Break |
+
av |
+Access violation |
+Break |
+
dm |
+Data misaligned |
+Break |
+
dz |
+Integer division by zero |
+Break |
+
c000008e |
+Floating point division by zero |
+Break |
+
eh |
+C++ EH exception |
+Second-chance break |
+
gp |
+Guard page violation |
+Break |
+
ii |
+Illegal instruction |
+Second-chance break |
+
iov |
+Integer overflow |
+Break |
+
ip |
+In-page I/O error |
+Break |
+
isc |
+Invalid system call |
+Break |
+
lsq |
+Invalid lock sequence |
+Break |
+
sbo |
+Stack buffer overflow |
+Break |
+
sov |
+Stack overflow |
+Break |
+
wkd |
+Wake debugger |
+Break |
+
aph |
+Application hang +This exception is triggered if the Windows operating system concludes that a process has stopped responding (that is, is hung). |
+Break |
+
3c |
+Child application termination |
+Second-chance break |
+
chhc |
+Invalid handle |
+Break |
+
Number |
+Any numbered exception |
+Second-chance break |
+
| Event code | +Meaning | +Default break status | +
|---|---|---|
dbce |
+Special debugger command exception |
+Ignore |
+
vcpp |
+Special Visual C++ exception |
+Ignore |
+
wos |
+WOW64 single-step exception |
+Break |
+
wob |
+WOW64 breakpoint exception- |
+Break |
+
ssessec |
+Single-step exception |
+Break |
+
bpebpec |
+Breakpoint exception |
+Break |
+
ccecc |
+CTRL+C or CTRL+BREAK +This exception is triggered if the target is a console application and CTRL+C or CTRL+BREAK is passed to it. |
+Break |
+
| Event code | +Meaning | +Default status | +
|---|---|---|
clr |
+Common Language Runtime exception |
+Second-chance break +Not handled |
+
clrn |
+Common Language Runtime notification exception |
+Second-chance break +Handled |
+
| Event code | +Meaning | +Default break status | +
|---|---|---|
ser |
+System error |
+Ignore |
+
cpr[:Process] |
+Process creation +Setting the break status of this event applies only to user-mode debugging. This event does not occur in kernel mode. +You can control this event only if you have activated debugging of child processes in CDB or WinDbg, either through the -o[command-line option](cdb-command-line-options.md) or through the [.childdbg (Debug Child Processes)](-childdbg--debug-child-processes-.md) command. +The process name can include an optional file name extension and an asterisk (*) or question mark (?) as wildcard characters. The debugger remembers only the most recent cpr setting. Separate settings for separate processes are not supported. Include a colon or a space between cpr and Process. +If Process is omitted, the setting applies to any child process creation. |
+Ignore |
+
epr[:Process] |
+Process exit +Setting the break status of this event applies only to user-mode debugging. This event does not occur in kernel mode. +You can control this event only if you have activated debugging of child processes in CDB or WinDbg, either through the -o[command-line option](cdb-command-line-options.md) or through the [.childdbg (Debug Child Processes)](-childdbg--debug-child-processes-.md) command. +The process name can include an optional file name extension and an asterisk (*) or question mark (?) as wildcard characters. The debugger remembers only the most recent epr setting. Separate settings for separate processes are not supported. Include a colon or a space between epr and Process. +If Process is omitted, the setting applies to any child process exit. |
+Ignore |
+
ct |
+Thread creation |
+Ignore |
+
et |
+Thread exit |
+Ignore |
+
ld[:Module] |
+Load module +If you specify Module, the break occurs when the module with this name is loaded. Module can specify the name or the address of the module. If the name is used, Module might contain a variety of wildcard characters and specifiers. (For more information about the syntax, see [String Wildcard Syntax](string-wildcard-syntax.md).) +The debugger remembers only the most recent ld setting. Separate settings for separate modules are not supported. Include a colon or a space between ld and Module. +If Module is omitted, the event is triggered when any module is loaded. |
+Output |
+
ud[:Module] |
+Unload module +If you specify Module, the break occurs when the module with this name, or at this base address, is unloaded. Module can specify the name or the address of the module. If the name is used, Module can be an exact name or include wildcard characters. If Module is an exact name, it is immediately resolved to a base address by using the current debugger module list and it is stored as an address. If Module contains wildcard characters, the pattern string is kept for later matching when unload events occur. +Rarely, the debugger does not have name information for unload events and matches only by the base address. Therefore, if Module contains wildcard characters, the debugger cannot perform a name match in this particular unload case and breaks when any module is unloaded. +The debugger remembers only the most recent ud setting. Separate settings for separate modules are not supported. Include a colon or a space between ld and Module. +If Module is omitted, the event is triggered when any module is loaded. |
+Output |
+
out[:Output] |
+Target application output +If you specify Output, the break occurs only when output that matches the specified pattern is received. Output can contain a variety of wildcard characters and specifiers. (For more information about the syntax, see [String Wildcard Syntax](string-wildcard-syntax.md).) However, Output cannot contain a colon or spaces. The match is not case sensitive. Include a colon or space between out and Output. |
+Ignore |
+
ibp |
+Initial break point +(This event occurs at the beginning of the debug session and after you restart the target computer.) |
+In user mode: Break. You can change this status to "Ignore" by using the -g[command-line option](command-line-options.md). +In kernel mode: Ignore. You can change this status to "Enabled" by a variety of methods. For more information about how to change this status, see [Crashing and Rebooting the Target Computer](crashing-and-rebooting-the-target-computer.md). |
+
iml |
+Initial module load +(Kernel mode only) |
+Ignore. You can change this status to "Break" by a variety of methods. For more information about how to change this status, see [Crashing and Rebooting the Target Computer](crashing-and-rebooting-the-target-computer.md). |
+
| Command | +WinDbg button | +WinDbg command | +WinDbg shortcut keys | +Effect | +
|---|---|---|---|---|
| + |  |
+[Debug | Run to Cursor](debug---run-to-cursor.md) |
+F7 +CTRL + F10 |
+(WinDbg only) Executes until it reaches the line that the cursor marks. |
+
| + |  |
+[Debug | Stop Debugging](debug---stop-debugging.md) |
+SHIFT + F5 |
+Stops all debugging and closes the target. |
+
(CDB/KD only) [CTRL+C](ctrl-c--break-.md) |
+ |
+[Debug | Break](debug---break.md) |
+CTRL + BREAK |
+Execution stops, and the debugger breaks into the target. |
+
[.restart (Restart Target Application)](-restart--restart-target-application-.md) |
+ |
+[Debug | Restart](debug---restart.md) |
+CTRL + SHIFT + F5 |
+(User mode only) Restarts the target application. |
+
[g (Go)](g--go-.md) |
+ |
+[Debug | Go](debug---go.md) |
+F5 |
+Target executes freely. |
+
[gc (Go from Conditional Breakpoint)](gc--go-from-conditional-breakpoint-.md) |
++ | + | + | Resumes execution after a [conditional breakpoint](setting-a-conditional-breakpoint.md). |
+
[gh (Go with Exception Handled)](gh--go-with-exception-handled-.md) |
++ | [Debug | Go Handled Exception](debug---go-handled-exception.md) |
++ | Same as g (Go), except that the current exception is treated as handled. |
+
[gn (Go with Exception Not Handled)](gn--gn--go-with-exception-not-handled-.md) |
++ | [Debug | Go Unhandled Exception](debug---go-unhandled-exception.md) |
++ | Same as g (Go), except that the current exception is treated as unhandled. |
+
[gu (Go Up)](gu--go-up-.md) |
+ |
+[Debug | Step Out](debug---step-out.md) |
+SHIFT + F11 |
+Target executes until the current function is complete. |
+
[p (Step)](p--step-.md) |
+ |
+[Debug | Step Over](debug---step-over.md) |
+F10 |
+Target executes one instruction. If this instruction is a function call, that function is executed as a single step. |
+
[pa (Step to Address)](pa--step-to-address-.md) |
++ | + | + | Target executes until it reaches the specified address. All steps in this function are displayed (but steps in called functions are not). |
+
[pc (Step to Next Call)](pc--step-to-next-call-.md) |
++ | + | + | Target executes until the next call instruction. If the current instruction is a call instruction, this call is executed completely and execution continues until the next call. |
+
[pct (Step to Next Call or Return)](pct--step-to-next-call-or-return-.md) |
++ | + | + | Target executes until it reaches a call instruction or a return instruction. |
+
[ph (Step to Next Branching Instruction)](ph--step-to-next-branching-instruction-.md) |
++ | + | + | Target executes until it reaches any kind of branching instruction, including conditional or unconditional branches, calls, returns, and system calls. |
+
[pt (Step to Next Return)](pt--step-to-next-return-.md) |
++ | + | + | Target executes until it reaches a return instruction. |
+
[t (Trace)](t--trace-.md) |
+ |
+[Debug | Step Into](debug---step-into.md) |
+F11 +F8 |
+Target executes one instruction. If this instruction is a function call, debugger traces into that call. |
+
[ta (Trace to Address)](ta--trace-to-address-.md) |
++ | + | + | Target executes until it reaches the specified address. All steps in this function and called functions are displayed. |
+
[tb (Trace to Next Branch)](tb--trace-to-next-branch-.md) |
++ | + | + | (All modes, except kernel mode, only on x86-based systems) Target executes until it reaches the next branch instruction. |
+
[tc (Trace to Next Call)](tc--trace-to-next-call-.md) |
++ | + | + | Target executes until the next call instruction. If the current instruction is a call instruction, the instruction is traced into until a new call is reached. |
+
[tct (Trace to Next Call or Return)](tct--trace-to-next-call-or-return-.md) |
++ | + | + | Target executes until it reaches a call instruction or return instruction. If the current instruction is a call instruction or return instruction, the instruction is traced into until a new call or return is reached. |
+
[th (Trace to Next Branching Instruction)](th--trace-to-next-branching-instruction-.md) |
++ | + | + | Target executes until it reaches any kind of branching instruction, including conditional or unconditional branches, calls, returns, and system calls. If the current instruction is a branching instruction, the instruction is traced into until a new branching instruction is reached. |
+
[tt (Trace to Next Return)](tt--trace-to-next-return-.md) |
++ | + | + | Target executes until it reaches a return instruction. If the current instruction is a return instruction, the instruction is traced into until a new return is reached. |
+
[wt (Trace and Watch Data)](wt--trace-and-watch-data-.md) |
++ | + | + | Target executes until the completion of the whole specified function. Statistics are then displayed. |
+
Abbreviation |
+kst |
+
Hexadecimal value |
+0x2000 |
+
Symbolic Name |
+FLG_KERNEL_STACK_TRACE_DB |
+
Destination |
+System-wide registry entry |
+
Abbreviation |
+ust |
+
Hexadecimal value |
+0x1000 |
+
Symbolic Name |
+FLG_USER_STACK_TRACE_DB |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
| Debuggers | +CDB, NTSD, KD |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Debuggers |
+KD and WinDbg only |
+
Modes |
+kernel mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
| Debuggers | +WinDbg |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Debuggers |
+CDB and KD only |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Debuggers |
+CDB and KD only |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Debuggers |
+KD and WinDbg only |
+
Modes |
+kernel mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Debuggers |
+CDB, KD |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Debuggers |
+KD and WinDbg only |
+
Modes |
+kernel mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Debuggers |
+KD and WinDbg only |
+
Modes |
+kernel mode only |
+
Targets |
+live debugging only |
+
Platforms |
+all |
+
Debuggers |
+CDB, KD, WinDbg |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Debuggers |
+CDB, KD, WinDbg |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| Setting | +Description / Example | +
wbg - Windows background +wfg - Windows foreground |
+Default window background and foreground colors. Default to system colors for window and window text.
+ <col fg="wfg" bg="wbg"> This is standard foreground / background text </col> |
+
clbg - Current line foreground +clfg - Current line background |
+Current line background and foreground colors. Default to system colors for highlight and highlight text.
+ <col fg="clfg" bg="clbg"> Test Text - Current Line</col> |
+
empbg - Emphasized background +emphfg - Emphasized foreground |
+Emphasized text. Defaults to light blue.
+ <col fg="empfg" bg="empbg"> This is emphasis foreground / background text </col> |
+
subbg - Subdued background +subfg- Subdued foreground |
+Subdued text. Default to system color for inactive caption text and inactive captions.
+ <col fg="subfg" bg="subbg"> This is subdued foreground / background text </col> |
+
normbg - Normal background +normfg - Normal foreground |
+Normal
+ <col fg="normfg" bg="normbg"> Test Text - Normal (normfg / normbg) </col> |
+
warnbg - Warning background +warnfg - Warning foreground |
+Warning
+ <col fg="warnfg" bg="warnbg"> Test Text - Warning (warnfg / warnbg) </col> |
+
errbg - Error background +errfg - Error foreground |
+Error
+ <col fg="errfg" bg="errbg"> Test Text - Error (errfg / errbg) </col> |
+
verbbg - Verbose background +verbfg - Verbose foreground |
+Verbose
+ <col fg="verbfg" bg="verbbg"> Test Text - Verbose (verbfg / verbbg) </col> |
+
srcnum - Source numeric constant |
+Source element colors.
+ <col fg="srcnum" bg="wbg"> Test Text - srcnum </col> |
+
srcchar - Source character constant |
+<col fg="srcchar" bg="wbg"> Test Text - srcchar </col> |
+
srcstr - Source string constant |
+<col fg="srcstr" bg="wbg"> Test Text - srcstr </col> |
+
srcid -Source identifier |
+<col fg="srcid " bg="wbg"> Test Text - srcid </col> |
+
srckw- Keyword |
+<col fg="srckw" bg="wbg"> Test Text - srckw </col> |
+
srcpair - Source brace or matching symbol pair |
+<col fg="srcpair" bg="empbbg"> Test Text - srcpair </col> |
+
srccmnt - Source comment |
+<col fg="srccmnt" bg="wbg"> Test Text - srccmnt </col> |
+
srcdrct - Source directive |
+<col fg="srcdrct" bg="wbg"> Test Text - srcdrct </col> |
+
srcspid - Source special identifier |
+<col fg="srcspid" bg="wbg"> Test Text - srcspid </col> |
+
srcannot - Source annotation |
+<col fg="srcannot" bg="wbg"> Test Text - srcannot </col> |
+
changed - Changed data |
+Used for data that has changed since a previous stop point, such as changed registers in WinDbg. Defaults to red.
+ <col fg="changed" bg="wbg"> Test Text - Changed</col> |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| Command | +Display | +
|---|---|
d |
+This displays data in the same format as the most recent d* command. If no previous d* command has been issued, d has the same effect as db. +Notice that d repeats the most recent command that began with d. This includes dda, ddp, ddu, dpa, dpp, dpu, dqa, dqp, dqu, dds, dps, dqs, ds, dS, dg, dl, dt, and dv, as well as the display commands on this page. If the parameters given after d are not appropriate, errors may result. |
+
da |
+ASCII characters. +Each line displays up to 48 characters. The display continues until the first null byte or until all characters in range have been displayed. All nonprintable characters, such as carriage returns and line feeds, are displayed as periods (.). |
+
db |
+Byte values and ASCII characters. +Each display line shows the address of the first byte in the line, followed by up to 16 hexadecimal byte values. The byte values are immediately followed by the corresponding ASCII values. The eighth and ninth hexadecimal values are separated by a hyphen (-). All nonprintable characters, such as carriage returns and line feeds, are displayed as periods (.). +The default count is 128 bytes. |
+
dc |
+Double-word values (4 bytes) and ASCII characters. +Each display line shows the address of the first word in the line and up to eight hexadecimal word values, as well as their ASCII equivalent. +The default count is 32 DWORDs (128 bytes). |
+
dd |
+Double-word values (4 bytes). +The default count is 32 DWORDs (128 bytes). |
+
dD |
+Double-precision floating-point numbers (8 bytes). +The default count is 15 numbers (120 bytes). |
+
df |
+Single-precision floating-point numbers (4 bytes). +The default count is 16 numbers (64 bytes). |
+
dp |
+Pointer-sized values. This command is equivalent to dd or dq, depending on whether the target computer's processor architecture is 32-bit or 64-bit, respectively. +The default count is 32 DWORDs or 16 quad-words (128 bytes). |
+
dq |
+Quad-word values (8 bytes). +The default count is 16 quad-words (128 bytes). |
+
du |
+Unicode characters. +Each line displays up to 48 characters. The display continues until the first null byte or until all characters in range have been displayed. All nonprintable characters, such as carriage returns and line feeds, are displayed as periods (.). |
+
dw |
+Word values (2 bytes). +Each display line shows the address of the first word in the line and up to eight hexadecimal word values. +The default count is 64 words (128 bytes). |
+
dW |
+Word values (2 bytes) and ASCII characters. +Each display line shows the address of the first word in the line and up to eight hexadecimal word values. +The default count is 64 words (128 bytes). |
+
dyb |
+Binary values and byte values. +The default count is 32 bytes. |
+
dyd |
+Binary values and double-word values (4 bytes). +The default count is 8 DWORDs (32 bytes). |
+
| Command | +Effect | +
|---|---|
verbose [on|off] |
+Turns verbose mode on or off. With no parameter, displays the current verbose mode setting. |
+
sympath [Path] |
+Sets the symbol search path. With no parameter, displays the current symbol search path. |
+
symopt Options +symopt +Options +symopt -Options +symopt |
+Sets the symbol options. With no + or -, the value of Options replaces the current symbol options. If + or - is used, Options specifies the options to be added or removed; there must be a space before the + or - but no space after it. With no parameter, the current symbol options are displayed. When DBH is launched, the default value of all the symbol options is 0x10C13. For a list of available options, see [Setting Symbol Options](symbol-options.md). |
+
help |
+Displays help text for the DBH commands. |
+
quit |
+Quits the DBH program. |
+
| Command | +Effect | +
|---|---|
load File |
+Loads the specified module. File should specify the path, file name, and file name extension of either the executable file or the symbol file. |
+
unload |
+Unloads the current module. |
+
base Address |
+Sets the default base address to the specified value. All symbol addresses will be determined relative to this base address. |
+
| Command | +Effect | +
|---|---|
findexe File Path |
+Locates the specified executable file in the specified path, using the FindExecutableImage routine. |
+
finddbg File Path |
+Locates the specified .dbg file in the specified path. Including the .dbg extension is optional. |
+
dir File Path |
+Locates the specified file in the specified path or in any subdirectory under this path, using the EnumDirTree routine. |
+
srchtree Path File |
+Locates the specified file in the specified path or in any subdirectory under this path, using the SearchTreeForFile routine. This command is the same as dir, except that the parameters are reversed. |
+
ffpath File |
+Finds the specified file in the current symbol path. |
+
| Command | +Effect | +
|---|---|
mod Address |
+Changes the default module to the module with the specified base address. |
+
refresh |
+Refreshes the module list. |
+
omap |
+Displays the module OMAP structures. |
+
epmod PID |
+Enumerates all the modules loaded for the specified process. PID specifies the process ID of the desired process. |
+
info |
+Displays information about the currently loaded module. |
+
obj Mask |
+Lists all object files associated with the default module that match the specified pattern. Mask may contain a variety of wildcard characters and specifiers; see [String Wildcard Syntax](string-wildcard-syntax.md) for details. |
+
src Mask |
+Lists all source files associated with the default module that match the specified pattern. Mask may contain a variety of wildcard characters and specifiers; see [String Wildcard Syntax](string-wildcard-syntax.md) for details. |
+
enummod |
+Enumerates all loaded modules. There is always at least one module, unless DBH is running without a target, in which case there are none. |
+
| Command | +Effect | +
|---|---|
enum Module!Symbol |
+Enumerates all symbols matching the specified module and symbol. Module specifies the module to search (without the file name extension). Symbol specifies a pattern that the symbol must contain. Both Module and Symbol may contain a variety of wildcard characters and specifiers; see [String Wildcard Syntax](string-wildcard-syntax.md) for details. |
+
enumaddr Address |
+Enumerates all symbols associated with the specified address. |
+
addr Address |
+Displays detailed information about the symbols associated with the specified address. |
+
name [Module!]Symbol |
+Displays detailed information about the specified symbol. An optional Module specifier may be included. Wildcards should not be used, because if multiple symbols match the pattern, name only displays the first of them. |
+
next [Module!]Symbol +next Address |
+Displays detailed information about the next symbol after the specified symbol or address. If a symbol is specified by name, an optional Module specifier may be included, but wildcards should not be used. |
+
prev [Module!]Symbol +prev Address |
+Displays detailed information about the first symbol previous to the specified symbol or address. If a symbol is specified by name, an optional Module specifier may be included, but wildcards should not be used. |
+
line File#LineNum |
+Displays the hexadecimal address of the binary instruction associated with the specified source line, and any symbols associated with this line. Also sets the current line number equal to the specified line number. File specifies the name of the source file, and LineNum specifies the line number within that file; these should be separated with a number sign ( # ). |
+
srclines File LineNum |
+Displays the object files associated with the specified source line, and the hexadecimal address of the binary instruction associated with this line. Does not change the current line number. File specifies the name of the source file, and LineNum specifies the line number within that file; these should be separated with a space. |
+
laddr Address |
+Displays the source file and line number corresponding to the symbol located at the specified address. |
+
linenext |
+Increments the current line number, and displays information about the new line number. |
+
lineprev |
+Decrements the current line number, and displays information about the new line number. |
+
locals Function [Mask] |
+Displays all local variables contained within the specified function. If Mask is included, only those locals matching the specified pattern are displayed; see [String Wildcard Syntax](string-wildcard-syntax.md) for details. |
+
type TypeName |
+Displays detailed information about the specified data type. TypeName specifies the name of the data type (for example, WSTRING). If no type name matches this value, any matching symbol will be displayed. Unlike most DBH command parameters, TypeName is case-sensitive. |
+
elines [Source [Obj]] |
+Enumerates all source lines matching the specified source mask and object mask. Source specifies the name of the source file, including the absolute path and file name extension. Obj specifies the name of the object file, including the relative path and file name extension. Both Source and Obj may contain a variety of wildcard characters and specifiers; see [String Wildcard Syntax](string-wildcard-syntax.md) for details. If a parameter is omitted this is equivalent to using the asterisk (*) wildcard. If you do not wish to specify path information, prefix the file name with *\ to indicate a wildcard path. |
+
index Value |
+Displays detailed information about the symbol with the specified index value. |
+
scope Address +scope [Module!]Symbol |
+Displays detailed information about the parent of the specified symbol. The symbol may be specified by address or by name. |
+
srch [mask=Symbol] [index=Index] [tag=Tag] [addr=Address] [globals] |
+Searches for all symbols that match the specified masks. Symbol specifies the symbol name. It should not include the module name, but it may contain wildcard characters and specifiers; see [String Wildcard Syntax](string-wildcard-syntax.md) for details. Index specifies the hexadecimal address of a symbol to be used as the parent for the search. Tag specifies the hexadecimal symbol type classifier (SymTagXxx) value that must match the symbol. Address specifies the address of the symbol. If globals is included, only global symbols will be displayed. |
+
uw Address |
+Displays the unwind information for the function at the specified address. |
+
dtag |
+Displays all the symbol type classifier (SymTagXxx) values. |
+
etypes |
+Enumerates all data types. |
+
dump |
+Displays a complete list of all symbol information in the target file. |
+
| Command | +Effect | +
|---|---|
home [Path] |
+Sets the home directory used by SymSrv and SrcSrv for the default downstream store. If the symbol path contains a reference to a symbol server that uses a default downstream store, then the sym subdirectory of the home directory will be used for the downstream store. With no parameter, home displays the current home directory. |
+
srvpath Path |
+Tests whether the specified path is the path of a symbol store. |
+
srvind File |
+Finds the symbol server index that corresponds to the specified file. The symbol server index is a unique value based on the contents of the file, regardless of whether it actually has been added to any symbol store. File should specify the file name and absolute path of the desired file. |
+
fii File |
+Displays the symbol server indexes for the specified binary file and its associated files. |
+
getfile File Index |
+Displays the file with the specified name and symbol server index. File specifies the name of the desired file; this should not include its path. Index specifies the symbol server index of the desired file. DBH uses the SymFindFileInPath routine to search the tree under the current symbol path for a file with this name and this index. |
+
sup Path File1 File2 |
+Stores a file in a symbol store, based on the values of the parameters. Path specifies the directory path of the symbol store. File1 and File2 are used to create a delta value, which is in turn used to determine the file being stored. |
+
storeadd File Store |
+Adds the specified file to the specified symbol store. Store should be the root path of the symbol store. |
+
| Command | +Effect | +
|---|---|
undec Name |
+Reveals the meaning of the decorations attached to the specified symbol name. Name can be any string; it need not correspond to a currently loaded symbol. If Name contains C++ decorations, the meaning of these decorations is displayed. |
+
add Name Address Size |
+Adds the specified imaginary symbol to the list of symbols loaded in DBH. Name specifies the name of the symbol to be added, Address specifies its hexadecimal address, and Size its hexadecimal size in bytes. This is treated like any other symbol in later DBH commands, until the DBH session is ended with quit or unload, or until the imaginary symbol is deleted with del. The actual target symbol file is not altered. |
+
del Name +del Address |
+Deletes an imaginary symbol previously added with the add command. The symbol can be specified either by name or by address. This cannot be used to delete real symbols. |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| Command | +Display | +
|---|---|
dd* |
+32-bit pointers used |
+
dq* |
+64-bit pointers used |
+
dp* |
+Standard pointer sizes used: 32-bit or 64-bit, depending on the target's processor architecture |
+
| Command | +Display | +
|---|---|
d*p |
+Displays the contents of the memory referenced by the pointer in DWORD or QWORD format, depending on the pointer size of the target's processor architecture. If this value matches any known symbol, this symbol is displayed as well. |
+
d*a |
+Displays the contents of the memory referenced by the pointer in ASCII character format. |
+
d*u |
+Displays the contents of the memory referenced by the pointer in Unicode character format. |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Abbreviation |
+dic |
+
Hexadecimal value |
+0x4 |
+
Symbolic Name |
+FLG_DEBUG_INITIAL_COMMAND |
+
Destination |
+System-wide registry entry, kernel flag |
+
bp |
+Sets a breakpoint that will be active until the module it is in is unloaded. |
+
bu |
+Sets a breakpoint that is unresolved when the module is unloaded and re-enables when the module reloads. |
+
bm |
+Sets a breakpoint for a symbol. This command will use bu or bp appropriately and allows wildcards * to be used to set breakpoints on every symbols that matches (like all methods in a class). |
+
bl |
+Lists breakpoints. |
+
bc |
+Clears a breakpoint from the list. Use bc * to clear all breakpoints. |
+
bd |
+Disables a breakpoint. Use bd * to disable all breakpoints. |
+
be |
+Enables a breakpoint. Use be * to enable all breakpoints. |
+
| Option | +Description | +
|---|---|
e |
+execute (when CPU fetches an instruction from the address) |
+
r |
+read/write (when CPU reads or writes to the address) |
+
w |
+write (when the CPU writes to the address) |
+
kb |
+Displays the stack and first three parameters. |
+
kp |
+Displays the stacks and the full list of parameters. |
+
kn |
+Allows you to see the stack with the frame information next to it. |
+
bp |
+Sets a breakpoint that will be active until the module it is in is unloaded. |
+
bu |
+Sets a breakpoint that is unresolved when the module is unloaded and re-enables when the module reloads. |
+
bm |
+Sets a breakpoint for a symbol. This command will use bu or bp appropriately and allows wildcards * to be used to set breakpoints on every symbols that matches (like all methods in a class). |
+
| Option | +Description | +
|---|---|
e |
+execute (when CPU fetches an instruction from the address) |
+
r |
+read/write (when CPU reads or writes to the address) |
+
w |
+write (when the CPU writes to the address) |
+
bl |
+Lists breakpoints. |
+
bc |
+Clears a breakpoint from the list. Use bc * to clear all breakpoints. |
+
bd |
+Disables a breakpoint. Use bd * to disable all breakpoints. |
+
be |
+Enables a breakpoint. Use be * to enable all breakpoints. |
+
kb |
+Displays the stack and first three parameters. |
+
kp |
+Displays the stacks and the full list of parameters. |
+
kn |
+Allows you to see the stack with the frame information next to it. |
+
db |
+Displays data in byte values and ASCII characters. |
+
dd |
+Displays data as double wide words (4 bytes). |
+
du |
+Displays data as Unicode characters. |
+
dw |
+Displays data as word values (2 bytes) and ASCII characters. |
+
| Command | +Description | +
|---|---|
ea |
+ASCII string (not NULL-terminated) |
+
eu |
+Unicode string (not NULL-terminated |
+
ew |
+Word values (2 bytes) |
+
eza |
+NULL-terminated ASCII string |
+
ezu |
+NULL-terminated Unicode string |
+
eb |
+Byte values |
+
ed |
+Double-word values (4 bytes) |
+
Abbreviation |
+dwl |
+
Hexadecimal value |
+0x04000000 |
+
Symbolic Name |
+FLG_DEBUG_INITIAL_COMMAND_EX |
+
Destination |
+System-wide registry entry |
+
| Parameter | +Description | +
| <PLMPackageName> | +The name of the application package. Use the .querypackages command to lists all UWP applications. Do not provide a path to the location of the package, provide just the package name. | +
| <ApplicationId> | +The ApplicationId is located in the application manifest file and can be viewed using the .querypackage or .querypackages command as discussed in this topic. +For more information about the application manifest file, see [App package manifest](https://msdn.microsoft.com/library/windows/apps/br211474). |
+
| [<parameters>] | +Optional parameters passed to the App. Not all apps use or require parameters. |
+
| Parameter | +Description | +
| <PLMPackageName> | +The name of the application package. Use the .querypackages command to lists all UWP applications. Do not provide a path to the location of the package, provide just the package name. |
+
| <BackgroundTaskId> | +The BackgroundTaskId can be located using the .querypackages command as described below. +For more information about the application manifest file, see [App package manifest](https://msdn.microsoft.com/library/windows/apps/br211474). |
+
| Parameter | +Description | +
| <PLMPackageName> | +The name of the application package. Use the .querypackages command to lists all UWP applications. Do not provide a path to the location of the package, provide just the package name. | +
| <ApplicationId> | +The ApplicationId can be located using .querypackage or .querypackages as discussed earlier in this topic. +For more information about the application manifest file, see [App package manifest](https://msdn.microsoft.com/library/windows/apps/br211474). |
+
| [<parameters>] | +Optional parameters that are passed to the application. Not all applications require or use these optional parameters. | +
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+x86, Itanium |
+
| Id | +decimal | +hex | +
|---|---|---|
KGDT_NULL |
+0 |
+0x00 |
+
KGDT_R0_CODE |
+8 |
+0x08 |
+
KGDT_R0_DATA |
+16 |
+0x10 |
+
KGDT_R3_CODE |
+24 |
+0x18 |
+
KGDT_R3_DATA |
+32 |
+0x20 |
+
KGDT_TSS |
+40 |
+0x28 |
+
KGDT_R0_PCR |
+48 |
+0x30 |
+
KGDT_R3_TEB |
+56 |
+0x38 |
+
KGDT_VDM_TILE |
+64 |
+0x40 |
+
KGDT_LDT |
+72 |
+0x48 |
+
KGDT_DF_TSS |
+80 |
+0x50 |
+
KGDT_NMI_TSS |
+88 |
+0x58 |
+
Abbreviation |
+dhc |
+
Hexadecimal value |
+0x00200000 |
+
Symbolic Name |
+FLG_HEAP_DISABLE_COALESCING |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+dps |
+
Hexadecimal value |
+0x80000 |
+
Symbolic Name |
+FLG_DISABLE_PAGE_KERNEL_STACKS |
+
Destination |
+System-wide registry entry |
+
Abbreviation |
+dpd |
+
Hexadecimal value |
+0x80000000 |
+
Symbolic Name |
+FLG_DISABLE_PROTDLLS |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+dse |
+
Hexadecimal value |
+0x10000 |
+
Symbolic Name |
+FLG_DISABLE_STACK_EXTENSION |
+
Destination |
+Image file registry entry |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| Option | +Description | +
|---|---|
-a[quantity] |
+Show each array element on a new line, with its index. A total of quantity elements will be displayed. There must be no space between the a and the quantity. If -a is not followed by a digit, all items in the array are shown. The -a[quantity] switch should appear immediately before each type name or field name that you want displayed in this manner. |
+
-b |
+Display blocks recursively. If a displayed structure contains substructures, it is expanded recursively to arbitrary depths and displayed in full. Pointers are expanded only if they are in the original structure, not in substructures. |
+
-c |
+Compact output. All fields are displayed on one line, if possible. (When used with the -a switch, each array element takes one line rather than being formatted as a several-line block.) |
+
-d |
+When used with a Name that is ended with an asterisk, display verbose output for all types that begin with Name. If Name does not end with an asterisk, display verbose output. |
+
-e |
+Forces dt to enumerate types. This option is only needed if dt is mistakenly interpreting the Name value as an instance rather than as a type. |
+
-i |
+Do not indent the subtypes. |
+
-o |
+Omit offset values of the structure fields. |
+
-p |
+Address is a physical address, rather than a virtual address. |
+
-r[depth] |
+Recursively dumps the subtype fields. If depth is given, this recursion will stop after depth levels. The depth must be a digit between 1 and 9, and there must be no space between the r and the depth. The -r[depth] switch should appear immediately before the address. |
+
-s size |
+Enumerate only those types whose size in bytes equals the value of size. The -s option is only useful when types are being enumerated. When -s is specified, -e is always implied as well. |
+
-t |
+Enumerate types only. |
+
-v |
+Verbose output. This gives additional information such as the total size of a structure and the number of its elements. When this is used along with the -y search option, all symbols are displayed, even those with no associated type information. |
+
| Option | +Description | +
|---|---|
-n |
+This indicates that the next parameter is a name. This should be used if the next item consists entirely of hexadecimal characters, because it will otherwise be taken as an address. |
+
-y |
+This indicates that the next parameter is the beginning of the name, not necessarily the entire name. When -y is included, all matches are listed, followed by detailed information on the first match in the list. If -y is not included, only exact matches will be displayed. |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
Modes |
+user mode, kernel mode |
+
Targets |
+live, crash dump |
+
Platforms |
+all |
+
| Command | +Enter | +
|---|---|
e |
+This enters data in the same format as the most recent e* command. (If the most recent e* command was ea, eza, eu, or ezu, the final parameter will be String and may not be omitted.) |
+
ea |
+ASCII string (not NULL-terminated). |
+
eb |
+Byte values. |
+
ed |
+Double-word values (4 bytes). |
+
eD |
+Double-precision floating-point numbers (8 bytes). |
+
ef |
+Single-precision floating-point numbers (4 bytes). |
+
ep |
+Pointer-sized values. This command is equivalent to ed or eq, depending on whether the target computer's processor architecture is 32-bit or 64-bit, respectively. |
+
eq |
+Quad-word values (8 bytes). |
+
eu |
+Unicode string (not NULL-terminated). |
+
ew |
+Word values (2 bytes). |
+
eza |
+NULL-terminated ASCII string. |
+
ezu |
+NULL-terminated Unicode string. |
+
Abbreviation |
+cse |
+
Hexadecimal value |
+0x10000000 |
+
Symbolic Name |
+FLG_CRITSEC_EVENT_CREATION |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+vrf |
+
Hexadecimal value |
+0x100 |
+
Symbolic Name |
+FLG_APPLICATION_VERIFIER |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+bhd |
+
Hexadecimal value |
+0x40000000 |
+
Symbolic Name |
+FLG_ENABLE_HANDLE_EXCEPTIONS |
+
Destination |
+System-wide registry entry, kernel flag |
+
Abbreviation |
+ece |
+
Hexadecimal value |
+0x00400000 |
+
Symbolic Name |
+FLG_ENABLE_CLOSE_EXCEPTIONS |
+
Destination |
+System-wide registry entry, kernel flag |
+
Abbreviation |
+d32 |
+
Hexadecimal value |
+0x20000 |
+
Symbolic Name |
+FLG_ENABLE_CSRDEBUG |
+
Destination |
+System-wide registry entry |
+
Abbreviation |
+eel |
+
Hexadecimal value |
+0x00800000 |
+
Symbolic Name |
+FLG_ENABLE_EXCEPTION_LOGGING |
+
Destination |
+System-wide registry entry, kernel flag |
+
Abbreviation |
+hfc |
+
Hexadecimal value |
+0x20 |
+
Symbolic Name |
+FLG_HEAP_ENABLE_FREE_CHECK |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+hpc |
+
Hexadecimal value |
+0x40 |
+
Symbolic Name |
+FLG_HEAP_VALIDATE_PARAMETERS |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+htd |
+
Hexadecimal value |
+0x8000 |
+
Symbolic Name |
+FLG_HEAP_ENABLE_TAG_BY_DLL |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+htg |
+
Hexadecimal value |
+0x800 |
+
Symbolic Name |
+FLG_HEAP_ENABLE_TAGGING |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+htc |
+
Hexadecimal value |
+0x10 |
+
Symbolic Name |
+FLG_HEAP_ENABLE_TAIL_CHECK |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+hvc |
+
Hexadecimal value |
+0x80 |
+
Symbolic Name |
+FLG_HEAP_VALIDATE_ALL |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+ksl |
+
Hexadecimal value |
+0x40000 |
+
Symbolic Name |
+FLG_ENABLE_KDEBUG_SYMBOL_LOAD |
+
Destination |
+System-wide registry entry, kernel flag |
+
Abbreviation |
+eot |
+
Hexadecimal value |
+0x01000000 |
+
Symbolic Name |
+FLG_ENABLE_HANDLE_TYPE_TAGGING |
+
Destination |
+System-wide registry entry, kernel flag |
+
Abbreviation |
+hpa |
+
Hexadecimal value |
+0x02000000 |
+
Symbolic Name |
+FLG_HEAP_PAGE_ALLOCS |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
Abbreviation |
+ptg |
+
Hexadecimal value |
+0x400 |
+
Symbolic Name |
+FLG_POOL_ENABLE_TAGGING |
+
Destination |
+System-wide registry entry |
+
Hexadecimal value |
+0x200 |
+
Symbolic Name |
+FLG_MONITOR_SILENT_PROCESS_EXIT |
+
Destination |
+Image file registry entry |
+
Abbreviation |
+scb |
+
Hexadecimal value |
+0x100000 |
+
Symbolic Name |
+FLG_ENABLE_SYSTEM_CRIT_BREAKS |
+
Destination |
+System-wide registry entry, kernel flag, image file registry entry |
+
| Level | +Description | +Value | +
|---|---|---|
DBG_LEVEL_INFO |
+All available debug information. This is the highest level of trace. |
+0x00000000 |
+
DBG_LEVEL_LOG |
+Log information. |
+0x00000800 |
+
DBG_LEVEL_WARN |
+Warnings. |
+0x00001000 |
+
DBG_LEVEL_ERR |
+Errors. |
+0x00002000 |
+
DBG_LEVEL_FATAL |
+Fatal errors, which can cause the operating system to crash. This is the lowest level of trace. |
+0x00003000 |
+
| Component | +Description | +Value | +
|---|---|---|
DBG_COMP_INIT |
+Handles adapter initialization. |
+0x00000001 |
+
DBG_COMP_CONFIG |
+Handles adapter configuration. |
+0x00000002 |
+
DBG_COMP_SEND |
+Handles sending data over the network. |
+0x00000004 |
+
DBG_COMP_RECV |
+Handles receiving data from the network. |
+0x00000008 |
+
DBG_COMP_PROTOCOL |
+Handles protocol operations. |
+0x00000010 |
+
DBG_COMP_BIND |
+Handles binding operations. |
+0x00000020 |
+
DBG_COMP_BUSINFO |
+Handles bus queries. |
+0x00000040 |
+
DBG_COMP_REG |
+Handles registry operations. |
+0x00000080 |
+
DBG_COMP_MEMORY |
+Handles memory management. |
+0x00000100 |
+
DBG_COMP_FILTER |
+Handles filter operations. |
+0x00000200 |
+
DBG_COMP_REQUEST |
+Handles requests. |
+0x00000400 |
+
DBG_COMP_WORK_ITEM |
+Handles work-item operations. |
+0x00000800 |
+
DBG_COMP_PNP |
+Handles Plug and Play operations. |
+0x00001000 |
+
DBG_COMP_PM |
+Handles power management operations. |
+0x00002000 |
+
DBG_COMP_OPENREF |
+Handles operations that open reference objects. |
+0x00004000 |
+
DBG_COMP_LOCKS |
+Handles locking operations. |
+0x00008000 |
+
DBG_COMP_RESET |
+Handles resetting operations. |
+0x00010000 |
+
DBG_COMP_WMI |
+Handles Windows Management Instrumentation operations. |
+0x00020000 |
+
DBG_COMP_CO |
+Handles Connection-Oriented NDIS. |
+0x00040000 |
+
DBG_COMP_REF |
+Handles reference operations. |
+0x00080000 |
+
DBG_COMP_ALL |
+Handles all NDIS components. |
+0xFFFFFFFF |
+