************* Path validation summary **************
Response Time (ms) Location.
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64.
Product: WinNt, suite: TerminalServer SingleUserTS Personal.
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff806`2f600000 PsLoadedModuleList = 0xfffff806`3022a1b0
Debug session time: Wed May 26 23:38:28.069 2021 (UTC + 3:00)
System Uptime: 0 days 1:58:12.887
Loading Kernel Symbols.
...............................................................
................................................................
................................................................
....
Loading User Symbols.
Loading unloaded module list.
.............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`2f9f6cf0 48894c2408 mov qword ptr [rsp+8],rcx ss:ffffba03`133d96f0=0000000000000139
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption.
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffba03133d9a10, Address of the trap frame for the exception that caused the BugCheck.
Arg3: ffffba03133d9968, Address of the exception record for the exception that caused the BugCheck.
Arg4: 0000000000000000, Reserved.
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6390.
Key : Analysis.DebugAnalysisManager
Value: Create.
Key : Analysis.Elapsed.mSec
Value: 16723.
Key : Analysis.Init.CPU.mSec
Value: 468.
Key : Analysis.Init.Elapsed.mSec
Value: 14175.
Key : Analysis.Memory.CommitPeak.Mb
Value: 86.
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY.
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release.
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139.
BUGCHECK_P1: 3
BUGCHECK_P2: ffffba03133d9a10.
BUGCHECK_P3: ffffba03133d9968.
BUGCHECK_P4: 0
TRAP_FRAME: ffffba03133d9a10 -- (.trap 0xffffba03133d9a10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd00e4996b208 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffba03133d9ca8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80634d04a86 rsp=ffffba03133d9ba0 rbp=ffffa9888f66f180
r8=ffffd00e4996b050 r9=0000000000000000 r10=ffffa9889d1bc7a8
r11=ffffd00e4996b170 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy.
Ntfs!NtfsDeleteScb+0x935f6:
fffff806`34d04a86 cd29 int 29h.
Resetting default scope.
EXCEPTION_RECORD: ffffba03133d9968 -- (.exr 0xffffba03133d9968)
ExceptionAddress: fffff80634d04a86 (Ntfs!NtfsDeleteScb+0x00000000000935f6)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001.
NumberParameters: 1
Parameter[0]: 0000000000000003.
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System.
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409.
EXCEPTION_PARAMETER1: 0000000000000003.
EXCEPTION_STR: 0xc0000409.
STACK_TEXT:
ffffba03`133d96e8 fffff806`2fa08c69 : 00000000`00000139 00000000`00000003 ffffba03`133d9a10 ffffba03`133d9968 : nt!KeBugCheckEx
ffffba03`133d96f0 fffff806`2fa09090 : 00000000`00000000 ffffd00e`3dd29150 ffffa988`8f66f180 fffff806`34c5749c : nt!KiBugCheckDispatch+0x69
ffffba03`133d9830 fffff806`2fa07423 : 00000000`00000040 01700170`00000ba2 00000000`00000000 ffffd00e`4964cec0 : nt!KiFastFailDispatch+0xd0
ffffba03`133d9a10 fffff806`34d04a86 : ffffd00e`4996c170 ffffa988`8f66f180 ffffa988`8f66f9f8 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
ffffba03`133d9ba0 fffff806`34c71396 : ffffa988`00000000 00000000`00000000 00000000`00000002 fffff806`34b25812 : Ntfs!NtfsDeleteScb+0x935f6
ffffba03`133d9c40 fffff806`34b42e25 : 00000000`00000000 ffffd00e`4996b170 fffff806`34b8a690 00000000`00000001 : Ntfs!NtfsRemoveScb+0x66
ffffba03`133d9ca0 fffff806`34c7112c : ffffa988`9d1bc7a8 00000000`00000000 ffffd00e`4996b010 ffffd00e`4996b400 : Ntfs!NtfsPrepareFcbForRemoval+0x75
ffffba03`133d9ce0 fffff806`34b239f0 : ffffa988`9d1bc7a8 ffffba03`133d9de2 ffffd00e`4996b468 ffffd00e`4996b010 : Ntfs!NtfsTeardownStructures+0x9c
ffffba03`133d9d60 fffff806`34c06c57 : ffffba03`133d9f00 ffffd00e`00000001 00000000`00000000 ffffd00e`4996b000 : Ntfs!NtfsDecrementCloseCounts+0xb0
ffffba03`133d9da0 fffff806`34c035df : ffffa988`9d1bc7a8 ffffd00e`4996b170 ffffd00e`4996b010 ffffa988`8f66f180 : Ntfs!NtfsCommonClose+0x467
ffffba03`133d9e80 fffff806`34c80ec4 : ffffba03`133da2f0 fffff806`2f9185b5 ffffa988`9ac81400 fffff806`2fce5adb : Ntfs!NtfsFspCloseInternal+0x2ef
ffffba03`133d9fe0 fffff806`34c5067c : 00000000`00000000 00000000`00000000 ffffa988`8f66f180 ffffd00e`3dca38b0 : Ntfs!NtfsFlushVolume+0x10c
ffffba03`133da0f0 fffff806`34c4fd29 : ffffa988`9dd8ad78 ffffa988`979e2060 ffffa988`9dd8ad01 ffffba03`133da320 : Ntfs!NtfsCommonFlushBuffers+0x8d0
ffffba03`133da210 fffff806`2f898bc8 : ffffba03`133da320 ffffa988`9dd8ad78 ffffa988`00000000 ffffa988`979e2060 : Ntfs!NtfsCommonFlushBuffersCallout+0x19
ffffba03`133da240 fffff806`2f898b3d : fffff806`34c4fd10 ffffba03`133da320 00000000`00000000 fffff806`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0x78
ffffba03`133da2b0 fffff806`34c27f6b : 00000000`00000000 00000000`00000310 ffffba03`133db000 00000000`00000030 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffba03`133da2f0 fffff806`34c27e95 : 00000000`00000000 ffffa988`8f3ee4c0 ffffba03`133da388 00000000`00000000 : Ntfs!NtfsCommonFlushBuffersOnNewStack+0x67
ffffba03`133da360 fffff806`2f9185b5 : ffffa988`985edc20 ffffa988`979e2060 ffffa988`9dd8ad78 ffffba03`133da388 : Ntfs!NtfsFsdFlushBuffers+0xe5
ffffba03`133da3d0 fffff806`33fb6ccf : ffffba03`133da448 ffffba03`133da4f0 ffffba03`133da430 00000000`00000000 : nt!IofCallDriver+0x55
ffffba03`133da410 fffff806`33fb48d3 : ffffba03`133da4a0 00000000`00000000 00000000`00000000 ffffa988`8bfb2140 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffffba03`133da480 fffff806`2f9185b5 : ffffa988`979e2060 ffffa988`8a8dc000 ffffba03`133da710 ffff9281`0e704000 : FLTMGR!FltpDispatch+0xa3
ffffba03`133da4e0 fffff806`2fce2718 : ffffba03`133da710 ffffa988`979e2060 00000000`00000001 ffffa988`00000000 : nt!IofCallDriver+0x55
ffffba03`133da520 fffff806`2fc98ee9 : ffffa988`00000000 ffffba03`133da710 00000000`00000000 ffffba03`133da710 : nt!IopSynchronousServiceTail+0x1a8
ffffba03`133da5c0 fffff806`2fc98cd6 : ffffa988`97acf080 00000000`00000000 ffffa988`8f4c18d0 00000000`00000000 : nt!NtFlushBuffersFileEx+0x1f9
ffffba03`133da650 fffff806`2fa086b5 : fffff806`2f600000 fffff806`2f80827e ffffba03`133da8e0 00000000`00000000 : nt!NtFlushBuffersFile+0x16
ffffba03`133da690 fffff806`2f9fab50 : fffff806`2ff956aa ffffba03`0f007280 000001fc`00000000 ffffba03`00000000 : nt!KiSystemServiceCopyEnd+0x25
ffffba03`133da828 fffff806`2ff956aa : ffffba03`0f007280 000001fc`00000000 ffffba03`00000000 fffff806`2f9fb290 : nt!KiServiceLinkage
ffffba03`133da830 fffff806`2f8f53b5 : ffffa988`97acf080 ffffa988`97acf080 fffff806`2ff95520 00000000`00000000 : nt!PopFlushVolumeWorker+0x18a
ffffba03`133dab10 fffff806`2f9fe348 : ffff9281`0e6f6180 ffffa988`97acf080 fffff806`2f8f5360 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffba03`133dab60 00000000`00000000 : ffffba03`133db000 ffffba03`133d4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt.
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.985
STACK_COMMAND: .thread ; .cxr ; kb.
BUCKET_ID_FUNC_OFFSET: d0.
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release.
OSPLATFORM_TYPE: x64.
OSNAME: Windows 10.
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner.
---------
************ Path validation summary **************
Response Time (ms) Location.
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64.
Product: WinNt, suite: TerminalServer SingleUserTS Personal.
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff807`52800000 PsLoadedModuleList = 0xfffff807`5342a1b0
Debug session time: Fri May 21 17:24:16.712 2021 (UTC + 3:00)
System Uptime: 0 days 0:00:32.530
Loading Kernel Symbols.
...............................................................
................................................................
................................................................
......
Loading User Symbols.
Loading unloaded module list.
.......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff807`52bf6cf0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff807`56c76050=000000000000000a
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an.
interrupt request level (IRQL) that is too high. This is usually.
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff807692ef900, memory referenced.
Arg2: 0000000000000002, IRQL.
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg4: fffff807692ef900, address which referenced memory.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5640.
Key : Analysis.DebugAnalysisManager
Value: Create.
Key : Analysis.Elapsed.mSec
Value: 5817.
Key : Analysis.Init.CPU.mSec
Value: 421.
Key : Analysis.Init.Elapsed.mSec
Value: 12927.
Key : Analysis.Memory.CommitPeak.Mb
Value: 82.
Key : WER.OS.Branch
Value: vb_release.
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: d1.
BUGCHECK_P1: fffff807692ef900.
BUGCHECK_P2: 2
BUGCHECK_P3: 8
BUGCHECK_P4: fffff807692ef900.
READ_ADDRESS: fffff807534fa390: Unable to get MiVisibleState.
Unable to get NonPagedPoolStart.
Unable to get NonPagedPoolEnd.
Unable to get PagedPoolStart.
Unable to get PagedPoolEnd.
unable to get nt!MmSpecialPagesInUse
fffff807692ef900.
IP_MODULE_UNLOADED:
vgk.sys+4f900
fffff807`692ef900 ?? ???
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: explorer.exe
DPC_STACK_BASE: FFFFF80756C76FB0.
TRAP_FRAME: fffff80756c76190 -- (.trap 0xfffff80756c76190)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8076b704be0 rbx=0000000000000000 rcx=ffff8d8da0637cb0
rdx=ffff8d8da02bdec0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff807692ef900 rsp=fffff80756c76328 rbp=fffff80756c76388
r8=ffff8d8da02bded8 r9=fffff80756c76374 r10=fffff80752a286a0
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc.
<Unloaded_vgk.sys>+0x4f900:
fffff807`692ef900 ?? ???
Resetting default scope.
FAILED_INSTRUCTION_ADDRESS:
vgk.sys+4f900
fffff807`692ef900 ?? ???
STACK_TEXT:
fffff807`56c76048 fffff807`52c08c69 : 00000000`0000000a fffff807`692ef900 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff807`56c76050 fffff807`52c04f69 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff807`56c76190 fffff807`692ef900 : fffff807`6bc63aa8 00000000`00000000 fffff807`56c76388 ffff8d8d`a063b9c0 : nt!KiPageFault+0x469
fffff807`56c76328 fffff807`6bc63aa8 : 00000000`00000000 fffff807`56c76388 ffff8d8d`a063b9c0 ffff8d8d`a02bdd60 : <Unloaded_vgk.sys>+0x4f900
fffff807`56c76330 fffff807`52b0dede : 00000000`00000000 00000000`00000000 ffff8d8d`a09aa001 00000000`00000000 : mouhid!MouHid_ReadComplete+0x758
fffff807`56c763d0 fffff807`52b0dda7 : 00000000`00000000 ffff8d8d`9bfb1406 ffff8d8d`a05be9b0 00000000`00000000 : nt!IopfCompleteRequest+0x11e
fffff807`56c764c0 fffff807`6bb1aef5 : ffff8d8d`a2662638 ffff8d8d`a0377102 00000000`00000000 00000000`00000008 : nt!IofCompleteRequest+0x17
fffff807`56c764f0 fffff807`6bb1a7ed : ffff8d8d`a03771d0 ffff8d8d`a0377102 ffff8d8d`a03771d0 00000000`00000008 : HIDCLASS!HidpDistributeInterruptReport+0x3f5
fffff807`56c765f0 fffff807`52b0dede : ffff8d8d`a0288010 ffff8d8d`a0288010 fffff807`56c76701 ffff8d8d`a028848b : HIDCLASS!HidpInterruptReadComplete+0x37d
fffff807`56c76690 fffff807`52b0dda7 : 00000000`00000001 00000000`00000000 ffff8d8d`a061d0e0 00000000`00000002 : nt!IopfCompleteRequest+0x11e
fffff807`56c76780 fffff807`552b811a : 00000000`00000000 ffff8d8d`97d918a0 ffff8d8d`a0288010 fffff807`56c76860 : nt!IofCompleteRequest+0x17
fffff807`56c767b0 fffff807`552b5bbf : ffff8d8d`9b375202 ffff8d8d`a01cf820 ffff8d8d`a0288010 00000000`00000000 : Wdf01000!FxRequest::CompleteInternal+0x23a [minkernel\wdf\framework\shared\core\fxrequest.cpp @ 869]
fffff807`56c76840 fffff807`7216b91d : 00000000`ffffff02 ffff8d8d`9b3750c0 ffff8d8d`a061d4c0 ffff8d8d`a061d4c0 : Wdf01000!imp_WdfRequestComplete+0x8f [minkernel\wdf\framework\shared\core\fxrequestapi.cpp @ 436]
fffff807`56c768a0 fffff807`7216b7e1 : ffff8d8d`9b375260 00000000`00000007 ffff8d8d`9b3752f0 fffff807`56c76ab8 : USBXHCI!Bulk_Transfer_CompleteCancelable+0xc9
fffff807`56c76900 fffff807`7216b5d0 : 00000000`00000004 fffff807`56c76a70 00000000`00000000 ffff8d8d`a05d76e0 : USBXHCI!Bulk_ProcessTransferEventWithED1+0x1fd
fffff807`56c769b0 fffff807`72166571 : 00000000`00000004 fffff807`56c76a88 00000000`00000008 fffff807`56c76a90 : USBXHCI!Bulk_EP_TransferEventHandler+0x10
fffff807`56c769e0 fffff807`721660a5 : 00000000`00000780 00007272`64a56600 ffff8d8d`9bbb02a0 ffff8d8d`9b36a170 : USBXHCI!Endpoint_TransferEventHandler+0xb1
fffff807`56c76a40 fffff807`72165d7c : ffff8d8d`964f7980 ffff8d8d`964d76c0 00007272`64988308 ffff8d8d`964f7000 : USBXHCI!Interrupter_DeferredWorkProcessor+0x315
fffff807`56c76b40 fffff807`552b38f6 : 00000000`00000f44 00000000`00400a02 00000000`00000000 00000018`13daba90 : USBXHCI!Interrupter_WdfEvtInterruptDpc+0xc
fffff807`56c76b70 fffff807`52b230ce : fffff807`4e534240 ffff8d8d`962f2000 fffff807`56c76e70 fffff807`00000002 : Wdf01000!FxInterrupt::_InterruptDpcThunk+0xa6 [minkernel\wdf\framework\shared\irphandlers\pnp\km\interruptobjectkm.cpp @ 410]
fffff807`56c76bb0 fffff807`52b223b4 : 00000000`00000000 00000000`00000000 00000000`00000008 00000000`000004ec : nt!KiExecuteAllDpcs+0x30e
fffff807`56c76d20 fffff807`52bfdd35 : 00000000`00000000 fffff807`4e531180 ffffe401`2623e3c0 ffff8d8d`a3c21080 : nt!KiRetireDpcList+0x1f4
fffff807`56c76fb0 fffff807`52bfdb20 : ffffa285`2fc05a48 fffff807`52ac656a 00000000`000a0008 fffff807`52fc4430 : nt!KxRetireDpcList+0x5
ffffc807`a62374d0 fffff807`52bfd3d5 : ffff8d8d`a3c21080 fffff807`52bf8861 00000000`00007fc0 ffffa285`2f824668 : nt!KiDispatchInterruptContinue
ffffc807`a6237500 fffff807`52bf8861 : 00000000`00007fc0 ffffa285`2f824668 ffff8d8d`97d668c0 fffff807`52a0827e : nt!KiDpcInterruptBypass+0x25
ffffc807`a6237510 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatch+0xb1
SYMBOL_NAME: vgk.sys+4f900
MODULE_NAME: vgk.
IMAGE_NAME: vgk.sys
STACK_COMMAND: .thread ; .cxr ; kb.
BUCKET_ID_FUNC_OFFSET: 4f900.
FAILURE_BUCKET_ID: AV_CODE_AV_UNLOADED_IP_vgk.sys!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release.
OSPLATFORM_TYPE: x64.
OSNAME: Windows 10.
FAILURE_ID_HASH: {58ddf758-2c33-45f8-8744-8e36d684565c}
Followup: MachineOwner.
---------
************* Path validation summary **************
Response Time (ms) Location.
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64.
Product: WinNt, suite: TerminalServer SingleUserTS Personal.
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff805`4b000000 PsLoadedModuleList = 0xfffff805`4bc2a1b0
Debug session time: Wed May 26 21:39:53.372 2021 (UTC + 3:00)
System Uptime: 0 days 0:14:16.191
Loading Kernel Symbols.
...............................................................
................................................................
................................................................
........
Loading User Symbols.
Loading unloaded module list.
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`4b3f6cf0 48894c2408 mov qword ptr [rsp+8],rcx ss:ffffef03`e97f7100=000000000000012b
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
FAULTY_HARDWARE_CORRUPTED_PAGE (12b)
This BugCheck indicates that a single bit error was found in this page. This is a hardware memory error.
Arguments:
Arg1: ffffffffc00002c4, virtual address mapping the corrupted page.
Arg2: 00000000000005a2, physical page number.
Arg3: 0000025543bf1150, zero.
Arg4: ffffca80c478b000, zero.
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4187.
Key : Analysis.DebugAnalysisManager
Value: Create.
Key : Analysis.Elapsed.mSec
Value: 9435.
Key : Analysis.Init.CPU.mSec
Value: 484.
Key : Analysis.Init.Elapsed.mSec
Value: 11820.
Key : Analysis.Memory.CommitPeak.Mb
Value: 81.
Key : BlackBox.SmDecompressionFailure.CompressedSize
Value: 0x5a2.
Key : BlackBox.SmDecompressionFailure.CompressionFormat
Value: 0x3.
Key : BlackBox.SmDecompressionFailure.SourceDataHash
Value: 0x417a0260.
Key : BlackBox.SmDecompressionFailure.SourceDataOffset
Value: 0x1150.
Key : BlackBox.SmDecompressionFailure.SourcePFN1
Value: 0x1a120e.
Key : BlackBox.SmDecompressionFailure.SourcePFN2
Value: 0xffffffffffffffff.
Key : BlackBox.SmDecompressionFailure.TargetPFN
Value: 0x4b19e.
Key : WER.OS.Branch
Value: vb_release.
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 12b.
BUGCHECK_P1: ffffffffc00002c4.
BUGCHECK_P2: 5a2.
BUGCHECK_P3: 25543bf1150.
BUGCHECK_P4: ffffca80c478b000.
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MemCompression.
STACK_TEXT:
ffffef03`e97f70f8 fffff805`4b596e62 : 00000000`0000012b ffffffff`c00002c4 00000000`000005a2 00000255`43bf1150 : nt!KeBugCheckEx
ffffef03`e97f7100 fffff805`4b44a5df : 00000000`00000001 00000000`c00002c4 ffffca80`c478b000 00000000`00040000 : nt!ST_STORE<SM_TRAITS>::StDmPageError+0x10a
ffffef03`e97f7160 fffff805`4b2a67c5 : 00000000`00000004 fffff805`4b2a632e 00000000`00000000 00000000`00000001 : nt!ST_STORE<SM_TRAITS>::StDmSinglePageCopy+0x1a3df7
ffffef03`e97f7220 fffff805`4b2a5ffc : 00000000`00000001 00000000`00001150 00000000`00000000 ffffb908`00010000 : nt!ST_STORE<SM_TRAITS>::StDmSinglePageTransfer+0xa5
ffffef03`e97f7270 fffff805`4b2a5e2c : 00000000`ffffffff ffffb908`bc8d2000 ffffef03`e97f7350 ffffb908`bc53f490 : nt!ST_STORE<SM_TRAITS>::StDmpSinglePageRetrieve+0x180
ffffef03`e97f7310 fffff805`4b2a5c79 : ffffca80`c21a0730 00000000`00000001 00000000`00000000 00000000`00000000 : nt!ST_STORE<SM_TRAITS>::StDmPageRetrieve+0xc8
ffffef03`e97f73c0 fffff805`4b2a5b31 : ffffb908`b7877000 ffffb908`bc53f490 ffffb908`bc8d2000 ffffb908`b78789c0 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadIssue+0x85
ffffef03`e97f7440 fffff805`4b298bc8 : ffffb908`ae75e040 ffffb908`b7877000 00000000`00000000 ffffb908`b951d060 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectReadCallout+0x21
ffffef03`e97f7470 fffff805`4b2a368f : fffff805`4b2a5b10 ffffef03`e97f7510 00000000`00000003 00000000`00000000 : nt!KeExpandKernelStackAndCalloutInternal+0x78
ffffef03`e97f74e0 fffff805`4b359934 : ffffef03`e97f75e0 00000000`31526d73 00000000`000003ff fffff805`4bd229c0 : nt!SMKM_STORE<SM_TRAITS>::SmStDirectRead+0xc7
ffffef03`e97f75b0 fffff805`4b359368 : 00000000`0000000c 00000000`000003ff ffffef03`e97f7660 fffff805`4bd229c0 : nt!SMKM_STORE<SM_TRAITS>::SmStWorkItemQueue+0x1ac
ffffef03`e97f7600 fffff805`4b2a4117 : 00000000`0000000c 00000000`00000010 ffffb908`bc53f490 ffffb908`b951d060 : nt!SMKM_STORE_MGR<SM_TRAITS>::SmIoCtxQueueWork+0xc0
ffffef03`e97f7690 fffff805`4b2fa96b : ffffb908`00000010 ffffb908`b951d120 00000000`00000000 ffffb908`b7877000 : nt!SMKM_STORE_MGR<SM_TRAITS>::SmPageRead+0x167
ffffef03`e97f7700 fffff805`4b25e0a0 : 0000007f`00000100 00000000`00000000 ffffef03`e97f7958 fffff805`4b25bff0 : nt!SmPageRead+0x33
ffffef03`e97f7750 fffff805`4b25bb4d : 00000000`00000002 ffffef03`e97f77e0 ffffef03`e97f7958 ffffb908`b951d010 : nt!MiIssueHardFaultIo+0x10c
ffffef03`e97f77a0 fffff805`4b328278 : 00000000`c0033333 00000000`00000001 000001fe`287b7b90 00000000`00000000 : nt!MiIssueHardFault+0x29d
ffffef03`e97f7860 fffff805`4b404e5e : ffffb908`ae75e040 ffffb908`00000000 ffffb908`b7809a70 ffffb908`00000000 : nt!MmAccessFault+0x468
ffffef03`e97f7a00 00007ffd`5b0b09b7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
000000dc`001ff680 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`5b0b09b7
SYMBOL_NAME: nt!ST_STORE<SM_TRAITS>::StDmPageError+10a
MODULE_NAME: nt.
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.985
STACK_COMMAND: .thread ; .cxr ; kb.
BUCKET_ID_FUNC_OFFSET: 10a.
FAILURE_BUCKET_ID: 0x12B_c00002c4_StCtDecompressFailed_nt!ST_STORE_SM_TRAITS_::StDmPageError
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release.
OSPLATFORM_TYPE: x64.
OSNAME: Windows 10.
************* Path validation summary **************
Response Time (ms) Location.
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64.
Product: WinNt, suite: TerminalServer SingleUserTS Personal.
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`71600000 PsLoadedModuleList = 0xfffff800`7222a1b0
Debug session time: Wed May 26 00:24:40.808 2021 (UTC + 3:00)
System Uptime: 3 days 5:14:03.964
Loading Kernel Symbols.
...............................................................
................................................................
................................................................
.....
Loading User Symbols.
Loading unloaded module list.
..........................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`719f6cf0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff928a`8c7f6b80=000000000000001a
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of.
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: fffff5f682000018.
Arg3: 0000000000006000.
Arg4: 0000000000000000.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4999.
Key : Analysis.DebugAnalysisManager
Value: Create.
Key : Analysis.Elapsed.mSec
Value: 15924.
Key : Analysis.Init.CPU.mSec
Value: 452.
Key : Analysis.Init.Elapsed.mSec
Value: 10231.
Key : Analysis.Memory.CommitPeak.Mb
Value: 81.
Key : MemoryManagement.PFN
Value: 6
Key : WER.OS.Branch
Value: vb_release.
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 1a.
BUGCHECK_P1: 41792.
BUGCHECK_P2: fffff5f682000018.
BUGCHECK_P3: 6000.
BUGCHECK_P4: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: wermgr.exe
STACK_TEXT:
ffff928a`8c7f6b78 fffff800`7184423a : 00000000`0000001a 00000000`00041792 fffff5f6`82000018 00000000`00006000 : nt!KeBugCheckEx
ffff928a`8c7f6b80 fffff800`71927296 : 00000000`00000000 0a000002`1f6f7863 00000000`00000005 fffff5f6`82000018 : nt!MiDeleteVa+0x153a
ffff928a`8c7f6c80 fffff800`719273ab : fffff5fa`fb410000 ffff9508`d5f2e700 ffff928a`00000000 ffff928a`8c7f70f0 : nt!MiWalkPageTablesRecursively+0x776
ffff928a`8c7f6d20 fffff800`719273ab : fffff5fa`fd7da080 ffff9508`d5f2e700 ffff928a`00000001 ffff928a`8c7f7100 : nt!MiWalkPageTablesRecursively+0x88b
ffff928a`8c7f6dc0 fffff800`719273ab : fffff5fa`fd7da000 ffff9508`d5f2e700 ffff928a`00000002 ffff928a`8c7f7110 : nt!MiWalkPageTablesRecursively+0x88b
ffff928a`8c7f6e60 fffff800`71804f4b : ffffb6f6`faaa7986 ffff9508`d5f2e700 00000000`00000003 ffff928a`8c7f7120 : nt!MiWalkPageTablesRecursively+0x88b
ffff928a`8c7f6f00 fffff800`71842ad1 : ffff928a`8c7f70a0 ffff9508`00000001 ffffc281`00000002 fffff800`00000000 : nt!MiWalkPageTables+0x36b
ffff928a`8c7f7000 fffff800`71c1d034 : 00000000`00000000 fffff800`7232d900 ffffd809`00000000 ffff9508`c32dc080 : nt!MiDeletePagablePteRange+0x4f1
ffff928a`8c7f7310 fffff800`7186b894 : ffff9508`d5f2e080 00000000`067441e0 00000000`00000002 fffff800`00000000 : nt!MiDeleteVadBitmap+0x8c
ffff928a`8c7f73a0 fffff800`71c1ceb0 : ffff9508`d5f2e080 ffff9508`d5f2e7c0 ffff9508`d5f2e700 ffff9508`d03d9080 : nt!MiDeleteFinalPageTables+0xc8
ffff928a`8c7f7460 fffff800`71c1a31f : ffff9508`d5f2e080 ffff928a`8c7f7520 ffff9508`d03d9080 ffff9508`d5f2e4c8 : nt!MmDeleteProcessAddressSpace+0x64
ffff928a`8c7f74b0 fffff800`71ce00f0 : ffff9508`d5f2e050 ffff9508`d5f2e050 00000000`00000000 ffff9508`c32a7380 : nt!PspProcessDelete+0x13f
ffff928a`8c7f7540 fffff800`71808357 : 00000000`00000000 00000000`00000000 ffff928a`8c7f76c9 ffff9508`d5f2e080 : nt!ObpRemoveObjectRoutine+0x80
ffff928a`8c7f75a0 fffff800`71bf372e : ffff9508`c32a7380 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObjectWithTag+0xc7
ffff928a`8c7f75e0 fffff800`71cc9605 : 00000002`00000043 fffff800`8851347c 00000000`00000103 00000000`00000000 : nt!ObCloseHandleTableEntry+0x29e
ffff928a`8c7f7720 fffff800`71ccb45d : ffff9508`d03d9080 ffff9508`d03d9080 ffffffff`ffffff01 ffff9508`d03884d8 : nt!ExSweepHandleTable+0xd5
ffff928a`8c7f77d0 fffff800`71cc9350 : ffffffff`ffffffff ffff9508`d0388080 ffff928a`8c7f7820 fffff800`71c1ff7c : nt!ObKillProcess+0x35
ffff928a`8c7f7800 fffff800`71c5b856 : ffff9508`d0388080 ffffd809`defbd0a0 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x204
ffff928a`8c7f7890 fffff800`71c5ed7e : ffff9508`00000000 00000000`00000001 00000000`00000000 00000000`012fe000 : nt!PspExitThread+0x5f6
ffff928a`8c7f7990 fffff800`71a086b5 : ffff9508`d0388080 ffff9508`d03d9080 ffff928a`8c7f7a80 ffff9508`d04d8160 : nt!NtTerminateProcess+0xde
ffff928a`8c7f7a00 00000000`77041cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`010ae888 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77041cfc.
SYMBOL_NAME: nt!MiDeleteVa+153a
MODULE_NAME: nt.
IMAGE_VERSION: 10.0.19041.985
STACK_COMMAND: .thread ; .cxr ; kb.
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 153a.
FAILURE_BUCKET_ID: 0x1a_41792_nt!MiDeleteVa
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release.
OSPLATFORM_TYPE: x64.
OSNAME: Windows 10.
FAILURE_ID_HASH: {ad6dfca3-101b-35a8-d6e1-12de9ecbc1f5}
Followup: MachineOwner.
---------
************* Path validation summary **************
Response Time (ms) Location.
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64.
Product: WinNt, suite: TerminalServer SingleUserTS Personal.
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff805`73c00000 PsLoadedModuleList = 0xfffff805`7482a1b0
Debug session time: Sat May 29 13:18:14.605 2021 (UTC + 3:00)
System Uptime: 0 days 11:10:50.423
Loading Kernel Symbols.
...............................................................
................................................................
................................................................
........
Loading User Symbols.
Loading unloaded module list.
...........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`73ff6cf0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff60f`ab1f6120=000000000000007e
8: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck. Usually the exception address pinpoints.
the driver/function that caused the problem. Always note this address.
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard.
coded breakpoint or assertion was hit, but this system was booted.
/NODEBUG. This is not supposed to happen as developers should never have.
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the.
system is booted /DEBUG. This will let us see why this breakpoint is.
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled.
Arg2: fffff80574297ad3, The address that the exception occurred at.
Arg3: fffff60fab1f7118, Exception Record Address.
Arg4: fffff60fab1f6950, Context Record Address.
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr.
Key : AV.Fault
Value: Read.
Key : Analysis.CPU.mSec
Value: 7234.
Key : Analysis.DebugAnalysisManager
Value: Create.
Key : Analysis.Elapsed.mSec
Value: 14586.
Key : Analysis.Init.CPU.mSec
Value: 406.
Key : Analysis.Init.Elapsed.mSec
Value: 7074.
Key : Analysis.Memory.CommitPeak.Mb
Value: 91.
Key : WER.OS.Branch
Value: vb_release.
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7e.
BUGCHECK_P1: ffffffffc0000005.
BUGCHECK_P2: fffff80574297ad3.
BUGCHECK_P3: fffff60fab1f7118.
BUGCHECK_P4: fffff60fab1f6950.
EXCEPTION_RECORD: fffff60fab1f7118 -- (.exr 0xfffff60fab1f7118)
ExceptionAddress: fffff80574297ad3 (nt!FsRtlTeardownPerFileContexts+0x0000000000000033)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000.
NumberParameters: 2
Parameter[0]: 0000000000000000.
Parameter[1]: 0000000000000108.
Attempt to read from address 0000000000000108.
CONTEXT: fffff60fab1f6950 -- (.cxr 0xfffff60fab1f6950)
rax=0000000000000c08 rbx=0000000000000100 rcx=ffffb402cd1a8158
rdx=0000000000000723 rsi=0000000000005365 rdi=0000000000000108
rip=fffff80574297ad3 rsp=fffff60fab1f7350 rbp=0000000000000000
r8=ffffb402cd1a8010 r9=0000000000000000 r10=fffff80574297aa0
r11=fffff60fab1f7380 r12=0000000000000000 r13=0000000000000000
r14=ffffc4028f878180 r15=ffffb402cd1a8018
iopl=0 nv up ei pl nz na po nc.
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
nt!FsRtlTeardownPerFileContexts+0x33:
fffff805`74297ad3 48393f cmp qword ptr [rdi],rdi ds:002b:00000000`00000108=????????????????
Resetting default scope.
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System.
READ_ADDRESS: fffff805748fa390: Unable to get MiVisibleState.
Unable to get NonPagedPoolStart.
Unable to get NonPagedPoolEnd.
Unable to get PagedPoolStart.
Unable to get PagedPoolEnd.
unable to get nt!MmSpecialPagesInUse
0000000000000108.
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005.
EXCEPTION_PARAMETER1: 0000000000000000.
EXCEPTION_PARAMETER2: 0000000000000108.
EXCEPTION_STR: 0xc0000005.
STACK_TEXT:
fffff60f`ab1f7350 fffff805`77670d52 : fffff60f`ab1f7438 00000000`00000100 00000000`00005365 ffffc402`8f878180 : nt!FsRtlTeardownPerFileContexts+0x33
fffff60f`ab1f7390 fffff805`77542aa2 : fffff60f`00000000 fffff805`77631200 ffffb402`000003f0 ffffb402`00008000 : Ntfs!NtfsDeleteFcb+0x422
fffff60f`ab1f7410 fffff805`7767117a : fffff60f`ab1f77f0 ffffc402`8f878180 ffffb402`ccdb95a0 ffffb402`ccdb99f8 : Ntfs!NtfsTeardownFromLcb+0x272
fffff60f`ab1f74b0 fffff805`775239f0 : fffff60f`ab1f77f0 fffff60f`ab1f75b2 ffffb402`ccdb99f8 ffffb402`ccdb95a0 : Ntfs!NtfsTeardownStructures+0xea
fffff60f`ab1f7530 fffff805`77606c57 : fffff60f`ab1f7600 ffffb402`00000000 00000000`00000000 ffffb402`ccdb9500 : Ntfs!NtfsDecrementCloseCounts+0xb0
fffff60f`ab1f7570 fffff805`776035df : fffff60f`ab1f77f0 ffffb402`ccdb9700 ffffb402`ccdb95a0 ffffc402`8f878180 : Ntfs!NtfsCommonClose+0x467
fffff60f`ab1f7650 fffff805`776312b8 : 00000000`0000001c fffff805`74924440 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspCloseInternal+0x2ef
fffff60f`ab1f77b0 fffff805`73f41225 : ffffc402`933555c0 fffff805`73f7f030 ffffc402`8dab9c60 ffffc402`00000000 : Ntfs!NtfsFspClose+0x88
fffff60f`ab1f7a70 fffff805`73ef53b5 : ffffc402`933555c0 00000000`00000080 ffffc402`8dadc080 000fa4ef`bd9bbfff : nt!ExpWorkerThread+0x105
fffff60f`ab1f7b10 fffff805`73ffe348 : ffffd501`af9c0180 ffffc402`933555c0 fffff805`73ef5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffff60f`ab1f7b60 00000000`00000000 : fffff60f`ab1f8000 fffff60f`ab1f1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!FsRtlTeardownPerFileContexts+33
MODULE_NAME: nt.
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.985
STACK_COMMAND: .cxr 0xfffff60fab1f6950 ; kb.
BUCKET_ID_FUNC_OFFSET: 33.
FAILURE_BUCKET_ID: AV_nt!FsRtlTeardownPerFileContexts
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
drive.google.com
