*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8076511762b, The address that the exception occurred at
Arg3: ffff8d0eb2b80728, Exception Record Address
Arg4: ffff8d0eb2b7ff70, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 24750
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on EMB
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 88055
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8076511762b
BUGCHECK_P3: ffff8d0eb2b80728
BUGCHECK_P4: ffff8d0eb2b7ff70
EXCEPTION_RECORD: ffff8d0eb2b80728 -- (.exr 0xffff8d0eb2b80728)
ExceptionAddress: fffff8076511762b (nt!RtlCompressBufferXpressHuffStandard+0x000000000000019b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000add37a000
Attempt to read from address 0000000add37a000
CONTEXT: ffff8d0eb2b7ff70 -- (.cxr 0xffff8d0eb2b7ff70)
rax=000000000000063a rbx=ffffe206dd37aea4 rcx=00000000000000bd
rdx=0000000000000035 rsi=ffffe206e2b44abc rdi=ffffe206e2b44ab4
rip=fffff8076511762b rsp=ffff8d0eb2b80960 rbp=ffffe206dd37aea5
r8=0000000add37a000 r9=ffffe206dd37aea4 r10=000000000000031d
r11=ffffe206dd37bfd8 r12=ffffe206dd37bfd8 r13=ffffe206dd37a000
r14=0000000000000010 r15=ffffe206e2b2d000
iopl=0 nv up ei pl nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050216
nt!RtlCompressBufferXpressHuffStandard+0x19b:
fffff807`6511762b 413810 cmp byte ptr [r8],dl ds:002b:0000000a`dd37a000=??
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff807653733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8076522a3b8: Unable to get Flags value from nt!KdVersionBlock
fffff8076522a3b8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
0000000add37a000
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000add37a000
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffff8d0e`b2b80960 fffff807`65116d11 : ffffe206`dd37a000 ffffe206`e2b55a5f ffffe206`e2b55a5f fffff807`66a909e3 : nt!RtlCompressBufferXpressHuffStandard+0x19b
ffff8d0e`b2b80a60 fffff807`64f1667f : ffffbc8a`20d2c9c4 00000000`00000000 ffffbc8a`22b5d040 fffff807`64e83e1c : nt!RtlCompressBufferXpressHuff+0x61
ffff8d0e`b2b80ac0 fffff807`66a90902 : ffffbc8a`230af080 fffff807`6538f240 ffffbc8a`20d2cc10 00000000`00000000 : nt!RtlCompressBuffer+0x6f
ffff8d0e`b2b80b20 fffff807`64e83965 : ffffbc8a`22b5d040 ffffbc8a`17092010 ffffbc8a`17092000 ffffbc8a`17092010 : Wof!FileProvCompressWorkItem+0x72
ffff8d0e`b2b80b70 fffff807`64f1e155 : ffffbc8a`22b5d040 00000000`00000080 ffffbc8a`17090300 00ffffff`00000001 : nt!ExpWorkerThread+0x105
ffff8d0e`b2b80c10 fffff807`64fc99c8 : fffff807`60228180 ffffbc8a`22b5d040 fffff807`64f1e100 00ffffff`00ffffff : nt!PspSystemThreadStartup+0x55
ffff8d0e`b2b80c60 00000000`00000000 : ffff8d0e`b2b81000 ffff8d0e`b2b7b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: Wof!FileProvCompressWorkItem+72
MODULE_NAME: Wof
IMAGE_NAME: Wof.sys
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .cxr 0xffff8d0eb2b7ff70 ; kb
BUCKET_ID_FUNC_OFFSET: 72
FAILURE_BUCKET_ID: AV_Wof!FileProvCompressWorkItem
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {338de1a7-22ee-9aa6-796c-0520688fc10d}
Followup: MachineOwner
---------