Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\pc\Downloads\081920-89265-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff805`33800000 PsLoadedModuleList = 0xfffff805`3442a310
Debug session time: Wed Aug 19 17:20:24.418 2020 (UTC + 3:00)
System Uptime: 0 days 0:14:25.101
Loading Kernel Symbols
...............................................................
................................................................
..............................................................
Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`33bddb60 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffee84`97b4b9f0=000000000000007e
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff805359ae75c, The address that the exception occurred at
Arg3: ffffee8497b4c9e8, Exception Record Address
Arg4: ffffee8497b4c220, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 9265
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on PC-BILGISAYAR
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 76662
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff805359ae75c
BUGCHECK_P3: ffffee8497b4c9e8
BUGCHECK_P4: ffffee8497b4c220
EXCEPTION_RECORD: ffffee8497b4c9e8 -- (.exr 0xffffee8497b4c9e8)
ExceptionAddress: fffff805359ae75c (Ntfs+0x000000000000e75c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffee8497b4c220 -- (.cxr 0xffffee8497b4c220)
rax=ff12c88fa4ca71f0 rbx=0000000000000000 rcx=ffffc88fa1aa6700
rdx=ffffc88fa4b7bd70 rsi=ffffc88fa1c39010 rdi=ffff960c1f641b40
rip=fffff805359ae75c rsp=ffffee8497b4cc20 rbp=0000000000000000
r8=ffffc88fa4b7bd70 r9=0000000000000000 r10=ffffc88f9a320a40
r11=ffffc88fa1aa6700 r12=0000000000000000 r13=ffffc88fa1aa6708
r14=ffffc88fa1c39368 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286
Ntfs+0xe75c:
fffff805`359ae75c 4c8b7818 mov r15,qword ptr [rax+18h] ds:002b:ff12c88f`a4ca7208=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff805344fa388: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8053440f2a8: Unable to get Flags value from nt!KdVersionBlock
fffff8053440f2a8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffee84`97b4cc20 ffffe482`2e9d8800 : ffffc88f`00000001 ffffc88f`a1aa6708 00000000`00008000 00000000`00000000 : Ntfs+0xe75c
ffffee84`97b4cc28 ffffc88f`00000001 : ffffc88f`a1aa6708 00000000`00008000 00000000`00000000 ffffc88f`a1aa6708 : 0xffffe482`2e9d8800
ffffee84`97b4cc30 ffffc88f`a1aa6708 : 00000000`00008000 00000000`00000000 ffffc88f`a1aa6708 00000000`00000000 : 0xffffc88f`00000001
ffffee84`97b4cc38 00000000`00008000 : 00000000`00000000 ffffc88f`a1aa6708 00000000`00000000 ffff960c`1f641b40 : 0xffffc88f`a1aa6708
ffffee84`97b4cc40 00000000`00000000 : ffffc88f`a1aa6708 00000000`00000000 ffff960c`1f641b40 00000000`00000000 : 0x8000
SYMBOL_NAME: Ntfs+e75c
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
STACK_COMMAND: .cxr 0xffffee8497b4c220 ; kb
BUCKET_ID_FUNC_OFFSET: e75c
FAILURE_BUCKET_ID: AV_Ntfs!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e1bb7f54-6f4e-c7d4-3721-6d997dd2bd66}
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff805359ae75c, The address that the exception occurred at
Arg3: ffffee8497b4c9e8, Exception Record Address
Arg4: ffffee8497b4c220, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 7515
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on PC-BILGISAYAR
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 12698
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff805359ae75c
BUGCHECK_P3: ffffee8497b4c9e8
BUGCHECK_P4: ffffee8497b4c220
EXCEPTION_RECORD: ffffee8497b4c9e8 -- (.exr 0xffffee8497b4c9e8)
ExceptionAddress: fffff805359ae75c (Ntfs+0x000000000000e75c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffee8497b4c220 -- (.cxr 0xffffee8497b4c220)
rax=ff12c88fa4ca71f0 rbx=0000000000000000 rcx=ffffc88fa1aa6700
rdx=ffffc88fa4b7bd70 rsi=ffffc88fa1c39010 rdi=ffff960c1f641b40
rip=fffff805359ae75c rsp=ffffee8497b4cc20 rbp=0000000000000000
r8=ffffc88fa4b7bd70 r9=0000000000000000 r10=ffffc88f9a320a40
r11=ffffc88fa1aa6700 r12=0000000000000000 r13=ffffc88fa1aa6708
r14=ffffc88fa1c39368 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286
Ntfs+0xe75c:
fffff805`359ae75c 4c8b7818 mov r15,qword ptr [rax+18h] ds:002b:ff12c88f`a4ca7208=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8053440f2a8: Unable to get Flags value from nt!KdVersionBlock
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffee84`97b4cc20 ffffe482`2e9d8800 : ffffc88f`00000001 ffffc88f`a1aa6708 00000000`00008000 00000000`00000000 : Ntfs+0xe75c
ffffee84`97b4cc28 ffffc88f`00000001 : ffffc88f`a1aa6708 00000000`00008000 00000000`00000000 ffffc88f`a1aa6708 : 0xffffe482`2e9d8800
ffffee84`97b4cc30 ffffc88f`a1aa6708 : 00000000`00008000 00000000`00000000 ffffc88f`a1aa6708 00000000`00000000 : 0xffffc88f`00000001
ffffee84`97b4cc38 00000000`00008000 : 00000000`00000000 ffffc88f`a1aa6708 00000000`00000000 ffff960c`1f641b40 : 0xffffc88f`a1aa6708
ffffee84`97b4cc40 00000000`00000000 : ffffc88f`a1aa6708 00000000`00000000 ffff960c`1f641b40 00000000`00000000 : 0x8000
SYMBOL_NAME: Ntfs+e75c
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
STACK_COMMAND: .cxr 0xffffee8497b4c220 ; kb
BUCKET_ID_FUNC_OFFSET: e75c
FAILURE_BUCKET_ID: AV_Ntfs!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e1bb7f54-6f4e-c7d4-3721-6d997dd2bd66}
Followup: MachineOwner
---------