Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\hazar\AppData\Local\Temp\7zO84DBC7DE\013121-7109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (24 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff803`41800000 PsLoadedModuleList = 0xfffff803`4242a2b0
Debug session time: Sat Jan 30 23:33:09.348 2021 (UTC + 3:00)
System Uptime: 0 days 6:39:20.987
Loading Kernel Symbols
...............................................................
................................................................
...............................................................
Loading User Symbols
Loading unloaded module list
................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`41bf5780 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffcb08`a943bd10=00000000000000be
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffab818b5d92f8, Virtual address for the attempted write.
Arg2: 8a00000000200121, PTE contents.
Arg3: ffffcb08a943bf00, (reserved)
Arg4: 000000000000000a, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2874
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-0H5DIQU
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 7394
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: be
BUGCHECK_P1: ffffab818b5d92f8
BUGCHECK_P2: 8a00000000200121
BUGCHECK_P3: ffffcb08a943bf00
BUGCHECK_P4: a
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: StartMenuExper
TRAP_FRAME: ffffcb08a943bf00 -- (.trap 0xffffcb08a943bf00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe08000000000 rbx=0000000000000000 rcx=0000000000000001
rdx=ffffe08000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80341a20fae rsp=ffffcb08a943c090 rbp=0000000000000000
r8=0000000000000000 r9=000000003d00116c r10=8000000000000000
r11=ffffcb08a943c118 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!MiWsleFree+0x17e:
fffff803`41a20fae f0480fba2e3f lock bts qword ptr [rsi],3Fh ds:00000000`00000000=????????????????
Resetting default scope
STACK_TEXT:
ffffcb08`a943bd08 fffff803`41c62ec8 : 00000000`000000be ffffab81`8b5d92f8 8a000000`00200121 ffffcb08`a943bf00 : nt!KeBugCheckEx
ffffcb08`a943bd10 fffff803`41a0ca4f : 8a000000`00200121 00000000`00000003 ffffcb08`a943bf80 00000000`00000000 : nt!MiRaisedIrqlFault+0x16caac
ffffcb08`a943bd60 fffff803`41c0395e : 00000000`003efa90 ffffab80`0bcefbc0 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x4ef
ffffcb08`a943bf00 fffff803`41a20fae : ffffcb08`a943c7f0 fffff803`41a20cbe ffffcb08`a943c158 00000001`00000001 : nt!KiPageFault+0x35e
ffffcb08`a943c090 fffff803`41a2043b : ffff840d`19313740 00007ff9`00000000 00000000`00000000 86000083`c9dba001 : nt!MiWsleFree+0x17e
ffffcb08`a943c120 fffff803`41af1cea : ffffcb08`a943c7d8 ffffab80`0a172c70 ffffab80`0a172c70 ffff840d`19313740 : nt!MiFreeWsleList+0x1bb
ffffcb08`a943c2f0 fffff803`41af1b15 : 00000000`00000000 86000003`5d0ed005 ffffe0bf`fcf24368 ffffcb08`a943c7d0 : nt!MiEmptyWorkingSetHelper+0x1b6
ffffcb08`a943c350 fffff803`41a0b9e6 : 00000000`00000000 ffffcb08`a943c770 00000000`00000000 ffff840d`19313740 : nt!MiEmptyPte+0x95
ffffcb08`a943c380 fffff803`41a0bafb : ffffe0f0`00000000 ffff840d`19313740 00000000`00000000 ffffcb08`a943c770 : nt!MiWalkPageTablesRecursively+0x776
ffffcb08`a943c420 fffff803`41a0bafb : ffffe0f0`00000000 ffff840d`19313740 00000000`00000001 ffffcb08`a943c780 : nt!MiWalkPageTablesRecursively+0x88b
ffffcb08`a943c4c0 fffff803`41a0bafb : ffffe0f0`00000000 ffff840d`19313740 00000000`00000002 ffffcb08`a943c790 : nt!MiWalkPageTablesRecursively+0x88b
ffffcb08`a943c560 fffff803`41a5de6b : fffff803`00000000 ffff840d`19313740 00000000`00000003 ffffcb08`a943c7a0 : nt!MiWalkPageTablesRecursively+0x88b
ffffcb08`a943c600 fffff803`41b0c3a3 : ffffcb08`a943c720 00000000`00000000 00000000`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b
ffffcb08`a943c700 fffff803`41c31f77 : 00000000`00000000 ffff840d`19313740 ffffd001`297b41c0 00000000`00000000 : nt!MiEmptyWorkingSetInitiate+0x107
ffffcb08`a943c8d0 fffff803`41a5c817 : 00000000`00000000 ffffcb08`a943ca00 ffffcb08`a943ca40 00000000`00000000 : nt!MiTrimOrAgeWorkingSet+0x1d5337
ffffcb08`a943c9c0 fffff803`41a40560 : fffff803`42450b40 ffffcb08`a943ca80 00000000`00002247 ffff840d`00000200 : nt!MiProcessWorkingSets+0x227
ffffcb08`a943ca60 fffff803`41bb4f8c : 00000000`00000004 00000000`00000003 00000000`ffffffff ffffd001`28a79180 : nt!MiWorkingSetManager+0x110
ffffcb08`a943cb20 fffff803`41b17e25 : ffff840d`0c361080 00000000`00000080 fffff803`41bb4ce0 00047ea7`00000004 : nt!KeBalanceSetManager+0x2ac
ffffcb08`a943cc10 fffff803`41bfcdd8 : ffffd001`28337180 ffff840d`0c361080 fffff803`41b17dd0 00000000`00009000 : nt!PspSystemThreadStartup+0x55
ffffcb08`a943cc60 00000000`00000000 : ffffcb08`a943d000 ffffcb08`a9437000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiRaisedIrqlFault+16caac
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 16caac
FAILURE_BUCKET_ID: 0xBE_nt!MiRaisedIrqlFault
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {1c5b4d11-09e0-def3-d2d0-70a11d69b92d}
Followup: MachineOwner
---------
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: fffff2bffe74ef88
Arg3: 0000008000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3968
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-0H5DIQU
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 6623
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: fffff2bffe74ef88
BUGCHECK_P3: 8000000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: OAWrapper.exe
STACK_TEXT:
ffff838a`8ba2ff78 fffff807`51a9d0fa : 00000000`0000001a 00000000`00041792 fffff2bf`fe74ef88 00000080`00000000 : nt!KeBugCheckEx
ffff838a`8ba2ff80 fffff807`51a0b9e6 : 00000000`00000000 00000000`00000000 00000000`00000070 fffff2bf`fe74ef88 : nt!MiDeleteVa+0x153a
ffff838a`8ba30080 fffff807`51a0bafb : fffff2f9`00000000 ffffc885`4160c700 ffff838a`00000000 ffff838a`8ba304f0 : nt!MiWalkPageTablesRecursively+0x776
ffff838a`8ba30120 fffff807`51a0bafb : fffff2f9`7cafff98 ffffc885`4160c700 ffff838a`00000001 ffff838a`8ba30500 : nt!MiWalkPageTablesRecursively+0x88b
ffff838a`8ba301c0 fffff807`51a0bafb : fffff2f9`7caff000 ffffc885`4160c700 ffff838a`00000002 ffff838a`8ba30510 : nt!MiWalkPageTablesRecursively+0x88b
ffff838a`8ba30260 fffff807`51a5de6b : 00000000`00000000 ffffc885`4160c700 00000000`00000003 ffff838a`8ba30520 : nt!MiWalkPageTablesRecursively+0x88b
ffff838a`8ba30300 fffff807`51a9b991 : ffff838a`8ba304a0 ffffc885`00000000 fffff2bf`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b
ffff838a`8ba30400 fffff807`51a6baf0 : 00000000`00000001 ffff838a`00000000 ffffc885`4160c550 ffffc885`428d7080 : nt!MiDeletePagablePteRange+0x4f1
ffff838a`8ba30710 fffff807`51e35c99 : ffffc885`3e37f990 00000000`00000000 ffffc885`00000000 ffffc885`00000000 : nt!MiDeleteVad+0x360
ffff838a`8ba30820 fffff807`51e35330 : ffffc885`3e37f990 ffffc885`415f4d20 ffffc885`428d7080 00000000`00000000 : nt!MiUnmapVad+0x49
ffff838a`8ba30850 fffff807`51e335ff : ffffc885`42029d60 ffffc885`42029d60 ffffc885`3e37f990 ffffc885`4160c080 : nt!MiCleanVad+0x30
ffff838a`8ba30880 fffff807`51e5d6e4 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffc885`4160c080 : nt!MmCleanProcessAddressSpace+0x137
ffff838a`8ba30900 fffff807`51f06596 : ffffc885`4160c080 ffffd905`19f62060 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffff838a`8ba30990 fffff807`51f09a8e : ffffc885`00000000 00000000`00000001 00000000`00000000 00000072`13ffa000 : nt!PspExitThread+0x5f6
ffff838a`8ba30a90 fffff807`51c071b8 : ffffc885`4160c080 ffffc885`428d7080 ffff838a`8ba30b80 00000000`00000c39 : nt!NtTerminateProcess+0xde
ffff838a`8ba30b00 00007ffc`ef16c534 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000072`140ffa88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`ef16c534
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
