What does this particular bug check refer to?

[Guest]

I've been having the same sort of shut downs recently, even after
reformatting my drive and starting over from scratch several times. Would
someone be able to determine from this event I've found in the event viewer
when I have a shutdown what is causing these shutdowns?

Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1001
Date: 10/13/2005
Time: 12:37:38 AM
User: N/A

Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x100000be
(0xbf8b6696, 0x11ffd021, 0xa9a0e178, 0x0000000c). A dump was saved in:
C:\WINDOWS\Minidump\Mini101305-02.dmp.

Any help would be appreciated. If I can at least determine what the
issue is, then I can hopefully fix it.

Thanks!

David

 

[David Candy]

Your code is not documented but all other 1nnnnnn are the same as 0nnnnnn.
Driver Development Tools: Windows DDK

Bug Check 0xBE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
The ATTEMPTED_WRITE_TO_READONLY_MEMORY bug check has a value of 0x000000BE. This is issued if a driver attempts to write to a read-only memory segment.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Virtual address of attempted write
2 PTE contents
3 Reserved
4 Reserved


If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Send feedback on this topic. / Built on Thursday, February 13, 2003


If you want to solve a blue screen do this

Type verifier in Start Run, follow the wizard but choose All Drivers. This will slow down your computer and cause more blue screen crashes but will pinpoint what is causing the crash (if the original error message didn't). Once you fix it you rerun verifier and turn it off.

If you can't start after enabling verifier
choose Last Known Good Configuration at the Failed Boot menu (which will
start without verifier).


You will be creating a crash dump file in c:\windows\minidump every blue screen. Make sure you are set to record minidumps (Small Memory Dumps) - type it in Help to see how.

Then

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)


Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

Download
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Load the crash dump file into windbg
and read what it says. You may need to tell it where the symbols are. Read it.
Type
!Analyze -v
into Windbg's command line.
(this will hopefully tell you the faulty component)

If the above is too technical then email the crash dump files to david @ mvps.org. Don't send me lots of them. Just the one from your last crash after you turn verifier on. And only one per mail.

You can look up specific details here
http://msdn.microsoft.com/library/d..._ea8b9fd0-2d81-4a04-a7ed-c1c6a80bd501.xml.asp

If it indicates faulty memory might be the cause you can get a memory tester
here
http://oca.microsoft.com/en/wi­ndiag.asp


If it mentions a core windows system file, meaning it a MS fix is required,
upload a minidump to

http://oca.microsoft.com

Also try typing the main error code in Help while online (ie,
Stop 0x50
and also try in the 8 digit form
stop 0x00000050)
and if there are too many hits use a filename if available. Generally memory
addresses are different for each computer (as each computer has a different
mix of drivers) so parameters that are memory addresses aren't that useful for searching, but NTStatus codes are (plus you can look them up here http://cvs.sourceforge.net/viewcvs.py/mingw/w32api/include/ddk/ntstatus.h?rev=1.2).