KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff804558389b3, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2765
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-62N06FT
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 16426
Key : Analysis.Memory.CommitPeak.Mb
Value: 88
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff804558389b3
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffffffffffff
READ_ADDRESS: fffff80455d733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80455c2a3c8: Unable to get Flags value from nt!KdVersionBlock
fffff80455c2a3c8: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
EXCEPTION_PARAMETER2: ffffffffffffffff
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: explorer.exe
TRAP_FRAME: 7501ef8348205b8d -- (.trap 0x7501ef8348205b8d)
Unable to read trap frame at 7501ef83`48205b8d
BAD_STACK_POINTER: ffffbb01e899f8f8
STACK_TEXT:
ffffbb01`e899f8f8 fffff804`55a2fd3f : 00000000`0000001e ffffffff`c0000005 fffff804`558389b3 00000000`00000000 : nt!KeBugCheckEx
ffffbb01`e899f900 fffff804`559c20a2 : 24648348`28244489 48ffdbb3`d5e80020 7501ef83`48205b8d c0336024`5c8b48c1 : nt!KiDispatchException+0x16859f
ffffbb01`e899ffb0 fffff804`559c2070 : fffff804`559d3216 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffff8004`c80abb98 fffff804`559d3216 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatchOnExceptionStackContinue
ffff8004`c80abba0 fffff804`559cefa2 : 00000000`40a90088 00000000`00000000 00000000`00000000 ffffbb01`e8549100 : nt!KiExceptionDispatch+0x116
ffff8004`c80abd80 fffff804`558389b3 : ffff8004`c80abf20 ffffa50f`fef29cf0 ffffa50f`f35a6080 ffffa50f`f35a6080 : nt!KiGeneralProtectionFault+0x322
ffff8004`c80abf18 ffffa50f`fef2ac10 : fffff804`00000000 ffffa50f`fef2ac10 ffff8004`c80ac0f9 ffff8004`c80ac0f9 : nt!ExpReleaseResourceExclusiveForThreadLite+0x253
ffff8004`c80abfd8 fffff804`00000000 : ffffa50f`fef2ac10 ffff8004`c80ac0f9 ffff8004`c80ac0f9 fffff804`00000000 : 0xffffa50f`fef2ac10
ffff8004`c80abfe0 ffffa50f`fef2ac10 : ffff8004`c80ac0f9 ffff8004`c80ac0f9 fffff804`00000000 fffff804`55901850 : 0xfffff804`00000000
ffff8004`c80abfe8 ffff8004`c80ac0f9 : ffff8004`c80ac0f9 fffff804`00000000 fffff804`55901850 ffff8d47`243d9c03 : 0xffffa50f`fef2ac10
ffff8004`c80abff0 ffff8004`c80ac0f9 : fffff804`00000000 fffff804`55901850 ffff8d47`243d9c03 00000000`00000000 : 0xffff8004`c80ac0f9
ffff8004`c80abff8 fffff804`00000000 : fffff804`55901850 ffff8d47`243d9c03 00000000`00000000 ffffa50f`fef2ac70 : 0xffff8004`c80ac0f9
ffff8004`c80ac000 fffff804`5590184f : ffff8d47`243d9c03 00000000`00000000 ffffa50f`fef2ac70 00000000`00000000 : 0xfffff804`00000000
ffff8004`c80ac008 ffff8d47`243d9c03 : 00000000`00000000 ffffa50f`fef2ac70 00000000`00000000 ffff8004`c80abfd0 : nt!KiComputeDueTime+0xaf
ffff8004`c80ac010 ffff8d47`243d9b7b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : win32kbase!IsValidGuiThreadContext+0x33
ffff8004`c80ac040 ffff8d47`240eaf5c : 00000000`00000000 00000000`00001cff 00000000`00000001 00000000`ffffffff : win32kbase!EnterCrit+0x16b
ffff8004`c80ac160 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x4c
SYMBOL_NAME: win32kbase!IsValidGuiThreadContext+33
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
IMAGE_VERSION: 10.0.18362.10024
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 33
FAILURE_BUCKET_ID: 0x1E_c0000005_R_STACKPTR_ERROR_win32kbase!IsValidGuiThreadContext
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {f69d4e45-c477-ff5f-7e30-685dd2eac9b8}
Followup: MachineOwner
---------
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffc48121b4b1b0
Arg3: 00000000e68997d8
Arg4: fffff803126b787b
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4764
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-62N06FT
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 27709
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7f
BUGCHECK_P1: 8
BUGCHECK_P2: ffffc48121b4b1b0
BUGCHECK_P3: e68997d8
BUGCHECK_P4: fffff803126b787b
TRAP_FRAME: ffffc48121b4b1b0 -- (.trap 0xffffc48121b4b1b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc48121b40180 rbx=0000000000000000 rcx=000055f27001be99
rdx=0000003a028f5035 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803126b787b rsp=00000000e68997d8 rbp=ffffb283e79bb010
r8=0000005e761185d4 r9=0000000000000000 r10=fffff80311cfa940
r11=ffffb4798be00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na po nc
hal!KeQueryPerformanceCounter+0xbb:
fffff803`126b787b 5e pop rsi
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
BAD_STACK_POINTER: 00000000e68997d8
STACK_TEXT:
ffffc481`21b4b068 fffff803`11dd30e9 : 00000000`0000007f 00000000`00000008 ffffc481`21b4b1b0 00000000`e68997d8 : nt!KeBugCheckEx
ffffc481`21b4b070 fffff803`11dcdf45 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffc481`21b4b1b0 fffff803`126b787b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0x2c5
00000000`e68997d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!KeQueryPerformanceCounter+0xbb
SYMBOL_NAME: nt!KiDoubleFaultAbort+2c5
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.18362.418
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 2c5
FAILURE_BUCKET_ID: 0x7f_8_STACKPTR_ERROR_nt!KiDoubleFaultAbort
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c5b9990d-856b-1bb5-7662-4621e5941c84}
Followup: MachineOwner
---------
