Z
Zakariya Hussein
This is my scanned dump file:
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17763 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 17763.1.amd64fre.rs5_release.180914-1434
Machine Name:
Kernel base = 0xfffff806`2ce19000 PsLoadedModuleList = 0xfffff806`2d2336f0
Debug session time: Thu Jun 4 21:02:50.686 2020 (UTC + 2:00)
System Uptime: 0 days 0:43:27.481
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000045`dc284018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`2cfd0ab0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffd8e`4d9c72a0=0000000000000050
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff80600000000, memory referenced.
Arg2: 0000000000000010, value 0 = read operation, 1 = write operation.
Arg3: fffff80600000000, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2468
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-55D85CL
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 5315
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: rs5_release
Key : WER.OS.Timestamp
Value: 2018-09-14T14:34:00Z
Key : WER.OS.Version
Value: 10.0.17763.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: fffff80600000000
BUGCHECK_P2: 10
BUGCHECK_P3: fffff80600000000
BUGCHECK_P4: 2
READ_ADDRESS: fffff80600000000
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
PROCESS_NAME: audiodg.exe
TRAP_FRAME: fffffd8e4d9c7580 -- (.trap 0xfffffd8e4d9c7580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffda0826be0118 rbx=0000000000000000 rcx=ffffda0826be0080
rdx=ffffda08176cf640 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80600000000 rsp=fffffd8e4d9c7710 rbp=0000000000000775
r8=0000000000000000 r9=fffff8062ce19000 r10=fffff8062d402d00
r11=ffffc28ddc9a0300 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
fffff806`00000000 ?? ???
Resetting default scope
FAILED_INSTRUCTION_ADDRESS:
+0
fffff806`00000000 ?? ???
STACK_TEXT:
fffffd8e`4d9c7298 fffff806`2cffcb73 : 00000000`00000050 fffff806`00000000 00000000`00000010 fffffd8e`4d9c7580 : nt!KeBugCheckEx
fffffd8e`4d9c72a0 fffff806`2cec9c68 : 00000000`ffffffff ffff8000`00000000 00000000`001f0003 fffff806`00000000 : nt!MiSystemFault+0x1b9673
fffffd8e`4d9c73e0 fffff806`2cfde5c9 : ffffffff`ffffffff 00000000`000000ff 00000000`00000015 fffff806`00000800 : nt!MmAccessFault+0x1d8
fffffd8e`4d9c7580 fffff806`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x349
fffffd8e`4d9c7710 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 da0822cd`15300000 : 0xfffff806`00000000
SYMBOL_NAME: nt!MiSystemFault+1b9673
MODULE_NAME: nt
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 1b9673
FAILURE_BUCKET_ID: AV_INVALID_BAD_IP_nt!MiSystemFault
OS_VERSION: 10.0.17763.1
BUILDLAB_STR: rs5_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {48ad9531-e3f8-1044-fc5f-d917677674c7}
Followup: MachineOwner
---------
Can anyone tell me what causes the BSODS?
Continue reading...
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17763 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 17763.1.amd64fre.rs5_release.180914-1434
Machine Name:
Kernel base = 0xfffff806`2ce19000 PsLoadedModuleList = 0xfffff806`2d2336f0
Debug session time: Thu Jun 4 21:02:50.686 2020 (UTC + 2:00)
System Uptime: 0 days 0:43:27.481
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000045`dc284018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`2cfd0ab0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffd8e`4d9c72a0=0000000000000050
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff80600000000, memory referenced.
Arg2: 0000000000000010, value 0 = read operation, 1 = write operation.
Arg3: fffff80600000000, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2468
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-55D85CL
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 5315
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: rs5_release
Key : WER.OS.Timestamp
Value: 2018-09-14T14:34:00Z
Key : WER.OS.Version
Value: 10.0.17763.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: fffff80600000000
BUGCHECK_P2: 10
BUGCHECK_P3: fffff80600000000
BUGCHECK_P4: 2
READ_ADDRESS: fffff80600000000
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
PROCESS_NAME: audiodg.exe
TRAP_FRAME: fffffd8e4d9c7580 -- (.trap 0xfffffd8e4d9c7580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffda0826be0118 rbx=0000000000000000 rcx=ffffda0826be0080
rdx=ffffda08176cf640 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80600000000 rsp=fffffd8e4d9c7710 rbp=0000000000000775
r8=0000000000000000 r9=fffff8062ce19000 r10=fffff8062d402d00
r11=ffffc28ddc9a0300 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
fffff806`00000000 ?? ???
Resetting default scope
FAILED_INSTRUCTION_ADDRESS:
+0
fffff806`00000000 ?? ???
STACK_TEXT:
fffffd8e`4d9c7298 fffff806`2cffcb73 : 00000000`00000050 fffff806`00000000 00000000`00000010 fffffd8e`4d9c7580 : nt!KeBugCheckEx
fffffd8e`4d9c72a0 fffff806`2cec9c68 : 00000000`ffffffff ffff8000`00000000 00000000`001f0003 fffff806`00000000 : nt!MiSystemFault+0x1b9673
fffffd8e`4d9c73e0 fffff806`2cfde5c9 : ffffffff`ffffffff 00000000`000000ff 00000000`00000015 fffff806`00000800 : nt!MmAccessFault+0x1d8
fffffd8e`4d9c7580 fffff806`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x349
fffffd8e`4d9c7710 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 da0822cd`15300000 : 0xfffff806`00000000
SYMBOL_NAME: nt!MiSystemFault+1b9673
MODULE_NAME: nt
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 1b9673
FAILURE_BUCKET_ID: AV_INVALID_BAD_IP_nt!MiSystemFault
OS_VERSION: 10.0.17763.1
BUILDLAB_STR: rs5_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {48ad9531-e3f8-1044-fc5f-d917677674c7}
Followup: MachineOwner
---------
Can anyone tell me what causes the BSODS?
Continue reading...