K
kevin forsythe
setup
toshiba M400 Tablet PC running XP PRO Tablet all public hotfixes
100 GB , 2GB RAM centrino duo processor
we uninstalled all anti-virus, spyware, we updated the bios to a "vista
version" for the M400 per toshiba website
http://www.csdsupport.toshiba.com/tais/csd/support/windows_vista/vista_beta.cgi
we downloaded and ran the Vista upgrade advisor RC... = all ok
downloaded RTM vista from MSFT Technet plus site.. (this is an upgrade
install - not clean)
ran another install check... it tells us everything should work ok (except
my epson scanner - but who cares)
about 2hrs on the "completing final install 80% " the systems does a
normal install reboot .. upon reboot we hit a BSOD
Stop 0x000008E appears to be with mpfirewall.sys at address 8Bc31bbb0
attempt to boot into safe mode thinking this will clear the error and allow
install to continue.. Vista returns an error that says something to the
effect that
vista installation can't continue in safe mode.... we all it to go into
normal mode.. same error occurs.. and repeats pattern... finally we select
the option to go
back to Win XP.. which we did..
Being the Geek that I am ... I was able to capture.. the mini crash dump
file.. and load it into WinDbg. debugger.. initally there were no symbols
for Vista up on the microsoft Symbols servers -HINT HINT.. TO MSFT
(SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ) but I did find
some RC1 Vista symbols package..
http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx which I
downloaded and loaded into the debugger as a second source.. (attached at
the bottom)
I had not heard of mpfirewall.sys before and assumed it was some MS
Firewall service.. here's where things get interesting.. decided to search
the NET .. turns out it's MCafee firewall.. which is weird.. because I've
never purchased, used, or installed any MCafee stuff on my PC... did more
searching... and come to learn the problem could possibly be *** AOL ***
YIKES!! GO Away.. I had never used it on this system.. but I guess it's
security service installs Mcafee files.. and toshiba ships the unit with
AOL... even if it's just on your system (and not running) Vista install will
blow up... this is just a theory.. I'm going to test completely removing
AOL and delete mpfirewall.sys and re-attempt to update my PC to Vista..
details to follow... anyone at MS care to review the debug below and
provide more info? perhaps this should be a MSFT KB Article...
are there actually any Vista install log file somewhere .. that might
provide me with more info (if so where is it kept) - I'll provide update
after more testing...
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\dumps3\Mini111706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
ERROR: PRCB.CurrentThread is not properly aligned in dump (RVA 0x1986, size
0x4, align 0x4)
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
Symbol search path is:
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
Debug session time: Fri Nov 17 02:32:45.536 2006 (GMT-8)
System Uptime: 0 days 0:00:36.223
WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
.........................................................................................................................................
Loading User Symbols
Loading unloaded module list
........
GetContextState failed, 0x80004005
CS descriptor lookup failed
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
Unable to get program counterUnable to load image
\SystemRoot\System32\Drivers\MpFirewall.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for MpFirewall.sys
*** ERROR: Module load completed but symbols could not be loaded for
MpFirewall.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 8bcacbb0, a2b9ba50, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
Probably caused by : MpFirewall.sys ( MpFirewall+2bb0 )
Followup: MachineOwner
---------
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
1: kd> ! analyze -v
GetContextState failed, 0x80004005
Unable to get program
counter*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8bcacbb0, The address that the exception occurred at
Arg3: a2b9ba50, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
FAULTING_MODULE: 81800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
MpFirewall+2bb0
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
0008:cbb0 ?? ???
TRAP_FRAME: a2b9ba50 -- (.trap ffffffffa2b9ba50)
Unable to read trap frame at a2b9ba50
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from 00000000 to 8bcacbb0
STACK_TEXT:
a2b9bac0 00000000 86ff4a00 86ff4948 86ff4330 MpFirewall+0x2bb0
STACK_COMMAND: kb
FOLLOWUP_IP:
MpFirewall+2bb0
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
0008:cbb0 ?? ???
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: MpFirewall+2bb0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: MpFirewall
IMAGE_NAME: MpFirewall.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
GetContextState failed, 0x80004005
1: kd> lmvm MpFirewall
start end module name
8bcaa000 8bcbe000 MpFirewall T (no symbols)
Loaded symbol image file: MpFirewall.sys
Image path: \SystemRoot\System32\Drivers\MpFirewall.sys
Image name: MpFirewall.sys
Timestamp: unavailable (00000000)
CheckSum: 00000000
ImageSize: 00014000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
GetContextState failed, 0x80004005
toshiba M400 Tablet PC running XP PRO Tablet all public hotfixes
100 GB , 2GB RAM centrino duo processor
we uninstalled all anti-virus, spyware, we updated the bios to a "vista
version" for the M400 per toshiba website
http://www.csdsupport.toshiba.com/tais/csd/support/windows_vista/vista_beta.cgi
we downloaded and ran the Vista upgrade advisor RC... = all ok
downloaded RTM vista from MSFT Technet plus site.. (this is an upgrade
install - not clean)
ran another install check... it tells us everything should work ok (except
my epson scanner - but who cares)
about 2hrs on the "completing final install 80% " the systems does a
normal install reboot .. upon reboot we hit a BSOD
Stop 0x000008E appears to be with mpfirewall.sys at address 8Bc31bbb0
attempt to boot into safe mode thinking this will clear the error and allow
install to continue.. Vista returns an error that says something to the
effect that
vista installation can't continue in safe mode.... we all it to go into
normal mode.. same error occurs.. and repeats pattern... finally we select
the option to go
back to Win XP.. which we did..
Being the Geek that I am ... I was able to capture.. the mini crash dump
file.. and load it into WinDbg. debugger.. initally there were no symbols
for Vista up on the microsoft Symbols servers -HINT HINT.. TO MSFT
(SRV*C:\symbols*http://msdl.microsoft.com/download/symbols ) but I did find
some RC1 Vista symbols package..
http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx which I
downloaded and loaded into the debugger as a second source.. (attached at
the bottom)
I had not heard of mpfirewall.sys before and assumed it was some MS
Firewall service.. here's where things get interesting.. decided to search
the NET .. turns out it's MCafee firewall.. which is weird.. because I've
never purchased, used, or installed any MCafee stuff on my PC... did more
searching... and come to learn the problem could possibly be *** AOL ***
YIKES!! GO Away.. I had never used it on this system.. but I guess it's
security service installs Mcafee files.. and toshiba ships the unit with
AOL... even if it's just on your system (and not running) Vista install will
blow up... this is just a theory.. I'm going to test completely removing
AOL and delete mpfirewall.sys and re-attempt to update my PC to Vista..
details to follow... anyone at MS care to review the debug below and
provide more info? perhaps this should be a MSFT KB Article...
are there actually any Vista install log file somewhere .. that might
provide me with more info (if so where is it kept) - I'll provide update
after more testing...
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\dumps3\Mini111706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
ERROR: PRCB.CurrentThread is not properly aligned in dump (RVA 0x1986, size
0x4, align 0x4)
DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?00000000`00000000?
Symbol search path is:
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Kernel base = 0x81800000 PsLoadedModuleList = 0x81908ab0
Debug session time: Fri Nov 17 02:32:45.536 2006 (GMT-8)
System Uptime: 0 days 0:00:36.223
WARNING: Data block is 0x320 bytes but only 0x290 bytes could be read
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
.........................................................................................................................................
Loading User Symbols
Loading unloaded module list
........
GetContextState failed, 0x80004005
CS descriptor lookup failed
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
Unable to get program counterUnable to load image
\SystemRoot\System32\Drivers\MpFirewall.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for MpFirewall.sys
*** ERROR: Module load completed but symbols could not be loaded for
MpFirewall.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 8bcacbb0, a2b9ba50, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
Probably caused by : MpFirewall.sys ( MpFirewall+2bb0 )
Followup: MachineOwner
---------
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
1: kd> ! analyze -v
GetContextState failed, 0x80004005
Unable to get program
counter*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8bcacbb0, The address that the exception occurred at
Arg3: a2b9ba50, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
FAULTING_MODULE: 81800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
MpFirewall+2bb0
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
0008:cbb0 ?? ???
TRAP_FRAME: a2b9ba50 -- (.trap ffffffffa2b9ba50)
Unable to read trap frame at a2b9ba50
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from 00000000 to 8bcacbb0
STACK_TEXT:
a2b9bac0 00000000 86ff4a00 86ff4948 86ff4330 MpFirewall+0x2bb0
STACK_COMMAND: kb
FOLLOWUP_IP:
MpFirewall+2bb0
GetContextState failed, 0x80004005
GetContextState failed, 0x80004005
0008:cbb0 ?? ???
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: MpFirewall+2bb0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: MpFirewall
IMAGE_NAME: MpFirewall.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
GetContextState failed, 0x80004005
1: kd> lmvm MpFirewall
start end module name
8bcaa000 8bcbe000 MpFirewall T (no symbols)
Loaded symbol image file: MpFirewall.sys
Image path: \SystemRoot\System32\Drivers\MpFirewall.sys
Image name: MpFirewall.sys
Timestamp: unavailable (00000000)
CheckSum: 00000000
ImageSize: 00014000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
GetContextState failed, 0x80004005