Can anyone help me read a dump file to figure out why my (most recent) BSOD occurred.

TheGreatRecon · 6 Jan 2024 at 08:28

Bugcheck Analysis:

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e) This is a very common BugCheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address.
Arguments:

Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80232527749, The address that the exception occurred at
Arg3: ffffb700ca0a6878, Exception Record Address
Arg4: ffffb700ca0a6090, Context Record Address

Debugging Details:

KEY_VALUES_STRING: 1

Key : AV.Fault
Value: Read

Key : Analysis.CPU.mSec
Value: 1343

Key : Analysis.Elapsed.mSec
Value: 1424

Key : Analysis.IO.Other.Mb
Value: 0

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 0

Key : Analysis.Init.CPU.mSec
Value: 155

Key : Analysis.Init.Elapsed.mSec
Value: 2666

Key : Analysis.Memory.CommitPeak.Mb
Value: 111

Key : Bugcheck.Code.KiBugCheckData
Value: 0x7e

Key : Bugcheck.Code.LegacyAPI
Value: 0x7e

Key : Dump.Attributes.AsUlong
Value: 1800

Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1

Key : Dump.Attributes.ErrorCode
Value: 0

Key : Dump.Attributes.LastLine
Value: Dump completed successfully.

Key : Dump.Attributes.ProgressPercentage
Value: 100

Key : Failure.Bucket
Value: AV_nt!RtlSubtreePredecessor

Key : Failure.Hash
Value: {9c83f313-8194-6a8e-da2b-014e09f29178}

Key : Hypervisor.Enlightenments.ValueHex
Value: 1497cf94

Key : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key : Hypervisor.Flags.ApicEnlightened
Value: 1

Key : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0

Key : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key : Hypervisor.Flags.CpuManager
Value: 1

Key : Hypervisor.Flags.DeprecateAutoEoi
Value: 0

Key : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key : Hypervisor.Flags.Epf
Value: 0

Key : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key : Hypervisor.Flags.MaxBankNumber
Value: 0

Key : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key : Hypervisor.Flags.Phase0InitDone
Value: 1

Key : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key : Hypervisor.Flags.RootScheduler
Value: 0

Key : Hypervisor.Flags.SynicAvailable
Value: 1

Key : Hypervisor.Flags.UseQpcBias
Value: 0

Key : Hypervisor.Flags.Value
Value: 4853999

Key : Hypervisor.Flags.ValueHex
Value: 4a10ef

Key : Hypervisor.Flags.VpAssistPage
Value: 1

Key : Hypervisor.Flags.VsmAvailable
Value: 1

Key : Hypervisor.RootFlags.AccessStats
Value: 1

Key : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key : Hypervisor.RootFlags.IsHyperV
Value: 1

Key : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key : Hypervisor.RootFlags.Nested
Value: 0

Key : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key : Hypervisor.RootFlags.Value
Value: 1015

Key : Hypervisor.RootFlags.ValueHex
Value: 3f7

Key : SecureKernel.HalpHvciEnabled
Value: 1

Key : WER.OS.Branch
Value: ni_release

Key : WER.OS.Version
Value: 10.0.22621.1

BUGCHECK_CODE: 7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80232527749

BUGCHECK_P3: ffffb700ca0a6878

BUGCHECK_P4: ffffb700ca0a6090

FILE_IN_CAB: MEMORY.DMP

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b

DUMP_FILE_ATTRIBUTES: 0x1800

EXCEPTION_RECORD: ffffb700ca0a6878 -- (.exr 0xffffb700ca0a6878)
ExceptionAddress: fffff80232527749 (nt!RtlSubtreePredecessor+0x0000000000000009)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: ffffb700ca0a6090 -- (.cxr 0xffffb700ca0a6090)
rax=0040000000080000 rbx=ffff80030e569d78 rcx=ffff80030e569d78
rdx=ffffa20699c54ef0 rsi=ffffa20699c54ed0 rdi=ffffa20699c54ef0
rip=fffff80232527749 rsp=ffffb700ca0a6ab8 rbp=ffffffffffffffff
r8=ffffffffffffffff r9=7ffffffffffffffc r10=fffff802325264e0
r11=000000000000be50 r12=0000000000008000 r13=0000000000000000
r14=ffffa20699c54ef0 r15=0000000000000706
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
nt!RtlSubtreePredecessor+0x9:
fffff802`32527749 488b4810 mov rcx,qword ptr [rax+10h] ds:002b:00400000`00080010=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME: System

READ_ADDRESS: ffffffffffffffff

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

EXCEPTION_STR: 0xc0000005

STACK_TEXT:
ffffb700`ca0a6ab8 fffff802`32526594 : ffffffff`ffffffff fffff802`324ec884 00000000`00000000 ffff8003`0ed1d580 : nt!RtlSubtreePredecessor+0x9
ffffb700`ca0a6ac0 fffff802`30b6bbf4 : ffff8003`0e569d78 ffffa206`99c54ea8 ffff8003`0f0d5760 fffff802`30ba2f4b : nt!RtlDeleteNoSplay+0xb4
ffffb700`ca0a6af0 fffff802`30ba29dc : ffffa206`99c54ed0 00000000`00000000 ffff8003`0f0d5700 fffff802`3246a0f1 : FLTMGR!TreeUnlinkMulti+0xf4
ffffb700`ca0a6b40 fffff802`30ba3b3a : ffffa206`8d222010 ffffb700`ca0a6d00 ffff8003`0f0d5700 fffff802`3250cc40 : FLTMGR!CleanupStreamListCtrl+0xec
ffffb700`ca0a6bc0 fffff802`32898732 : ffff8003`0f0d5738 ffff8003`0f0d5700 ffff8003`0f0d5738 ffff8003`0f0d5700 : FLTMGR!DeleteStreamListCtrlCallback+0xba
ffffb700`ca0a6c00 fffff802`3757cfe0 : ffff8003`0f0d5700 ffffb700`ca0a6d48 ffffb700`ca0a70d0 00000000`00000705 : nt!FsRtlTeardownPerStreamContexts+0xe2
ffffb700`ca0a6c40 fffff802`3757c4c1 : ffff8003`0f0d55e0 ffff8003`00008000 ffff8001`01000000 00000000`00000000 : Ntfs!NtfsDeleteScb+0x170
ffffb700`ca0a6ce0 fffff802`3744730d : ffff8003`0f0d5700 ffff8003`0f0d5700 ffff8003`0f0d55a0 ffff8003`0f0d5700 : Ntfs!NtfsRemoveScb+0xad
ffffb700`ca0a6d40 fffff802`3757c210 : ffff8003`0f0d55a0 00000000`00000000 ffffb700`ca0a70d0 ffff8003`0f0d5700 : Ntfs!NtfsPrepareFcbForRemoval+0x5d
ffffb700`ca0a6d80 fffff802`37447012 : ffffb700`ca0a70d0 ffffa206`8d28f1b0 ffff8003`0f0d5a00 ffff8003`0f0d55a0 : Ntfs!NtfsTeardownStructures+0xa0
ffffb700`ca0a6e00 fffff802`3757b903 : ffffb700`ca0a6fc8 ffffb700`ca0a7480 ffffb700`ca0a6fc8 ffff8003`0f0d5500 : Ntfs!NtfsDecrementCloseCounts+0xe2
ffffb700`ca0a6e60 fffff802`3757b302 : ffffb700`ca0a70d0 ffff8003`0f0d5700 ffff8003`0f0d55a0 ffffa206`8d28f1b0 : Ntfs!NtfsCommonClose+0x423
ffffb700`ca0a6f30 fffff802`37555cf8 : ffffb700`ca0a7100 ffffa206`8d28f1b0 ffffb700`ca0a7480 ffffa206`8731fc00 : Ntfs!NtfsFspCloseInternal+0x252
ffffb700`ca0a7090 fffff802`32434f85 : ffffa206`8731fc00 ffffa206`996fa000 ffffa206`00000000 ffffa206`00000000 : Ntfs!NtfsFspClose+0x88
ffffb700`ca0a7380 fffff802`32507167 : ffffa206`996fa040 00000000`000006ae ffffa206`996fa040 fffff802`32434e30 : nt!ExpWorkerThread+0x155
ffffb700`ca0a7570 fffff802`3261bb94 : fffff802`2fbec180 ffffa206`996fa040 fffff802`32507110 aeac53f0`6b65f40a : nt!PspSystemThreadStartup+0x57
ffffb700`ca0a75c0 00000000`00000000 : ffffb700`ca0a8000 ffffb700`ca0a1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34

SYMBOL_NAME: nt!RtlSubtreePredecessor+9

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

STACK_COMMAND: .cxr 0xffffb700ca0a6090 ; kb

BUCKET_ID_FUNC_OFFSET: 9

FAILURE_BUCKET_ID: AV_nt!RtlSubtreePredecessor

OS_VERSION: 10.0.22621.1

BUILDLAB_STR: ni_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {9c83f313-8194-6a8e-da2b-014e09f29178}

Followup: MachineOwner

Murphy · 6 Jan 2024 at 10:12

Most basic way would be to use...

Blue screen of death (STOP error) information in dump files.

Displays information about blue screen crashes occured on your system. (MiniDump Reader)

www.nirsoft.net

The bugcheck you posted doesn't really tell you the root cause as the exception occurred in ntkrnlmp.exe but that's just what caught it, not what caused it.

Pigeon_Killer · 6 Jan 2024 at 10:24

BlueScreenView's a great bit of software but WinDbg usually provides more in-depth analysis.

Murphy · 6 Jan 2024 at 10:37

Pigeon_Killer said:
WinDbg usually provides more in-depth analysi

True but anytime i tried using that it did my head in.

Showboat · 6 Jan 2024 at 10:59

Windbg will tell you the dll that caused the crash, and then you can either update drivers or start looking at hardware issues

If its the first crash i'd just ignore it!

TheGreatRecon · 6 Jan 2024 at 12:43

I'm using Windbg but I don't understand it at all so that's why I'm posting, not my first crash either, done it multiple times now.

mrk · 6 Jan 2024 at 13:38

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

Might be a long shot but set your RAM at base JEDEC speeds (aka disable XMP) and see if it happens again. I'm gonna bet RAM is unstable at whatever speed/timings its at either due to incorrect values set, bugged BIOS (needs update), or just faulty RAM.

You can pre-check the latter by running RAM testing tools such as Karhu/memtest86/memtest86+ etc.

TheGreatRecon · 6 Jan 2024 at 14:38

mrk said:
Might be a long shot but set your RAM at base JEDEC speeds (aka disable XMP) and see if it happens again. I'm gonna bet RAM is unstable at whatever speed/timings its at either due to incorrect values set, bugged BIOS (needs update), or just faulty RAM.

You can pre-check the latter by running RAM testing tools such as Karhu/memtest86/memtest86

Expo is disabled already and just updated bios. I'll give memtest a try but I got a cpu fan speed detection error just now if that means anything.

mrk · 6 Jan 2024 at 14:45

Double check fan header connection isn't loose, but that's a bit strange though, weird board error maybe :/

darael · 6 Jan 2024 at 19:21

Give WhoCrashed a try.

TheGreatRecon · 7 Jan 2024 at 09:21

mrk said:
Double check fan header connection isn't loose, but that's a bit strange though, board error maybe :/

Think I might of found the culprit after all. Tried both ram sticks individually in both of their slots and one seems to boot and the other doesn't so it seems I got sold faulty ram after all.

TheGreatRecon · 7 Jan 2024 at 14:47

mrk said:
Might be a long shot but set your RAM at base JEDEC speeds (aka disable XMP) and see if it happens again. I'm gonna bet RAM is unstable at whatever speed/timings its at either due to incorrect values set, bugged BIOS (needs update), or just faulty RAM.

You can pre-check the latter by running RAM testing tools such as Karhu/memtest86/memtest86+ etc.

Well I tried memtest, first ram stick passed but second ram stick had 764 errors in its first test so I'd imagine that would be the culprit?

mrk · 7 Jan 2024 at 16:21

Yeah should be no errors!

TheGreatRecon · 7 Jan 2024 at 17:12

mrk said:
Yeah should be no errors!

Relieved to finally figure out what's causing all these blue screens, think it had like 4000 errors by the time it finished. Cheers everyone for the help

mrk · 7 Jan 2024 at 19:15

We accept payment in tea and biscuits!