Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffe00186bfc860, Virtual address for the attempted execute.
Arg2: 80000000469bc963, PTE contents.
Arg3: ffffd000cc56ae70, (reserved)
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xFC
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
TRAP_FRAME: ffffd000cc56ae70 -- (.trap 0xffffd000cc56ae70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000001ab000
rdx=ffffd000cb707180 rsi=0000000000000000 rdi=0000000000000000
rip=ffffe00186bfc860 rsp=ffffd000cc56b000 rbp=ffffd000cf0248c9
r8=0000000000000006 r9=7fffe001d1bf7050 r10=ffffe001d1bf7050
r11=7ffffffffffffffc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na pe nc
ffffe001`86bfc860 0100 add dword ptr [rax],eax ds:00000000`00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff803757bc5fa to fffff8037575e9a0
STACK_TEXT:
ffffd000`cc56ac28 fffff803`757bc5fa : 00000000`000000fc ffffe001`86bfc860 80000000`469bc963 ffffd000`cc56ae70 : nt!KeBugCheckEx
ffffd000`cc56ac30 fffff803`7580d50a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4d74a
ffffd000`cc56ac70 fffff803`7578944d : ffffe001`895a6080 ffffd000`cc56ad00 ffffe001`81c68900 00000000`00000000 : nt!MiRaisedIrqlFault+0x152
ffffd000`cc56acb0 fffff803`75768c2f : 00000000`00000008 ffffe001`895a6080 00000000`80000300 fffff800`acb20000 : nt! ?? ::FNODOBFM::`string'+0x1a59d
ffffd000`cc56ae70 ffffe001`86bfc860 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x12f
ffffd000`cc56b000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffe001`86bfc860
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4d74a
fffff803`757bc5fa cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4d74a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54c832b2
IMAGE_VERSION: 6.3.9600.17668
BUCKET_ID_FUNC_OFFSET: 4d74a
FAILURE_BUCKET_ID: 0xFC_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0xFC_nt!_??_::FNODOBFM::_string_
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xfc_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {a715e467-86e4-97ce-e0a9-37223e080980}
Followup: MachineOwner
---------
6: kd> .trap 0xffffd000cc56ae70
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000001ab000
rdx=ffffd000cb707180 rsi=0000000000000000 rdi=0000000000000000
rip=ffffe00186bfc860 rsp=ffffd000cc56b000 rbp=ffffd000cf0248c9
r8=0000000000000006 r9=7fffe001d1bf7050 r10=ffffe001d1bf7050
r11=7ffffffffffffffc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na pe nc
ffffe001`86bfc860 0100 add dword ptr [rax],eax ds:00000000`00000000=????????
6: kd> !pte 80000000469bc963
VA 80000000469bc963
PXE at FFFFF6FB7DBED000 PPE at FFFFF6FB7DA00008 PDE at FFFFF6FB400011A0 PTE at FFFFF68000234DE0
contains 020000000482E867 contains 0210000065EAF867 contains 0000000000000000
GetUlongFromAddress: unable to read from fffff80375971104
pfn 482e ---DA--UWEV pfn 65eaf---DA--UWEV not valid
WARNING: noncanonical VA, accesses will fault !
Write access results in fault.
Running driver verifier should tell more:
It looks a lot like each other if you ask me and the suggestion is the same, driver verifier.
Code:
******************************************************************************** *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffd00000000007, Virtual address for the attempted execute.
Arg2: 80000000001a8963, PTE contents.
Arg3: ffffd000210ba4c0, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xFC
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
TRAP_FRAME: ffffd000210ba4c0 -- (.trap 0xffffd000210ba4c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd00000000007 rbx=0000000000000000 rcx=000000000000cff0
rdx=ffffe001ad42b001 rsi=0000000000000000 rdi=0000000000000000
rip=ffffd00000000007 rsp=ffffd000210ba658 rbp=ffffe001b08b92fe
r8=ffffe001ad42b010 r9=00000000000007ff r10=ffffd0019b880c40
r11=ffffd000210ba650 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffffd000`00000007 ff ???
Resetting default scope
LOCK_ADDRESS: fffff803e6f883e0 -- (!locks fffff803e6f883e0)
Resource @ nt!PiEngineLock (0xfffff803e6f883e0) Exclusively owned
Contention Count = 20
Threads: ffffe001aead8040-01<*>
1 total locks, 1 locks currently held
PNP_TRIAGE:
Lock address : 0xfffff803e6f883e0
Thread Count : 1
Thread address: 0xffffe001aead8040
Thread wait : 0x2e1d
LAST_CONTROL_TRANSFER: from fffff803e6e1ca0e to fffff803e6dd3760
STACK_TEXT:
ffffd000`210ba218 fffff803`e6e1ca0e : 00000000`000000fc ffffd000`00000007 80000000`001a8963 ffffd000`210ba4c0 : nt!KeBugCheckEx
ffffd000`210ba220 fffff803`e6cc8e09 : 00000000`00000000 ffffd000`210ba448 ffffe001`b0971800 fffff803`e6c21f25 : nt! ?? ::FNODOBFM::`string'+0x3a90e
ffffd000`210ba260 fffff803`e6cca17c : 00000000`00000011 ffffe001`b08b91b0 ffffd000`210ba4c0 ffffe001`b0971a40 : nt!MiSystemFault+0x7e9
ffffd000`210ba350 fffff803`e6ddc9bc : ffffe001`ab68a300 ffffe001`ae22d290 00000000`00000000 ffffd000`210ba569 : nt!MmAccessFault+0x62c
ffffd000`210ba4c0 ffffd000`00000007 : fffff800`fae09fb2 ffffe001`b08b91b0 ffffc001`7907c8fd 00000000`00000000 : nt!KiPageFault+0x13c
ffffd000`210ba658 fffff800`fae09fb2 : ffffe001`b08b91b0 ffffc001`7907c8fd 00000000`00000000 ffffc001`7907c8fd : 0xffffd000`00000007
ffffd000`210ba660 fffff800`fae081ff : ffffe001`b08b91b0 ffffe001`ab68a310 ffffe001`b08b91b0 ffffe001`ad480060 : PCIIDEX!ControllerStartDevice+0x1ea
ffffd000`210ba6d0 fffff803`e7044a7d : ffffe001`ad403b80 ffffd000`210ba7f0 ffffe001`b08b9060 00000000`00000000 : PCIIDEX!GenPnpFdoStartDevice+0x6f
ffffd000`210ba710 fffff803`e6c94e14 : ffffe001`ad480060 00000000`00000000 ffffe001`ab68a310 00000000`00000000 : nt!PnpAsynchronousCall+0xe5
ffffd000`210ba750 fffff803`e6d85294 : 00000000`00000000 ffffe001`ad480060 fffff803`e6c94970 fffff803`e6c94970 : nt!PnpSendIrp+0x54
ffffd000`210ba7c0 fffff803`e7174c73 : ffffe001`ae511d30 ffffe001`ab68a310 00000000`00000000 00000000`00000000 : nt!PnpStartDevice+0x88
ffffd000`210ba850 fffff803`e7174b5f : ffffe001`ae511d30 ffffd000`210baa20 00000000`00000000 ffffe001`ae511d30 : nt!PnpStartDeviceNode+0xdb
ffffd000`210ba8e0 fffff803`e7159927 : ffffe001`ae511d30 00000000`00000001 00000000`00000001 ffffe001`ab53dd30 : nt!PipProcessStartPhase1+0x53
ffffd000`210ba920 fffff803`e712cc95 : ffffe001`ae59e010 ffffe001`aef64b30 00000000`00000000 00000000`00000000 : nt!PipProcessDevNodeTree+0x40b
ffffd000`210baba0 fffff803`e6d78eb2 : 00000001`00000003 00000000`00000000 00000000`00000000 ffffe001`32706e50 : nt!PiProcessReenumeration+0xa1
ffffd000`210babf0 fffff803`e6cfbb79 : ffffe001`aead8040 fffff803`e6f86e80 fffff803`e7024340 fffff803`e7024340 : nt!PnpDeviceActionWorker+0x166
ffffd000`210bacc0 fffff803`e6c9a125 : 00000004`ad1b3ffe 00000000`00000080 ffffe001`ab41b700 ffffe001`aead8040 : nt!ExpWorkerThread+0xe9
ffffd000`210bad50 fffff803`e6dd8906 : ffffd001`a0400180 ffffe001`aead8040 fffff803`e6c9a0e4 00000000`00000000 : nt!PspSystemThreadStartup+0x41
ffffd000`210bada0 00000000`00000000 : ffffd000`210bb000 ffffd000`210b5000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
PCIIDEX!ControllerStartDevice+1ea
fffff800`fae09fb2 85ff test edi,edi
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: PCIIDEX!ControllerStartDevice+1ea
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: PCIIDEX
IMAGE_NAME: PCIIDEX.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 5632d167
IMAGE_VERSION: 10.0.10586.0
BUCKET_ID_FUNC_OFFSET: 1ea
FAILURE_BUCKET_ID: 0xFC_PCIIDEX!ControllerStartDevice
BUCKET_ID: 0xFC_PCIIDEX!ControllerStartDevice
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xfc_pciidex!controllerstartdevice
FAILURE_ID_HASH: {18624ccb-5ca4-6ecb-90a2-dc57d16efca7}
Followup: MachineOwner
---------
GetPointerFromAddress: unable to read from fffff803e7010200
THREAD ffffe001aead8040 Cid 0004.0efc Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 3
Not impersonating
GetUlongFromAddress: unable to read from fffff803e6f5fef8
Owning Process ffffe001ab41b700 Image: System
Attached Process N/A Image: N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount 11805
Context Switch Count 3687 IdealProcessor: 2 NoStackSwap
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address nt!ExpWorkerThread (0xfffff803e6cfba90)
Stack Init ffffd000210badd0 Current ffffd000210ba070
Base ffffd000210bb000 Limit ffffd000210b5000 Call 0
Priority 12 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
ffffd000`210ba218 fffff803`e6e1ca0e : 00000000`000000fc ffffd000`00000007 80000000`001a8963 ffffd000`210ba4c0 : nt!KeBugCheckEx
ffffd000`210ba220 fffff803`e6cc8e09 : 00000000`00000000 ffffd000`210ba448 ffffe001`b0971800 fffff803`e6c21f25 : nt! ?? ::FNODOBFM::`string'+0x3a90e
ffffd000`210ba260 fffff803`e6cca17c : 00000000`00000011 ffffe001`b08b91b0 ffffd000`210ba4c0 ffffe001`b0971a40 : nt!MiSystemFault+0x7e9
ffffd000`210ba350 fffff803`e6ddc9bc : ffffe001`ab68a300 ffffe001`ae22d290 00000000`00000000 ffffd000`210ba569 : nt!MmAccessFault+0x62c
ffffd000`210ba4c0 ffffd000`00000007 : fffff800`fae09fb2 ffffe001`b08b91b0 ffffc001`7907c8fd 00000000`00000000 : nt!KiPageFault+0x13c (TrapFrame @ ffffd000`210ba4c0)
ffffd000`210ba658 fffff800`fae09fb2 : ffffe001`b08b91b0 ffffc001`7907c8fd 00000000`00000000 ffffc001`7907c8fd : 0xffffd000`00000007
ffffd000`210ba660 fffff800`fae081ff : ffffe001`b08b91b0 ffffe001`ab68a310 ffffe001`b08b91b0 ffffe001`ad480060 : PCIIDEX!ControllerStartDevice+0x1ea
ffffd000`210ba6d0 fffff803`e7044a7d : ffffe001`ad403b80 ffffd000`210ba7f0 ffffe001`b08b9060 00000000`00000000 : PCIIDEX!GenPnpFdoStartDevice+0x6f
ffffd000`210ba710 fffff803`e6c94e14 : ffffe001`ad480060 00000000`00000000 ffffe001`ab68a310 00000000`00000000 : nt!PnpAsynchronousCall+0xe5
ffffd000`210ba750 fffff803`e6d85294 : 00000000`00000000 ffffe001`ad480060 fffff803`e6c94970 fffff803`e6c94970 : nt!PnpSendIrp+0x54
ffffd000`210ba7c0 fffff803`e7174c73 : ffffe001`ae511d30 ffffe001`ab68a310 00000000`00000000 00000000`00000000 : nt!PnpStartDevice+0x88
ffffd000`210ba850 fffff803`e7174b5f : ffffe001`ae511d30 ffffd000`210baa20 00000000`00000000 ffffe001`ae511d30 : nt!PnpStartDeviceNode+0xdb
ffffd000`210ba8e0 fffff803`e7159927 : ffffe001`ae511d30 00000000`00000001 00000000`00000001 ffffe001`ab53dd30 : nt!PipProcessStartPhase1+0x53
ffffd000`210ba920 fffff803`e712cc95 : ffffe001`ae59e010 ffffe001`aef64b30 00000000`00000000 00000000`00000000 : nt!PipProcessDevNodeTree+0x40b
ffffd000`210baba0 fffff803`e6d78eb2 : 00000001`00000003 00000000`00000000 00000000`00000000 ffffe001`32706e50 : nt!PiProcessReenumeration+0xa1
ffffd000`210babf0 fffff803`e6cfbb79 : ffffe001`aead8040 fffff803`e6f86e80 fffff803`e7024340 fffff803`e7024340 : nt!PnpDeviceActionWorker+0x166
ffffd000`210bacc0 fffff803`e6c9a125 : 00000004`ad1b3ffe 00000000`00000080 ffffe001`ab41b700 ffffe001`aead8040 : nt!ExpWorkerThread+0xe9
ffffd000`210bad50 fffff803`e6dd8906 : ffffd001`a0400180 ffffe001`aead8040 fffff803`e6c9a0e4 00000000`00000000 : nt!PspSystemThreadStartup+0x41
ffffd000`210bada0 00000000`00000000 : ffffd000`210bb000 ffffd000`210b5000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
Machine ID Information [From Smbios 2.4, DMIVersion 0, Size=1197]
BiosVendor = Award Software International, Inc.
BiosVersion = F11
BiosReleaseDate = 08/10/2010
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = P55A-UD3
SystemFamily =
SystemVersion =
SystemSKU =
BaseBoardManufacturer = Gigabyte Technology Co., Ltd.
BaseBoardProduct = P55A-UD3
BaseBoardVersion = x.x
CPUID: "Intel(R) Core(TM) i5 CPU 750 @ 2.67GHz"
MaxSpeed: 2670
CurrentSpeed: 2532
Bugcheck code 000000FC
Arguments ffffd000`00000007 80000000`001a8963 ffffd000`210ba4c0 00000000`00000002
Debug session time: Sat Dec 26 11:17:37.755 2015 (UTC + 1:00)
System Uptime: 0 days 0:03:04.468
3: kd> .trap 0xffffd000210ba4c0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd00000000007 rbx=0000000000000000 rcx=000000000000cff0
rdx=ffffe001ad42b001 rsi=0000000000000000 rdi=0000000000000000
rip=ffffd00000000007 rsp=ffffd000210ba658 rbp=ffffe001b08b92fe
r8=ffffe001ad42b010 r9=00000000000007ff r10=ffffd0019b880c40
r11=ffffd000210ba650 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffffd000`00000007 ff ???
3: kd> !pte 80000000001a8963
VA 80000000001a8963
PXE at FFFFF6FB7DBED000 PPE at FFFFF6FB7DA00000 PDE at FFFFF6FB40000000 PTE at FFFFF68000000D40
contains 01200002150E8867 contains 0000000000000000
pfn 2150e8 ---DA--UWEV not valid
WARNING: noncanonical VA, accesses will fault !