J
jaker468
I recently started to get the blue screen of death. I have done all the memory scans and have wiped all my drives, reformatted, and reinstalled windows, but I still get Blue Screens. Before reformatting, the order of BSoD stop codes were ""Critical Process Died", "System Service Exception", "Driver IRQL NOT LESS OR EQUAL", and "MEMORY MANAGEMENT". After reformatting, I got another "MEMORY MANAGEMENT" stop code. I am wondering if the problem is hardware related, which it seems to be, and if so, does this say what hardware component is to blame?
Here is what the debugger listed from the .dmp file ...
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\091320-7656-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`50400000 PsLoadedModuleList = 0xfffff800`5102a2f0
Debug session time: Sun Sep 13 22:42:58.426 2020 (UTC - 4:00)
System Uptime: 0 days 0:27:40.808
Loading Kernel Symbols
...............................................................
................................................................
..........................................................
Loading User Symbols
Loading unloaded module list
............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`507ddf40 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd608`36326ec0=000000000000001a
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: fffff300e267f110
Arg3: 4000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2015
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-HTKOQD0
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 13310
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: fffff300e267f110
BUGCHECK_P3: 4000000000000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
STACK_TEXT:
ffffd608`36326eb8 fffff800`5085435a : 00000000`0000001a 00000000`00041792 fffff300`e267f110 40000000`00000000 : nt!KeBugCheckEx
ffffd608`36326ec0 fffff800`506119f1 : 00000000`00000003 fffff300`e267f000 ffffd608`36327390 00000000`00000003 : nt!MiDeleteVa+0x192a6a
ffffd608`36326fb0 fffff800`50611d10 : 00000000`00000000 ffffc386`d7e07700 00000000`00000000 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x301
ffffd608`36327040 fffff800`50611d10 : 00000000`00000000 ffffc386`d7e07700 fffff379`00000000 00000000`00000010 : nt!MiWalkPageTablesRecursively+0x620
ffffd608`363270d0 fffff800`50611d10 : ffffd608`36327390 ffffc386`d7e07700 00000000`00000000 00000000`00000020 : nt!MiWalkPageTablesRecursively+0x620
ffffd608`36327160 fffff800`5060e61b : ffffe980`087a2682 ffffc386`d7e07700 00000000`00000000 00000000`00000030 : nt!MiWalkPageTablesRecursively+0x620
ffffd608`363271f0 fffff800`506c18a1 : ffffd608`36327390 ffffc386`00000000 00000000`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b
ffffd608`363272f0 fffff800`506a6e4f : 00000000`00000000 00000000`00000060 ffffc386`d7e077c0 00000000`00000000 : nt!MiDeletePagablePteRange+0x491
ffffd608`36327770 fffff800`509eaf39 : ffffc386`d7e07080 00000000`00000000 00007ff7`00000000 00000000`00000001 : nt!MiDeleteVad+0x41f
ffffd608`363278a0 fffff800`509ead12 : ffffc386`d63506e0 00000000`00000000 ffffc386`d7e07080 00000000`00000000 : nt!MiUnmapVad+0x49
ffffd608`363278d0 fffff800`509eab89 : 00000084`131ff118 00000084`00000004 00007ff7`1145e330 00000000`00000000 : nt!MiUnmapViewOfSection+0x152
ffffd608`363279b0 fffff800`507ef875 : ffffc386`da1eb080 000001c4`ca000000 ffffd608`36327a80 ffffc386`d7e07080 : nt!NtUnmapViewOfSectionEx+0x99
ffffd608`36327a00 00007ffb`2e00f734 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000084`131ff048 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`2e00f734
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
Continue reading...
Here is what the debugger listed from the .dmp file ...
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\091320-7656-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`50400000 PsLoadedModuleList = 0xfffff800`5102a2f0
Debug session time: Sun Sep 13 22:42:58.426 2020 (UTC - 4:00)
System Uptime: 0 days 0:27:40.808
Loading Kernel Symbols
...............................................................
................................................................
..........................................................
Loading User Symbols
Loading unloaded module list
............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`507ddf40 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd608`36326ec0=000000000000001a
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: fffff300e267f110
Arg3: 4000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2015
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-HTKOQD0
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 13310
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: fffff300e267f110
BUGCHECK_P3: 4000000000000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
STACK_TEXT:
ffffd608`36326eb8 fffff800`5085435a : 00000000`0000001a 00000000`00041792 fffff300`e267f110 40000000`00000000 : nt!KeBugCheckEx
ffffd608`36326ec0 fffff800`506119f1 : 00000000`00000003 fffff300`e267f000 ffffd608`36327390 00000000`00000003 : nt!MiDeleteVa+0x192a6a
ffffd608`36326fb0 fffff800`50611d10 : 00000000`00000000 ffffc386`d7e07700 00000000`00000000 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x301
ffffd608`36327040 fffff800`50611d10 : 00000000`00000000 ffffc386`d7e07700 fffff379`00000000 00000000`00000010 : nt!MiWalkPageTablesRecursively+0x620
ffffd608`363270d0 fffff800`50611d10 : ffffd608`36327390 ffffc386`d7e07700 00000000`00000000 00000000`00000020 : nt!MiWalkPageTablesRecursively+0x620
ffffd608`36327160 fffff800`5060e61b : ffffe980`087a2682 ffffc386`d7e07700 00000000`00000000 00000000`00000030 : nt!MiWalkPageTablesRecursively+0x620
ffffd608`363271f0 fffff800`506c18a1 : ffffd608`36327390 ffffc386`00000000 00000000`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b
ffffd608`363272f0 fffff800`506a6e4f : 00000000`00000000 00000000`00000060 ffffc386`d7e077c0 00000000`00000000 : nt!MiDeletePagablePteRange+0x491
ffffd608`36327770 fffff800`509eaf39 : ffffc386`d7e07080 00000000`00000000 00007ff7`00000000 00000000`00000001 : nt!MiDeleteVad+0x41f
ffffd608`363278a0 fffff800`509ead12 : ffffc386`d63506e0 00000000`00000000 ffffc386`d7e07080 00000000`00000000 : nt!MiUnmapVad+0x49
ffffd608`363278d0 fffff800`509eab89 : 00000084`131ff118 00000084`00000004 00007ff7`1145e330 00000000`00000000 : nt!MiUnmapViewOfSection+0x152
ffffd608`363279b0 fffff800`507ef875 : ffffc386`da1eb080 000001c4`ca000000 ffffd608`36327a80 ffffc386`d7e07080 : nt!NtUnmapViewOfSectionEx+0x99
ffffd608`36327a00 00007ffb`2e00f734 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000084`131ff048 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`2e00f734
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
Continue reading...