*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000038, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff804111637ba, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2874
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 21204
Key : Analysis.Init.CPU.mSec
Value: 1375
Key : Analysis.Init.Elapsed.mSec
Value: 8913
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
BUGCHECK_CODE: a
BUGCHECK_P1: 38
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff804111637ba
READ_ADDRESS: fffff804115713b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000038
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: GameBar.exe
TRAP_FRAME: fffffa07df3e2560 -- (.trap 0xfffffa07df3e2560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000001000002000 rbx=0000000000000000 rcx=0000000000084a00
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff804111637ba rsp=fffffa07df3e26f0 rbp=fffffa07df3e27a9
r8=fffffa07df3e2758 r9=ffffb88353e8b001 r10=ffffb8837482e8b0
r11=0000000fffffffff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po nc
nt!MiResolvePageFileFault+0x9d2:
fffff804`111637ba 488b4238 mov rax,qword ptr [rdx+38h] ds:00000000`00000038=????????????????
Resetting default scope
STACK_TEXT:
fffffa07`df3e2418 fffff804`111d5929 : 00000000`0000000a 00000000`00000038 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffa07`df3e2420 fffff804`111d1c69 : ffffb883`582ea580 00000000`00000000 ffffb883`582ea580 fffffa07`df3e2780 : nt!KiBugCheckDispatch+0x69
fffffa07`df3e2560 fffff804`111637ba : 00007ff6`5ecda844 fffffa07`00000001 01000002`00000003 01000002`516f8064 : nt!KiPageFault+0x469
fffffa07`df3e26f0 fffff804`110cfb4d : fffffa07`00000001 fffff23f`fb2f66d0 00000000`00000000 fffffa07`df3e2858 : nt!MiResolvePageFileFault+0x9d2
fffffa07`df3e2810 fffff804`110cdad9 : 00000000`00000114 00000000`00000003 00000000`c0000016 00000000`00000000 : nt!MiDispatchFault+0x9bd
fffffa07`df3e2960 fffff804`111d1b5e : 00000000`00000001 00000000`00000000 00007ff6`5eef4730 00000205`f2a98f50 : nt!MmAccessFault+0x169
fffffa07`df3e2b00 00007ff6`5ecda844 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
00000086`3b0fdd88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff6`5ecda844
SYMBOL_NAME: nt!MiResolvePageFileFault+9d2
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.1379
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 9d2
FAILURE_BUCKET_ID: AV_nt!MiResolvePageFileFault
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {792a0b16-e499-d3be-c970-fb2f83008d00}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80151541101, The address that the exception occurred at
Arg3: ffffc18a49296ac8, Exception Record Address
Arg4: fffff8015527d930, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 3140
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 25280
Key : Analysis.Init.CPU.mSec
Value: 1328
Key : Analysis.Init.Elapsed.mSec
Value: 12936
Key : Analysis.Memory.CommitPeak.Mb
Value: 83
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80151541101
BUGCHECK_P3: ffffc18a49296ac8
BUGCHECK_P4: fffff8015527d930
EXCEPTION_RECORD: ffffc18a49296ac8 -- (.exr 0xffffc18a49296ac8)
ExceptionAddress: fffff80151541101 (nt!MiDemoteCombinedPte+0x0000000000000051)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8015527d930 -- (.cxr 0xfffff8015527d930)
rax=ffffc3e1f0f87000 rbx=0000000000000051 rcx=ffffc48d3e8e79c0
rdx=ffffc3bfff6a36c0 rsi=ffffc3bfff6a36c0 rdi=ffffc18a49297310
rip=fffff80151541101 rsp=ffffc18a49296d00 rbp=00007ffed46d8000
r8=8000000000000000 r9=ffffc48d866c9050 r10=0000000000000000
r11=ffffc38000000000 r12=0000000000000000 r13=ffffc18a49297410
r14=8000000000000000 r15=ffffc48d3e8e79c0
iopl=0 nv up ei ng nz na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050287
nt!MiDemoteCombinedPte+0x51:
fffff801`51541101 498378f001 cmp qword ptr [r8-10h],1 ds:002b:7fffffff`fffffff0=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: svchost.exe
READ_ADDRESS: fffff801519713b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffc18a`49296d00 fffff801`5145c577 : 00000000`00000000 ffffc3bf`ff6a3690 00000000`00000002 00000000`00000000 : nt!MiDemoteCombinedPte+0x51
ffffc18a`49296dd0 fffff801`51458d27 : 00000000`00000000 ffffc18a`49297410 00000000`00000000 00000000`00000000 : nt!MiAgePte+0x427
ffffc18a`49296e70 fffff801`514591e1 : ffffc18a`49297410 ffffc18a`49297410 ffffc48d`00000000 ffffc3e1`dfffb518 : nt!MiWalkPageTablesRecursively+0x1e7
ffffc18a`49296f30 fffff801`514591e1 : ffffc18a`49297410 ffffc18a`49297410 ffffc48d`00000000 ffffc3e1`f0efffd8 : nt!MiWalkPageTablesRecursively+0x6a1
ffffc18a`49296ff0 fffff801`514591e1 : ffffc18a`49297410 ffffc18a`49297410 ffffc48d`00000000 ffffc3e1`f0f877f8 : nt!MiWalkPageTablesRecursively+0x6a1
ffffc18a`492970b0 fffff801`5145896c : ffffc18a`49297410 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x6a1
ffffc18a`49297170 fffff801`514583f7 : ffffc18a`49297410 ffffc18a`00000002 00000000`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36c
ffffc18a`49297270 fffff801`51457b32 : ffffc48d`4fdec080 fffff801`00000000 00000003`00000000 00000000`00000000 : nt!MiAgeWorkingSet+0x3a7
ffffc18a`49297790 fffff801`5145744a : ffffc48d`3e8e79c0 ffffc18a`49297a50 00000000`00000000 00000000`00000000 : nt!MiTrimOrAgeWorkingSet+0x3b2
ffffc18a`49297880 fffff801`51535220 : fffff801`00000002 00000000`00000000 fffff801`51868180 ffffc48d`23044010 : nt!MiProcessWorkingSets+0x1fa
ffffc18a`49297a30 fffff801`516c9966 : 00000000`00000001 00000000`00000008 00000000`ffffffff 00000000`00000001 : nt!MiWorkingSetManager+0xc8
ffffc18a`49297af0 fffff801`5158d945 : 00000000`00000008 00000000`ffffffff fffff801`51868180 00000000`00000120 : nt!MmWorkingSetManager+0x12
ffffc18a`49297b20 fffff801`51527c15 : ffffc48d`23124080 00000000`00000080 fffff801`5158d7f0 48432067`6e696e6e : nt!KeBalanceSetManager+0x155
ffffc18a`49297c10 fffff801`515cb098 : ffff9e81`249a0180 ffffc48d`23124080 fffff801`51527bc0 524f5753`5341505f : nt!PspSystemThreadStartup+0x55
ffffc18a`49297c60 00000000`00000000 : ffffc18a`49298000 ffffc18a`49292000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiDemoteCombinedPte+51
MODULE_NAME: nt
IMAGE_VERSION: 10.0.18362.1379
STACK_COMMAND: .cxr 0xfffff8015527d930 ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 51
FAILURE_BUCKET_ID: AV_nt!MiDemoteCombinedPte
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c577c73b-79a7-0c44-6c62-58e1d697b6d8}
Followup: MachineOwner
---------