Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (
http://www.osr.com)
Online Crash Dump Analysis Service
See
http://www.osronline.com for more information
Windows 8 Kernel Version 16299 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff801`8f680000 PsLoadedModuleList = 0xfffff801`8f9e1ff0
Debug session time: Fri Dec 15 08:58:06.635 2017 (UTC - 5:00)
System Uptime: 0 days 17:22:58.343
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8018f71590e, The address that the exception occurred at
Arg3: ffff880c9b33ebf8, Exception Record Address
Arg4: ffff880c9b33e440, Context Record Address
Debugging Details:
------------------
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!MiDemoteCombinedPte+46
fffff801`8f71590e 49394720 cmp qword ptr [r15+20h],rax
EXCEPTION_RECORD: ffff880c9b33ebf8 -- (.exr 0xffff880c9b33ebf8)
ExceptionAddress: fffff8018f71590e (nt!MiDemoteCombinedPte+0x0000000000000046)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffff880c9b33e440 -- (.cxr 0xffff880c9b33e440)
rax=0000000000000001 rbx=8700020686702025 rcx=ffff9c8bab21dac0
rdx=ffff9c8bab21dac0 rsi=00007ffb7e98f000 rdi=ffff880c9b33f380
rip=fffff8018f71590e rsp=ffff880c9b33ee30 rbp=ffff880c9b33f490
r8=8000000000000000 r9=ffffd10000000000 r10=ffff9c8bab21dac0
r11=0000000000000000 r12=ffffd13ffdbf4c78 r13=ffffd13ffdbf4c78
r14=ffff9c8bad009c10 r15=7fffffffffffffd0
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!MiDemoteCombinedPte+0x46:
fffff801`8f71590e 49394720 cmp qword ptr [r15+20h],rax ds:002b:7fffffff`fffffff0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: SettingSyncHos
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
ffffffffffffffff
FOLLOWUP_IP:
nt!MiDemoteCombinedPte+46
fffff801`8f71590e 49394720 cmp qword ptr [r15+20h],rax
BUGCHECK_STR: AV
EXCEPTION_STR: 0x0
LAST_CONTROL_TRANSFER: from fffff8018f71496b to fffff8018f71590e
STACK_TEXT:
ffff880c`9b33ee30 fffff801`8f71496b : 00000000`00000004 ffffd200`b04de180 00000000`00000000 87000206`86702025 : nt!MiDemoteCombinedPte+0x46
ffff880c`9b33ef00 fffff801`8f7139d2 : 00000000`00000000 00000000`00000000 ffff880c`9b33f490 00000000`00000000 : nt!MiAgePte+0x96b
ffff880c`9b33efa0 fffff801`8f713b0a : 00000000`00000000 00000000`00000000 00000000`00000000 ffff880c`9b33f490 : nt!MiWalkPageTablesRecursively+0x202
ffff880c`9b33f050 fffff801`8f713b0a : 00000000`00000000 55555555`55555555 ffff9c8b`a1a620b0 ffff880c`9b33f490 : nt!MiWalkPageTablesRecursively+0x33a
ffff880c`9b33f100 fffff801`8f713b0a : 00000000`00000000 00000000`00000000 00000000`00000000 ffff880c`9b33f490 : nt!MiWalkPageTablesRecursively+0x33a
ffff880c`9b33f1b0 fffff801`8f71370f : ffff880c`9b33f490 00000000`00000000 ffff880c`9b33f280 ffff880c`9b33f490 : nt!MiWalkPageTablesRecursively+0x33a
ffff880c`9b33f260 fffff801`8f713351 : 00000000`00000000 fffff801`8f715360 ffff9c8b`a1a62010 fffff801`73576d4d : nt!MiWalkPageTables+0x20f
ffff880c`9b33f300 fffff801`8f712d45 : ffff9c8b`ab21dac0 00000000`00000000 ffff9c8b`a1a62010 00000000`00000000 : nt!MiAgeWorkingSet+0x2b1
ffff880c`9b33f7f0 fffff801`8f7124b9 : 00000000`00000000 ffff880c`9b33fa80 ffff880c`9b33f9b0 00000000`00000000 : nt!MiTrimOrAgeWorkingSet+0x175
ffff880c`9b33f8b0 fffff801`8f73fdca : fffff801`8fa01e40 fffff801`8fa01e40 00000000`00000138 00000000`00000138 : nt!MiProcessWorkingSets+0x219
ffff880c`9b33fa60 fffff801`8f7afe30 : 00000000`ffffffff 00000000`00000006 00000000`ffffffff 00000000`00000001 : nt!MiWorkingSetManager+0xa2
ffff880c`9b33fb20 fffff801`8f6a8f87 : ffff9c8b`a1b7f040 00000000`00000080 fffff801`8f7afce0 00000000`00000000 : nt!KeBalanceSetManager+0x150
ffff880c`9b33fc10 fffff801`8f7e9676 : fffff801`8e6d5180 ffff9c8b`a1b7f040 fffff801`8f6a8f40 00000000`00000000 : nt!PspSystemThreadStartup+0x47
ffff880c`9b33fc60 00000000`00000000 : ffff880c`9b340000 ffff880c`9b33a000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiDemoteCombinedPte+46
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5a29b8d4
STACK_COMMAND: .cxr 0xffff880c9b33e440 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_AV_nt!MiDemoteCombinedPte+46
BUCKET_ID: X64_AV_nt!MiDemoteCombinedPte+46
Followup: MachineOwner
---------
This free analysis is provided by OSR Open Systems Resources, Inc.
Want a deeper understanding of crash dump analysis? Check out our
Windows Kernel Debugging and Crash Dump Analysis Seminar (opens in new tab/window)
