Microsoft (R) Windows Debugger Version 6.10.0003.233 X86 Copyright (c) Microsoft Corporation. All rights reserved. Opened \\.\com1 Waiting to reconnect... Connected to Windows Server 2003 3790 x86 compatible target at (Mon Jun 13 12:17:16.294 2022 (GMT+2)), ptr64 FALSE Kernel Debugger connection established. Symbol search path is: srv*c:\symbols\*http://msdl.microsoft.com/download/symbols;srv*c:\msvc_pdb\*http://msdl.microsoft.com/download/symbols Executable search path is: Windows Server 2003 Kernel Version 3790 MP (1 procs) Free x86 compatible Built by: 3790.srv03_sp2_rtm.070216-1710 Machine Name: Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8 System Uptime: not available Break instruction exception - code 80000003 (first chance) ******************************************************************************* * * * You are seeing this message because you pressed either * * CTRL+C (if you run kd.exe) or, * * CTRL+BREAK (if you run WinDBG), * * on your debugger machine's keyboard. * * * * THIS IS NOT A BUG OR A SYSTEM CRASH * * * * If you did not intend to break into the debugger, press the "g" key, then * * press the "Enter" key now. This message might immediately reappear. If it * * does, press "g" and "Enter" again. * * * ******************************************************************************* nt!RtlpBreakWithStatusInstruction: 80871f24 cc int 3 0: kd> !process 0 0 **** NT ACTIVE PROCESS DUMP **** PROCESS 89d97818 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000 DirBase: 7fca1020 ObjectTable: e1000e38 HandleCount: 265. Image: System 0: kd> .process /P 89d97818 Implicit process is now 89d97818 .cache forcedecodeptes done 0: kd> g rtR0DbgKrnlNtInit: 'ntoskrnl.exe' not found, picking '\WINDOWS\system32\ntkrnlpa.exe' instead IPRT: RTMpPoke => rtMpPokeCpuUsingDpc rtR0DbgKrnlNtInit: 'ntoskrnl.exe' not found, picking '\WINDOWS\system32\ntkrnlpa.exe' instead IPRT: RTMpPoke => rtMpPokeCpuUsingDpc IPRT: RTMpPoke => rtMpPokeCpuUsingDpc vgdrvHeartbeatInit: Setting up heartbeat to trigger every 2000 milliseconds vgdrvNtSetupDevice: Device is ready! rtR0DbgKrnlNtInit: 'ntoskrnl.exe' not found, picking '\WINDOWS\system32\ntkrnlpa.exe' instead IPRT: RTMpPoke => rtMpPokeCpuUsingDpc Breakpoint 18 hit win32k!DxDdStartupDxGraphics: bf804edd 8bff mov edi,edi 1: kd> kb ChildEBP RetAddr Args to Child bad39ce4 bf8050d3 00000000 00000000 00000000 win32k!DxDdStartupDxGraphics bad39d48 bf80661d bad39d64 8088978c 00050000 win32k!InitializeGreCSRSS+0x1b bad39d50 8088978c 00050000 00000074 00000078 win32k!NtUserInitialize+0x66 bad39d50 7c9385ec 00050000 00000074 00000078 nt!KiFastCallEntry+0xfc WARNING: Stack unwind information not available. Following frames may be wrong. 0015fdb0 75973496 00000000 001626d2 001626f5 ntdll+0x285ec 0015fe74 7c939f3d 00160748 00160178 00162778 0x75973496 0015ff78 7597313f 0000000a 001625b0 0016261c ntdll+0x29f3d 0015ff8c 4a6810a7 0000000a 001625b0 001625a4 0x7597313f 0015ffa4 4a68131e 0000000a 001625b0 001625dc 0x4a6810a7 0015fff4 00000000 7ffd7000 000000c8 00000188 0x4a68131e 1: kd> dd esp L7 bad39ce8 bf8050d3 00000000 00000000 00000000 bad39cf8 00000000 00000000 89c6f250 1: kd> x win32k!gpepCSRSS bf9b2a6c win32k!gpepCSRSS = 1: kd> dd win32k!gpepCSRSS bf9b2a6c 89c6f250 00000000 0000c001 0000c032 bf9b2a7c 0000c034 0000c033 c030c031 c02ec02f bf9b2a8c c02cc02d c039c02b c035c038 c001c038 bf9b2a9c c0370000 0000c036 00000000 00000000 bf9b2aac 00000000 00000000 00000000 00000000 bf9b2abc 00000000 00000000 00000000 00000000 bf9b2acc 00000000 00000000 00000000 00000000 bf9b2adc 00000000 00000000 00000000 00000000 1: kd> gu WARNING: Software breakpoints on session addresses can cause bugchecks. Use hardware execution breakpoints (ba e) if possible. Breakpoint 17 hit dxg!DxDdStartupDxGraphics: bf9deeee 8bff mov edi,edi 1: kd> gu WARNING: Software breakpoints on session addresses can cause bugchecks. Use hardware execution breakpoints (ba e) if possible. win32k!DxDdStartupDxGraphics+0x84: bf804f65 8bf0 mov esi,eax 1: kd> gu WARNING: Software breakpoints on session addresses can cause bugchecks. Use hardware execution breakpoints (ba e) if possible. win32k!InitializeGreCSRSS+0x1b: bf8050d3 85c0 test eax,eax 1: kd> dd esp L5 bad39d04 0015fd94 00000000 bad30023 00000023 bad39d14 00000000 1: kd> gu WARNING: Software breakpoints on session addresses can cause bugchecks. Use hardware execution breakpoints (ba e) if possible. win32k!NtUserInitialize+0x66: bf80661d 85c0 test eax,eax 1: kd> r eax eax=00000001