Saturday, February 26, 2011

The case of the flash crash

One of my favorite things to do is to watch Leo Laporte’s TWiT network. On the website they offer a live feed which is great to tune into. The feed however requires Adobe flash to view the feed. When I tried to checkout the show on my work laptop, it would immediately BSOD my HP 8510p laptop running Windows XP SP3 x86. Unfortunately this would happen EVERY time I tried to view the show. Being a fan of Mark Russinovich’s ‘the case of’ blog series I thought I'd share how I identified the cause of the BSOD and ultimately how I fixed it.

To analyze the crash I had to install WinDbg which is installed with the Windows SDK. I downloaded the Windows 7 SDK and installed WinDbg . Before I installed WinDbg I needed to set my system crash dump settings to a create a full dump. On the System Properties applet select Advanced tab > Start and Recovery Settings > Kernel memory dump.

2011-02-26 13h14_50
2011-02-26 13h12_36 
2011-02-26 13h13_35
After configuring my crash dump I forced a crash by trying to view TWiT again, BOOM > BSOD.

Now I was ready to reboot and open the MEMORY.DMP file in WinDbg . The one thing you’ll need to do in WinDbg is setup the symbol server.
2011-02-26 13h25_22 

Opening the crash dump showed me:

Probably caused by : ativvaxx.dll ( ativvaxx!vMMDLLInitFuncs+51a9 )

Ah ha! An ATI driver:
0: kd> lmvm ativvaxx
start    end        module name
bf400000 bf573100   ativvaxx   (export symbols)       ativvaxx.dll
    Loaded symbol image file: ativvaxx.dll
    Image path: \SystemRoot\System32\ativvaxx.dll
    Image name: ativvaxx.dll
    Timestamp:        Tue Jan 29 21:49:52 2008 (479FE5D0)
    CheckSum:         0017A815
    ImageSize:        00173100
    File version:
    Product version:
    File flags:       0 (Mask 0)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04e4
    CompanyName:      ATI Technologies Inc.
    ProductName:      ATI Technologies Inc. Radeon Video Acceleration Universal Driver
    InternalName:     ativvaxx.dll
    OriginalFilename: ativvaxx.dll
    PrivateBuild:     Built by swtools on CNABAE04 on 01/29/08 at 21:49
    SpecialBuild:     DevStudio Build
    FileDescription:  Radeon Video Acceleration Universal Driver
    LegalCopyright:   Copyright (C) 1998-2005 ATI Technologies Inc.
    LegalTrademarks:  Radeon (TM) is a Trademark of ATI Technologies Inc.

After I identified the cause I decided to update my video card drivers. So I went over to HP’s website and downloaded the latest ATI video card drivers and installed them.

After rebooting, the version of ativvaxx.dll changed from to and viola opening the Flash TWiT live feed player did not crash my computer anymore! Now back to watching TWiT :-)