*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffff8301695a6468
Arg3: 0010000000000000
Arg4: 0000000000000000
Debugging Details:
------------------KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5671
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 19868
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffff82002dfed040
BUGCHECK_P3: 80000000000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: WerFaultSecure.exe
STACK_TEXT:
ffff8306`c33b6338 fffff807`7474ccaa : 00000000`0000001a 00000000`00041792 ffff8200`2dfed040 00800000`00000000 : nt!KeBugCheckEx
ffff8306`c33b6340 fffff807`7474b4df : ffffdc01`a3895740 00000000`00000000 ffff8200`00000002 00000000`00000000 : nt!MiDeleteVa+0x153a
ffff8306`c33b6440 fffff807`747229a0 : 00000000`00000001 ffff8306`00000000 ffffdc01`a3895590 ffffdc01`a36a9080 : nt!MiDeletePagablePteRange+0x48f
ffff8306`c33b6750 fffff807`74b0391b : ffffdc01`a36a9080 00000000`00000000 ffffdc01`00000000 ffffdc01`00000000 : nt!MiDeleteVad+0x360
ffff8306`c33b6860 fffff807`74b027af : ffffdc01`a3e60390 ffffdc01`a3e60390 ffffdc01`a3e4b620 ffffdc01`a38950c0 : nt!MiCleanVad+0x43
ffff8306`c33b6890 fffff807`749f164f : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffdc01`a38950c0 : nt!MmCleanProcessAddressSpace+0x137
ffff8306`c33b6910 fffff807`749e6f96 : ffffdc01`a38950c0 ffffa685`b26b2060 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x13b
ffff8306`c33b6990 fffff807`74a4a7ee : ffffdc01`00000000 00000000`00000001 00000256`aed31540 0000005b`fdabc000 : nt!PspExitThread+0x5f6
ffff8306`c33b6a90 fffff807`74806bb8 : ffffdc01`a38950c0 ffffdc01`a36a9080 ffff8306`c33b6b80 ffffdc01`a38950c0 : nt!NtTerminateProcess+0xde
ffff8306`c33b6b00 00007ffb`3d66c324 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000005b`fd97f8a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`3d66c324
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80439477479, The address that the exception occurred at
Arg3: ffffc401175fe198, Exception Record Address
Arg4: ffffc401175fd9d0, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 9203
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 29062
Key : Analysis.Memory.CommitPeak.Mb
Value: 86
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80439477479
BUGCHECK_P3: ffffc401175fe198
BUGCHECK_P4: ffffc401175fd9d0
EXCEPTION_RECORD: ffffc401175fe198 -- (.exr 0xffffc401175fe198)
ExceptionAddress: fffff80439477479 (nt!RtlSubtreePredecessor+0x0000000000000009)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffc401175fd9d0 -- (.cxr 0xffffc401175fd9d0)
rax=0010000000000000 rbx=ffffc50e975c0818 rcx=ffffc50e975c0818
rdx=ffffe78cb39e06c0 rsi=ffffe78cb5437890 rdi=ffffe78cb39e06c0
rip=fffff80439477479 rsp=ffffc401175fe3d8 rbp=ffffc50e975c0818
r8=ffffffffffffffff r9=7fffe78cb39e0688 r10=fffff80439475eb0
r11=ffffe78cabb40040 r12=ffffc50e975c0818 r13=ffffc50e975c0818
r14=ffffe78cb39e06c0 r15=ffffc50e975c0828
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
nt!RtlSubtreePredecessor+0x9:
fffff804`39477479 488b4810 mov rcx,qword ptr [rax+10h] ds:002b:00100000`00000010=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff80439efb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80439e0f340: Unable to get Flags value from nt!KdVersionBlock
fffff80439e0f340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffc401`175fe3d8 fffff804`39475f64 : ffffe78c`abb70748 ffffe78c`b5437890 ffffe78c`b39e0620 fffff804`38c1c6f2 : nt!RtlSubtreePredecessor+0x9
ffffc401`175fe3e0 fffff804`38be871c : 00000000`00000000 fffff804`394db1de ffffe78c`abb40040 ffffe78c`b39e0688 : nt!RtlDeleteNoSplay+0xb4
ffffc401`175fe410 fffff804`38c1c4d7 : ffffe78c`abb7072c fffff804`38c0a060 00000000`00000000 00000000`ffffbfff : FLTMGR!TreeUnlinkMulti+0xec
ffffc401`175fe460 fffff804`38be65be : ffffe78c`b47224e0 ffffe78c`b5437890 ffffc401`175fe589 00000000`00000000 : FLTMGR!FltpRemoveAllNamesCachedForFileObject+0x157
ffffc401`175fe4d0 fffff804`38be5b37 : ffffc401`175fe700 fffff804`394c8c02 ffffe78c`abb02900 00000000`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x89e
ffffc401`175fe5f0 fffff804`38be4b46 : ffffc401`175ff000 ffffc401`175f9000 ffffe78c`b82a8ba0 ffffc401`175fe710 : FLTMGR!FltpPassThroughInternal+0xc7
ffffc401`175fe640 fffff804`38be48bb : ffffffff`fffe7960 00000000`00000000 00000000`00000000 00000000`00000080 : FLTMGR!FltpPassThrough+0x1d6
ffffc401`175fe6e0 fffff804`394cd6c5 : ffffe78c`b5437890 fffff804`394cfec8 ffffe78c`abb43b90 ffffe78c`00000000 : FLTMGR!FltpDispatch+0x8b
ffffc401`175fe740 fffff804`398c5b7a : ffffe78c`b5437890 ffffc50e`938d5750 ffffe78c`abb02910 ffffe78c`abb02910 : nt!IofCallDriver+0x55
ffffc401`175fe780 fffff804`398bff00 : ffffc50e`938d5750 00000000`00000000 ffffe78c`a90c3e80 fffff804`39bb1019 : nt!IopDeleteFile+0x13a
ffffc401`175fe800 fffff804`394db967 : 00000000`00000000 00000000`00000000 ffffc50e`938d5750 ffffe78c`b5437890 : nt!ObpRemoveObjectRoutine+0x80
ffffc401`175fe860 fffff804`3949cb8e : 00000000`00000000 ffffe78c`b656ca90 ffffe78c`b656ca90 ffffe78c`b656ca90 : nt!ObfDereferenceObjectWithTag+0xc7
ffffc401`175fe8a0 fffff804`398f9a3d : 00000000`00088081 ffffe78c`b656ca90 fffff804`39e50c00 00000000`00088081 : nt!HalPutDmaAdapter+0xe
ffffc401`175fe8d0 fffff804`3958479d : 00000000`00000001 00000000`00000000 ffffc401`175fe9a0 ffffe78c`b656ca98 : nt!MiSegmentDelete+0x155
ffffc401`175fe920 fffff804`395b9079 : 00000000`00000000 fffff804`00000001 00000000`00000000 00000000`00000000 : nt!MiProcessDereferenceList+0xc1
ffffc401`175fe9e0 fffff804`394a29a5 : ffffe78c`abb40040 ffffe78c`abb40040 00000000`00000080 fffff804`395b8f50 : nt!MiDereferenceSegmentThread+0x129
ffffc401`175fec10 fffff804`395fc868 : ffff9d81`697d5180 ffffe78c`abb40040 fffff804`394a2950 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffc401`175fec60 00000000`00000000 : ffffc401`175ff000 ffffc401`175f9000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!RtlSubtreePredecessor+9
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.610
STACK_COMMAND: .cxr 0xffffc401175fd9d0 ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: AV_nt!RtlSubtreePredecessor
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {9c83f313-8194-6a8e-da2b-014e09f29178}
Followup: MachineOwner
---------*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff803442c955c, The address that the exception occurred at
Arg3: fffffa88e4a1b348, Exception Record Address
Arg4: fffffa88e4a1ab80, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 8843
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 29340
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff803442c955c
BUGCHECK_P3: fffffa88e4a1b348
BUGCHECK_P4: fffffa88e4a1ab80
EXCEPTION_RECORD: fffffa88e4a1b348 -- (.exr 0xfffffa88e4a1b348)
ExceptionAddress: fffff803442c955c (nt!RtlRbRemoveNode+0x000000000000031c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffffa88e4a1ab80 -- (.cxr 0xfffffa88e4a1ab80)
rax=ff7fa18392ce6888 rbx=ffffa18381200290 rcx=0000000000000048
rdx=ff7fa18392ce6888 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803442c955c rsp=fffffa88e4a1b588 rbp=ffffa18392cd3888
r8=ff7fa18392ce6888 r9=0000000000000000 r10=0000000000000001
r11=ffffa18392cd3888 r12=0000000000000000 r13=ffffa18392cce000
r14=0000000000000000 r15=ffffa18392cd8880
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
nt!RtlRbRemoveNode+0x31c:
fffff803`442c955c f6421001 test byte ptr [rdx+10h],1 ds:002b:ff7fa183`92ce6898=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff80344cfb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80344c0f340: Unable to get Flags value from nt!KdVersionBlock
fffff80344c0f340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffffa88`e4a1b588 fffff803`442c9000 : 00000000`0000008a ffffa183`92cd8fe0 00000000`00000000 ffffa183`92cd8880 : nt!RtlRbRemoveNode+0x31c
fffffa88`e4a1b5a0 fffff803`442c8a48 : ffffa183`81200280 ffffa183`92cce000 ffff8f87`45b1bd60 fffffa88`e4a1b6a8 : nt!RtlpHpVsChunkCoalesce+0xb0
fffffa88`e4a1b600 fffff803`442c73d4 : ffff8f87`00000000 ffff8f87`00000000 00000000`00000080 ffff8f87`00000000 : nt!RtlpHpVsContextFree+0x188
fffffa88`e4a1b6a0 fffff803`449b1019 : ffff8f87`00000890 ffffa183`92cd9010 ffffa183`92cd9010 01000000`00100000 : nt!ExFreeHeapPool+0x4d4
fffffa88`e4a1b780 fffff803`4433342f : 00000000`00000100 00000000`00000000 ffffd500`06918b10 ffffd500`06918b10 : nt!ExFreePool+0x9
fffffa88`e4a1b7b0 fffff803`44314202 : ffff8f87`51530750 fffffa88`e4a1b8d8 ffff8f87`51685911 ffff8f87`51530450 : nt!MiDeleteSubsectionPages+0x63f
fffffa88`e4a1b870 fffff803`446f997a : 00000000`00088089 00000000`00000000 fffff803`44c50c00 00000000`00088089 : nt!MiDeleteSegmentPages+0x56
fffffa88`e4a1b8d0 fffff803`4438479d : 00000000`00000001 00000000`00000000 fffffa88`e4a1b9a0 ffff8f87`515306d8 : nt!MiSegmentDelete+0x92
fffffa88`e4a1b920 fffff803`443b9079 : 00000000`00000000 fffff803`00000001 00000000`00000000 00000000`00000000 : nt!MiProcessDereferenceList+0xc1
fffffa88`e4a1b9e0 fffff803`442a29a5 : ffff8f87`45ce2040 ffff8f87`45ce2040 00000000`00000080 fffff803`443b8f50 : nt!MiDereferenceSegmentThread+0x129
fffffa88`e4a1bc10 fffff803`443fc868 : fffff803`40121180 ffff8f87`45ce2040 fffff803`442a2950 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffffa88`e4a1bc60 00000000`00000000 : fffffa88`e4a1c000 fffffa88`e4a16000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!ExFreePool+9
IMAGE_NAME: Pool_Corruption
IMAGE_VERSION: 10.0.19041.610
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xfffffa88e4a1ab80 ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: AV_nt!ExFreePool
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {2ae0a97e-dcd7-47ef-dbfb-430f2cbf58a1}
Followup: Pool_corruption
---------*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffff8301695a6468
Arg3: 0010000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 8390
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 31292
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffff8301695a6468
BUGCHECK_P3: 10000000000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: cleanmgr.exe
STACK_TEXT:
ffffb00c`30d25048 fffff805`5c14ccaa : 00000000`0000001a 00000000`00041792 ffff8301`695a6468 00100000`00000000 : nt!KeBugCheckEx
ffffb00c`30d25050 fffff805`5c0e9526 : 00000000`00000000 fffff805`5c0c4a8a 00000000`00000011 ffff8301`695a6468 : nt!MiDeleteVa+0x153a
ffffb00c`30d25150 fffff805`5c0e963b : ffff8341`00000000 ffffb502`e469a900 ffffb00c`00000000 ffffb00c`30d255c0 : nt!MiWalkPageTablesRecursively+0x776
ffffb00c`30d251f0 fffff805`5c0e963b : ffff8341`a0c05a50 ffffb502`e469a900 ffffb00c`00000001 ffffb00c`30d255d0 : nt!MiWalkPageTablesRecursively+0x88b
ffffb00c`30d25290 fffff805`5c0e963b : ffff8341`a0c05000 ffffb502`e469a900 ffffb00c`00000002 ffffb00c`30d255e0 : nt!MiWalkPageTablesRecursively+0x88b
ffffb00c`30d25330 fffff805`5c0d859b : 00004000`30d20110 ffffb502`e469a900 ffffb00c`00000003 ffffb00c`30d255f0 : nt!MiWalkPageTablesRecursively+0x88b
ffffb00c`30d253d0 fffff805`5c14b541 : ffffb00c`30d25570 ffffb502`00000000 fffff380`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b
ffffb00c`30d254d0 fffff805`5c1229a0 : 00000000`00000001 ffffb00c`00000000 ffffb502`e469a750 ffffb502`e18b8080 : nt!MiDeletePagablePteRange+0x4f1
ffffb00c`30d257e0 fffff805`5c11ae6f : 00000000`2d2b4e0a 00000000`00000000 ffffb502`00000000 fffff805`00000000 : nt!MiDeleteVad+0x360
ffffb00c`30d258f0 fffff805`5c4fadfc : ffffb00c`00000000 00000000`00000000 ffffb00c`30d25a50 000002d2`b4c80000 : nt!MiFreeVadRange+0xa3
ffffb00c`30d25950 fffff805`5c4fa8d5 : 00000000`00000000 000000f4`657fa298 ffff0eb0`f2a5a875 00007ffc`00000004 : nt!MmFreeVirtualMemory+0x4ec
ffffb00c`30d25aa0 fffff805`5c206bb8 : ffffb502`e18b8080 00000000`00000000 ffffb00c`30d25b80 ffffb502`e527cf90 : nt!NtFreeVirtualMemory+0x95
ffffb00c`30d25b00 00007ffc`4f72c164 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000f4`657fa3c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`4f72c164
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff801168c9fed, The address that the exception occurred at
Arg3: fffff50219be1f18, Exception Record Address
Arg4: fffff50219be1750, Context Record Address
Debugging Details:
------------------KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 9750
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 35081
Key : Analysis.Memory.CommitPeak.Mb
Value: 90
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff801168c9fed
BUGCHECK_P3: fffff50219be1f18
BUGCHECK_P4: fffff50219be1750
EXCEPTION_RECORD: fffff50219be1f18 -- (.exr 0xfffff50219be1f18)
ExceptionAddress: fffff801168c9fed (nt!RtlRbInsertNodeEx+0x000000000000008d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff50219be1750 -- (.cxr 0xfffff50219be1750)
rax=ffffb98247a9d788 rbx=ffffb98247e3d788 rcx=0000000000000000
rdx=ffffb9824fc83788 rsi=00000000000000e8 rdi=0000000000000001
rip=fffff801168c9fed rsp=fffff50219be2150 rbp=0000000000000000
r8=ff7fb982468f0788 r9=ffffb9824de39788 r10=ffffb98240600290
r11=0000000000000001 r12=0000000000000000 r13=ffffb982482bfca0
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
nt!RtlRbInsertNodeEx+0x8d:
fffff801`168c9fed 498b18 mov rbx,qword ptr [r8] ds:002b:ff7fb982`468f0788=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff801172fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8011720f340: Unable to get Flags value from nt!KdVersionBlock
fffff8011720f340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffff502`19be2150 fffff801`168c8c97 : ffffb982`46679000 fffff502`19be21d0 ffffb982`40600280 33333333`33333333 : nt!RtlRbInsertNodeEx+0x8d
fffff502`19be2160 fffff801`168c73d4 : 00000000`00000000 ffffb982`00000000 00000000`00000000 ffffcb09`00000000 : nt!RtlpHpVsContextFree+0x3d7
fffff502`19be2200 fffff801`16fb1019 : fffff502`00000220 00000000`00000000 ffffb982`4d999bc8 01000000`00100000 : nt!ExFreeHeapPool+0x4d4
fffff502`19be22e0 fffff801`12cfcca7 : ffffcb09`42142040 ffffcb09`44c08e88 00000000`ffff7fff ffffb982`4d999bc8 : nt!ExFreePool+0x9
fffff502`19be2310 fffff801`12cfc7c6 : ffffb982`4d999bc8 fffff801`12cea060 ffffb982`00000000 ffffffff`ffffffff : FLTMGR!FltReleaseFileNameInformation+0x127
fffff502`19be2350 fffff801`12cfc858 : ffffcb09`44c08e20 ffffcb09`3b7620a0 00000000`00000705 ffffffff`ffffffff : FLTMGR!DeleteNameCacheNodes+0x196
fffff502`19be23b0 fffff801`12cfcd8a : ffffcb09`44c08e20 ffffcb09`44c08e28 ffffcb09`44c08e20 ffffcb09`44c08e20 : FLTMGR!CleanupStreamListCtrl+0x80
fffff502`19be23f0 fffff801`16bcfb09 : ffffb982`4da101a8 ffffcb09`44c08e28 00000000`00000000 fffff502`19be28f0 : FLTMGR!DeleteStreamListCtrlCallback+0xba
fffff502`19be2430 fffff801`18e8c10b : ffffb982`4da10170 fffff502`19be2578 fffff502`19be28f0 00000000`00000705 : nt!FsRtlTeardownPerStreamContexts+0xc9
fffff502`19be2470 fffff801`18e8be96 : ffffb982`4da10170 ffffb982`4da02800 ffffb982`000004a7 fffff801`18d9db42 : Ntfs!NtfsDeleteScb+0x17b
fffff502`19be2510 fffff801`18d97b95 : 00000000`00000000 ffffb982`4da10170 ffffb982`4da0c9f8 00000000`00000000 : Ntfs!NtfsRemoveScb+0x66
fffff502`19be2570 fffff801`18e8bc2c : fffff502`19be28f0 fffff801`18ed7930 ffffb982`4da10010 ffffb982`4da10400 : Ntfs!NtfsPrepareFcbForRemoval+0x75
fffff502`19be25b0 fffff801`18d9bd40 : fffff502`19be28f0 fffff502`19be26b2 ffffb982`4da10468 ffffb982`4da10010 : Ntfs!NtfsTeardownStructures+0x9c
fffff502`19be2630 fffff801`18ebb4d7 : fffff502`19be2700 ffffb982`00000000 00000000`00000000 ffffb982`4da10000 : Ntfs!NtfsDecrementCloseCounts+0xb0
fffff502`19be2670 fffff801`18eb7ff1 : fffff502`19be28f0 ffffb982`4da10170 ffffb982`4da10010 ffffcb09`3b776180 : Ntfs!NtfsCommonClose+0x467
fffff502`19be2750 fffff801`18ed79b8 : 00000000`0000001c fffff801`17325440 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspCloseInternal+0x241
fffff502`19be28b0 fffff801`169034b5 : ffffcb09`42142040 fffff801`18ed7930 ffffcb09`37c6ca20 fffff801`00000000 : Ntfs!NtfsFspClose+0x88
fffff502`19be2b70 fffff801`168a29a5 : ffffcb09`42142040 00000000`00000080 ffffcb09`37c92040 00000000`00000000 : nt!ExpWorkerThread+0x105
fffff502`19be2c10 fffff801`169fc868 : ffff9281`351ea180 ffffcb09`42142040 fffff801`168a2950 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffff502`19be2c60 00000000`00000000 : fffff502`19be3000 fffff502`19bdd000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!ExFreePool+9
IMAGE_NAME: Pool_Corruption
IMAGE_VERSION: 10.0.19041.610
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xfffff50219be1750 ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: AV_nt!ExFreePool
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {2ae0a97e-dcd7-47ef-dbfb-430f2cbf58a1}
Followup: Pool_corruption
---------
drive.google.com
