Mavi ekran hatası

Murat5038 dedi:

https://download.msi.com/bos_exe/mb/7C52v36.zip

BIOS güncelleyin.

Karıncalanma dediğini mavi ekran sırasında yaşıyorsan normal.
MSI araçlarını, Vanguard, RyzenMaster kaldır.

USB'de şarj ettiğin cihaz varsa çıkart.

Genişletmek için tıkla...

Etandaloth dedi:

RAM'lerde sorun olduğunu düşünüyorum. Memtest86 testini yapın bizimle paylaşın. Onun dışında EasyAntiCheat programını kaldırın. Windows Update yapın. CMD'yi yönetici olarak çalıştırıp sfc /scannow yazıp taratın. Bu işlem biraz uzun süreblir sonuçlarını bekliyorum.

Memtest86 ile Bozuk RAM Testi

Bu rehberimizde Memtes86 ile RAM testi yaparak bozuk RAM modüllerini nasıl tespit edeceğinize bakıyoruz. Bilgisayarda karşılaşılan mavi ekran hataları genelde bozuk RAM kaynaklı oluyor. Bozuk bellek modüllerini tespit etmenin de ... Devamı: Memtest86 ile Bozuk RAM Testi Kaynak Technopat Devamı...

www.technopat.net

Sürprizbozan

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 00005e368acfe7f4, Actual security check cookie from the stack
Arg2: 00005e368a4fe7f4, Expected security check cookie
Arg3: ffffa1c975b0180b, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 3311

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 6571

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: f7

BUGCHECK_P1: 5e368acfe7f4

BUGCHECK_P2: 5e368a4fe7f4

BUGCHECK_P3: ffffa1c975b0180b

BUGCHECK_P4: 0

SECURITY_COOKIE: Expected 00005e368a4fe7f4 found 00005e368acfe7f4

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: SearchIndexer.exe

STACK_TEXT:
fffff28b`560b56e8 fffff801`6d6bd275 : 00000000`000000f7 00005e36`8acfe7f4 00005e36`8a4fe7f4 ffffa1c9`75b0180b : nt!KeBugCheckEx
fffff28b`560b56f0 fffff801`6d42a750 : ffffc50d`d337a340 00000000`00000000 00000000`00000000 00000000`00000000 : nt!_report_gsfailure+0x25
fffff28b`560b5730 fffff801`6d42b6ce : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IoRemoveIoCompletion+0x1b0
fffff28b`560b5860 fffff801`6d5ef878 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffc50d`d3783690 : nt!NtWaitForWorkViaWorkerFactory+0x38e
fffff28b`560b5a90 00007ffd`5f3cf814 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000c5`4d37f758 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`5f3cf814


SYMBOL_NAME: nt!_report_gsfailure+25

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.450

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 25

FAILURE_BUCKET_ID: 0xF7_ONE_BIT_MISSING_GSFRAME_nt!_report_gsfailure

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {8f84f302-dd0e-1f96-6f9c-0ea31ad59f42}

Followup: MachineOwner
---------

Sürprizbozan

UNEXPECTED_STORE_EXCEPTION (154)
The store component caught an unexpected exception.
Arguments:
Arg1: ffff8385aadb3000, Pointer to the store context or data manager
Arg2: ffffcb847f052750, Exception information
Arg3: 0000000000000001, Reserved
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 3155

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 13154

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 154

BUGCHECK_P1: ffff8385aadb3000

BUGCHECK_P2: ffffcb847f052750

BUGCHECK_P3: 1

BUGCHECK_P4: 0

EXCEPTION_RECORD: ffffcb847f0536d8 -- (.exr 0xffffcb847f0536d8)
ExceptionAddress: fffff8076752196c (nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x000000000000006c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000000000ffd0
Attempt to read from address 000000000000ffd0

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 000000000000ffd0

CONTEXT: ffffcb847f052f10 -- (.cxr 0xffffcb847f052f10)
rax=000000000000087c rbx=000000000000000c rcx=0000000000000000
rdx=0000000000001ffa rsi=000000000000054c rdi=0000000000000018
rip=fffff8076752196c rsp=ffffcb847f053910 rbp=ffff8385aadb30d0
r8=0000000000000467 r9=000000000000000d r10=0000000000002ffd
r11=000000000000000a r12=000000000008ce71 r13=0000000000000000
r14=00000000005ffab5 r15=000000000008ce71
iopl=0 nv up ei pl nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050216
nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x6c:
fffff807`6752196c 480304d1 add rax,qword ptr [rcx+rdx*8] ds:002b:00000000`0000ffd0=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: MemCompression

READ_ADDRESS: fffff80767efa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80767e0f2f0: Unable to get Flags value from nt!KdVersionBlock
fffff80767e0f2f0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
000000000000ffd0

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffcb84`7f053910 fffff807`6745f4bd : 00000000`00000002 00000000`00000059 ffff8385`aadb30d0 00000000`0000004a : nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x6c
ffffcb84`7f053930 fffff807`6745f3a3 : 00000000`00000000 00000000`0008ce71 00000000`00000001 00000000`005ffab5 : nt!B_TREE<unsigned long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeNodeFindKey+0x51
ffffcb84`7f053970 fffff807`67527e38 : ffff8385`aadb30e8 ffff8385`aadb30d0 ffff8385`aadb30d0 ffff8385`aadb30a8 : nt!B_TREE<unsigned long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeSearchKey+0x6f
ffffcb84`7f0539c0 fffff807`674e2f60 : 00000000`00000000 ffffcb84`7f053a69 ffff8385`aadb3050 ffff8385`0008ce71 : nt!ST_STORE<SM_TRAITS>::StDmPageRecordRemove+0xc0
ffffcb84`7f053a00 fffff807`674632a2 : 00000000`00000000 ffff8385`ba05b910 00000000`00000000 fffff807`67463193 : nt!ST_STORE<SM_TRAITS>::StDmPageRemove+0x1fc
ffffcb84`7f053ad0 fffff807`674627d2 : ffff8385`aadb3000 ffffcb84`7f053b98 00000000`00000001 ffff8385`a7d670c0 : nt!ST_STORE<SM_TRAITS>::StWorkItemProcess+0xc2
ffffcb84`7f053b20 fffff807`6754fb51 : ffffe380`00000000 ffff8385`00000000 00000000`00000000 00000000`00000000 : nt!SMKM_STORE<SM_TRAITS>::SmStWorker+0x12a
ffffcb84`7f053be0 fffff807`67546745 : ffff8385`aadb3000 fffff807`6754fb40 ffffcb84`7efe93a8 000f8067`b4bbbdff : nt!SMKM_STORE<SM_TRAITS>::SmStWorkerThread+0x11
ffffcb84`7f053c10 fffff807`675e5598 : ffffe380`8319f180 ffff8385`a7d670c0 fffff807`675466f0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffcb84`7f053c60 00000000`00000000 : ffffcb84`7f054000 ffffcb84`7f04e000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+6c

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.450

STACK_COMMAND: .cxr 0xffffcb847f052f10 ; kb

BUCKET_ID_FUNC_OFFSET: 6c

FAILURE_BUCKET_ID: 0x154_c0000005_nt!ST_STORE_SM_TRAITS_::ST_HASH_ENTRY_COMPARATOR::Compare

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {426d4c7c-c7dd-ba6b-033e-e49b31abf05a}

Followup: MachineOwner
---------

Sürprizbozan

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000061941, The subtype of the bugcheck.
Arg2: 00007ffa846370bc
Arg3: 000000000000001d
Arg4: ffff940acc01bb00

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2702

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 3607

Key : Analysis.Memory.CommitPeak.Mb
Value: 74

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 1a

BUGCHECK_P1: 61941

BUGCHECK_P2: 7ffa846370bc

BUGCHECK_P3: 1d

BUGCHECK_P4: ffff940acc01bb00

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: opera.exe

STACK_TEXT:
ffff940a`cc01b958 fffff800`15c02576 : 00000000`0000001a 00000000`00061941 00007ffa`846370bc 00000000`0000001d : nt!KeBugCheckEx
ffff940a`cc01b960 fffff800`15bec01e : 000001b0`ddab36e0 ffff940a`cc01bb80 000001b0`db098cc0 ffffffff`ff676980 : nt!MmAccessFault+0x1efc76
ffff940a`cc01bb00 00007ffa`846370bc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
00000007`faffe778 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`846370bc


MODULE_NAME: hardware

IMAGE_NAME: hardware_ram

STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0x1a_61941_PAGE_TABLE_RESERVED_BITS_SET_IMAGE_hardware_ram

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c6e5c6cf-692e-7852-5dc5-b74944540fc0}

Followup: MachineOwner
---------

Sürprizbozan: EasyAntiCheat

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff806452e936e, The address that the exception occurred at
Arg3: ffff858329579018, Exception Record Address
Arg4: ffff858329578850, Context Record Address

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for EasyAntiCheat.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : AV.Dereference
Value: NullClassPtr

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 3561

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 23327

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff806452e936e

BUGCHECK_P3: ffff858329579018

BUGCHECK_P4: ffff858329578850

EXCEPTION_RECORD: ffff858329579018 -- (.exr 0xffff858329579018)
ExceptionAddress: fffff806452e936e (nt!ObpCaptureHandleInformation+0x00000000000000ae)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000028
Attempt to read from address 0000000000000028

CONTEXT: ffff858329578850 -- (.cxr 0xffff858329578850)
rax=0000000000000000 rbx=ffffa4864fcfe910 rcx=ffff8d81a94d5170
rdx=ffffa4865092f5a0 rsi=ffffa4864fcfe910 rdi=0000000000000644
rip=fffff806452e936e rsp=ffff858329579258 rbp=ffffa4864eeef600
r8=0000000000000000 r9=ffffa4865092f570 r10=0000000000076178
r11=ffff8583295792a0 r12=ffff8d81a945f010 r13=ffff858329579338
r14=fffff806452e92c0 r15=0000000000080000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
nt!ObpCaptureHandleInformation+0xae:
fffff806`452e936e 8a4028 mov al,byte ptr [rax+28h] ds:002b:00000000`00000028=??
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

READ_ADDRESS: fffff806456fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8064560f2f0: Unable to get Flags value from nt!KdVersionBlock
fffff8064560f2f0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000000000028

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000028

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffff8583`29579258 fffff806`45359121 : 00000000`00000644 00000000`00000000 ffffde0c`00000000 fffff806`44cc9dc2 : nt!ObpCaptureHandleInformation+0xae
ffff8583`29579260 fffff806`452e9245 : fffff806`452e92c0 ffffa486`4eeef618 00000000`00080000 ffff8583`295793a4 : nt!ExpSnapShotHandleTables+0x131
ffff8583`295792f0 fffff806`453568b1 : ffff8583`295793a4 00000000`00076178 00000000`00080000 00000000`00000000 : nt!ObGetHandleInformation+0x39
ffff8583`29579330 fffff806`451e460a : ffffde0c`4f590010 00000000`00000000 ffff8d81`a945f010 ffffde0c`513cb560 : nt!ExpGetHandleInformation+0x5d
ffff8583`29579370 fffff806`44ffba47 : ffffde0c`525f2500 fffff806`435301ed ffffde0c`525f2500 00000000`00000000 : nt!ExpQuerySystemInformation+0x1e8a7a
ffff8583`29579a30 fffff806`43543f47 : fffff806`44ff0000 00000000`00000000 00000000`00080000 00000000`00080010 : nt!NtQuerySystemInformation+0x37
ffff8583`29579a70 fffff806`44ff0000 : 00000000`00000000 00000000`00080000 00000000`00080010 ffffde0c`42469040 : EasyAntiCheat+0x23f47
ffff8583`29579a78 00000000`00000000 : 80000000`00000004 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCopyVirtualMemory+0x800


SYMBOL_NAME: EasyAntiCheat+23f47

MODULE_NAME: EasyAntiCheat

IMAGE_NAME: EasyAntiCheat.sys

STACK_COMMAND: .cxr 0xffff858329578850 ; kb

BUCKET_ID_FUNC_OFFSET: 23f47

FAILURE_BUCKET_ID: AV_EasyAntiCheat!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {b4c0fbf5-e9c2-7752-9e19-fdc24f57a9df}

Followup: MachineOwner
---------

Sürprizbozan

UNEXPECTED_STORE_EXCEPTION (154)
The store component caught an unexpected exception.
Arguments:
Arg1: ffff92013ce39000, Pointer to the store context or data manager
Arg2: ffffa7821e452750, Exception information
Arg3: 0000000000000001, Reserved
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 2952

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 8137

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 154

BUGCHECK_P1: ffff92013ce39000

BUGCHECK_P2: ffffa7821e452750

BUGCHECK_P3: 1

BUGCHECK_P4: 0

EXCEPTION_RECORD: ffffa7821e4536d8 -- (.exr 0xffffa7821e4536d8)
ExceptionAddress: fffff8074fb2196c (nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x000000000000006c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000006e50
Attempt to read from address 0000000000006e50

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000006e50

CONTEXT: ffffa7821e452f10 -- (.cxr 0xffffa7821e452f10)
rax=000000000000027c rbx=000000000000000c rcx=0000000000000000
rdx=0000000000000dca rsi=0000000000000168 rdi=0000000000000018
rip=fffff8074fb2196c rsp=ffffa7821e453910 rbp=ffff92013ce390d0
r8=000000000000015d r9=000000000000000d r10=00000000000026e5
r11=0000000000000008 r12=000000000002ba1e r13=0000000000000000
r14=00000000004dca35 r15=000000000002ba1e
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00050206
nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x6c:
fffff807`4fb2196c 480304d1 add rax,qword ptr [rcx+rdx*8] ds:002b:00000000`00006e50=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: MemCompression

READ_ADDRESS: fffff807504fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8075040f2f0: Unable to get Flags value from nt!KdVersionBlock
fffff8075040f2f0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000000006e50

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffa782`1e453910 fffff807`4fa5f4bd : 00000000`00000002 00000000`00000251 ffff9201`3ce390d0 00000000`0000023b : nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x6c
ffffa782`1e453930 fffff807`4fa5f3a3 : 00000000`00000000 00000000`0002ba1e 00000000`00000001 00000000`004dca35 : nt!B_TREE<unsigned long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeNodeFindKey+0x51
ffffa782`1e453970 fffff807`4fb27e38 : ffff9201`3ce390e8 ffff9201`3ce390d0 ffff9201`3ce390d0 ffff9201`3ce390a8 : nt!B_TREE<unsigned long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeSearchKey+0x6f
ffffa782`1e4539c0 fffff807`4fae2f60 : 00000000`00000000 ffffa782`1e453a69 ffff9201`3ce39050 ffff9201`0002ba1e : nt!ST_STORE<SM_TRAITS>::StDmPageRecordRemove+0xc0
ffffa782`1e453a00 fffff807`4fa632a2 : 00000000`00000000 ffff9201`46041550 00000000`00000000 fffff807`4fa63193 : nt!ST_STORE<SM_TRAITS>::StDmPageRemove+0x1fc
ffffa782`1e453ad0 fffff807`4fa627d2 : ffff9201`3ce39000 ffffa782`1e453b98 00000000`00000001 ffff9201`3b6770c0 : nt!ST_STORE<SM_TRAITS>::StWorkItemProcess+0xc2
ffffa782`1e453b20 fffff807`4fb4fb51 : fffff807`00000000 ffff9201`00000000 00000000`00000000 00000000`00000000 : nt!SMKM_STORE<SM_TRAITS>::SmStWorker+0x12a
ffffa782`1e453be0 fffff807`4fb46745 : ffff9201`3ce39000 fffff807`4fb4fb40 ffffa782`1e3db3a8 000f8067`b4bbbdff : nt!SMKM_STORE<SM_TRAITS>::SmStWorkerThread+0x11
ffffa782`1e453c10 fffff807`4fbe5598 : fffff807`4cfc9180 ffff9201`3b6770c0 fffff807`4fb466f0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffa782`1e453c60 00000000`00000000 : ffffa782`1e454000 ffffa782`1e44e000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+6c

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.450

STACK_COMMAND: .cxr 0xffffa7821e452f10 ; kb

BUCKET_ID_FUNC_OFFSET: 6c

FAILURE_BUCKET_ID: 0x154_c0000005_nt!ST_STORE_SM_TRAITS_::ST_HASH_ENTRY_COMPARATOR::Compare

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {426d4c7c-c7dd-ba6b-033e-e49b31abf05a}

Followup: MachineOwner
---------

Genişletmek için tıkla...

Etandaloth dedi:

RAM'lerde sorun olduğunu düşünüyorum. Memtest86 testini yapın bizimle paylaşın. Onun dışında EasyAntiCheat programını kaldırın. Windows Update yapın. CMD'yi yönetici olarak çalıştırıp sfc /scannow yazıp taratın. Bu işlem biraz uzun süreblir sonuçlarını bekliyorum.

Memtest86 ile Bozuk RAM Testi

Bu rehberimizde Memtes86 ile RAM testi yaparak bozuk RAM modüllerini nasıl tespit edeceğinize bakıyoruz. Bilgisayarda karşılaşılan mavi ekran hataları genelde bozuk RAM kaynaklı oluyor. Bozuk bellek modüllerini tespit etmenin de ... Devamı: Memtest86 ile Bozuk RAM Testi Kaynak Technopat Devamı...

www.technopat.net

Sürprizbozan

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 00005e368acfe7f4, Actual security check cookie from the stack
Arg2: 00005e368a4fe7f4, Expected security check cookie
Arg3: ffffa1c975b0180b, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 3311

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 6571

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: f7

BUGCHECK_P1: 5e368acfe7f4

BUGCHECK_P2: 5e368a4fe7f4

BUGCHECK_P3: ffffa1c975b0180b

BUGCHECK_P4: 0

SECURITY_COOKIE: Expected 00005e368a4fe7f4 found 00005e368acfe7f4

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: SearchIndexer.exe

STACK_TEXT:
fffff28b`560b56e8 fffff801`6d6bd275 : 00000000`000000f7 00005e36`8acfe7f4 00005e36`8a4fe7f4 ffffa1c9`75b0180b : nt!KeBugCheckEx
fffff28b`560b56f0 fffff801`6d42a750 : ffffc50d`d337a340 00000000`00000000 00000000`00000000 00000000`00000000 : nt!_report_gsfailure+0x25
fffff28b`560b5730 fffff801`6d42b6ce : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IoRemoveIoCompletion+0x1b0
fffff28b`560b5860 fffff801`6d5ef878 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffc50d`d3783690 : nt!NtWaitForWorkViaWorkerFactory+0x38e
fffff28b`560b5a90 00007ffd`5f3cf814 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000c5`4d37f758 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`5f3cf814


SYMBOL_NAME: nt!_report_gsfailure+25

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.450

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 25

FAILURE_BUCKET_ID: 0xF7_ONE_BIT_MISSING_GSFRAME_nt!_report_gsfailure

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {8f84f302-dd0e-1f96-6f9c-0ea31ad59f42}

Followup: MachineOwner
---------

Sürprizbozan

UNEXPECTED_STORE_EXCEPTION (154)
The store component caught an unexpected exception.
Arguments:
Arg1: ffff8385aadb3000, Pointer to the store context or data manager
Arg2: ffffcb847f052750, Exception information
Arg3: 0000000000000001, Reserved
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 3155

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 13154

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 154

BUGCHECK_P1: ffff8385aadb3000

BUGCHECK_P2: ffffcb847f052750

BUGCHECK_P3: 1

BUGCHECK_P4: 0

EXCEPTION_RECORD: ffffcb847f0536d8 -- (.exr 0xffffcb847f0536d8)
ExceptionAddress: fffff8076752196c (nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x000000000000006c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000000000ffd0
Attempt to read from address 000000000000ffd0

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 000000000000ffd0

CONTEXT: ffffcb847f052f10 -- (.cxr 0xffffcb847f052f10)
rax=000000000000087c rbx=000000000000000c rcx=0000000000000000
rdx=0000000000001ffa rsi=000000000000054c rdi=0000000000000018
rip=fffff8076752196c rsp=ffffcb847f053910 rbp=ffff8385aadb30d0
r8=0000000000000467 r9=000000000000000d r10=0000000000002ffd
r11=000000000000000a r12=000000000008ce71 r13=0000000000000000
r14=00000000005ffab5 r15=000000000008ce71
iopl=0 nv up ei pl nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050216
nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x6c:
fffff807`6752196c 480304d1 add rax,qword ptr [rcx+rdx*8] ds:002b:00000000`0000ffd0=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: MemCompression

READ_ADDRESS: fffff80767efa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80767e0f2f0: Unable to get Flags value from nt!KdVersionBlock
fffff80767e0f2f0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
000000000000ffd0

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffcb84`7f053910 fffff807`6745f4bd : 00000000`00000002 00000000`00000059 ffff8385`aadb30d0 00000000`0000004a : nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x6c
ffffcb84`7f053930 fffff807`6745f3a3 : 00000000`00000000 00000000`0008ce71 00000000`00000001 00000000`005ffab5 : nt!B_TREE<unsigned long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeNodeFindKey+0x51
ffffcb84`7f053970 fffff807`67527e38 : ffff8385`aadb30e8 ffff8385`aadb30d0 ffff8385`aadb30d0 ffff8385`aadb30a8 : nt!B_TREE<unsigned long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeSearchKey+0x6f
ffffcb84`7f0539c0 fffff807`674e2f60 : 00000000`00000000 ffffcb84`7f053a69 ffff8385`aadb3050 ffff8385`0008ce71 : nt!ST_STORE<SM_TRAITS>::StDmPageRecordRemove+0xc0
ffffcb84`7f053a00 fffff807`674632a2 : 00000000`00000000 ffff8385`ba05b910 00000000`00000000 fffff807`67463193 : nt!ST_STORE<SM_TRAITS>::StDmPageRemove+0x1fc
ffffcb84`7f053ad0 fffff807`674627d2 : ffff8385`aadb3000 ffffcb84`7f053b98 00000000`00000001 ffff8385`a7d670c0 : nt!ST_STORE<SM_TRAITS>::StWorkItemProcess+0xc2
ffffcb84`7f053b20 fffff807`6754fb51 : ffffe380`00000000 ffff8385`00000000 00000000`00000000 00000000`00000000 : nt!SMKM_STORE<SM_TRAITS>::SmStWorker+0x12a
ffffcb84`7f053be0 fffff807`67546745 : ffff8385`aadb3000 fffff807`6754fb40 ffffcb84`7efe93a8 000f8067`b4bbbdff : nt!SMKM_STORE<SM_TRAITS>::SmStWorkerThread+0x11
ffffcb84`7f053c10 fffff807`675e5598 : ffffe380`8319f180 ffff8385`a7d670c0 fffff807`675466f0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffcb84`7f053c60 00000000`00000000 : ffffcb84`7f054000 ffffcb84`7f04e000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+6c

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.450

STACK_COMMAND: .cxr 0xffffcb847f052f10 ; kb

BUCKET_ID_FUNC_OFFSET: 6c

FAILURE_BUCKET_ID: 0x154_c0000005_nt!ST_STORE_SM_TRAITS_::ST_HASH_ENTRY_COMPARATOR::Compare

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {426d4c7c-c7dd-ba6b-033e-e49b31abf05a}

Followup: MachineOwner
---------

Sürprizbozan

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000061941, The subtype of the bugcheck.
Arg2: 00007ffa846370bc
Arg3: 000000000000001d
Arg4: ffff940acc01bb00

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2702

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 3607

Key : Analysis.Memory.CommitPeak.Mb
Value: 74

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 1a

BUGCHECK_P1: 61941

BUGCHECK_P2: 7ffa846370bc

BUGCHECK_P3: 1d

BUGCHECK_P4: ffff940acc01bb00

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: opera.exe

STACK_TEXT:
ffff940a`cc01b958 fffff800`15c02576 : 00000000`0000001a 00000000`00061941 00007ffa`846370bc 00000000`0000001d : nt!KeBugCheckEx
ffff940a`cc01b960 fffff800`15bec01e : 000001b0`ddab36e0 ffff940a`cc01bb80 000001b0`db098cc0 ffffffff`ff676980 : nt!MmAccessFault+0x1efc76
ffff940a`cc01bb00 00007ffa`846370bc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
00000007`faffe778 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`846370bc


MODULE_NAME: hardware

IMAGE_NAME: hardware_ram

STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0x1a_61941_PAGE_TABLE_RESERVED_BITS_SET_IMAGE_hardware_ram

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c6e5c6cf-692e-7852-5dc5-b74944540fc0}

Followup: MachineOwner
---------

Sürprizbozan: EasyAntiCheat

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff806452e936e, The address that the exception occurred at
Arg3: ffff858329579018, Exception Record Address
Arg4: ffff858329578850, Context Record Address

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for EasyAntiCheat.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : AV.Dereference
Value: NullClassPtr

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 3561

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 23327

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff806452e936e

BUGCHECK_P3: ffff858329579018

BUGCHECK_P4: ffff858329578850

EXCEPTION_RECORD: ffff858329579018 -- (.exr 0xffff858329579018)
ExceptionAddress: fffff806452e936e (nt!ObpCaptureHandleInformation+0x00000000000000ae)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000028
Attempt to read from address 0000000000000028

CONTEXT: ffff858329578850 -- (.cxr 0xffff858329578850)
rax=0000000000000000 rbx=ffffa4864fcfe910 rcx=ffff8d81a94d5170
rdx=ffffa4865092f5a0 rsi=ffffa4864fcfe910 rdi=0000000000000644
rip=fffff806452e936e rsp=ffff858329579258 rbp=ffffa4864eeef600
r8=0000000000000000 r9=ffffa4865092f570 r10=0000000000076178
r11=ffff8583295792a0 r12=ffff8d81a945f010 r13=ffff858329579338
r14=fffff806452e92c0 r15=0000000000080000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
nt!ObpCaptureHandleInformation+0xae:
fffff806`452e936e 8a4028 mov al,byte ptr [rax+28h] ds:002b:00000000`00000028=??
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

READ_ADDRESS: fffff806456fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8064560f2f0: Unable to get Flags value from nt!KdVersionBlock
fffff8064560f2f0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000000000028

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000028

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffff8583`29579258 fffff806`45359121 : 00000000`00000644 00000000`00000000 ffffde0c`00000000 fffff806`44cc9dc2 : nt!ObpCaptureHandleInformation+0xae
ffff8583`29579260 fffff806`452e9245 : fffff806`452e92c0 ffffa486`4eeef618 00000000`00080000 ffff8583`295793a4 : nt!ExpSnapShotHandleTables+0x131
ffff8583`295792f0 fffff806`453568b1 : ffff8583`295793a4 00000000`00076178 00000000`00080000 00000000`00000000 : nt!ObGetHandleInformation+0x39
ffff8583`29579330 fffff806`451e460a : ffffde0c`4f590010 00000000`00000000 ffff8d81`a945f010 ffffde0c`513cb560 : nt!ExpGetHandleInformation+0x5d
ffff8583`29579370 fffff806`44ffba47 : ffffde0c`525f2500 fffff806`435301ed ffffde0c`525f2500 00000000`00000000 : nt!ExpQuerySystemInformation+0x1e8a7a
ffff8583`29579a30 fffff806`43543f47 : fffff806`44ff0000 00000000`00000000 00000000`00080000 00000000`00080010 : nt!NtQuerySystemInformation+0x37
ffff8583`29579a70 fffff806`44ff0000 : 00000000`00000000 00000000`00080000 00000000`00080010 ffffde0c`42469040 : EasyAntiCheat+0x23f47
ffff8583`29579a78 00000000`00000000 : 80000000`00000004 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCopyVirtualMemory+0x800


SYMBOL_NAME: EasyAntiCheat+23f47

MODULE_NAME: EasyAntiCheat

IMAGE_NAME: EasyAntiCheat.sys

STACK_COMMAND: .cxr 0xffff858329578850 ; kb

BUCKET_ID_FUNC_OFFSET: 23f47

FAILURE_BUCKET_ID: AV_EasyAntiCheat!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {b4c0fbf5-e9c2-7752-9e19-fdc24f57a9df}

Followup: MachineOwner
---------

Sürprizbozan

UNEXPECTED_STORE_EXCEPTION (154)
The store component caught an unexpected exception.
Arguments:
Arg1: ffff92013ce39000, Pointer to the store context or data manager
Arg2: ffffa7821e452750, Exception information
Arg3: 0000000000000001, Reserved
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 2952

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-5DL7M86

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 8137

Key : Analysis.Memory.CommitPeak.Mb
Value: 76

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 154

BUGCHECK_P1: ffff92013ce39000

BUGCHECK_P2: ffffa7821e452750

BUGCHECK_P3: 1

BUGCHECK_P4: 0

EXCEPTION_RECORD: ffffa7821e4536d8 -- (.exr 0xffffa7821e4536d8)
ExceptionAddress: fffff8074fb2196c (nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x000000000000006c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000006e50
Attempt to read from address 0000000000006e50

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000006e50

CONTEXT: ffffa7821e452f10 -- (.cxr 0xffffa7821e452f10)
rax=000000000000027c rbx=000000000000000c rcx=0000000000000000
rdx=0000000000000dca rsi=0000000000000168 rdi=0000000000000018
rip=fffff8074fb2196c rsp=ffffa7821e453910 rbp=ffff92013ce390d0
r8=000000000000015d r9=000000000000000d r10=00000000000026e5
r11=0000000000000008 r12=000000000002ba1e r13=0000000000000000
r14=00000000004dca35 r15=000000000002ba1e
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00050206
nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x6c:
fffff807`4fb2196c 480304d1 add rax,qword ptr [rcx+rdx*8] ds:002b:00000000`00006e50=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: MemCompression

READ_ADDRESS: fffff807504fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8075040f2f0: Unable to get Flags value from nt!KdVersionBlock
fffff8075040f2f0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000000006e50

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffa782`1e453910 fffff807`4fa5f4bd : 00000000`00000002 00000000`00000251 ffff9201`3ce390d0 00000000`0000023b : nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+0x6c
ffffa782`1e453930 fffff807`4fa5f3a3 : 00000000`00000000 00000000`0002ba1e 00000000`00000001 00000000`004dca35 : nt!B_TREE<unsigned long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeNodeFindKey+0x51
ffffa782`1e453970 fffff807`4fb27e38 : ffff9201`3ce390e8 ffff9201`3ce390d0 ffff9201`3ce390d0 ffff9201`3ce390a8 : nt!B_TREE<unsigned long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeSearchKey+0x6f
ffffa782`1e4539c0 fffff807`4fae2f60 : 00000000`00000000 ffffa782`1e453a69 ffff9201`3ce39050 ffff9201`0002ba1e : nt!ST_STORE<SM_TRAITS>::StDmPageRecordRemove+0xc0
ffffa782`1e453a00 fffff807`4fa632a2 : 00000000`00000000 ffff9201`46041550 00000000`00000000 fffff807`4fa63193 : nt!ST_STORE<SM_TRAITS>::StDmPageRemove+0x1fc
ffffa782`1e453ad0 fffff807`4fa627d2 : ffff9201`3ce39000 ffffa782`1e453b98 00000000`00000001 ffff9201`3b6770c0 : nt!ST_STORE<SM_TRAITS>::StWorkItemProcess+0xc2
ffffa782`1e453b20 fffff807`4fb4fb51 : fffff807`00000000 ffff9201`00000000 00000000`00000000 00000000`00000000 : nt!SMKM_STORE<SM_TRAITS>::SmStWorker+0x12a
ffffa782`1e453be0 fffff807`4fb46745 : ffff9201`3ce39000 fffff807`4fb4fb40 ffffa782`1e3db3a8 000f8067`b4bbbdff : nt!SMKM_STORE<SM_TRAITS>::SmStWorkerThread+0x11
ffffa782`1e453c10 fffff807`4fbe5598 : fffff807`4cfc9180 ffff9201`3b6770c0 fffff807`4fb466f0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffa782`1e453c60 00000000`00000000 : ffffa782`1e454000 ffffa782`1e44e000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME: nt!ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR::Compare+6c

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.450

STACK_COMMAND: .cxr 0xffffa7821e452f10 ; kb

BUCKET_ID_FUNC_OFFSET: 6c

FAILURE_BUCKET_ID: 0x154_c0000005_nt!ST_STORE_SM_TRAITS_::ST_HASH_ENTRY_COMPARATOR::Compare

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {426d4c7c-c7dd-ba6b-033e-e49b31abf05a}

Followup: MachineOwner
---------

Genişletmek için tıkla...