1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 61616161, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8167fcab, address which referenced memory

Debugging Details:
------------------

*** ERROR: Module load completed but symbols could not be loaded for nipplpt.sys

READ_ADDRESS:  61616161 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeReleaseSemaphore+af
8167fcab 8b00            mov     eax,dword ptr [eax]

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre

TRAP_FRAME:  a9ccd94c -- (.trap 0xffffffffa9ccd94c)
ErrCode = 00000000
eax=61616161 ebx=00000000 ecx=61616161 edx=81756700 esi=8beeff20 edi=8186b120
eip=8167fcab esp=a9ccd9c0 ebp=a9ccd9f4 iopl=0         ov up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010a97
nt!KeReleaseSemaphore+0xaf:
8167fcab 8b00            mov     eax,dword ptr [eax]  ds:0023:61616161=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 817d97c4 to 81758194

STACK_TEXT:  
a9ccd454 817d97c4 00000003 419ab74a 00000065 nt!RtlpBreakWithStatusInstruction
a9ccd4a8 817d92de 86c44340 a9ccd8a8 a9ccd94c nt!KiBugCheckDebugBreak+0x1f
a9ccd87c 81756d46 0000000a 61616161 00000002 nt!KeBugCheck2+0x676
a9ccd8a0 8176b393 0000000a 61616161 00000002 nt!KiBugCheck2+0xc6
a9ccd8a0 8167fcab 0000000a 61616161 00000002 nt!KiTrap0E+0x1cf
a9ccd9f4 8beea360 8beeff20 00000000 00000001 nt!KeReleaseSemaphore+0xaf
WARNING: Stack unwind information not available. Following frames may be wrong.
a9ccdc30 81718f9e 00000001 419abf92 00000000 nipplpt+0x1360
a9ccdc70 8176c6d1 8beea249 00000001 00000000 nt!PspSystemThreadStartup+0x58
a9ccdc7c 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x15


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nipplpt+1360
8beea360 5f              pop     edi

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  nipplpt+1360

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nipplpt

IMAGE_NAME:  nipplpt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5472c94a

FAILURE_BUCKET_ID:  AV_nipplpt+1360

BUCKET_ID:  AV_nipplpt+1360

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_nipplpt+1360

FAILURE_ID_HASH:  {f120251d-9712-1180-b3ee-3ba90135aac7}

Followup: MachineOwner
---------