Bugcheck: STOP 0x50 - Sanity: Losing

Discussion in 'Windows 64 Bit' started by Samuel Denbigh Leslie, Nov 29, 2006.

  1. Greetings everyone,

    This post is a follow-up to a previous post of mine from a while back,
    titled "System Crash - STOP 0x50", so firstly, if you want some extra
    background please quickly read that post!

    OK, this post is going to be fairly long, as I am going to lay out
    everything I know about the problem and have tried to rectify it, in the
    desperate hope someone can offer some help to solve the issue, because I am
    at my wits end.

    Issue Summary:
    I am getting STOP 0x50 bugchecks (PAGE_FAULT_IN_NONPAGED_AREA) frequently
    when doing certain tasks.

    Steps to reproduce:
    I have managed to pinpoint the exact activity required in order to cause the
    bugcheck. Namely, I must be running Winamp (v.5.32 - Current - x86) while
    also using WinImage (v.8.0.8000 - Current - x64). Winamp is a media player,
    as I'm sure most of you would be aware :) WinImage is a floppy image editing
    application, allowing the creation and modification of a diverse range of
    floppy disk image formats. Note that the bugcheck will not occur
    immediately, but will occur at some point during the continual concurrent
    use of these two applications. The time the bugcheck takes to manifest
    appears to be random, anywhere between 10 minutes and hours. I am still
    unsure if system uptime has any real impact on the time taken for the issue
    to manifest (e.g. quicker to crash after system has been up for 24+ hrs than
    from a fresh reboot).

    Hardware Information:
    The following is a list of the machines "critical" hardware. I have excluded
    minor components such as keyboard and mouse, as well as components highly
    unlikely to be the (potential) cause, such as hard-drives and
    optical-drives. Please feel free to request more detailed hardware
    information if you think it would help in any way! All of the below system
    components are running their latest respective drivers.
    ***Mainboard: ASUS A8N32-SLI Deluxe
    ***Processor: AMD Athlon 64 X2 Dual Core 4200+
    ***Memory: Kingston DDR 2x1024MB
    ***Graphics: NVIDIA GeForce 7800GT
    ***Audio: Creative Audigy 4

    System Configuration:
    The system is running Microsoft Windows Server 2003 R2 - Enterprise x64
    Edition and is kept up-to-date with updates via the Microsoft Updates
    web-site and Automatic Updates. The system is configured to output kernel
    memory dumps, and has 4096MB of virtual memory.

    Troubleshooting Steps:
    1. The system has had Windows Memory Diagnostics run in extended test mode
    for over 24 hrs straight with no errors recorded.
    2. The system has had Stress Prime 2004 Orthos Edition v.0.41.110.18 run in
    blend mode (stress both CPU and RAM) for over 24 hrs straight with no errors
    recorded. For those unfamiliar with this program, it is based on Prime95 and
    adds a number of useful features, including dual core support. The test
    places the CPU and RAM of the system under extreme pressure, and is
    frequently used to stress test a machine to the maximum.
    3. The system has had Debugging Tools for Windows 64-bit installed for
    kernel memory crash dump analysis. This is way out of my league, as I have
    no expertise in the analysis of system memory crash dumps, but I have
    managed to gleam a number of useful bits of information from a basic
    analysis of the dumps. See below for further details.
    4. The system has had Driver Verifier enabled with custom settings in an
    attempt to help isolate the problem (unsuccessful thus far). See below for
    further details.
    5. The user has posted a desperate plea for help to the
    microsoft.public.windows.64bit.general newsgroup ;)

    Debugging Tools for Windows 64-bit:
    I have completed some very basic analysis of the kernel memory crash dumps
    through the use of WinDbg, and have made a few observations:
    ***Winamp.exe is always cited as the responsible process. However, if this
    is in fact true, I believe WinImage to be the "catalyst" for the bugcheck to
    occur, as I can run Winamp for seemingly any period of time without issue.
    It is only when used in conjunction with WinImage that the bugcheck occurs.
    ***The win32k!NtUserfnINDEVICECHANGE+0x1bb instruction is always listed as
    the ultimate culprit, and is always the final instruction in the stack trace
    before the page fault instructions. I have been desperately trying to find
    any information on this reference, yet have come up with nothing. Can anyone
    share any further light on this other than it's obvious implied function
    judging from its name?
    I have attached the latest debug output from WinDbg after running an
    !analyze -v on the latest crash dump, maybe someone much more qualified than
    I can gleam some more useful information from it? If anyone actually wants a
    copy of the crash dump, let me know, but I realise that's asking a lot.

    Driver Verifier:
    The Windows Driver Verifier has been enabled with custom settings as
    follows:
    ***Special pool
    ***Pool tracking
    ***Force IRQL checking
    ***All non Microsoft Corporation drivers have been selected for
    verification.
    Once again, this kind of tool is well out of my expertise, so I'm uncertain
    if these are "good" settings. Thus far, they haven't revealed anything
    interesting in the form of different bugcheck messages or different data
    during the analysis of the latest kernel memory crash dump.

    Random Thoughts:
    1. I am 99% certain that the issue is not caused by a hardware problem. I
    draw this conclusion from two lines of reasoning; the system is able to
    successfully complete all diagnostics I have thrown at it, including ones
    involving extreme system stress, and the system is able to run Windows XP
    Professional (32-bit) without issue, which was the previous operating system
    in use.
    2. I am beginning to wonder if the problem lies in win32k.sys itself, and is
    not a driver issue. This is mainly because I have had absolutely zero
    success in isolating the problem to a specific driver. However, I'm really
    not qualified to make that kind of conclusion, just voicing my thoughts.
    3. Would changing the crash dump type to a complete memory dump be at all
    beneficial? Could it possibly reveal more through something as simple as the
    standard !analyze -v command in WinDbg?

    That about covers everything I can think up for now. Apologies for the
    length of this post, however, I'm just trying to provide as much information
    as possible in the hope some of it may lead to a solution.

    Thanks in advance for any help at all!

    -Samuel Denbigh Leslie
     
    Samuel Denbigh Leslie, Nov 29, 2006
    #1
    1. Advertisements

  2. This is really over my head too, but here is a very interesting article that
    may lead you further on. It's a discussion on the technical background as
    well as instructive in how to interpret a memory dump.

    http://www.osronline.com/article.cfm?id=335

    I am thinking that [maybe] one of those app's (or both?) aren't real 64bit
    compiled for your machine, but 32bit app's that just happen to work, but not
    without interfering with the other. If you can believe that, maybe try and
    find a substitute for that (or both?).

    This is a bit like analyzing someone elses dream, I think you are better off
    doing it yourself.

    Best of wishes!

    Tony. . .
     
    Tony Sperling, Nov 29, 2006
    #2
    1. Advertisements

  3. Thank-you for your reply Tony.

    I've checked out the link you enclosed and it is very interesting,
    particularly in terms of it clearing up the exact definition of what is
    going on here. I'm afraid however, that most of it is well over my ability,
    as I'm not a programmer, or a debugger ;)

    Concerning your point on the apps, I'm not entirely sure I understand what
    you mean. Winamp is definitely a 32-bit application and I am running the
    64-bit edition of WinImage. Task Manager confirms this. Finding a substitute
    for both (or just one of them) isn't really an ideal solution, particularly
    in the case of WinImage, which is a very specific program.

    As for your point on analyzing someone elses dream, I wish it was a dream :(

    Still, I'd appreciate any further help you or anyone else can offer, as this
    is a dream well beyond my ability.

    Thanks again,

    Samuel Denbigh Leslie
     
    Samuel Denbigh Leslie, Nov 30, 2006
    #3
  4. O.K. - This gives us a starting point. Since my own experiences are dated
    and weak, I think that making a detour via 'experiment', may be a short-cut
    for us.

    As I interpreted that article, and having in mind that you need both those
    app's running to trigger the event, while also noting that WinImage is
    compiled for 64bit, that we should try and find a sub for Winamp.

    You see, a processor is frequently defined as a sort of calculator, but that
    is not a very good description - better to say that it is a 'bit-pattern
    manipulator'. The general public has understood that everything inside is
    kept running by way of all these [One's] and [Zero's] but can't figure what
    it all means.

    The simple truth is that the bit-patterns are continually being flushed
    thrugh the processor's Registers, and which specific Register it passes
    determine how it is interpreted. So, any Byte or set of Bytes can be
    interpreted as being one of four (4) entities:

    1. A numerical
    2. A character or string of characters.
    3. An adress in the memory space.
    4. A pointer into the memory space.

    The difference between an adress and a pointer is that the pointer has a
    fixed and often smaller size and it's use is popular since it is often much
    faster to manipulate data by redirection instead of manipulating the actual
    data.

    Modern programs need to do some household clean-up tasks as they go along,
    and should not leave things behind ( specifically not pointers! ) that other
    processes might trip over.(The next process might not know how to interpret
    whatever it is that it finds there?) I am not sure, but these tasks could be
    tricky for maintaining compatibility between 32bit and 64bit processes,
    generally the Registers are used by convention and nobody notice anything
    until 'Sam' comes along and runs WinAmp and WinImage concurrently, but
    conventions change, and specifically when major changes, like the
    32bit/64bit evolutionary change happened - I suggest you try and find a
    replacement for WinAmp.

    There is a little free-ware thing called MediaPlayerClassic that is popular
    in this here Forum - I do not know if it will meet your needs, but there are
    Codecs available for everything under the sun. Go to:

    http://www.free-codecs.com/index.htm

    they have everything in one place. If you still think you need WinAmp, try
    an earlier version (or an update!) You may still have the machine crash, but
    you may get a different stop code and by comparing, that could lead us
    further.

    I hardly know enough to read and debug my own code - analyzing memory dumps
    of somebody elses work is a different kettle of fish altogether, I would
    need to have the commented code to reference and the freedom to tear a month
    (at least) out of the calendar, to make head-or-tail of any of that stuff,
    and guess-work would be the expected outcome, at best!

    But keep it coming! We have occasional visits of programmers here too.


    Tony. . .
     
    Tony Sperling, Nov 30, 2006
    #4
  5. Dear UBfusion,

    I can answer "a" right now:

    I run the two applications together merely because I like to listen to music
    while I work. The two applications have no relation to each other while
    running, and should not be communicating with or providing a service to each
    other in any way. Not running one while running the other, may be a
    possibility, but is hardly an ideal solution. I wish to get to the bottom of
    this and resolve the issue.

    As for the other questions, I will do some further tests to get answers, and
    get back to you ASAP. Hopefully within 24 hours or shortly thereafter.

    Thanks for the help,

    Samuel Denbigh Leslie
     
    Samuel Denbigh Leslie, Nov 30, 2006
    #5
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.