Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\maksu\Desktop\112620-13062-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff803`58800000 PsLoadedModuleList = 0xfffff803`5942a3b0
Debug session time: Thu Nov 26 22:15:28.144 2020 (UTC + 3:00)
System Uptime: 0 days 2:41:43.824
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`58bf5210 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffcd01`ee4060e0=000000000000004e
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000002, A list entry was corrupt
Arg2: 00000000001ce5e3, entry in list being removed
Arg3: 000000000041f37f, highest physical page number
Arg4: 00000000000000f0, reference count of entry being removed
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6421
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G2EFLS9
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 13327
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 4e
BUGCHECK_P1: 2
BUGCHECK_P2: 1ce5e3
BUGCHECK_P3: 41f37f
BUGCHECK_P4: f0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: steam.exe
STACK_TEXT:
ffffcd01`ee4060d8 fffff803`58af5a09 : 00000000`0000004e 00000000`00000002 00000000`001ce5e3 00000000`0041f37f : nt!KeBugCheckEx
ffffcd01`ee4060e0 fffff803`58b1d2df : ffff9b00`056b1ac0 00000000`00000001 00000000`00000005 ffff9b00`056b1ce0 : nt!MiUnlinkPageFromList+0xc89
ffffcd01`ee406170 fffff803`58b39922 : 00000000`00000000 ffff9b00`03c44d00 00000000`00000001 ffff9b00`056b1cd0 : nt!MiUnlinkStandbyBatch+0x16f
ffffcd01`ee4061b0 fffff803`58b37b5f : 00000000`00005600 00000000`05600000 00000000`00040000 ffffa20d`8afdc970 : nt!MmCheckCachedPageStates+0x12f2
ffffcd01`ee406380 fffff803`58f008f0 : 00000000`05600000 00000000`00000000 00000000`00000001 ffffcd01`ee406490 : nt!CcFetchDataForRead+0x8f
ffffcd01`ee4063e0 fffff803`58b378f9 : ffffa20d`8d45b270 00000000`05600000 00000000`00040000 ffffa20d`89c82001 : nt!CcMapAndCopyFromCache+0xe0
ffffcd01`ee406480 fffff803`5b539fdd : ffffa20d`8525c900 ffffa20d`00000000 ffffd088`0401d414 00000000`0903a825 : nt!CcCopyReadEx+0x139
ffffcd01`ee406530 fffff803`550a73fb : 00000000`00000000 ffffcd01`ee406908 ffffcd01`ee4068c8 00000000`10a28020 : Ntfs!NtfsCopyReadA+0x2ed
ffffcd01`ee406820 fffff803`550a44d7 : ffffcd01`ee406930 ffffcd01`ee4068c8 ffffa20d`8a00a160 ffffa20d`8a00a060 : FLTMGR!FltpPerformFastIoCall+0x16b
ffffcd01`ee406880 fffff803`550db405 : ffffcd01`ee407000 ffffcd01`ee401000 ffffa20d`89c82080 fffff803`58eefbce : FLTMGR!FltpPassThroughFastIo+0x107
ffffcd01`ee406900 fffff803`58eb97bf : ffffa20d`8d93ec30 00000000`00000000 00000000`00000000 ffffa20d`00000000 : FLTMGR!FltpFastIoRead+0x165
ffffcd01`ee4069b0 fffff803`58c06bb8 : 00000000`00000e60 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x37f
ffffcd01`ee406a90 00000000`77d61cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`09aaef18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77d61cfc
SYMBOL_NAME: nt!MiUnlinkPageFromList+c89
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: c89
FAILURE_BUCKET_ID: 0x4E_2_nt!MiUnlinkPageFromList
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b084f841-86a9-e353-1d26-a04cfe7406b4}
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\maksu\Desktop\112620-12656-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`82c00000 PsLoadedModuleList = 0xfffff800`8382a3b0
Debug session time: Thu Nov 26 22:23:50.349 2020 (UTC + 3:00)
System Uptime: 0 days 0:05:57.029
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
.......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`82ff5210 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff386`b946f420=000000000000000a
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff00082f28246, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000084, value 0 = read operation, 1 = write operation
Arg4: fffff00082f28246, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6655
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G2EFLS9
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 9169
Key : Analysis.Memory.CommitPeak.Mb
Value: 83
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: d1
BUGCHECK_P1: fffff00082f28246
BUGCHECK_P2: ff
BUGCHECK_P3: 84
BUGCHECK_P4: fffff00082f28246
READ_ADDRESS: fffff800838fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8008380f340: Unable to get Flags value from nt!KdVersionBlock
fffff8008380f340: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
fffff00082f28246
ADDITIONAL_DEBUG_TEXT: The trap occurred when interrupts are disabled on the target.
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffff386b946f560 -- (.trap 0xfffff386b946f560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffd589e0663c08
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff00082f28246 rsp=fffff386b946f6f0 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000414 r10=ffffd589e0663c08
r11=0000000000000048 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na po nc
fffff000`82f28246 ?? ???
Resetting default scope
FAILED_INSTRUCTION_ADDRESS:
+0
fffff000`82f28246 ?? ???
STACK_TEXT:
fffff386`b946f418 fffff800`83007169 : 00000000`0000000a fffff000`82f28246 00000000`000000ff 00000000`00000084 : nt!KeBugCheckEx
fffff386`b946f420 fffff800`83003469 : ffff760f`ca6e6e27 00000000`00000000 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff386`b946f560 fffff000`82f28246 : 00000f00`0000015f 00000f00`0000002d 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x469
fffff386`b946f6f0 00000f00`0000015f : 00000f00`0000002d 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff000`82f28246
fffff386`b946f6f8 00000f00`0000002d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00000f00`0000015f
fffff386`b946f700 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd589`e410b330 : 0x00000f00`0000002d
SYMBOL_NAME: nt!KiPageFault+469
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 469
FAILURE_BUCKET_ID: DISABLED_INTERRUPT_FAULT_CODE_AV_BAD_IP_nt!KiPageFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {f2ab72c5-099d-9077-bfcf-ba12aa825b36}
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\maksu\Desktop\112620-15812-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff804`6bc00000 PsLoadedModuleList = 0xfffff804`6c82a3b0
Debug session time: Thu Nov 26 22:17:24.724 2020 (UTC + 3:00)
System Uptime: 0 days 0:01:30.403
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
.......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff804`6bff5210 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd38e`a95023f0=0000000000000139
8: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd38ea9502710, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd38ea9502668, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 7593
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G2EFLS9
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 10535
Key : Analysis.Memory.CommitPeak.Mb
Value: 85
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffd38ea9502710
BUGCHECK_P3: ffffd38ea9502668
BUGCHECK_P4: 0
TRAP_FRAME: ffffd38ea9502710 -- (.trap 0xffffd38ea9502710)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000081 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff8384397a5ac8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8046bec4a53 rsp=ffffd38ea95028a0 rbp=ffffd7013cb01180
r8=ffff8384397a5ad8 r9=ffff8384397a5ad8 r10=0000000000000080
r11=ffffd38ea9502900 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!KeSetEvent+0xb3:
fffff804`6bec4a53 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd38ea9502668 -- (.exr 0xffffd38ea9502668)
ExceptionAddress: fffff8046bec4a53 (nt!KeSetEvent+0x00000000000000b3)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Discord.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffd38e`a95023e8 fffff804`6c007169 : 00000000`00000139 00000000`00000003 ffffd38e`a9502710 ffffd38e`a9502668 : nt!KeBugCheckEx
ffffd38e`a95023f0 fffff804`6c007590 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd38e`a9502530 fffff804`6c005923 : ffffc0c3`eed44408 00000000`00000000 00000000`00000008 ffffd38e`a95027b0 : nt!KiFastFailDispatch+0xd0
ffffd38e`a9502710 fffff804`6bec4a53 : 00000000`00000000 ffffc087`02f67d20 ffff8384`398e18e0 ffffd701`3cb01180 : nt!KiRaiseSecurityCheckFailure+0x323
ffffd38e`a95028a0 ffffc0c3`ee059c88 : ffff8384`397a5ac0 ffffd38e`a95029d9 ffffc087`02d208a0 ffff8384`39a16d00 : nt!KeSetEvent+0xb3
ffffd38e`a9502930 ffffc0c3`ee05966a : 00000000`00000001 00000000`00000401 00000000`00000000 00000000`00000000 : win32kfull!_PostTransformableMessageExtended+0x3b8
ffffd38e`a9502a30 ffffc0c3`edec723d : ffff8384`39b560c0 ffffd38e`a9502b80 00000000`00000000 00000000`00000000 : win32kfull!NtUserPostMessage+0x13a
ffffd38e`a9502ac0 fffff804`6c006bb8 : ffff8384`39b560c0 ffff8384`398db960 ffffd38e`a9502b80 ffffd38e`a9502b80 : win32k!NtUserPostMessage+0x15
ffffd38e`a9502b00 00007ff9`6a420134 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`0dcde8d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`6a420134
SYMBOL_NAME: win32kfull!_PostTransformableMessageExtended+3b8
MODULE_NAME: win32kfull
IMAGE_NAME: win32kfull.sys
IMAGE_VERSION: 10.0.19041.630
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 3b8
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_win32kfull!_PostTransformableMessageExtended
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e9ad042f-96b5-a2de-b479-d19b84616aa3}
Followup: MachineOwner
---------
