PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffeff7c01a4010, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: 0000000000000000, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000006, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 8218
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 26618
Key : Analysis.Init.CPU.mSec
Value: 1093
Key : Analysis.Init.Elapsed.mSec
Value: 2698
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffeff7c01a4010
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 6
READ_ADDRESS: fffff803200fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffeff7c01a4010
MM_INTERNAL_CODE: 6
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffff68b34852b00 -- (.trap 0xfffff68b34852b00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffeff7fbfdf000 rbx=0000000000000000 rcx=ffffef8034802c28
rdx=ffffeff7c01a4010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8031f62fc88 rsp=fffff68b34852c90 rbp=ffffcc858aff0c00
r8=ffffef8000000000 r9=0000007ffffffff8 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MmCheckCachedPageStates+0xe8:
fffff803`1f62fc88 488b1a mov rbx,qword ptr [rdx] ds:ffffeff7`c01a4010=????????????????
Resetting default scope
STACK_TEXT:
fffff68b`348527d8 fffff803`1f887678 : 00000000`00000050 ffffeff7`c01a4010 00000000`00000000 ffffeff7`fbe00d20 : nt!KeBugCheckEx
fffff68b`348527e0 fffff803`1f728cfd : fffff68b`34852a20 fffff68b`34852960 fffff68b`34852968 fffff68b`34852978 : nt!MiZeroFault+0x161988
fffff68b`348528d0 fffff803`1f727f7a : 00000000`00000001 00000000`00000000 fffff68b`34852b80 00000000`00000000 : nt!MiUserFault+0x80d
fffff68b`34852960 fffff803`1f804d5e : ffffb78c`bbe03000 00000000`00000000 00000000`00001000 00000000`00000000 : nt!MmAccessFault+0x16a
fffff68b`34852b00 fffff803`1f62fc88 : fffff68b`00000000 fffff803`1f715841 ffffcc85`75002340 00000000`000000d0 : nt!KiPageFault+0x35e
fffff68b`34852c90 fffff803`1f62facd : 00000000`00000000 fffff68b`34853098 00000000`00000000 ffffcc85`8aff0c38 : nt!MmCheckCachedPageStates+0xe8
fffff68b`34852e60 fffff803`1f62e5b5 : 00000000`00001001 00000000`00001000 00000000`ffffff01 fffff68b`00000000 : nt!CcMapAndRead+0xdd
fffff68b`34852ec0 fffff803`1f9fbed9 : fffff68b`34853260 fffff68b`34853098 ffffcc85`00001000 00000000`00000000 : nt!CcPinFileData+0x975
fffff68b`34852fd0 fffff803`2506919f : 00000000`00000000 ffffffff`fe414000 00000000`00001000 fffff68b`34853260 : nt!CcPinRead+0xd9
fffff68b`34853090 fffff803`25098a12 : 00000000`00000000 ffffcc85`8bab8180 ffffffff`fe414000 ffffcc85`00000001 : Ntfs!NtfsPinStream+0xa3
fffff68b`348530e0 fffff803`250f905d : fffff68b`34853378 fffff68b`348539b9 ffffb78c`b9fd6080 ffffcc85`8aff0c38 : Ntfs!PinAttributeForRestart+0x92
fffff68b`34853120 fffff803`2516098f : ffffcc85`8aff0c38 ffffb78c`b9fd6080 ffffb78c`b9fd60a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
fffff68b`34853220 fffff803`250aacd1 : ffffcc85`8aff0c38 00000000`00000000 ffffcc85`8a7380e0 fffff68b`348533d0 : Ntfs!RedoPass+0x5cb
fffff68b`34853370 fffff803`250b65b9 : ffffcc85`8bab81c0 ffffcc85`8bab8180 00000000`00000000 ffffcc85`8bab81c0 : Ntfs!NtfsRestartVolume+0x165
fffff68b`348534e0 fffff803`25026e03 : ffffcc85`8aff0c38 00000000`0191bdda 00000000`24f2eb00 fffff803`24f52ef9 : Ntfs!NtfsMountVolume+0x1259
fffff68b`34853950 fffff803`24f2f214 : ffffcc85`8aff0c38 fffff803`24f2ebc0 00000000`00000000 ffffcc85`8aff0c38 : Ntfs!NtfsCommonFileSystemControl+0xcf
fffff68b`34853a20 fffff803`1f741225 : ffffcc85`85f49040 ffffcc85`85f49040 ffffcc85`7567aa20 ffffcc85`00000000 : Ntfs!NtfsFspDispatch+0x654
fffff68b`34853b70 fffff803`1f6f53b5 : ffffcc85`85f49040 00000000`00000080 ffffcc85`75697180 00000000`00000001 : nt!ExpWorkerThread+0x105
fffff68b`34853c10 fffff803`1f7fe278 : fffff803`1cf8c180 ffffcc85`85f49040 fffff803`1f6f5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
fffff68b`34853c60 00000000`00000000 : fffff68b`34854000 fffff68b`3484e000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiZeroFault+161988
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1052
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 161988
FAILURE_BUCKET_ID: AV_R_INVALID_nt!MiZeroFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4012c162-8821-abc7-6952-420de1d68bbf}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8058042ff89, The address that the exception occurred at
Arg3: ffffe200fa867a58, Exception Record Address
Arg4: ffffe200fa867290, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 9843
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 24775
Key : Analysis.Init.CPU.mSec
Value: 1186
Key : Analysis.Init.Elapsed.mSec
Value: 2942
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8058042ff89
BUGCHECK_P3: ffffe200fa867a58
BUGCHECK_P4: ffffe200fa867290
EXCEPTION_RECORD: ffffe200fa867a58 -- (.exr 0xffffe200fa867a58)
ExceptionAddress: fffff8058042ff89 (nt!MmCheckCachedPageStates+0x00000000000003e9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00002000000001b0
Attempt to read from address 00002000000001b0
CONTEXT: ffffe200fa867290 -- (.cxr 0xffffe200fa867290)
rax=0000000000000023 rbx=000000000041f600 rcx=ffffe200fa867d40
rdx=0000200000000198 rsi=ffff95800c5e2000 rdi=0000000000000007
rip=fffff8058042ff89 rsp=ffffe200fa867c90 rbp=ffff800ebfc2ec00
r8=ffffc88000000000 r9=0000007ffffffff8 r10=0000000fffffffff
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=ffffc8c0075b6ea0
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!MmCheckCachedPageStates+0x3e9:
fffff805`8042ff89 488b5218 mov rdx,qword ptr [rdx+18h] ds:002b:00002000`000001b0=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff80580efb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
00002000000001b0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00002000000001b0
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffe200`fa867c90 fffff805`8042facd : 00000000`00000000 ffffe200`fa868098 00000000`00000000 ffff800e`bfc2ec78 : nt!MmCheckCachedPageStates+0x3e9
ffffe200`fa867e60 fffff805`8042e5b5 : 00000000`00001001 00000000`00001000 00000000`ffffff01 ffffe200`00000000 : nt!CcMapAndRead+0xdd
ffffe200`fa867ec0 fffff805`807fbed9 : ffffe200`fa868260 ffffe200`fa868098 ffff800e`00001000 00000000`00000000 : nt!CcPinFileData+0x975
ffffe200`fa867fd0 fffff805`84e6919f : 00000000`00000000 ffffffff`fe414000 00000000`00001000 ffffe200`fa868260 : nt!CcPinRead+0xd9
ffffe200`fa868090 fffff805`84e98a12 : 00000000`00000000 ffff800e`c2447180 ffffffff`fe414000 ffff800e`00000001 : Ntfs!NtfsPinStream+0xa3
ffffe200`fa8680e0 fffff805`84ef905d : ffffe200`fa868378 ffffe200`fa8689b9 ffffb605`40bd6080 ffff800e`bfc2ec78 : Ntfs!PinAttributeForRestart+0x92
ffffe200`fa868120 fffff805`84f6098f : ffff800e`bfc2ec78 ffffb605`40bd6080 ffffb605`40bd60a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
ffffe200`fa868220 fffff805`84eaacd1 : ffff800e`bfc2ec78 00000000`00000000 ffff800e`c244c0e0 ffffe200`fa8683d0 : Ntfs!RedoPass+0x5cb
ffffe200`fa868370 fffff805`84eb65b9 : ffff800e`c24471c0 ffff800e`c2447180 00000000`00000000 ffff800e`c24471c0 : Ntfs!NtfsRestartVolume+0x165
ffffe200`fa8684e0 fffff805`84e26e03 : ffff800e`bfc2ec78 00000000`0191bdda 00000000`84d2eb00 fffff805`84d52ef9 : Ntfs!NtfsMountVolume+0x1259
ffffe200`fa868950 fffff805`84d2f214 : ffff800e`bfc2ec78 fffff805`84d2ebc0 00000000`00000000 ffff800e`bfc2ec78 : Ntfs!NtfsCommonFileSystemControl+0xcf
ffffe200`fa868a20 fffff805`80541225 : ffff800e`c1110040 ffff800e`c1110040 ffff800e`b4caabf0 ffff800e`00000000 : Ntfs!NtfsFspDispatch+0x654
ffffe200`fa868b70 fffff805`804f53b5 : ffff800e`c1110040 00000000`00000080 ffff800e`b4c97240 000fa425`bd9bbfff : nt!ExpWorkerThread+0x105
ffffe200`fa868c10 fffff805`805fe278 : fffff805`7cca0180 ffff800e`c1110040 fffff805`804f5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffe200`fa868c60 00000000`00000000 : ffffe200`fa869000 ffffe200`fa863000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MmCheckCachedPageStates+3e9
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1052
STACK_COMMAND: .cxr 0xffffe200fa867290 ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 3e9
FAILURE_BUCKET_ID: AV_nt!MmCheckCachedPageStates
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3400d3f2-0a18-41fd-5365-e00970cc23e4}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80113a48e1d, The address that the exception occurred at
Arg3: ffff8707756ec8d8, Exception Record Address
Arg4: ffff8707756ec110, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullPtr
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 8703
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 26792
Key : Analysis.Init.CPU.mSec
Value: 1155
Key : Analysis.Init.Elapsed.mSec
Value: 2697
Key : Analysis.Memory.CommitPeak.Mb
Value: 85
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80113a48e1d
BUGCHECK_P3: ffff8707756ec8d8
BUGCHECK_P4: ffff8707756ec110
EXCEPTION_RECORD: ffff8707756ec8d8 -- (.exr 0xffff8707756ec8d8)
ExceptionAddress: fffff80113a48e1d (nt!MiAddViewsForSection+0x000000000000001d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
CONTEXT: ffff8707756ec110 -- (.cxr 0xffff8707756ec110)
rax=0000000000000000 rbx=000fffffffffe440 rcx=0000000000000000
rdx=000fffffffffe440 rsi=ffff8707756ecdc0 rdi=ffff8707756ecdd0
rip=fffff80113a48e1d rsp=ffff8707756ecb10 rbp=ffff8707756ecba9
r8=0000000000000005 r9=0000000000000000 r10=0000000000000040
r11=ffff8707756ecbe0 r12=ffffc48a200d0590 r13=0000000000000001
r14=ffffc48a12de4158 r15=0000000000000040
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!MiAddViewsForSection+0x1d:
fffff801`13a48e1d 4c8b39 mov r15,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff801144fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffff8707`756ecb10 fffff801`13b45b64 : 00000000`0000029c 000fffff`ffffe440 00000000`00000000 00000000`000009d2 : nt!MiAddViewsForSection+0x1d
ffff8707`756ecc10 fffff801`13b4702e : ffffffff`fe400000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmMapViewInSystemCache+0xc4
ffff8707`756ecd90 fffff801`13a2f85a : ffffffff`fe400000 ffffc48a`00000000 00000000`00000000 00000000`00000001 : nt!CcGetVacbMiss+0xce
ffff8707`756ece20 fffff801`13a2dcf7 : ffffc48a`00000000 fffff801`00000001 ffff8707`756ecf00 ffff8707`756ecf08 : nt!CcGetVirtualAddress+0x33a
ffff8707`756ecec0 fffff801`13dfbed9 : ffff8707`756ed260 ffff8707`756ed098 ffffc48a`00001000 00000000`00000000 : nt!CcPinFileData+0xb7
ffff8707`756ecfd0 fffff801`19a6919f : 00000000`00000000 ffffffff`fe414000 00000000`00001000 ffff8707`756ed260 : nt!CcPinRead+0xd9
ffff8707`756ed090 fffff801`19a98a12 : 00000000`00000000 ffffc48a`2054c180 ffffffff`fe414000 ffffc48a`00000001 : Ntfs!NtfsPinStream+0xa3
ffff8707`756ed0e0 fffff801`19af905d : ffff8707`756ed378 ffff8707`756ed9b9 ffffa100`bffd6080 ffffc48a`1f502d48 : Ntfs!PinAttributeForRestart+0x92
ffff8707`756ed120 fffff801`19b6098f : ffffc48a`1f502d48 ffffa100`bffd6080 ffffa100`bffd60a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
ffff8707`756ed220 fffff801`19aaacd1 : ffffc48a`1f502d48 00000000`00000000 ffffc48a`205510e0 ffff8707`756ed3d0 : Ntfs!RedoPass+0x5cb
ffff8707`756ed370 fffff801`19ab65b9 : ffffc48a`2054c1c0 ffffc48a`2054c180 00000000`00000000 ffffc48a`2054c1c0 : Ntfs!NtfsRestartVolume+0x165
ffff8707`756ed4e0 fffff801`19a26e03 : ffffc48a`1f502d48 00000000`0191bdda 00000000`1992eb00 fffff801`19952ef9 : Ntfs!NtfsMountVolume+0x1259
ffff8707`756ed950 fffff801`1992f214 : ffffc48a`1f502d48 fffff801`1992ebc0 00000000`00000000 ffffc48a`1f502d48 : Ntfs!NtfsCommonFileSystemControl+0xcf
ffff8707`756eda20 fffff801`13b41225 : ffffc48a`1f2e5040 ffffc48a`1f2e5040 ffffc48a`12c74b70 ffffc48a`00000000 : Ntfs!NtfsFspDispatch+0x654
ffff8707`756edb70 fffff801`13af53b5 : ffffc48a`1f2e5040 00000000`00000080 ffffc48a`12c97180 000fa425`bd9bbfff : nt!ExpWorkerThread+0x105
ffff8707`756edc10 fffff801`13bfe278 : ffffe681`40d5c180 ffffc48a`1f2e5040 fffff801`13af5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8707`756edc60 00000000`00000000 : ffff8707`756ee000 ffff8707`756e8000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiAddViewsForSection+1d
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1052
STACK_COMMAND: .cxr 0xffff8707756ec110 ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 1d
FAILURE_BUCKET_ID: AV_nt!MiAddViewsForSection
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5737f6ec-d210-baf6-6144-afbb01d4f054}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8054282e470, The address that the exception occurred at
Arg3: ffffee02a4cb4c88, Exception Record Address
Arg4: ffffee02a4cb44c0, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 7842
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 22897
Key : Analysis.Init.CPU.mSec
Value: 1077
Key : Analysis.Init.Elapsed.mSec
Value: 3203
Key : Analysis.Memory.CommitPeak.Mb
Value: 86
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8054282e470
BUGCHECK_P3: ffffee02a4cb4c88
BUGCHECK_P4: ffffee02a4cb44c0
EXCEPTION_RECORD: ffffee02a4cb4c88 -- (.exr 0xffffee02a4cb4c88)
ExceptionAddress: fffff8054282e470 (nt!CcPinFileData+0x0000000000000830)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000000000028aa1e
Attempt to read from address 000000000028aa1e
CONTEXT: ffffee02a4cb44c0 -- (.cxr 0xffffee02a4cb44c0)
rax=0000000000000000 rbx=fffffffffe415000 rcx=ffffb883f629ca00
rdx=00000000000002fd rsi=00000000ffffffff rdi=000000000028aa1e
rip=fffff8054282e470 rsp=ffffee02a4cb4ec0 rbp=ffffb883f3c3d518
r8=0000000000000000 r9=0000000000001000 r10=0000000000000000
r11=ffffee02a4cb5088 r12=0000000000000001 r13=ffffb883f5fc1d70
r14=ffffee02a4cb5098 r15=fffffffffe414000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!CcPinFileData+0x830:
fffff805`4282e470 663917 cmp word ptr [rdi],dx ds:002b:00000000`0028aa1e=????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff805432fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
000000000028aa1e
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 000000000028aa1e
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
ffffee02`a4cb4ec0 fffff805`42bfbed9 : ffffee02`a4cb5260 ffffee02`a4cb5098 ffffb883`00001000 00000000`00000000 : nt!CcPinFileData+0x830
ffffee02`a4cb4fd0 fffff805`4766919f : 00000000`00000000 ffffffff`fe414000 00000000`00001000 ffffee02`a4cb5260 : nt!CcPinRead+0xd9
ffffee02`a4cb5090 fffff805`47698a12 : 00000000`00000000 ffffb883`f73e2180 ffffffff`fe414000 ffffb883`00000001 : Ntfs!NtfsPinStream+0xa3
ffffee02`a4cb50e0 fffff805`476f905d : ffffee02`a4cb5378 ffffee02`a4cb59b9 ffffdd8a`e9116080 ffffb883`f3c3d518 : Ntfs!PinAttributeForRestart+0x92
ffffee02`a4cb5120 fffff805`4776098f : ffffb883`f3c3d518 ffffdd8a`e9116080 ffffdd8a`e91160a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
ffffee02`a4cb5220 fffff805`476aacd1 : ffffb883`f3c3d518 00000000`00000000 ffffb883`f5c900e0 ffffee02`a4cb53d0 : Ntfs!RedoPass+0x5cb
ffffee02`a4cb5370 fffff805`476b65b9 : ffffb883`f73e21c0 ffffb883`f73e2180 00000000`00000000 ffffb883`f73e21c0 : Ntfs!NtfsRestartVolume+0x165
ffffee02`a4cb54e0 fffff805`47626e03 : ffffb883`f3c3d518 00000000`0191bdda 00000000`4752eb00 fffff805`47552ef9 : Ntfs!NtfsMountVolume+0x1259
ffffee02`a4cb5950 fffff805`4752f214 : ffffb883`f3c3d518 fffff805`4752ebc0 00000000`00000000 ffffb883`f3c3d518 : Ntfs!NtfsCommonFileSystemControl+0xcf
ffffee02`a4cb5a20 fffff805`42941225 : ffffb883`f6065080 ffffb883`f6065080 ffffb883`e9a7aa20 00000000`00000000 : Ntfs!NtfsFspDispatch+0x654
ffffee02`a4cb5b70 fffff805`428f53b5 : ffffb883`f6065080 00000000`00000080 ffffb883`e9a97240 000fa425`bd9bbfff : nt!ExpWorkerThread+0x105
ffffee02`a4cb5c10 fffff805`429fe278 : ffff9480`bd2d0180 ffffb883`f6065080 fffff805`428f5360 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffee02`a4cb5c60 00000000`00000000 : ffffee02`a4cb6000 ffffee02`a4cb0000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!CcPinFileData+830
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1052
STACK_COMMAND: .cxr 0xffffee02a4cb44c0 ; kb
BUCKET_ID_FUNC_OFFSET: 830
FAILURE_BUCKET_ID: AV_nt!CcPinFileData
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {b8f31abd-0bab-dd40-d93b-2ea5c337f628}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80412448e1d, The address that the exception occurred at
Arg3: fffff9875862e8d8, Exception Record Address
Arg4: fffff9875862e110, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullPtr
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 13077
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 34027
Key : Analysis.Init.CPU.mSec
Value: 1108
Key : Analysis.Init.Elapsed.mSec
Value: 2320
Key : Analysis.Memory.CommitPeak.Mb
Value: 86
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff80412448e1d
BUGCHECK_P3: fffff9875862e8d8
BUGCHECK_P4: fffff9875862e110
EXCEPTION_RECORD: fffff9875862e8d8 -- (.exr 0xfffff9875862e8d8)
ExceptionAddress: fffff80412448e1d (nt!MiAddViewsForSection+0x000000000000001d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000
CONTEXT: fffff9875862e110 -- (.cxr 0xfffff9875862e110)
rax=0000000000000000 rbx=000fffffffffe440 rcx=0000000000000000
rdx=000fffffffffe440 rsi=fffff9875862edc0 rdi=fffff9875862edd0
rip=fffff80412448e1d rsp=fffff9875862eb10 rbp=fffff9875862eba9
r8=0000000000000005 r9=0000000000000000 r10=0000000000000040
r11=fffff9875862ebe0 r12=ffffd987c51045d0 r13=0000000000000001
r14=ffffd987b8a19940 r15=0000000000000040
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!MiAddViewsForSection+0x1d:
fffff804`12448e1d 4c8b39 mov r15,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff80412efb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000000
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffff987`5862eb10 fffff804`12545b64 : 00000000`0000004a 000fffff`ffffe440 00000000`00000000 00000000`000009d2 : nt!MiAddViewsForSection+0x1d
fffff987`5862ec10 fffff804`1254702e : ffffffff`fe400000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmMapViewInSystemCache+0xc4
fffff987`5862ed90 fffff804`1242f85a : ffffffff`fe400000 ffffd987`00000000 00000000`00000000 00000000`00000001 : nt!CcGetVacbMiss+0xce
fffff987`5862ee20 fffff804`1242dcf7 : ffffd987`00000000 fffff804`00000001 fffff987`5862ef00 fffff987`5862ef08 : nt!CcGetVirtualAddress+0x33a
fffff987`5862eec0 fffff804`127fbed9 : fffff987`5862f260 fffff987`5862f098 ffffd987`00001000 00000000`00000000 : nt!CcPinFileData+0xb7
fffff987`5862efd0 fffff804`1466919f : 00000000`00000000 ffffffff`fe414000 00000000`00001000 fffff987`5862f260 : nt!CcPinRead+0xd9
fffff987`5862f090 fffff804`14698a12 : 00000000`00000000 ffffd987`b6148180 ffffffff`fe414000 ffffd987`00000001 : Ntfs!NtfsPinStream+0xa3
fffff987`5862f0e0 fffff804`146f905d : fffff987`5862f378 fffff987`5862f9b9 ffffb509`7b416080 ffffd987`b6ad2a28 : Ntfs!PinAttributeForRestart+0x92
fffff987`5862f120 fffff804`1476098f : ffffd987`b6ad2a28 ffffb509`7b416080 ffffb509`7b4160a8 00000000`00000000 : Ntfs!DoAction+0x5fc91
fffff987`5862f220 fffff804`146aacd1 : ffffd987`b6ad2a28 00000000`00000000 ffffd987`b6ae60e0 fffff987`5862f3d0 : Ntfs!RedoPass+0x5cb
fffff987`5862f370 fffff804`146b65b9 : ffffd987`b61481c0 ffffd987`b6148180 00000000`00000000 ffffd987`b61481c0 : Ntfs!NtfsRestartVolume+0x165
fffff987`5862f4e0 fffff804`14626e03 : ffffd987`b6ad2a28 00000000`0191bdda 00000000`1452eb00 fffff804`14552ef9 : Ntfs!NtfsMountVolume+0x1259
fffff987`5862f950 fffff804`1452f214 : ffffd987`b6ad2a28 fffff804`1452ebc0 00000000`00000000 ffffd987`b6ad2a28 : Ntfs!NtfsCommonFileSystemControl+0xcf
fffff987`5862fa20 fffff804`12541225 : ffffd987`aa8e3040 ffffd987`aa8e3040 ffffd987`aa6aabf0 fffff804`00000000 : Ntfs!NtfsFspDispatch+0x654
fffff987`5862fb70 fffff804`124f53b5 : ffffd987`aa8e3040 00000000`00000080 ffffd987`aa697180 07a0b25c`00000001 : nt!ExpWorkerThread+0x105
fffff987`5862fc10 fffff804`125fe278 : fffff804`0c564180 ffffd987`aa8e3040 fffff804`124f5360 22000761`00000000 : nt!PspSystemThreadStartup+0x55
fffff987`5862fc60 00000000`00000000 : fffff987`58630000 fffff987`5862a000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiAddViewsForSection+1d
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1052
STACK_COMMAND: .cxr 0xfffff9875862e110 ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 1d
FAILURE_BUCKET_ID: AV_nt!MiAddViewsForSection
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5737f6ec-d210-baf6-6144-afbb01d4f054}
Followup: MachineOwner
---------
drive.google.com
www.technopat.net
