IRQL_NOT_LESS_OR_EQUAL with no driver referenced

Question

I had a Windows Server 2008 R2 crash over the holidays and just got the dump file. When I looked into the dump file, I pulled out the Bug Check code 0x0000000a - IRQL_NOT_LESS_OR_EQUAL. However, looking in BlueScreenView there's no Driver associated with this and I'm puzzling over why this would be.

Looking the bug check up online, it looks like this is reporting accessing memory addresses that are restricted. Am I right in thinking that because of the lack of a driver reference, this means we are seeing something operating without a driver? As in, a very low level process?

analyze it with windbg: https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-15-WinDbg-Bugchecks — magicandre1981, Dec 01 '15 at 18:38
That's going to be a lot of work to set up and use, what's the value in using WinDBG vs. BlueScreenView? What can that give me above and beyond the scraping already being used? — Sean Long, Dec 01 '15 at 18:44
BlueScreenView shows 99.999% crap. Windbg is the ultimate debugger — magicandre1981, Dec 01 '15 at 18:46
if you need help, zip the dmp file, upload the zip to OneDrive/dropbox/GoogleDrive and post a share link here — magicandre1981, Dec 02 '15 at 05:01

score 1 · Accepted Answer · answered Dec 03 '15 at 05:04

Bluescreen view only gives you a high level overview. In order to get in depth you will need to analyze the crash dump using Windows Debugging tools.

Analyzing a crash dump seems difficult, however it's pretty simple. This Technet article goes in depth, but it's really a 4 step process.

Download the Windows Debugging tools from the wizard only instal the WinDbg tool.
Launch the tool and configure the symbol path to use

SRVc:\SymbolsCache=http://msdl.microsoft.com/download/symbols

Open the crash dump / minidump.
Click on the blue link that says "!analyze -v" to get more information about the events leading up to the crash.

IRQL_NOT_LESS_OR_EQUAL with no driver referenced

1 Answers1