shyzeq
Hectopat
- Katılım
- 2 Eylül 2019
- Mesajlar
- 566
- Çözümler
- 3
Birkaç gündür sık sık farklı kodlarda mavi ekran almaya başladım ve en sonuncusu da bugün oldu. En son aldığım mavi ekranın minidump kodları
Kod:
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802`34200000 PsLoadedModuleList = 0xfffff802`34e2a3b0
Debug session time: Mon Nov 16 20:24:16.030 2020 (UTC + 3:00)
System Uptime: 0 days 7:26:17.679
Loading Kernel Symbols
...............................................................
............Page 357250 not present in the dump file. Type ".hh dbgerr004" for details
....................................................
Page 3ca78c not present in the dump file. Type ".hh dbgerr004" for details
.Page 3c7625 not present in the dump file. Type ".hh dbgerr004" for details
.Page 3c7afa not present in the dump file. Type ".hh dbgerr004" for details
.....................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000082`77929018). Type ".hh dbgerr001" for details
Loading unloaded module list
......................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`345f5210 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffb8c`5ff864f0=000000000000003b
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff802344c6e09, Address of the instruction which caused the bugcheck
Arg3: fffffb8c5ff86df0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
Page 3ca78c not present in the dump file. Type ".hh dbgerr004" for details
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3906
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-O3OL2QL
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 12189
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff802344c6e09
BUGCHECK_P3: fffffb8c5ff86df0
BUGCHECK_P4: 0
CONTEXT: fffffb8c5ff86df0 -- (.cxr 0xfffffb8c5ff86df0)
rax=00000000000000e5 rbx=ffffae8fcf994030 rcx=fffff80234200000
rdx=0000000000000000 rsi=0000000000000070 rdi=000000003c98bafa
rip=fffff802344c6e09 rsp=fffffb8c5ff877f0 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000070 r10=0000000000000000
r11=ffffb47858000000 r12=000000003c98bafa r13=0000000000000005
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050256
nt!PspReturnQuota+0x49:
fffff802`344c6e09 488b1f mov rbx,qword ptr [rdi] ds:002b:00000000`3c98bafa=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: audiodg.exe
STACK_TEXT:
fffffb8c`5ff877f0 fffff802`348c008b : 00000000`000007bc ffffae8f`cf994030 ffffae8f`c1ac2a60 00000000`3c98bafa : nt!PspReturnQuota+0x49
fffffb8c`5ff87850 fffff802`348bff08 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpFreeObject+0x12b
fffffb8c`5ff878b0 fffff802`344db967 : 00000000`00000000 00000000`00000000 fffffb8c`5ff87a39 ffffae8f`cf994060 : nt!ObpRemoveObjectRoutine+0x88
fffffb8c`5ff87910 fffff802`348ed70e : ffffae8f`c1ac2a60 00000000`00000001 ffffffff`ffffffff ffff850d`5d9d9df0 : nt!ObfDereferenceObjectWithTag+0xc7
fffffb8c`5ff87950 fffff802`348f138c : 00000000`0000077c fffffb8c`5ff87b80 ffffae8f`d39ba080 ffffae8f`d3055680 : nt!ObCloseHandleTableEntry+0x29e
fffffb8c`5ff87a90 fffff802`34606bb8 : ffffae8f`d39ba000 00000187`531a0000 fffffb8c`5ff87b80 ffffae8f`00000000 : nt!NtClose+0xec
fffffb8c`5ff87b00 00007ff9`d6bcbf84 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000082`77afd568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`d6bcbf84
SYMBOL_NAME: nt!PspReturnQuota+49
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
STACK_COMMAND: .cxr 0xfffffb8c5ff86df0 ; kb
BUCKET_ID_FUNC_OFFSET: 49
FAILURE_BUCKET_ID: 0x3B_c0000005_nt!PspReturnQuota
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4f7a12a3-e780-e96e-652a-4cb63b354224}
Followup: MachineOwner
---------
5: kd> lmvm nt
Browse full module list
start end module name
fffff802`34200000 fffff802`35246000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\15B12C74F0E177581B6B27DD4C5022C21\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\Dbg\sym\ntoskrnl.exe\64EBCC571046000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 64EBCC57 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00A5A624
ImageSize: 01046000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Son düzenleyen: Moderatör:
