10: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 0000000080000003, Exception code that caused the BugCheck
Arg2: fffff8012f8643fc, Address of the instruction which caused the BugCheck
Arg3: ffffb48532d763b0, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4843
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 7273
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 358
Key : Analysis.Init.Elapsed.mSec
Value: 1754
Key : Analysis.Memory.CommitPeak.Mb
Value: 99
Key : Bugcheck.Code.DumpHeader
Value: 0x3b
Key : Bugcheck.Code.Register
Value: 0x3b
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 050423-6515-01.dmp
BUGCHECK_CODE: 3b
BUGCHECK_P1: 80000003
BUGCHECK_P2: fffff8012f8643fc
BUGCHECK_P3: ffffb48532d763b0
BUGCHECK_P4: 0
CONTEXT: ffffb48532d763b0 -- (.cxr 0xffffb48532d763b0)
rax=0000000000000004 rbx=ffffb48532d77680 rcx=ffffb48532d77660
rdx=0000000000000000 rsi=0000000000000702 rdi=0000000000000000
rip=fffff8012f8643fc rsp=ffffb48532d76db8 rbp=0000000000000702
r8=0000000000000020 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000001 r13=ffffb48532d774a0
r14=ffffb48532d77400 r15=ffffb48532d77428
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040202
Ntfs!memcpy+0x2bc:
fffff801`2f8643fc cc int 3
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: WerFault.exe
STACK_TEXT:
ffffb485`32d76db8 fffff801`2f83b0d6 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffcd0a`1bf4de08 : Ntfs!memcpy+0x2bc
ffffb485`32d76dc0 fffff801`2f83ace4 : 00000000`00000000 00000000`00000001 ffffb485`32d77400 fffff801`2f83c220 : Ntfs!NtfsCleanupIrpContext+0x2b6
ffffb485`32d76e20 fffff801`2f97cf03 : 00000000`00000000 ffffcd0a`1bf4da20 00000000`0000ffff 00000000`00000000 : Ntfs!NtfsExtendedCompleteRequestInternal+0x134
ffffb485`32d76e80 fffff801`2f92b4eb : ffffb485`32d77400 00000000`00000000 ffffa30c`1782ba01 ffffb485`32d77400 : Ntfs!NtfsCompleteCleanupRequest+0x53
ffffb485`32d76ec0 fffff801`2f91b9bd : 00000000`00000000 00000000`00000000 00000000`00000000 ffffb485`32d773d0 : Ntfs!NtfsCommonCleanup+0x5b8b
ffffb485`32d77360 fffff801`2ac11385 : ffffcd0a`208ee010 ffffb485`32d77780 ffffcd0a`1bf4da20 ffffcd0a`0be17d60 : Ntfs!NtfsFsdCleanup+0x1bd
ffffb485`32d776b0 fffff801`2967710f : 00000000`00000005 ffffb485`32d77760 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
ffffb485`32d776f0 fffff801`29674a43 : ffffb485`32d77780 00000000`00000000 00000000`00000000 ffffcd0a`1cda20c0 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffffb485`32d77760 fffff801`2ac11385 : ffffcd0a`202d1ee0 fffff801`2ac1124d 00000000`00040282 fffff801`48f16332 : FLTMGR!FltpDispatch+0xa3
ffffb485`32d777c0 fffff801`2b00e827 : 00000000`00000001 ffffcd0a`202d1ee0 00000000`00000000 00000000`000c0002 : nt!IofCallDriver+0x55
ffffb485`32d77800 fffff801`2b0165ff : ffffcd0a`1cda20c0 00000000`00000001 ffffa30c`00000000 ffffcd0a`202d1eb0 : nt!IopCloseFile+0x177
ffffb485`32d77890 fffff801`2b01176c : 00000000`0000032c ffffd20a`6c77e1b7 ffffcd0a`20d83080 fffff801`2ae0fb78 : nt!ObCloseHandleTableEntry+0x51f
ffffb485`32d779d0 fffff801`2ae0fb9a : ffffcd0a`20d83000 000001d2`9cd10000 ffffb485`32d77ac0 00000000`00008001 : nt!NtClose+0xec
ffffb485`32d77a40 00007ffc`37a0d244 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x3ef
00000024`e0b37908 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`37a0d244
SYMBOL_NAME: Ntfs!memcpy+2bc
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
IMAGE_VERSION: 10.0.19041.1223
STACK_COMMAND: .cxr 0xffffb48532d763b0 ; kb
BUCKET_ID_FUNC_OFFSET: 2bc
FAILURE_BUCKET_ID: 0x3B_80000003_Ntfs!memcpy
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5d7226bf-ac1c-6ab6-5de2-c70fced230b1}
Followup: MachineOwner
---------
10: kd> !sysinfo machineid
Machine ID Information [From Smbios 3.5, DMIVersion 0, Size=5209]
BiosMajorRelease = 5
BiosMinorRelease = 27
BiosVendor = American Megatrends International, LLC.
BiosVersion = A.30
BiosReleaseDate = 01/06/2023
SystemManufacturer = Micro-Star International Co., Ltd.
SystemProductName = MS-7E07
SystemFamily = Default string
SystemVersion = 2.0
SystemSKU = Default string
BaseBoardManufacturer = Micro-Star International Co., Ltd.
BaseBoardProduct = PRO Z790-A WIFI (MS-7E07)
BaseBoardVersion = 2.0
----------
10: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffc784e3f85001, Virtual address for the attempted execute.
Arg2: 8a00000132c009e3, PTE contents.
Arg3: ffff9a8c410a4ce0, (reserved)
Arg4: 0000000000000003, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for Netwtw10.sys
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4406
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 7876
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 343
Key : Analysis.Init.Elapsed.mSec
Value: 2217
Key : Analysis.Memory.CommitPeak.Mb
Value: 88
Key : Bugcheck.Code.DumpHeader
Value: 0xfc
Key : Bugcheck.Code.Register
Value: 0xfc
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 050523-6625-01.dmp
BUGCHECK_CODE: fc
BUGCHECK_P1: ffffc784e3f85001
BUGCHECK_P2: 8a00000132c009e3
BUGCHECK_P3: ffff9a8c410a4ce0
BUGCHECK_P4: 3
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff9a8c410a4ce0 -- (.trap 0xffff9a8c410a4ce0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffc784d291dc70
rdx=ffff9a8c410a4ea0 rsi=0000000000000000 rdi=0000000000000000
rip=ffffc784e3f85001 rsp=ffff9a8c410a4e78 rbp=0000000000000028
r8=ffff9a8c410a4ee0 r9=ffff9a8c410a4ee8 r10=000000000000003f
r11=ffffc784e34b0f3a r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ffffc784`e3f85001 005802 add byte ptr [rax+2],bl ds:00000000`00000002=??
Resetting default scope
STACK_TEXT:
ffff9a8c`410a4aa8 fffff800`248773e6 : 00000000`000000fc ffffc784`e3f85001 8a000001`32c009e3 ffff9a8c`410a4ce0 : nt!KeBugCheckEx
ffff9a8c`410a4ab0 fffff800`2486a12d : 00000000`00000011 00000000`00000003 00000000`00000000 ffff9a8c`410a4c00 : nt!MiCheckSystemNxFault+0x150bda
ffff9a8c`410a4af0 fffff800`2466e89f : ffff9a8c`410a4cd0 00000000`00000011 ffff9a8c`410a4d60 00000000`00000000 : nt!MiRaisedIrqlFault+0x163eb5
ffff9a8c`410a4b40 fffff800`2480b7d8 : 00000000`00000000 fffff800`40904cf8 ffff9a8c`410a4ef0 ffff9a8c`410a4d61 : nt!MmAccessFault+0x4ef
ffff9a8c`410a4ce0 ffffc784`e3f85001 : fffff800`40ae82bd 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x358
ffff9a8c`410a4e78 fffff800`40ae82bd : 00000000`00000001 00000000`00000000 00000000`00000000 ffffc784`e67d6172 : 0xffffc784`e3f85001
ffff9a8c`410a4e80 00000000`00000001 : 00000000`00000000 00000000`00000000 ffffc784`e67d6172 618a0020`00000800 : Netwtw10+0x3282bd
ffff9a8c`410a4e88 00000000`00000000 : 00000000`00000000 ffffc784`e67d6172 618a0020`00000800 ffffffed`b79e0773 : 0x1
SYMBOL_NAME: Netwtw10+3282bd
MODULE_NAME: Netwtw10
IMAGE_NAME: Netwtw10.sys
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 3282bd
FAILURE_BUCKET_ID: 0xFC_Netwtw10!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {194ddea0-6fa8-c325-1246-7d2d9a520ede}
Followup: MachineOwner
---------
10: kd> lmvm Netwtw10
Browse full module list
start end module name
fffff800`407c0000 fffff800`40d11000 Netwtw10 T (no symbols)
Loaded symbol image file: Netwtw10.sys
Image path: \SystemRoot\System32\DriverStore\FileRepository\netwtw6e.inf_amd64_05bb65221939f713\Netwtw10.sys
Image name: Netwtw10.sys
Browse all global symbols functions data
Timestamp: Tue Oct 18 18:55:11 2022 (634ECC5F)
CheckSum: 004E4BFB
ImageSize: 00551000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
drive.google.com
