SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: fffff880060fe6c8, Exception Record Address
Arg4: fffff880060fdf30, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
FAULTING_IP:
+5fc2270751a9359
00000000`00000000 ?? ???
EXCEPTION_RECORD: fffff880060fe6c8 -- (.exr 0xfffff880060fe6c8)
ExceptionAddress: 0000000000000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000008
Parameter[1]: 0000000000000000
Attempt to execute non-executable address 0000000000000000
CONTEXT: fffff880060fdf30 -- (.cxr 0xfffff880060fdf30;r)
rax=fffff8a003d2f350 rbx=00000000c01e0110 rcx=fffffa800760e800
rdx=fffff8a003d2f290 rsi=fffffa8003da4d58 rdi=fffffa8005cd8000
rip=0000000000000000 rsp=fffff880060fe908 rbp=fffff8a003d2f290
r8=00000000c01e0101 r9=0000000000000000 r10=fffff8a002aa0000
r11=000000000000000e r12=00000000000000b7 r13=0000000000000000
r14=fffffa8005f41a60 r15=00000000000001ac
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010286
00000000`00000000 ?? ???
Last set context:
rax=fffff8a003d2f350 rbx=00000000c01e0110 rcx=fffffa800760e800
rdx=fffff8a003d2f290 rsi=fffffa8003da4d58 rdi=fffffa8005cd8000
rip=0000000000000000 rsp=fffff880060fe908 rbp=fffff8a003d2f290
r8=00000000c01e0101 r9=0000000000000000 r10=fffff8a002aa0000
r11=000000000000000e r12=00000000000000b7 r13=0000000000000000
r14=fffffa8005f41a60 r15=00000000000001ac
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010286
00000000`00000000 ?? ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
EXCEPTION_PARAMETER1: 0000000000000008
EXCEPTION_PARAMETER2: 0000000000000000
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ef100
GetUlongFromAddress: unable to read from fffff800032ef1c8
0000000000000000 Nonpaged pool
FOLLOWUP_IP:
dxgmms1!VIDMM_GLOBAL::PrepareDmaBuffer+fd9
fffff880`02c1ec2d 4883a5c000000000 and qword ptr [rbp+0C0h],0
FAILED_INSTRUCTION_ADDRESS:
+fd9
00000000`00000000 ?? ???
BUGCHECK_STR: 0x7E
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
LAST_CONTROL_TRANSFER: from fffff88002c1ec2d to 0000000000000000
STACK_TEXT:
fffff880`060fe908 fffff880`02c1ec2d : 00000000`000001ac 00000000`00000000 00000000`00000200 fffffa80`00000000 : 0x0
fffff880`060fe910 fffff880`02c388b1 : 00000000`00000000 fffff8a0`01f638e0 fffffa80`00000000 fffffa80`05f41a60 : dxgmms1!VIDMM_GLOBAL::PrepareDmaBuffer+0xfd9
fffff880`060feae0 fffff880`02c385ec : fffff880`02c38014 00000000`00000000 fffffa80`00000000 fffffa80`00000000 : dxgmms1!VidSchiSubmitRenderCommand+0x241
fffff880`060fecd0 fffff880`02c380ea : 00000000`00000000 fffffa80`03d1bd50 00000000`00000080 fffffa80`05c9f010 : dxgmms1!VidSchiSubmitQueueCommand+0x50
fffff880`060fed00 fffff800`033912e8 : 00000000`01daf7e3 fffff800`03236180 00000000`00000001 fffffa80`05ca5950 : dxgmms1!VidSchiWorkerThread+0xd6
fffff880`060fed40 fffff800`030ebec6 : fffff800`03236180 fffffa80`05ca5950 fffff800`032461c0 00000000`00000000 : nt!PspSystemThreadStartup+0x194
fffff880`060fed80 00000000`00000000 : fffff880`060ff000 fffff880`060f9000 fffff880`060fe680 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: dxgmms1!VIDMM_GLOBAL::PrepareDmaBuffer+fd9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dxgmms1
IMAGE_NAME: dxgmms1.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5d5222c1
IMAGE_VERSION: 6.1.7601.24513
STACK_COMMAND: .cxr 0xfffff880060fdf30 ; kb
FAILURE_BUCKET_ID: X64_0x7E_NULL_IP_dxgmms1!VIDMM_GLOBAL::PrepareDmaBuffer+fd9
BUCKET_ID: X64_0x7E_NULL_IP_dxgmms1!VIDMM_GLOBAL::PrepareDmaBuffer+fd9
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x7e_null_ip_dxgmms1!vidmm_global::preparedmabuffer+fd9
FAILURE_ID_HASH: {c1ef8b1a-cfed-0b2f-afe6-56c4877f6b0f}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8800f4a8b38, Address of the instruction which caused the bugcheck
Arg3: fffff8800973a220, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
FAULTING_IP:
amdkmdag+441b38
fffff880`0f4a8b38 0f1101 movups xmmword ptr [rcx],xmm0
CONTEXT: fffff8800973a220 -- (.cxr 0xfffff8800973a220;r)
rax=000000000090878b rbx=0000000000000000 rcx=000000000090878b
rdx=0000000000000000 rsi=fffffa8007494000 rdi=fffff8800973b600
rip=fffff8800f4a8b38 rsp=fffff8800973abf8 rbp=fffff8800973b600
r8=0000000000002780 r9=0101010101010101 r10=0000000040006280
r11=fffff8800973b108 r12=fffffa800924e000 r13=fffffa8005f43000
r14=fffff8800973b600 r15=fffffa800924e000
iopl=0 nv up ei pl nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212
amdkmdag+0x441b38:
fffff880`0f4a8b38 0f1101 movups xmmword ptr [rcx],xmm0 ds:002b:00000000`0090878b=????????????????????????????????
Last set context:
rax=000000000090878b rbx=0000000000000000 rcx=000000000090878b
rdx=0000000000000000 rsi=fffffa8007494000 rdi=fffff8800973b600
rip=fffff8800f4a8b38 rsp=fffff8800973abf8 rbp=fffff8800973b600
r8=0000000000002780 r9=0101010101010101 r10=0000000040006280
r11=fffff8800973b108 r12=fffffa800924e000 r13=fffffa8005f43000
r14=fffff8800973b600 r15=fffffa800924e000
iopl=0 nv up ei pl nz ac pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212
amdkmdag+0x441b38:
fffff880`0f4a8b38 0f1101 movups xmmword ptr [rcx],xmm0 ds:002b:00000000`0090878b=????????????????????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: Border Officer
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
LAST_CONTROL_TRANSFER: from fffff8800f232a8f to fffff8800f4a8b38
STACK_TEXT:
fffff880`0973abf8 fffff880`0f232a8f : 00000000`002cb2df fffffa80`07632f30 fffff880`0f4d6580 00000000`00000000 : amdkmdag+0x441b38
fffff880`0973ac00 00000000`002cb2df : fffffa80`07632f30 fffff880`0f4d6580 00000000`00000000 fffffa80`07261510 : amdkmdag+0x1cba8f
fffff880`0973ac08 fffffa80`07632f30 : fffff880`0f4d6580 00000000`00000000 fffffa80`07261510 fffff880`0f1a8f60 : 0x2cb2df
fffff880`0973ac10 fffff880`0f4d6580 : 00000000`00000000 fffffa80`07261510 fffff880`0f1a8f60 fffff880`0973ac80 : 0xfffffa80`07632f30
fffff880`0973ac18 00000000`00000000 : fffffa80`07261510 fffff880`0f1a8f60 fffff880`0973ac80 fffffa80`07494000 : amdkmdag+0x46f580
FOLLOWUP_IP:
amdkmdag+441b38
fffff880`0f4a8b38 0f1101 movups xmmword ptr [rcx],xmm0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: amdkmdag+441b38
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: amdkmdag
IMAGE_NAME: amdkmdag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5f4665e8
STACK_COMMAND: .cxr 0xfffff8800973a220 ; kb
FAILURE_BUCKET_ID: X64_0x3B_amdkmdag+441b38
BUCKET_ID: X64_0x3B_amdkmdag+441b38
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x3b_amdkmdag+441b38
FAILURE_ID_HASH: {05ea1010-82ef-f391-8946-c51f064ba57c}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80003348440, The address that the exception occurred at
Arg3: fffff880031b3b58, Exception Record Address
Arg4: fffff880031b33c0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
FAULTING_IP:
nt!CmpFindNameInListWithStatus+1c0
fffff800`03348440 4885c0 test rax,rax
EXCEPTION_RECORD: fffff880031b3b58 -- (.exr 0xfffff880031b3b58)
ExceptionAddress: fffff80003348440 (nt!CmpFindNameInListWithStatus+0x00000000000001c0)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 00000000486375c0
Attempt to write to address 00000000486375c0
CONTEXT: fffff880031b33c0 -- (.cxr 0xfffff880031b33c0;r)
rax=0000000000000000 rbx=fffff8a000057370 rcx=0000000000000000
rdx=0000000000000000 rsi=fffff80003594548 rdi=0000000000000000
rip=fffff80003348440 rsp=fffff880031b3d90 rbp=0000000000000000
r8=fffff8a00006d000 r9=0000000000000000 r10=0000000000000065
r11=0000000000000000 r12=fffff8a0000572ac r13=00000000800003a0
r14=0000000000000000 r15=fffff8a000024010
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!CmpFindNameInListWithStatus+0x1c0:
fffff800`03348440 4885c0 test rax,rax
Last set context:
rax=0000000000000000 rbx=fffff8a000057370 rcx=0000000000000000
rdx=0000000000000000 rsi=fffff80003594548 rdi=0000000000000000
rip=fffff80003348440 rsp=fffff880031b3d90 rbp=0000000000000000
r8=fffff8a00006d000 r9=0000000000000000 r10=0000000000000065
r11=0000000000000000 r12=fffff8a0000572ac r13=00000000800003a0
r14=0000000000000000 r15=fffff8a000024010
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!CmpFindNameInListWithStatus+0x1c0:
fffff800`03348440 4885c0 test rax,rax
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 00000000486375c0
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032f8100
GetUlongFromAddress: unable to read from fffff800032f81c8
00000000486375c0 Nonpaged pool
FOLLOWUP_IP:
nt!CmpFindNameInListWithStatus+1c0
fffff800`03348440 4885c0 test rax,rax
BUGCHECK_STR: 0x7E
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
LAST_CONTROL_TRANSFER: from fffff8000334435c to fffff80003348440
STACK_TEXT:
fffff880`031b3d90 fffff800`0334435c : 00000000`00000000 fffff8a0`00057370 fffff800`03594548 fffff800`00000000 : nt!CmpFindNameInListWithStatus+0x1c0
fffff880`031b3e10 fffff800`0350af8c : fffff8a0`00024010 fffff8a0`00024010 00000000`00000000 fffff880`031b4450 : nt!CmpGetSymbolicLink+0x4dc
fffff880`031b3f10 fffff800`03467c64 : fffffa80`04cba1c8 00000000`00000000 fffffa80`04cba010 fffff8a0`00001900 : nt!CmpParseKey+0x17ec
fffff880`031b4200 fffff800`03355776 : 00000000`00000000 fffff880`031b4380 fffff880`00000240 fffffa80`018d1390 : nt!ObpLookupObjectName+0x784
fffff880`031b4300 fffff800`03348fca : 00000000`00000034 00000000`00000000 00000000`00000000 fffff880`031b4820 : nt!ObOpenObjectByName+0x306
fffff880`031b43d0 fffff800`0333e3fa : fffff880`031b47b8 ffffffff`00020019 fffff880`031b4720 fffff800`00000000 : nt!CmOpenKey+0x28a
fffff880`031b4520 fffff800`030fcf53 : 00000000`00000034 fffff880`031b4780 fffff880`031b4820 fffff800`00020019 : nt!NtOpenKey+0x12
fffff880`031b4560 fffff800`030f26c0 : fffff800`0338f56c fffff880`031b47d0 00000000`00000000 00000000`00000001 : nt!KiSystemServiceCopyEnd+0x13
fffff880`031b46f8 fffff800`0338f56c : fffff880`031b47d0 00000000`00000000 00000000`00000001 fffff800`030f26c0 : nt!KiServiceLinkage
fffff880`031b4700 fffff800`03436d8a : fffffa80`018b9b00 00000000`000007ff 00000000`00000001 00000000`00000001 : nt!IopOpenRegistryKeyEx+0x38
fffff880`031b4760 fffff800`03478795 : fffff880`031b4870 00000000`00000000 00000000`20206f49 fffff880`031b4870 : nt!PnpGetDeviceInstanceCsConfigFlags+0x2a
fffff880`031b47b0 fffff800`034789dd : ffffffff`80000554 00000000`00000000 00000000`00000001 00000000`00000000 : nt!PnpIsDeviceInstanceEnabled+0x105
fffff880`031b4820 fffff800`0349450f : 00000000`00000000 fffff8a0`012dead0 fffff8a0`01bf1a3a ffffffff`80000554 : nt!PnpIsAnyDeviceInstanceEnabled+0x13d
fffff880`031b48c0 fffff800`03495bad : fffff880`031b49f8 fffff880`04d3d0e8 00000000`00000000 00000000`00000000 : nt!PnpPrepareDriverLoading+0x8f
fffff880`031b49a0 fffff800`034963d5 : fffffa80`04bdaed8 00000000`00000000 00000000`00000001 00000000`00000001 : nt!IopLoadDriver+0x5dd
fffff880`031b4c70 fffff800`0309edc9 : fffff800`00000000 ffffffff`80000560 fffff800`03496380 fffffa80`00000657 : nt!IopLoadUnloadDriver+0x55
fffff880`031b4cb0 fffff800`0339a2e8 : 00000000`00000000 fffff880`02f63180 00000000`00000080 00000000`00000001 : nt!ExpWorkerThread+0x111
fffff880`031b4d40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PspSystemThreadStartup+0x194
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!CmpFindNameInListWithStatus+1c0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5e0ead5e
IMAGE_VERSION: 6.1.7601.24545
STACK_COMMAND: .cxr 0xfffff880031b33c0 ; kb
FAILURE_BUCKET_ID: X64_0x7E_nt!CmpFindNameInListWithStatus+1c0
BUCKET_ID: X64_0x7E_nt!CmpFindNameInListWithStatus+1c0
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x7e_nt!cmpfindnameinlistwithstatus+1c0
FAILURE_ID_HASH: {0accb5f3-31b3-835c-fcdc-69e3c4c5199c}
Followup: MachineOwner
---------
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000008cc, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000000088c, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
LAST_CONTROL_TRANSFER: from fffff8000313415c to fffff800030eeea0
STACK_TEXT:
fffff880`031c2b08 fffff800`0313415c : 00000000`0000004e 00000000`00000099 00000000`000008cc 00000000`00000000 : nt!KeBugCheckEx
fffff880`031c2b10 fffff800`03178ab8 : fffffa80`018d2148 fffffa80`0001e210 ffffffff`ffffffff fffff6fc`40027078 : nt!MiBadShareCount+0x4c
fffff880`031c2b50 fffff800`030acffa : 80000000`008cc863 fffff6fc`40027090 00000000`00000012 fffff6fc`40027090 : nt!MiDeleteKernelStackPages+0x2a8
fffff880`031c2ba0 fffff800`030ab180 : fffff6fc`40027090 00000000`00000000 00000000`00000000 fffff800`0308f3dc : nt!MiDeleteKernelStack+0x15e
fffff880`031c2c00 fffff800`031dfc91 : 00000000`00000001 00000000`00000001 fffffa80`04cdc6b8 fffffa80`018d2040 : nt!MmDeleteKernelStack+0x2b4
fffff880`031c2c80 fffff800`0309edc9 : fffff800`031dfbf0 fffff800`0326b850 fffffa80`018d2040 00000000`00000000 : nt!PspReaper+0xa1
fffff880`031c2cb0 fffff800`0339a2e8 : 00000000`00000000 fffff880`02f63180 00000000`00000080 00000000`00000001 : nt!ExpWorkerThread+0x111
fffff880`031c2d40 fffff800`030f4ec6 : fffff880`02f63180 fffffa80`018d2040 fffff880`02f72140 00000000`00000000 : nt!PspSystemThreadStartup+0x194
fffff880`031c2d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+4c
fffff800`0313415c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+4c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5e0ead5e
IMAGE_VERSION: 6.1.7601.24545
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x4e_99_nt!mibadsharecount+4c
FAILURE_ID_HASH: {4c83cdad-f603-74ff-b7e1-9eb7f3029c2a}
Followup: MachineOwner
---------
3: kd> lmvm nt
start end module name
fffff800`0305b000 fffff800`03638000 nt (pdb symbols) C:\Program Files\Windows Kits\8.1\Debuggers\x86\sym\ntkrnlmp.pdb\57489119968749168D61EA066CAE95891\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\Program Files\Windows Kits\8.1\Debuggers\x86\sym\ntoskrnl.exe\5E0EAD5E5dd000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Fri Jan 03 02:56:30 2020 (5E0EAD5E)
CheckSum: 00551102
ImageSize: 005DD000
File version: 6.1.7601.24545
Product version: 6.1.7601.24545
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7601.24545
FileVersion: 6.1.7601.24545 (win7sp1_ldr_escrow.200102-1707)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88007d55848
Arg3: fffff88007d550b0
Arg4: fffff8000305f58b
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88007d55848 -- (.exr 0xfffff88007d55848)
ExceptionAddress: fffff8000305f58b (nt!CcUninitializeCacheMap+0x00000000000000ab)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88007d550b0 -- (.cxr 0xfffff88007d550b0;r)
rax=fffffa8007be33a8 rbx=fffffa8007aea380 rcx=fffff800031ec840
rdx=0000000000000000 rsi=0000000000000000 rdi=effffa8007aea4f0
rip=fffff8000305f58b rsp=fffff88007d55a80 rbp=fffffa8007b1f740
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffff8a001a86140 r12=fffff800032a89c0 r13=0000000000000000
r14=fffff8a001a86010 r15=0000000001a86010
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!CcUninitializeCacheMap+0xab:
fffff800`0305f58b 48396f08 cmp qword ptr [rdi+8],rbp ds:002b:effffa80`07aea4f8=????????????????
Last set context:
rax=fffffa8007be33a8 rbx=fffffa8007aea380 rcx=fffff800031ec840
rdx=0000000000000000 rsi=0000000000000000 rdi=effffa8007aea4f0
rip=fffff8000305f58b rsp=fffff88007d55a80 rbp=fffffa8007b1f740
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffff8a001a86140 r12=fffff800032a89c0 r13=0000000000000000
r14=fffff8a001a86010 r15=0000000001a86010
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!CcUninitializeCacheMap+0xab:
fffff800`0305f58b 48396f08 cmp qword ptr [rdi+8],rbp ds:002b:effffa80`07aea4f8=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032a5100
GetUlongFromAddress: unable to read from fffff800032a51c8
ffffffffffffffff
FOLLOWUP_IP:
nt!CcUninitializeCacheMap+ab
fffff800`0305f58b 48396f08 cmp qword ptr [rdi+8],rbp
FAULTING_IP:
nt!CcUninitializeCacheMap+ab
fffff800`0305f58b 48396f08 cmp qword ptr [rdi+8],rbp
BUGCHECK_STR: 0x24
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
LAST_CONTROL_TRANSFER: from fffff880012a583b to fffff8000305f58b
STACK_TEXT:
fffff880`07d55a80 fffff880`012a583b : fffff8a0`01a86010 fffff8a0`01a86010 fffffa80`07b1f700 00000000`00000000 : nt!CcUninitializeCacheMap+0xab
fffff880`07d55b00 fffff880`01216769 : fffffa80`05757e40 fffffa80`07be24d0 fffff880`076c2690 fffffa80`05f2bb50 : Ntfs!NtfsCommonCleanup+0xbdb
fffff880`07d55f30 fffff800`0309f1e7 : fffff880`076c2690 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`07d55f60 fffff800`0309f1a8 : 00000000`00000000 fffff880`07d56000 00000000`00000000 fffff800`03051f47 : nt!KySwitchKernelStackCallout+0x27
fffff880`076c2550 fffff800`03051f47 : 00000000`00000000 fffffa80`053d1ef0 00000000`86486863 fffffa80`05f2bb51 : nt!KiSwitchKernelStackContinue
fffff880`076c2570 fffff880`012167e2 : fffff880`01216750 fffff880`076c2690 fffff880`076c2901 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`076c2660 fffff880`012b3584 : fffff880`076c2730 fffff880`076c2730 fffff880`076c2730 fffff800`03038734 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`076c26d0 fffff880`010d183f : fffff880`076c2730 fffffa80`05e0c860 fffffa80`05e0cbb8 fffffa80`05283010 : Ntfs!NtfsFsdCleanup+0x144
fffff880`076c2940 fffff880`010d06df : fffffa80`05a2ade0 00000000`00000000 fffffa80`05e0c800 fffffa80`05e0c860 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`076c29d0 fffff800`03300def : fffffa80`05e0c860 fffffa80`078be260 00000000`00000000 fffffa80`07b1f740 : fltmgr!FltpDispatch+0xcf
fffff880`076c2a30 fffff800`033019ed : 00000000`00000000 fffffa80`051f89f0 00000000`00000574 00000000`00000002 : nt!IopCloseFile+0x11f
fffff880`076c2ac0 fffff800`03434849 : 00000000`00000590 fffffa80`00000001 fffffa80`07b1f740 fffffa80`05f2bb50 : nt!ObpDecrementHandleCount+0x16d
fffff880`076c2b40 fffff800`033006d4 : 00000000`00000590 fffffa80`07b1f710 fffffa80`078be260 fffff8a0`01388690 : nt!ObpCloseHandleTableEntry+0x269
fffff880`076c2bd0 fffff800`030a9f53 : fffffa80`05f2bb50 fffff880`076c2ca0 00000000`00000000 00000000`00004000 : nt!ObpCloseHandle+0x94
fffff880`076c2c20 00000000`76d4989a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0182f588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d4989a
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!CcUninitializeCacheMap+ab
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5e0ead5e
IMAGE_VERSION: 6.1.7601.24545
STACK_COMMAND: .cxr 0xfffff88007d550b0 ; kb
FAILURE_BUCKET_ID: X64_0x24_nt!CcUninitializeCacheMap+ab
BUCKET_ID: X64_0x24_nt!CcUninitializeCacheMap+ab
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x24_nt!ccuninitializecachemap+ab
FAILURE_ID_HASH: {3045fc25-eff5-935d-9854-b216f6333bc3}
Followup: MachineOwner
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80003145c91, The address that the exception occurred at
Arg3: fffff8800330f8b8, Exception Record Address
Arg4: fffff8800330f120, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
FAULTING_IP:
nt!MiDeleteSegmentPages+61
fffff800`03145c91 4c8b7308 mov r14,qword ptr [rbx+8]
EXCEPTION_RECORD: fffff8800330f8b8 -- (.exr 0xfffff8800330f8b8)
ExceptionAddress: fffff80003145c91 (nt!MiDeleteSegmentPages+0x0000000000000061)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800330f120 -- (.cxr 0xfffff8800330f120;r)
rax=0000000000000000 rbx=bffffa8005f80100 rcx=0000090482413000
rdx=00000000d2413800 rsi=0000000000000000 rdi=00000000000800a1
rip=fffff80003145c91 rsp=fffff8800330faf0 rbp=fa8025f800c80460
r8=000000000000bd38 r9=00000000d24138d0 r10=0000000fffffffff
r11=00000000000004bb r12=fffff6fb7dbed078 r13=0000000000000000
r14=fffff8a00011aa60 r15=fffffa80040f2e70
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!MiDeleteSegmentPages+0x61:
fffff800`03145c91 4c8b7308 mov r14,qword ptr [rbx+8] ds:002b:bffffa80`05f80108=????????????????
Last set context:
rax=0000000000000000 rbx=bffffa8005f80100 rcx=0000090482413000
rdx=00000000d2413800 rsi=0000000000000000 rdi=00000000000800a1
rip=fffff80003145c91 rsp=fffff8800330faf0 rbp=fa8025f800c80460
r8=000000000000bd38 r9=00000000d24138d0 r10=0000000fffffffff
r11=00000000000004bb r12=fffff6fb7dbed078 r13=0000000000000000
r14=fffff8a00011aa60 r15=fffffa80040f2e70
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!MiDeleteSegmentPages+0x61:
fffff800`03145c91 4c8b7308 mov r14,qword ptr [rbx+8] ds:002b:bffffa80`05f80108=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032a1100
GetUlongFromAddress: unable to read from fffff800032a11c8
ffffffffffffffff
FOLLOWUP_IP:
nt!MiDeleteSegmentPages+61
fffff800`03145c91 4c8b7308 mov r14,qword ptr [rbx+8]
BUGCHECK_STR: 0x7E
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
LAST_CONTROL_TRANSFER: from fffff800033f46c5 to fffff80003145c91
STACK_TEXT:
fffff880`0330faf0 fffff800`033f46c5 : fffffa80`05f80010 00000000`00000011 00000000`69536d4d fffff800`000800a1 : nt!MiDeleteSegmentPages+0x61
fffff880`0330fbc0 fffff800`030684f1 : fffffa80`05f80018 00000000`00000001 00000000`00000000 00000000`00000000 : nt!MiSegmentDelete+0xd5
fffff880`0330fc00 fffff800`03068769 : 00000000`00000000 00000000`00000080 00000000`00000001 00000000`00000012 : nt!MiProcessDereferenceList+0x131
fffff880`0330fcc0 fffff800`033432e8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDereferenceSegmentThread+0x10d
fffff880`0330fd40 fffff800`0309dec6 : fffff880`02f63180 fffffa80`052083b0 fffff880`02f72140 00000001`2920e61c : nt!PspSystemThreadStartup+0x194
fffff880`0330fd80 00000000`00000000 : fffff880`03310000 fffff880`0330a000 fffff880`0330f7f0 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiDeleteSegmentPages+61
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5e0ead5e
IMAGE_VERSION: 6.1.7601.24545
STACK_COMMAND: .cxr 0xfffff8800330f120 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x7E_nt!MiDeleteSegmentPages+61
BUCKET_ID: X64_0x7E_nt!MiDeleteSegmentPages+61
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x7e_nt!mideletesegmentpages+61
FAILURE_ID_HASH: {ee7dfbdc-4b48-947e-8144-bdb5cefa11e0}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000323ba39, Address of the instruction which caused the bugcheck
Arg3: fffff8800be48ab0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx adresindeki y nerge, 0x%08lx bellek adresine ba
FAULTING_IP:
nt!ExDeferredFreePool+249
fffff800`0323ba39 4c395808 cmp qword ptr [rax+8],r11
CONTEXT: fffff8800be48ab0 -- (.cxr 0xfffff8800be48ab0;r)
rax=f7fffa8005ff7d00 rbx=0000000000000000 rcx=fffff8000325ba30
rdx=fffffa800884a550 rsi=0000000000000000 rdi=fffffa8007dce670
rip=fffff8000323ba39 rsp=fffff8800be49480 rbp=0000000000000000
r8=fffffa800783cdc0 r9=fffffa800884a620 r10=0000000000000001
r11=fffffa800884a630 r12=fffff8000325b880 r13=0000000000000000
r14=0000000000000004 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ExDeferredFreePool+0x249:
fffff800`0323ba39 4c395808 cmp qword ptr [rax+8],r11 ds:002b:f7fffa80`05ff7d08=????????????????
Last set context:
rax=f7fffa8005ff7d00 rbx=0000000000000000 rcx=fffff8000325ba30
rdx=fffffa800884a550 rsi=0000000000000000 rdi=fffffa8007dce670
rip=fffff8000323ba39 rsp=fffff8800be49480 rbp=0000000000000000
r8=fffffa800783cdc0 r9=fffffa800884a620 r10=0000000000000001
r11=fffffa800884a630 r12=fffff8000325b880 r13=0000000000000000
r14=0000000000000004 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ExDeferredFreePool+0x249:
fffff800`0323ba39 4c395808 cmp qword ptr [rax+8],r11 ds:002b:f7fffa80`05ff7d08=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: Border Officer
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff8000323ba39
STACK_TEXT:
fffff880`0be49480 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x249
FOLLOWUP_IP:
nt!ExDeferredFreePool+249
fffff800`0323ba39 4c395808 cmp qword ptr [rax+8],r11
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExDeferredFreePool+249
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 6.1.7601.24545
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .cxr 0xfffff8800be48ab0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+249
BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+249
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x3b_nt!exdeferredfreepool+249
FAILURE_ID_HASH: {3a66443f-620d-25f0-d91f-c31117c6a858}
Followup: Pool_corruption
---------