************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit.
UseExperimentalFeatureForNugetShare : false.
AllowNugetExeUpdate : false.
- Configuring repositories.
----> Repository : LocalInstalled, Enabled: true.
----> Repository : UserExtensions, Enabled: true.
************* Waiting for Debugger Extensions Gallery to Initialize **************
.
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 36.
Microsoft (R) Windows Debugger Version 10.0.25324.1001 AMD64.
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\bugra\Desktop\041623-7968-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (20 procs) Free x64.
Product: WinNt, suite: TerminalServer SingleUserTS.
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Kernel base = 0xfffff806`35600000 PsLoadedModuleList = 0xfffff806`3622a310
Debug session time: Sun Apr 16 20:38:52.510 2023 (UTC + 3:00)
System Uptime: 0 days 0:00:13.126
Loading Kernel Symbols.
...............................................................
................................................................
................................................................
............................
Loading User Symbols.
Loading unloaded module list.
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`359f3ea0 48894c2408 mov qword ptr [rsp+8],rcx ss:fffff60a`36187430=000000000000000a
19: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an.
interrupt request level (IRQL) that is too high. This is usually.
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced.
Arg2: 0000000000000002, IRQL.
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg4: fffff8064e6b5195, address which referenced memory.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 1655.
Key : Analysis.Elapsed.mSec
Value: 6941.
Key : Analysis.IO.Other.Mb
Value: 11.
Key : Analysis.IO.Read.Mb
Value: 2
Key : Analysis.IO.Write.Mb
Value: 18.
Key : Analysis.Init.CPU.mSec
Value: 155.
Key : Analysis.Init.Elapsed.mSec
Value: 24909.
Key : Analysis.Memory.CommitPeak.Mb
Value: 129.
Key : Bugcheck.Code.LegacyAPI
Value: 0xd1.
Key : Failure.Bucket
Value: AV_rtf64x64!unknown_function
Key : Failure.Hash
Value: {91d6f247-f02b-bde9-35b3-efc844316e53}
Key : WER.OS.Branch
Value: vb_release.
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: d1.
BUGCHECK_P1: 8
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8064e6b5195.
FILE_IN_CAB: 041623-7968-01.dmp
READ_ADDRESS: fffff806362fa390: Unable to get MiVisibleState.
Unable to get NonPagedPoolStart.
Unable to get NonPagedPoolEnd.
Unable to get PagedPoolStart.
Unable to get PagedPoolEnd.
unable to get nt!MmSpecialPagesInUse
0000000000000008.
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System.
TRAP_FRAME: fffff60a36187570 -- (.trap 0xfffff60a36187570)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=ffffe388cdd575a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8064e6b5195 rsp=fffff60a36187700 rbp=fffff60a36187810
r8=ffffe388cfe5417c r9=0000000000000000 r10=00000000ffffffff
r11=0000000000000137 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy.
rtf64x64+0x5195:
fffff806`4e6b5195 48397808 cmp qword ptr [rax+8],rdi ds:00000000`00000008=????????????????
Resetting default scope.
STACK_TEXT:
fffff60a`36187428 fffff806`35a05e69 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff60a`36187430 fffff806`35a02169 : 00000000`00000000 00000000`746c6946 00000000`000000e0 00000000`00000cfc : nt!KiBugCheckDispatch+0x69
fffff60a`36187570 fffff806`4e6b5195 : 00000000`00000000 ffffe388`cdd575a0 ffffb4a0`58c8a27e 00000000`00000001 : nt!KiPageFault+0x469
fffff60a`36187700 00000000`00000000 : ffffe388`cdd575a0 ffffb4a0`58c8a27e 00000000`00000001 ffffe388`bcddf8a0 : rtf64x64+0x5195
SYMBOL_NAME: rtf64x64+5195
MODULE_NAME: rtf64x64.
IMAGE_NAME: rtf64x64.sys
STACK_COMMAND: .cxr; .ecxr ; kb.
BUCKET_ID_FUNC_OFFSET: 5195.
FAILURE_BUCKET_ID: AV_rtf64x64!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release.
OSPLATFORM_TYPE: x64.
OSNAME: Windows 10.
FAILURE_ID_HASH: {91d6f247-f02b-bde9-35b3-efc844316e53}
Followup: MachineOwner.
---------
19: kd> lmvm rtf64x64.
Browse full module list.
start end module name.
fffff806`4e6b0000 fffff806`4e6c1000 rtf64x64 T (no symbols)
Loaded symbol image file: rtf64x64.sys
Image path: \SystemRoot\system32\DRIVERS\rtf64x64.sys
Image name: rtf64x64.sys
Browse all global symbols functions data.
Timestamp: Fri Aug 27 06:00:42 2021 (6128555A)
CheckSum: 00019C8A.
ImageSize: 00011000.
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
drive.google.com
Bu da dump dosyaları.
