ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8003b6d0028, Virtual address for the attempted write.
Arg2: 090000027aeaa021, PTE contents.
Arg3: ffff8285969ef230, (reserved)
Arg4: 000000000000000b, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 8
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-R1MKTM3
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 39
Key : Analysis.Memory.CommitPeak.Mb
Value: 70
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: be
BUGCHECK_P1: fffff8003b6d0028
BUGCHECK_P2: 90000027aeaa021
BUGCHECK_P3: ffff8285969ef230
BUGCHECK_P4: b
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff8285969ef230 -- (.trap 0xffff8285969ef230)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8003b6d0000 rbx=0000000000000000 rcx=0000000000002710
rdx=000000000000186a rsi=0000000000000000 rdi=0000000000000000
rip=fffff8003b6ce570 rsp=ffff8285969ef3c0 rbp=0000000000000006
r8=0000000000000000 r9=0000000000000000 r10=00000000000004a1
r11=0000000009ba47c7 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
DKTLFSMF+0xe570:
fffff800`3b6ce570 44895828 mov dword ptr [rax+28h],r11d ds:fffff800`3b6d0028=89402444
Resetting default scope
STACK_TEXT:
ffff8285`969eef88 fffff800`369e350c : 00000000`000000be fffff800`3b6d0028 09000002`7aeaa021 ffff8285`969ef230 : nt!KeBugCheckEx
ffff8285`969eef90 fffff800`36872edf : 960e888b`76e00001 00000000`00000003 00000000`00000000 fffff800`3b6d0028 : nt!MiSystemFault+0x1d67dc
ffff8285`969ef090 fffff800`369cf320 : 00000002`00000009 00000000`00000002 00000000`00000005 ffffa68d`0aa0ab40 : nt!MmAccessFault+0x34f
ffff8285`969ef230 fffff800`3b6ce570 : ffffa68d`0aa026d0 00000001`00000000 ffff8285`969ef4d8 ffffa68d`0aa026d0 : nt!KiPageFault+0x360
ffff8285`969ef3c0 ffffa68d`0aa026d0 : 00000001`00000000 ffff8285`969ef4d8 ffffa68d`0aa026d0 00000000`00000000 : DKTLFSMF+0xe570
ffff8285`969ef3c8 00000001`00000000 : ffff8285`969ef4d8 ffffa68d`0aa026d0 00000000`00000000 fffff800`3b6c9f7e : 0xffffa68d`0aa026d0
ffff8285`969ef3d0 ffff8285`969ef4d8 : ffffa68d`0aa026d0 00000000`00000000 fffff800`3b6c9f7e 00000000`00000000 : 0x00000001`00000000
ffff8285`969ef3d8 ffffa68d`0aa026d0 : 00000000`00000000 fffff800`3b6c9f7e 00000000`00000000 fffff800`3b6d0ac5 : 0xffff8285`969ef4d8
ffff8285`969ef3e0 00000000`00000000 : fffff800`3b6c9f7e 00000000`00000000 fffff800`3b6d0ac5 fffff800`3b6d0000 : 0xffffa68d`0aa026d0
SYMBOL_NAME: DKTLFSMF+e570
MODULE_NAME: DKTLFSMF
IMAGE_NAME: DKTLFSMF.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: e570
FAILURE_BUCKET_ID: 0xBE_DKTLFSMF!unknown_function
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {7379665e-c20d-49db-6657-191649525b32}
Followup: MachineOwner
Donanımsal ise de RAM vb bileşenler kontrol edilmelidir.
