[CODE title="Kod"]
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\maksu\Downloads\Compressed\011521-7312-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff801`40000000 PsLoadedModuleList = 0xfffff801`40c2a2b0
Debug session time: Fri Jan 15 13:54:11.063 2021 (UTC + 3:00)
System Uptime: 0 days 15:46:54.698
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff801`403f5780 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffb889`646b44e0=000000000000003b
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8014087638d, Address of the instruction which caused the bugcheck
Arg3: ffffb889646b4de0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6671
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G2EFLS9
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 10405
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8014087638d
BUGCHECK_P3: ffffb889646b4de0
BUGCHECK_P4: 0
CONTEXT: ffffb889646b4de0 -- (.cxr 0xffffb889646b4de0)
rax=ffffb889646b5818 rbx=ffffbc05138b1e30 rcx=0000020000000000
rdx=ffffb889646b5870 rsi=0000000000000000 rdi=ffffbc050bcc1ea0
rip=fffff8014087638d rsp=ffffb889646b57e0 rbp=ffffb889646b5a39
r8=0000000000000000 r9=7fffbc050bcc1ed0 r10=7ffffffffffffffc
r11=ffffb889646b5780 r12=0000000000000000 r13=0000000000000000
r14=ffffbc05138b1e00 r15=00000000ffff8009
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282
nt!CmpKeyEnumStackFreeResumeContext+0x1d:
fffff801`4087638d 0fb701 movzx eax,word ptr [rcx] ds:002b:00000200`00000000=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: GoogleCrashHandler64.exe
STACK_TEXT:
ffffb889`646b57e0 fffff801`407eb9f9 : ffffbc05`138b1e30 ffffb889`646b5a39 00000000`00000000 ffffbc05`0bcc1ea0 : nt!CmpKeyEnumStackFreeResumeContext+0x1d
ffffb889`646b5820 fffff801`405faef0 : ffff8087`c32c3ae0 ffffbc05`138b1e00 00000000`00000000 00000000`00000000 : nt!CmpDeleteKeyObject+0x1c9339
ffffb889`646b58b0 fffff801`40261277 : 00000000`00000000 00000000`00000000 ffffb889`646b5a39 ffffbc05`138b1e30 : nt!ObpRemoveObjectRoutine+0x80
ffffb889`646b5910 fffff801`4062887e : ffff8087`c32c3ae0 00000000`00000000 00000000`00000000 ffffbc05`10a9c340 : nt!ObfDereferenceObjectWithTag+0xc7
ffffb889`646b5950 fffff801`4062c4fc : 00000000`000000d0 00000000`00000000 00000000`00000000 fffff801`406358fa : nt!ObCloseHandleTableEntry+0x29e
ffffb889`646b5a90 fffff801`404071b8 : 00007ffd`9e727100 00000212`d1260000 ffffb889`646b5b80 ffff8087`cb97e080 : nt!NtClose+0xec
ffffb889`646b5b00 00007ffd`9f5ac194 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000001f`dacff7a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`9f5ac194
SYMBOL_NAME: nt!CmpKeyEnumStackFreeResumeContext+1d
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .cxr 0xffffb889646b4de0 ; kb
BUCKET_ID_FUNC_OFFSET: 1d
FAILURE_BUCKET_ID: 0x3B_c0000005_nt!CmpKeyEnumStackFreeResumeContext
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b7a0748a-2b44-5712-9569-e12b3062e779}
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\maksu\Downloads\Compressed\123120-6203-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff806`40800000 PsLoadedModuleList = 0xfffff806`4142a2b0
Debug session time: Thu Dec 31 12:05:04.100 2020 (UTC + 3:00)
System Uptime: 1 days 10:30:08.734
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
.................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`40bf5780 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffef08`f3792230=000000000000007e
8: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80640bfd6b7, The address that the exception occurred at
Arg3: ffffef08f3793228, Exception Record Address
Arg4: ffffef08f3792a60, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 9984
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G2EFLS9
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 23209
Key : Analysis.Memory.CommitPeak.Mb
Value: 80
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80640bfd6b7
BUGCHECK_P3: ffffef08f3793228
BUGCHECK_P4: ffffef08f3792a60
EXCEPTION_RECORD: ffffef08f3793228 -- (.exr 0xffffef08f3793228)
ExceptionAddress: fffff80640bfd6b7 (nt!ExpInterlockedPopEntrySListFault)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffef08f3792a60 -- (.cxr 0xffffef08f3792a60)
rax=00000007e86b0004 rbx=ffff80050baae4e8 rcx=fffff8064144eae0
rdx=ec126ad6e6a5ebe0 rsi=0000000000000010 rdi=0000000000000000
rip=fffff80640bfd6b7 rsp=ffffef08f3793460 rbp=0000000000000001
r8=ec126ad6e6a5ebe0 r9=0000000000000000 r10=fffff8064144eae0
r11=0000000000000000 r12=ffff80050baae508 r13=ffff80050baae460
r14=fffff8064144c6c0 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282
nt!ExpInterlockedPopEntrySListFault:
fffff806`40bfd6b7 498b08 mov rcx,qword ptr [r8] ds:002b:ec126ad6`e6a5ebe0=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff806414fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8064140f330: Unable to get Flags value from nt!KdVersionBlock
fffff8064140f330: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffef08`f3793460 fffff806`40a24cf4 : ffffd90a`3d492148 fffff806`41450b40 00000000`00000001 ffff8005`0baae460 : nt!ExpInterlockedPopEntrySListFault
ffffef08`f3793470 fffff806`40aba39c : ffff8005`0baae4e8 ffffef08`f3793579 00000000`00000000 00000000`00000019 : nt!MiGetInPageSupportBlock+0x40
ffffef08`f37934a0 fffff806`40e3ea63 : ffff8005`0baae460 00000000`00000000 ffff8004`00000011 00000000`00000000 : nt!MiPfPutPagesInTransition+0x1bc
ffffef08`f37935e0 fffff806`40abe39f : ffff8005`0a633a20 ffffef08`f37937f0 ffff8005`0baae460 ffff8005`0dec5500 : nt!MmPrefetchForCacheManager+0xb7
ffffef08`f3793640 fffff806`40bb2bb0 : ffff8005`00004000 00000000`00000000 00000000`00024000 ffff8004`fa132080 : nt!CcAsyncReadPrefetch+0x13f
ffffef08`f37936f0 fffff806`40b17e25 : ffff8004`fa132080 ffff8004`fa132080 fffff806`40bb2a20 ffff8004`fa3e8420 : nt!CcAsyncReadWorker+0x190
ffffef08`f3793c10 fffff806`40bfcdd8 : ffff9500`d6e40180 ffff8004`fa132080 fffff806`40b17dd0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffef08`f3793c60 00000000`00000000 : ffffef08`f3794000 ffffef08`f378e000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiGetInPageSupportBlock+40
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .cxr 0xffffef08f3792a60 ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 40
FAILURE_BUCKET_ID: AV_nt!MiGetInPageSupportBlock
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ca996487-bb12-da65-51b7-f25961015b60}
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\maksu\Downloads\Compressed\010521-7140-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff803`7f600000 PsLoadedModuleList = 0xfffff803`8022a2b0
Debug session time: Tue Jan 5 20:10:53.223 2021 (UTC + 3:00)
System Uptime: 2 days 0:06:07.857
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..
Loading User Symbols
Loading unloaded module list
..............................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`7f9f5780 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffbb06`2b84be70=000000000000001a
8: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
contains the address of the PFN for the corrupted page table page.
On a 32 bit OS, parameter 2 contains a pointer to the number of used
PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffff10006fb1a80
Arg3: 0000000000000068
Arg4: 0000000000000069
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4937
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-G2EFLS9
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 7521
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41790
BUGCHECK_P2: fffff10006fb1a80
BUGCHECK_P3: 68
BUGCHECK_P4: 69
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MsMpEng.exe
STACK_TEXT:
ffffbb06`2b84be68 fffff803`7f89a5da : 00000000`0000001a 00000000`00041790 fffff100`06fb1a80 00000000`00000068 : nt!KeBugCheckEx
ffffbb06`2b84be70 fffff803`7f89ad6e : 00000000`00000000 ffffbb06`2b84c580 fffff081`1f182000 ffffbb06`2b84c4d0 : nt!MiDeletePteRun+0x17da
ffffbb06`2b84c080 fffff803`7f80bedd : 00000000`00000000 ffff9485`3f288700 ffffbb06`2b84c4d0 fffff081`1f181ea0 : nt!MiDeleteVaTail+0x6e
ffffbb06`2b84c0b0 fffff803`7f80bafb : fffff0f8`00000000 ffff9485`3f288700 ffffbb06`00000000 ffffbb06`2b84c520 : nt!MiWalkPageTablesRecursively+0xc6d
ffffbb06`2b84c150 fffff803`7f80bafb : fffff0f8`7c2047c0 ffff9485`3f288700 ffffbb06`00000001 ffffbb06`2b84c530 : nt!MiWalkPageTablesRecursively+0x88b
ffffbb06`2b84c1f0 fffff803`7f80bafb : fffff0f8`7c204000 ffff9485`3f288700 ffffbb06`00000002 ffffbb06`2b84c540 : nt!MiWalkPageTablesRecursively+0x88b
ffffbb06`2b84c290 fffff803`7f85de6b : 00000000`00000000 ffff9485`3f288700 00000000`00000003 ffffbb06`2b84c550 : nt!MiWalkPageTablesRecursively+0x88b
ffffbb06`2b84c330 fffff803`7f89b991 : ffffbb06`2b84c4d0 ffff9485`00000000 00000000`00000002 fffff803`00000000 : nt!MiWalkPageTables+0x36b
ffffbb06`2b84c430 fffff803`7f86baf0 : 00000000`00000001 ffffbb06`00000000 ffff9485`3f288550 ffff9485`3f280080 : nt!MiDeletePagablePteRange+0x4f1
ffffbb06`2b84c740 fffff803`7fc35343 : ffff9485`3f280080 00000000`00000000 ffff9485`00000000 ffff9485`00000000 : nt!MiDeleteVad+0x360
ffffbb06`2b84c850 fffff803`7fc335ff : ffff9485`436a5540 ffff9485`436a5540 ffff9485`4ba34b70 ffff9485`3f288080 : nt!MiCleanVad+0x43
ffffbb06`2b84c880 fffff803`7fc5d6e4 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffff9485`3f288080 : nt!MmCleanProcessAddressSpace+0x137
ffffbb06`2b84c900 fffff803`7fd06596 : ffff9485`3f288080 ffff8186`2a068060 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffffbb06`2b84c990 fffff803`7fd09a8e : ffff9485`00000000 00000000`00000001 00000000`00000000 000000b0`79d79000 : nt!PspExitThread+0x5f6
ffffbb06`2b84ca90 fffff803`7fa071b8 : ffff9485`3f288080 ffff9485`3f280080 ffffbb06`2b84cb80 00000000`000007b2 : nt!NtTerminateProcess+0xde
ffffbb06`2b84cb00 00007ffa`d948c534 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000b0`79a9f958 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`d948c534
SYMBOL_NAME: nt!MiDeletePteRun+17da
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 17da
FAILURE_BUCKET_ID: 0x1a_41790_nt!MiDeletePteRun
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {27ce5d5a-97b1-faf0-183f-c86809269d56}
Followup: MachineOwner
---------
[/CODE]
