Code:
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\063019-25750-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*
Symbol search path is: SRV*
Executable search path is:
Windows 10 Kernel Version 17763 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff804`02013000 PsLoadedModuleList = 0xfffff804`0242e5d0
Debug session time: Sat Jun 29 20:21:32.455 2019 (UTC + 2:00)
System Uptime: 0 days 0:34:58.183
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
......
For analysis of this file, run !analyze -v
1: kd> !analyze
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {80000003, fffff804020421c5, ffffce817d3a1e70, 0}
Probably caused by : ntkrnlmp.exe ( nt!KeCheckStackAndTargetAddress+45 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 0000000080000003, Exception code that caused the bugcheck
Arg2: fffff804020421c5, Address of the instruction which caused the bugcheck
Arg3: ffffce817d3a1e70, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.17763.557 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 0212
BIOS_DATE: 02/17/2013
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: B75M-A
BASEBOARD_VERSION: Rev X.0x
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: 80000003
BUGCHECK_P2: fffff804020421c5
BUGCHECK_P3: ffffce817d3a1e70
BUGCHECK_P4: 0
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid
FAULTING_IP:
nt!KeCheckStackAndTargetAddress+45
fffff804`020421c5 cc int 3
CONTEXT: ffffce817d3a1e70 -- (.cxr 0xffffce817d3a1e70)
rax=ffffce817d3a2888 rbx=ffffce817d3a3aa8 rcx=0000000000000000
rdx=ffffce817d3a3aa8 rsi=ffffce817d3a30b0 rdi=0000000000000000
rip=fffff804020421c5 rsp=ffffce817d3a2860 rbp=ffffce817d3a2e70
r8=ffffce817d3a30b0 r9=ffffce817d3a2ef0 r10=0000fffff804021a
r11=ffff99fa2fe00000 r12=ffffce817d3a3ab0 r13=ffffce817d3a3868
r14=ffffce817d3a2ef0 r15=ffffce817d3a3868
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!KeCheckStackAndTargetAddress+0x45:
fffff804`020421c5 cc int 3
Resetting default scope
BUGCHECK_STR: 0x3B_80000003
CPU_COUNT: 4
CPU_MHZ: d40
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3a
CPU_STEPPING: 9
CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 20'00000000 (cache) 20'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: r5apex.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: MICHAL
ANALYSIS_SESSION_TIME: 07-06-2019 19:37:13.0989
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
EXCEPTION_RECORD: 0000000000001000 -- (.exr 0x1000)
Cannot read Exception record @ 0000000000001000
TRAP_FRAME: ffff920805771000 -- (.trap 0xffff920805771000)
Unable to read trap frame at ffff9208`05771000
LAST_CONTROL_TRANSFER: from fffff804021a13cb to fffff804020421c5
STACK_TEXT:
ffffce81`7d3a2860 fffff804`021a13cb : 00000000`00000000 ffffce81`7d3a3ab0 00000000`00000000 ffffce81`7d3a2e78 : nt!KeCheckStackAndTargetAddress+0x45
ffffce81`7d3a2890 fffff804`021cf9f2 : ffffce81`7d3a3ab0 ffffce81`7d3a2e70 ffffce81`7d3a2f50 00000000`0010001f : nt!_C_specific_handler+0x3b
ffffce81`7d3a2900 fffff804`021283a0 : ffffce81`7d3a2f50 00000000`00000000 ffffce81`7d3a2e70 ffffce81`7d3a3868 : nt!RtlpExecuteHandlerForException+0x12
ffffce81`7d3a2930 fffff804`02035bb4 : ffffce81`7d3a3868 ffffce81`7d3a35b0 ffffce81`7d3a3868 00000000`00000000 : nt!RtlDispatchException+0x430
ffffce81`7d3a3080 fffff804`021d8742 : 00000000`00001000 ffffce81`7d3a3910 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x144
ffffce81`7d3a3730 fffff804`021d4a68 : 00000000`00000000 00000000`00000000 00000000`00000001 ffffd48a`778ae070 : nt!KiExceptionDispatch+0xc2
ffffce81`7d3a3910 00000000`00000000 : fffff804`02612db2 00000000`00000001 ffffce81`7d3a3b80 00000000`00000000 : nt!KiPageFault+0x428
THREAD_SHA1_HASH_MOD_FUNC: 6e131cefa79277b75e380ffeef670a4be4241694
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b70187dca55a65465a0155b7e1f275331642252a
THREAD_SHA1_HASH_MOD: 30a3e915496deaace47137d5b90c3ecc03746bf6
FOLLOWUP_IP:
nt!KeCheckStackAndTargetAddress+45
fffff804`020421c5 cc int 3
FAULT_INSTR_CODE: cf8b48cc
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KeCheckStackAndTargetAddress+45
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 33a6c3fc
IMAGE_VERSION: 10.0.17763.557
STACK_COMMAND: .cxr 0xffffce817d3a1e70 ; kb
BUCKET_ID_FUNC_OFFSET: 45
FAILURE_BUCKET_ID: 0x3B_80000003_nt!KeCheckStackAndTargetAddress
BUCKET_ID: 0x3B_80000003_nt!KeCheckStackAndTargetAddress
PRIMARY_PROBLEM_CLASS: 0x3B_80000003_nt!KeCheckStackAndTargetAddress
TARGET_TIME: 2019-06-29T18:21:32.000Z
OSBUILD: 17763
OSSERVICEPACK: 557
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1997-06-17 19:06:04
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.17763.557
ANALYSIS_SESSION_ELAPSED_TIME: 164a
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x3b_80000003_nt!kecheckstackandtargetaddress
FAILURE_ID_HASH: {3c8e413e-71c2-0077-9ab0-f2dd61308472}
Followup: MachineOwner
---------
1: kd> .load pde
=========================================================================================
PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
1: kd> !dpx
Start memory scan : 0xffffce817d3a1538 ($csp)
End memory scan : 0xffffce817d3a4000 (Kernel Stack Base)
rsp : 0xffffce817d3a1538 : 0xfffff804021d8669 : nt!KiBugCheckDispatch+0x69
0xffffce817d3a1538 : 0xfffff804021d8669 : nt!KiBugCheckDispatch+0x69
0xffffce817d3a1550 : 0xfffff804020421c5 : nt!KeCheckStackAndTargetAddress+0x45
0xffffce817d3a1568 : 0xfffff80402a869f4 : hal!HalpApicRequestInterrupt+0x94
0xffffce817d3a1610 : 0xfffff804020421c5 : nt!KeCheckStackAndTargetAddress+0x45
0xffffce817d3a1618 : 0xfffff804020421a8 : nt!KeCheckStackAndTargetAddress+0x28
0xffffce817d3a1658 : 0xfffff804021d8088 : nt!KiSystemServiceCopyEnd+0x28
0xffffce817d3a1678 : 0xfffff804021d7abc : nt!KiSystemServiceHandler+0x7c
0xffffce817d3a16a8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a16b0 : 0xfffff804021d7a40 : nt!KiSystemServiceHandler
0xffffce817d3a16b8 : 0xfffff804021cf9f2 : nt!RtlpExecuteHandlerForException+0x12
0xffffce817d3a16c0 : 0xfffff804024f6000 : "nt!Ports <PERF> (nt+0x4e3000)"
0xffffce817d3a16c8 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a16e0 : 0xffffce817d3a1cb0 : 0xfffff804021d8088 : nt!KiSystemServiceCopyEnd+0x28
0xffffce817d3a16e8 : 0xfffff804021283a0 : nt!RtlDispatchException+0x430
0xffffce817d3a1720 : 0xffffce817d3a1750 : 0xfffff80402abc700 : hal!HalpApicX2WriteCommand
0xffffce817d3a1728 : 0xfffff80402098282 : nt!KiChooseTargetProcessor+0x172
0xffffce817d3a1740 : 0xfffff80402571240 : nt!ExNode0
0xffffce817d3a1750 : 0xfffff80402abc700 : hal!HalpApicX2WriteCommand
0xffffce817d3a1758 : 0xfffff80402a869f4 : hal!HalpApicRequestInterrupt+0x94
0xffffce817d3a1778 : 0xfffff80402a869f4 : hal!HalpApicRequestInterrupt+0x94
0xffffce817d3a1898 : 0xffffce817d3a2638 : 0xfffff804020421c5 : nt!KeCheckStackAndTargetAddress+0x45
Unable to load image nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
0xffffce817d3a1908 : 0xfffff80402114203 : nt!KiAbEntryGetLockedHeadEntry+0x4c3
0xffffce817d3a1918 : 0xfffff80402114009 : nt!KiAbEntryGetLockedHeadEntry+0x2c9
0xffffce817d3a19e0 : 0xfffff80402a9e130 : hal!HalpApicX2EndOfInterrupt
0xffffce817d3a19e8 : 0xfffff804021cdb1f : nt!KiDispatchInterrupt+0xf
0xffffce817d3a1a38 : 0xfffff804021cdf2f : nt!SwapContext+0x1af
0xffffce817d3a1a78 : 0xfffff804021cdcd8 : nt!KxDispatchInterrupt+0x138
0xffffce817d3a1b68 : 0xfffff804021cdb1f : nt!KiDispatchInterrupt+0xf
0xffffce817d3a1b70 : 0xfffff80402a9e130 : hal!HalpApicX2EndOfInterrupt
0xffffce817d3a1b78 : 0xfffff804021cdb1f : nt!KiDispatchInterrupt+0xf
0xffffce817d3a1b88 : 0xfffff804020f4b08 : nt!KeQueryCurrentStackInformation+0x68
0xffffce817d3a1ba8 : 0xfffff80402128c60 : nt!RtlGetExtendedContextLength2+0x3c
0xffffce817d3a1bb8 : 0xfffff804020f4a84 : nt!RtlpGetStackLimits+0x14
0xffffce817d3a1be8 : 0xfffff80402128016 : nt!RtlDispatchException+0xa6
0xffffce817d3a1c38 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1c88 : 0xfffff8040250cfa4 : "nt!Ports <PERF> (nt+0x4f9fa4)"
0xffffce817d3a1ca8 : 0xfffff804020ee9bd : nt!KiAbProcessContextSwitch+0x15d
0xffffce817d3a1cb0 : 0xfffff804021d8088 : nt!KiSystemServiceCopyEnd+0x28
0xffffce817d3a1cb8 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1cc0 : 0xfffff8040250cfa4 : "nt!Ports <PERF> (nt+0x4f9fa4)"
0xffffce817d3a1ce0 : 0xfffff804021d7a40 : nt!KiSystemServiceHandler
0xffffce817d3a1d18 : 0xfffff80402035a70 : nt!KiDispatchException
0xffffce817d3a1d20 : 0xfffff80402612def : nt!NtSetEvent+0xcf
0xffffce817d3a1d28 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1d30 : 0xfffff804024f87fc : "nt!Ports <PERF> (nt+0x4e57fc)"
0xffffce817d3a1d38 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1d40 : 0xfffff80402509b48 : "nt!Ports <PERF> (nt+0x4f6b48)"
0xffffce817d3a1d48 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1d50 : 0xfffff8040250ca4c : "nt!Ports <PERF> (nt+0x4f9a4c)"
0xffffce817d3a1d58 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1d60 : 0xfffff80402502cf0 : "nt!Ports <PERF> (nt+0x4efcf0)"
0xffffce817d3a1d68 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1d70 : 0xfffff804024f7d40 : "nt!Ports <PERF> (nt+0x4e4d40)"
0xffffce817d3a1d78 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1d80 : 0xfffff8040250cfbc : "nt!Ports <PERF> (nt+0x4f9fbc)"
0xffffce817d3a1d88 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1d90 : 0xfffff8040250cee4 : "nt!Ports <PERF> (nt+0x4f9ee4)"
0xffffce817d3a1d98 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1da0 : 0xfffff80402527284 : "nt!Ports <PERF> (nt+0x514284)"
0xffffce817d3a1da8 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a1db0 : 0xfffff8040250cfa4 : "nt!Ports <PERF> (nt+0x4f9fa4)"
0xffffce817d3a1db8 : 0xfffff80402128d3a : nt!RtlInitializeExtendedContext2+0x32
0xffffce817d3a1dc8 : 0xfffff804021295e7 : nt!KeCopyLastBranchInformation+0x33
0xffffce817d3a1df8 : 0xfffff80402035f2e : nt!KdTrap+0x22
0xffffce817d3a1e38 : 0xfffff80402035bb4 : nt!KiDispatchException+0x144
0xffffce817d3a1ee8 : 0xffffce817d3a2888 : 0xfffff804021a13cb : nt!_C_specific_handler+0x3b
0xffffce817d3a1ef8 : 0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a1f00 : 0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a1f30 : 0xffffce817d3a2ef0 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a1f58 : 0xffffce817d3a2ef0 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a1f68 : 0xfffff804020421c5 : nt!KeCheckStackAndTargetAddress+0x45
0xffffce817d3a1fd8 : 0xffffce817d3a2638 : 0xfffff804020421c5 : nt!KeCheckStackAndTargetAddress+0x45
0xffffce817d3a2020 : 0xfffff804024f6000 : "nt!Ports <PERF> (nt+0x4e3000)"
0xffffce817d3a2028 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a2138 : 0xfffff804020f4d91 : nt!EtwWriteEx+0xe1
0xffffce817d3a2248 : 0xfffff804020f4c9c : nt!EtwWrite+0x2c
0xffffce817d3a22b0 : 0xfffff80402a9e130 : hal!HalpApicX2EndOfInterrupt
0xffffce817d3a22c8 : 0xfffff80402128c60 : nt!RtlGetExtendedContextLength2+0x3c
0xffffce817d3a2308 : 0xfffff80402128b59 : nt!RtlGetExtendedContextLength+0x2d
0xffffce817d3a24b0 : 0xffffce817d3a25f0 : 0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a24c0 : 0xffffce817d3a2ef0 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a24d8 : 0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a24e0 : 0xffffce817d3a2750 : 0xfffff804024f6000 : "nt!Ports <PERF> (nt+0x4e3000)"
0xffffce817d3a24e8 : 0xfffff804021d8742 : nt!KiExceptionDispatch+0xc2
0xffffce817d3a25f0 : 0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a2618 : 0xffffce817d3a2ef0 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a2638 : 0xfffff804020421c5 : nt!KeCheckStackAndTargetAddress+0x45
0xffffce817d3a26c8 : 0xfffff804021d247b : nt!KiBreakpointTrap+0x2fb
0xffffce817d3a26d0 : 0x0000000000000000 : Trap @ ffffce817d3a26d0
0xffffce817d3a2700 : 0xffffce817d3a2888 : 0xfffff804021a13cb : nt!_C_specific_handler+0x3b
0xffffce817d3a2710 : 0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a2720 : 0xffffce817d3a2ef0 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a2750 : 0xfffff804024f6000 : "nt!Ports <PERF> (nt+0x4e3000)"
0xffffce817d3a2758 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a2838 : 0xfffff804020421c6 : nt!KeCheckStackAndTargetAddress+0x46
0xffffce817d3a2868 : 0xfffff8040fd18813 : dxgmms2!VidSchiProfilePerformanceTick+0x193
0xffffce817d3a2888 : 0xfffff804021a13cb : nt!_C_specific_handler+0x3b
0xffffce817d3a28a8 : 0xffffce817d3a2e78 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a28e8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a28f8 : 0xfffff804021cf9f2 : nt!RtlpExecuteHandlerForException+0x12
0xffffce817d3a2920 : 0xffffce817d3a2ef0 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a2928 : 0xfffff804021283a0 : nt!RtlDispatchException+0x430
0xffffce817d3a2958 : 0xfffff8040fd86d8b : dxgmms2!VIDMM_DEVICE::EnsureSchedulable+0x9b
0xffffce817d3a2988 : 0xfffff8040fd15681 : dxgmms2!VidSchiSubmitCommandPacketToQueue+0x211
0xffffce817d3a29d0 : 0xfffff8040fd1470c : dxgmms2!VidSchiInterlockedInsertTailList+0x5c
0xffffce817d3a2a38 : 0xfffff804020e50d9 : nt!ExAcquirePushLockExclusiveEx+0xe9
0xffffce817d3a2a68 : 0xfffff804021d8088 : nt!KiSystemServiceCopyEnd+0x28
0xffffce817d3a2a98 : 0xfffff8040fd826f6 : dxgmms2!VIDMM_GLOBAL::ETWAllocationHandle+0xb6
0xffffce817d3a2ac8 : 0xfffff8040c210c16 : dxgkrnl!IsThreadCrossSessionAttached+0x12
0xffffce817d3a2af8 : 0xfffff8040c2acca2 : dxgkrnl!DXGALLOCATIONREFERENCE::~DXGALLOCATIONREFERENCE+0x142
0xffffce817d3a2b18 : 0xfffff804020e50d9 : nt!ExAcquirePushLockExclusiveEx+0xe9
0xffffce817d3a2b58 : 0xfffff804020e4f2f : nt!ExReleasePushLockExclusiveEx+0x1af
0xffffce817d3a2c28 : 0xfffff80402061d40 : nt!ExTryAcquirePushLockExclusiveEx+0xf0
0xffffce817d3a2c68 : 0xfffff8040fd86d8b : dxgmms2!VIDMM_DEVICE::EnsureSchedulable+0x9b
0xffffce817d3a2c98 : 0xfffff8040fd15681 : dxgmms2!VidSchiSubmitCommandPacketToQueue+0x211
0xffffce817d3a2ce0 : 0xfffff8040fd1470c : dxgmms2!VidSchiInterlockedInsertTailList+0x5c
0xffffce817d3a2d48 : 0xffffa9de3e3c1086 : win32kbase!UserSessionSwitchLeaveCrit+0x96
0xffffce817d3a2d68 : 0xffffa9de3e3a6722 : win32kbase!ReleaseCacheDC+0x4c2
0xffffce817d3a2d78 : 0xfffff8040fd86a59 : dxgmms2!VidSchSubmitCommand+0x2e9
0xffffce817d3a2dc8 : 0xfffff804020f4b08 : nt!KeQueryCurrentStackInformation+0x68
0xffffce817d3a2de8 : 0xfffff80402128c60 : nt!RtlGetExtendedContextLength2+0x3c
0xffffce817d3a2df8 : 0xfffff804020f4a84 : nt!RtlpGetStackLimits+0x14
0xffffce817d3a2e28 : 0xfffff80402128016 : nt!RtlDispatchException+0xa6
0xffffce817d3a2e68 : 0xfffff8040c2aca49 : dxgkrnl!DXGADAPTER::AcquireCoreResourceShared+0x129
0xffffce817d3a2e78 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a2ec8 : 0xfffff80402527284 : "nt!Ports <PERF> (nt+0x514284)"
0xffffce817d3a2ef0 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a2ef8 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a2f00 : 0xfffff80402527284 : "nt!Ports <PERF> (nt+0x514284)"
0xffffce817d3a2f20 : 0xfffff804021a1390 : nt!_C_specific_handler
0xffffce817d3a2f58 : 0xfffff80402612d20 : nt!NtSetEvent
0xffffce817d3a2f60 : 0xfffff80402612def : nt!NtSetEvent+0xcf
0xffffce817d3a2f68 : 0xfffff80402013000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffffce817d3a2f70 : 0xfffff80402527284 : "nt!Ports <PERF> (nt+0x514284)"
0xffffce817d3a2ff8 : 0xfffff80402128d3a : nt!RtlInitializeExtendedContext2+0x32
0xffffce817d3a3008 : 0xfffff804021295e7 : nt!KeCopyLastBranchInformation+0x33
0xffffce817d3a3018 : 0xfffff804020e50d9 : nt!ExAcquirePushLockExclusiveEx+0xe9
0xffffce817d3a3038 : 0xfffff80402035f2e : nt!KdTrap+0x22
0xffffce817d3a3078 : 0xfffff80402035bb4 : nt!KiDispatchException+0x144
0xffffce817d3a30d8 : 0xfffff804020e4f2f : nt!ExReleasePushLockExclusiveEx+0x1af
0xffffce817d3a3148 : 0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a31d8 : 0xfffff8040fd826f6 : dxgmms2!VIDMM_GLOBAL::ETWAllocationHandle+0xb6
0xffffce817d3a3208 : 0xfffff8040c210c16 : dxgkrnl!IsThreadCrossSessionAttached+0x12
0xffffce817d3a3238 : 0xfffff8040c2acca2 : dxgkrnl!DXGALLOCATIONREFERENCE::~DXGALLOCATIONREFERENCE+0x142
0xffffce817d3a3508 : 0xfffff80402128c60 : nt!RtlGetExtendedContextLength2+0x3c
0xffffce817d3a3528 : 0xfffff804020c7c30 : nt!MiInPagePageTable+0x290
0xffffce817d3a3548 : 0xfffff80402128b59 : nt!RtlGetExtendedContextLength+0x2d
0xffffce817d3a3648 : 0xfffff804020dd2c6 : nt!MiUnlockWorkingSetShared+0x66
0xffffce817d3a3678 : 0xfffff804020dbca2 : nt!MiUserFault+0x742
0xffffce817d3a36a8 : 0xffffce817d3a3648 : 0xfffff804020dd2c6 : nt!MiUnlockWorkingSetShared+0x66
0xffffce817d3a36d8 : 0xfffff804021ce234 : nt!SwapContext+0x4b4
0xffffce817d3a3728 : 0xfffff804021d8742 : nt!KiExceptionDispatch+0xc2
0xffffce817d3a3818 : 0xfffff80402029ec1 : nt!ExInterlockedRemoveHeadList+0x31
0xffffce817d3a3908 : 0xfffff804021d4a68 : nt!KiPageFault+0x428
0xffffce817d3a3910 : 0x0000000000000000 : Trap @ ffffce817d3a3910
0xffffce817d3a3a18 : 0xfffff804020968f7 : nt!KeSetEvent+0xb7
0xffffce817d3a3a58 : 0xfffff8040263445e : nt!ObReferenceObjectByHandle+0x2e
0xffffce817d3a3a90 : 0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a3aa8 : 0xfffff80402612db2 : nt!NtSetEvent+0x92
0xffffce817d3a3af8 : 0xfffff804021d8088 : nt!KiSystemServiceCopyEnd+0x28
0xffffce817d3a3b00 : 0xffff9208d986d080 : Trap @ ffffce817d3a3b00
1: kd> lmvm nvlddmkm
Browse full module list
start end module name
fffff804`0fe60000 fffff804`11396000 nvlddmkm T (no symbols)
Loaded symbol image file: nvlddmkm.sys
Image path: nvlddmkm.sys
Image name: nvlddmkm.sys
Browse all global symbols functions data
Timestamp: Wed May 22 14:18:43 2019 (5CE5BCB3)
CheckSum: 014D759C
ImageSize: 01536000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Run msconfig, select "Boot" page, select "Advanced options" and check "Debug". Reboot computer
Code:
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\070119-29046-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*
Symbol search path is: SRV*
Executable search path is:
Windows 10 Kernel Version 17763 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff806`4c019000 PsLoadedModuleList = 0xfffff806`4c4345d0
Debug session time: Mon Jul 1 14:06:00.739 2019 (UTC + 2:00)
System Uptime: 0 days 14:34:58.467
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
1: kd> !analyze
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 139, {3, fffff98f7f2316d0, fffff98f7f231628, 0}
Probably caused by : win32kfull.sys ( win32kfull!xxxRealSleepThread+370 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff98f7f2316d0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff98f7f231628, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.17763.557 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 0212
BIOS_DATE: 02/17/2013
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: B75M-A
BASEBOARD_VERSION: Rev X.0x
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: fffff98f7f2316d0
BUGCHECK_P3: fffff98f7f231628
BUGCHECK_P4: 0
TRAP_FRAME: fffff98f7f2316d0 -- (.trap 0xfffff98f7f2316d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9b0d4ed90e48 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8064c0f1fff rsp=fffff98f7f231860 rbp=fffff98f7f2318d1
r8=0000000000000001 r9=0000000000000000 r10=fffff98f7f231a98
r11=ffffd67c12800000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
nt!KeWaitForSingleObject+0xcdf:
fffff806`4c0f1fff cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffff98f7f231628 -- (.exr 0xfffff98f7f231628)
ExceptionAddress: fffff8064c0f1fff (nt!KeWaitForSingleObject+0x0000000000000cdf)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 4
CPU_MHZ: d40
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3a
CPU_STEPPING: 9
CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 20'00000000 (cache) 20'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: r5apex.exe
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: MICHAL
ANALYSIS_SESSION_TIME: 07-06-2019 19:41:30.0607
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff8064c1de669 to fffff8064c1ccef0
STACK_TEXT:
fffff98f`7f2313a8 fffff806`4c1de669 : 00000000`00000139 00000000`00000003 fffff98f`7f2316d0 fffff98f`7f231628 : nt!KeBugCheckEx
fffff98f`7f2313b0 fffff806`4c1dea10 : ffffe681`dcc91180 fffff806`4c0f2031 00000000`00000000 ffff9b0d`4f4dfb70 : nt!KiBugCheckDispatch+0x69
fffff98f`7f2314f0 fffff806`4c1dce08 : ffffd50a`c46ac000 fffff98f`7f2317e0 fffff98f`7f2317d0 ffffd50a`c46ac010 : nt!KiFastFailDispatch+0xd0
fffff98f`7f2316d0 fffff806`4c0f1fff : fffff806`4c577240 00000000`00000000 fffff806`4cac2700 00000000`4ca8c9f4 : nt!KiRaiseSecurityCheckFailure+0x308
fffff98f`7f231860 fffff806`4c0f0244 : ffff9b0d`4ed90e40 ffffd67c`0000000d ffff9b0d`5185a800 ffffd551`f7b91000 : nt!KeWaitForSingleObject+0xcdf
fffff98f`7f231930 ffffd551`f6443580 : ffffd50a`00000001 fffff98f`7f231a98 fffff98f`7f232b80 00000000`0000000d : nt!KeWaitForMultipleObjects+0x44
fffff98f`7f231a00 ffffd551`f64420ee : ffff9b0d`4f750000 fffff98f`7f230000 00000000`00000000 ffff9b0d`00000000 : win32kfull!xxxRealSleepThread+0x370
fffff98f`7f231b10 ffffd551`f654b92d : 00000000`00000000 fffff98f`7f232b80 00000000`00000200 fffff98f`7f231dd0 : win32kfull!xxxInterSendMsgEx+0x154e
fffff98f`7f231ce0 ffffd551`f651abf3 : 00000000`00000001 ffffd50a`c479b420 00000000`00000000 00000000`00000000 : win32kfull!xxxCallHook2+0x9e5
fffff98f`7f231f40 ffffd551`f64491a9 : 00000000`00000002 00000000`00000000 ffffd50a`fffffff7 ffffd50a`00000000 : win32kfull!xxxCallMouseHook+0x4b
fffff98f`7f231f80 ffffd551`f6445520 : ffffd50a`c46ac010 fffff98f`7f232b80 00000000`00003dff 00000000`00000000 : win32kfull!xxxScanSysQueue+0x20d9
fffff98f`7f232850 ffffd551`f6444b97 : fffff98f`7f232a20 fffff98f`7f233dbf 0000006d`00000000 ffff9b0d`4f4dfb70 : win32kfull!xxxRealInternalGetMessage+0x910
fffff98f`7f2329e0 fffff806`4c1de088 : 0000006d`0452f580 ffff9b0d`46427080 fffff98f`7f232aa8 00000000`00000000 : win32kfull!NtUserPeekMessage+0x157
fffff98f`7f232a90 00007ffa`234610c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000006d`0452f358 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`234610c4
THREAD_SHA1_HASH_MOD_FUNC: bc05c420f7af3a2d92a3685134fd2dd1f6010aba
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 11f8da0232d1149426a3c27a6ee53d64dfc38ee7
THREAD_SHA1_HASH_MOD: 6f4b5fcabf34c4734e713ded83c86ccfba9bf095
FOLLOWUP_IP:
win32kfull!xxxRealSleepThread+370
ffffd551`f6443580 448be0 mov r12d,eax
FAULT_INSTR_CODE: bae08b44
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: win32kfull!xxxRealSleepThread+370
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kfull
IMAGE_NAME: win32kfull.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 56883fe6
IMAGE_VERSION: 10.0.17763.557
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 370
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_win32kfull!xxxRealSleepThread
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_win32kfull!xxxRealSleepThread
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_win32kfull!xxxRealSleepThread
TARGET_TIME: 2019-07-01T12:06:00.000Z
OSBUILD: 17763
OSSERVICEPACK: 557
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1997-06-17 19:06:04
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.17763.557
ANALYSIS_SESSION_ELAPSED_TIME: 9bd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_win32kfull!xxxrealsleepthread
FAILURE_ID_HASH: {5d589c68-6d98-ce9b-289f-e95089450584}
Followup: MachineOwner
---------
1: kd> .load pde
=========================================================================================
PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
1: kd> !dpx
Start memory scan : 0xfffff98f7f2313a8 ($csp)
End memory scan : 0xfffff98f7f233000 (Kernel Stack Base)
rsp : 0xfffff98f7f2313a8 : 0xfffff8064c1de669 : nt!KiBugCheckDispatch+0x69
0xfffff98f7f2313a8 : 0xfffff8064c1de669 : nt!KiBugCheckDispatch+0x69
0xfffff98f7f2313d8 : 0xfffff8064c1d4234 : nt!SwapContext+0x4b4
0xfffff98f7f2314e8 : 0xfffff8064c1dea10 : nt!KiFastFailDispatch+0xd0
0xfffff98f7f2314f8 : 0xfffff8064c0f2031 : nt!KeWaitForSingleObject+0xd11
0xfffff98f7f2315d0 : 0xfffff8064c0eb790 : nt!KeLeaveCriticalRegion
0xfffff98f7f2315d8 : 0xffffd551f7b742db : win32kbase!EnterCrit+0x20b
0xfffff98f7f231638 : 0xfffff8064c0f1fff : nt!KeWaitForSingleObject+0xcdf
0xfffff98f7f231688 : 0xffffd551f7b7f094 : win32kbase!ThreadUnlock1+0x14
0xfffff98f7f2316b8 : 0xffffd551f64401d9 : win32kfull!SfnDWORD+0x369
0xfffff98f7f2316c8 : 0xfffff8064c1dce08 : nt!KiRaiseSecurityCheckFailure+0x308
0xfffff98f7f2316d0 : 0xffffd50ac46ac000 : Trap @ fffff98f7f2316d0
0xfffff98f7f231738 : 0xffffd551f654ad16 : win32kfull!IsThreadCrossSessionAttached+0x12
0xfffff98f7f2317c8 : 0xffffd551f643da9b : win32kfull!xxxHkCallHook+0x7bb
0xfffff98f7f231818 : 0xfffff8064c09e282 : nt!KiChooseTargetProcessor+0x172
0xfffff98f7f231838 : 0xfffff8064c0f1fff : nt!KeWaitForSingleObject+0xcdf
0xfffff98f7f231850 : 0xfffff98f7f231860 : 0xfffff8064c577240 : nt!ExNode0
0xfffff98f7f231860 : 0xfffff8064c577240 : nt!ExNode0
0xfffff98f7f231870 : 0xfffff8064cac2700 : hal!HalpApicX2WriteCommand
0xfffff98f7f2318a8 : 0xffffd551f7b7f094 : win32kbase!ThreadUnlock1+0x14
0xfffff98f7f231928 : 0xfffff8064c0f0244 : nt!KeWaitForMultipleObjects+0x44
0xfffff98f7f231948 : 0xffffd551f7b91000 : win32kbase!UserSessionSwitchLeaveCrit+0x10
0xfffff98f7f231988 : 0xfffff8064c0eda97 : nt!ExReleasePushLockSharedEx+0x37
0xfffff98f7f2319a8 : 0xffffd551f64401d9 : win32kfull!SfnDWORD+0x369
0xfffff98f7f2319c0 : 0xfffff8064c0eb790 : nt!KeLeaveCriticalRegion
0xfffff98f7f2319c8 : 0xffffd551f7b8cc4d : win32kbase!CInputThread::IsInputThread+0x5d
0xfffff98f7f2319f8 : 0xffffd551f6443580 : win32kfull!xxxRealSleepThread+0x370
0xfffff98f7f231a78 : 0xffffd551f645c227 : win32kfull!W32GetThreadWin32Thread+0x27
0xfffff98f7f231aa0 : 0xfffff8064c03f4f0 : nt!KeSetKernelStackSwapEnable
0xfffff98f7f231aa8 : 0xffffd551f654bd8c : win32kfull!CKernelStackSwap::DisableStackSwap+0x44
0xfffff98f7f231ab0 : 0xfffff98f7f231c70 : 0xfffff8064c090601 : nt!PsGetIoPriorityThread+0x21
0xfffff98f7f231b38 : 0xffffd551f654bc96 : win32kfull!xxxCallHook+0x72
0xfffff98f7f231c00 : 0xfffff8064c033c60 : nt!PsGetThreadWin32Thread
0xfffff98f7f231c08 : 0xffffd551f7b7f137 : win32kbase!W32GetThreadWin32Thread+0x27
0xfffff98f7f231c70 : 0xfffff8064c090601 : nt!PsGetIoPriorityThread+0x21
0xfffff98f7f231c88 : 0xfffff8064c5f12dc : nt!PsChargeProcessWakeCounter+0x4c
0xfffff98f7f231cd8 : 0xffffd551f654b92d : win32kfull!xxxCallHook2+0x9e5
0xfffff98f7f231d28 : 0xffffd551f7c14602 : win32kbase!IsThreadCrossSessionAttached+0x12
0xfffff98f7f231d58 : 0xffffd551f7b7f137 : win32kbase!W32GetThreadWin32Thread+0x27
0xfffff98f7f231d70 : 0xfffff98f7f231ea0 : 0xfffff8064c033c60 : nt!PsGetThreadWin32Thread
0xfffff98f7f231d90 : 0xfffff8064c090630 : nt!KeIsAttachedProcess
0xfffff98f7f231d98 : 0xffffd551f7c14602 : win32kbase!IsThreadCrossSessionAttached+0x12
0xfffff98f7f231dc8 : 0xffffd551f7b7f137 : win32kbase!W32GetThreadWin32Thread+0x27
0xfffff98f7f231df8 : 0xffffd551f7b7f094 : win32kbase!ThreadUnlock1+0x14
0xfffff98f7f231e28 : 0xffffd551f643dfd5 : win32kfull!xxxDCEWindowHitTest2Internal+0x1f5
0xfffff98f7f231ea0 : 0xfffff8064c033c60 : nt!PsGetThreadWin32Thread
0xfffff98f7f231ea8 : 0xffffd551f7b7f137 : win32kbase!W32GetThreadWin32Thread+0x27
0xfffff98f7f231ec8 : 0xffffd551f6528550 : win32kfull!ReleaseWakeReference
0xfffff98f7f231ee0 : 0xfffff8064c090630 : nt!KeIsAttachedProcess
0xfffff98f7f231ee8 : 0xffffd551f7c14602 : win32kbase!IsThreadCrossSessionAttached+0x12
0xfffff98f7f231f38 : 0xffffd551f651abf3 : win32kfull!xxxCallMouseHook+0x4b
0xfffff98f7f231fa8 : 0xfffff8064c314862 : nt!RtlpHpLfhSubsegmentCommitBlock+0x5a
Unable to load image EasyAntiCheat.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for EasyAntiCheat.sys
0xfffff98f7f232290 : 0xffffd551f64e9080 : win32kfull!DereferenceW32Thread
0xfffff98f7f2322a8 : 0xffffd551f64e9080 : win32kfull!DereferenceW32Thread
0xfffff98f7f232310 : 0xffffd551f64e9080 : win32kfull!DereferenceW32Thread
0xfffff98f7f232328 : 0xffffd551f64e9080 : win32kfull!DereferenceW32Thread
0xfffff98f7f232340 : 0xffffd551f64e9080 : win32kfull!DereferenceW32Thread
0xfffff98f7f232368 : 0xfffff8064c5c2d82 : nt!PspIoMiniPacketCallbackRoutine+0x12
0xfffff98f7f2324a8 : 0xfffff8064c63a45e : nt!ObReferenceObjectByHandle+0x2e
0xfffff98f7f2324f8 : 0xfffff8064c5b1683 : nt!NtRemoveIoCompletionEx+0x123
0xfffff98f7f232588 : 0xfffff8064c0a015e : nt!IoSetIoCompletionEx+0xee
0xfffff98f7f2325d8 : 0xfffff8064c618f04 : nt!NtSetIoCompletionEx+0x104
0xfffff98f7f232638 : 0xfffff8064c1de088 : nt!KiSystemServiceCopyEnd+0x28
0xfffff98f7f2326a8 : 0xfffff8064c1ddef0 : nt!KiSystemServiceStart
0xfffff98f7f232758 : 0xfffff8064c1479ff : nt!EtwProviderEnabled+0x1f
0xfffff98f7f232788 : 0xfffff8064c69caf1 : nt!EtwTiLogProtectExecVm+0x65
0xfffff98f7f2327a8 : 0xfffff8064c0e32c6 : nt!MiUnlockWorkingSetShared+0x66
0xfffff98f7f2327d8 : 0xfffff8064c147950 : nt!MiAllowProtectionChange+0x108
0xfffff98f7f232848 : 0xffffd551f6445520 : win32kfull!xxxRealInternalGetMessage+0x910
0xfffff98f7f2328b8 : 0xfffff8064c0eb0d9 : nt!ExAcquirePushLockExclusiveEx+0xe9
0xfffff98f7f2328f0 : 0xfffff8064c0eb790 : nt!KeLeaveCriticalRegion
0xfffff98f7f232970 : 0xffffd551f7d32a28 : win32kbase!gpresUser
0xfffff98f7f2329d8 : 0xffffd551f6444b97 : win32kfull!NtUserPeekMessage+0x157
0xfffff98f7f232a18 : 0xffffd551f7b91086 : win32kbase!UserSessionSwitchLeaveCrit+0x96
0xfffff98f7f232a88 : 0xfffff8064c1de088 : nt!KiSystemServiceCopyEnd+0x28
0xfffff98f7f232ac8 : 0xffffd551f64e85de : win32kfull!NtUserGetThreadState+0x5e
0xfffff98f7f232af8 : 0xfffff8064c1dde32 : nt!KiSystemServiceUser+0x47
0xfffff98f7f232b00 : 0xffff9b0d46427080 : Trap @ fffff98f7f232b00
1: kd> lmvm easyanticheat
Browse full module list
start end module name
fffff806`77500000 fffff806`77602000 EasyAntiCheat T (no symbols)
Loaded symbol image file: EasyAntiCheat.sys
Image path: EasyAntiCheat.sys
Image name: EasyAntiCheat.sys
Browse all global symbols functions data
Timestamp: Tue Jun 11 02:07:33 2019 (5CFF6F55)
CheckSum: 0010B4D4
ImageSize: 00102000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
And:
Code:
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\070119-30078-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*
Symbol search path is: SRV*
Executable search path is:
Windows 10 Kernel Version 17763 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff804`7d6a5000 PsLoadedModuleList = 0xfffff804`7dac05d0
Debug session time: Mon Jul 1 14:29:42.718 2019 (UTC + 2:00)
System Uptime: 0 days 0:08:44.446
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
......
For analysis of this file, run !analyze -v
2: kd> !analyze
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {9e, 2, 0, fffff8047d718483}
Probably caused by : memory_corruption ( nt!MiWriteValidPteNewProtection+13 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000000009e, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8047d718483, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.17763.557 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 0212
BIOS_DATE: 02/17/2013
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: B75M-A
BASEBOARD_VERSION: Rev X.0x
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: 9e
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8047d718483
READ_ADDRESS: GetUlongFromAddress: unable to read from fffff8047db6c380
fffff8047dbe7390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
000000000000009e
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiWriteValidPteNewProtection+13
fffff804`7d718483 488b11 mov rdx,qword ptr [rcx]
CPU_COUNT: 4
CPU_MHZ: d40
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3a
CPU_STEPPING: 9
CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 20'00000000 (cache) 20'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: r5apex.exe
ANALYSIS_SESSION_HOST: MICHAL
ANALYSIS_SESSION_TIME: 07-06-2019 19:42:56.0784
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
TRAP_FRAME: ffff988b1e44bde0 -- (.trap 0xffff988b1e44bde0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000940126c rbx=0000000000000000 rcx=000000000000009e
rdx=ffff9b014b0001a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8047d718483 rsp=ffff988b1e44bf70 rbp=0000000000000000
r8=ffff9b014b0001a0 r9=0000000000000610 r10=0000000100000056
r11=fffff57abd5ea000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MiWriteValidPteNewProtection+0x13:
fffff804`7d718483 488b11 mov rdx,qword ptr [rcx] ds:00000000`0000009e=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8047d86a669 to fffff8047d858ef0
STACK_TEXT:
ffff988b`1e44bc98 fffff804`7d86a669 : 00000000`0000000a 00000000`0000009e 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffff988b`1e44bca0 fffff804`7d866a8e : ffff9b01`4af29140 fffff804`7d6099f4 00000000`00000000 00001f80`000f02f0 : nt!KiBugCheckDispatch+0x69
ffff988b`1e44bde0 fffff804`7d718483 : ffff9b01`00000001 ffff9b01`00000000 fffff804`7d6a5000 00000000`00000000 : nt!KiPageFault+0x44e
ffff988b`1e44bf70 fffff804`7d95fad4 : 00000000`00000000 fffff804`7d7a1674 ffff9b01`4b000180 ffff9b01`4b091180 : nt!MiWriteValidPteNewProtection+0x13
ffff988b`1e44bfa0 00000000`00000000 : ffff9b01`4af70100 00000000`00000000 00000000`00000000 ffff988b`1e44c3c0 : nt!MiLargePageFault+0x1ec
THREAD_SHA1_HASH_MOD_FUNC: 6b0d6b75fd6499e6f76b17ad4d12a61330a04a82
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b20b3f94e59a0522b8f65f31cc772736f7c36d83
THREAD_SHA1_HASH_MOD: f08ac56120cad14894587db086f77ce277bfae84
FOLLOWUP_IP:
nt!MiWriteValidPteNewProtection+13
fffff804`7d718483 488b11 mov rdx,qword ptr [rcx]
FAULT_INSTR_CODE: 4c118b48
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiWriteValidPteNewProtection+13
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 33a6c3fc
IMAGE_VERSION: 10.0.17763.557
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 13
FAILURE_BUCKET_ID: AV_nt!MiWriteValidPteNewProtection
BUCKET_ID: AV_nt!MiWriteValidPteNewProtection
PRIMARY_PROBLEM_CLASS: AV_nt!MiWriteValidPteNewProtection
TARGET_TIME: 2019-07-01T12:29:42.000Z
OSBUILD: 17763
OSSERVICEPACK: 557
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1997-06-17 19:06:04
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.17763.557
ANALYSIS_SESSION_ELAPSED_TIME: 1609
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!miwritevalidptenewprotection
FAILURE_ID_HASH: {dbc1da4b-9280-514a-55e9-526a556a1d14}
Followup: MachineOwner
---------
2: kd> .load pde
=========================================================================================
PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
2: kd> !dpx
Start memory scan : 0xffff988b1e44bc98 ($csp)
End memory scan : 0xffff988b1e44d000 (Kernel Stack Base)
rsp : 0xffff988b1e44bc98 : 0xfffff8047d86a669 : nt!KiBugCheckDispatch+0x69
0xffff988b1e44bc98 : 0xfffff8047d86a669 : nt!KiBugCheckDispatch+0x69
0xffff988b1e44bcc0 : 0xfffff8047d718483 : nt!MiWriteValidPteNewProtection+0x13
0xffff988b1e44bd98 : 0xfffff8047d60aaf5 : hal!HalPerformEndOfInterrupt+0x25
0xffff988b1e44bdd8 : 0xfffff8047d866a8e : nt!KiPageFault+0x44e
0xffff988b1e44bde0 : 0xffff9b014af29140 : Trap @ ffff988b1e44bde0
0xffff988b1e44bde8 : 0xfffff8047d6099f4 : hal!HalpApicRequestInterrupt+0x94
0xffff988b1e44bee0 : 0xfffff8047d860a40 : nt!PspGetSetContextSpecialApc
0xffff988b1e44bf08 : 0xfffff8047d860ad2 : nt!PspGetSetContextSpecialApc+0x92
0xffff988b1e44bf48 : 0xfffff8047d718483 : nt!MiWriteValidPteNewProtection+0x13
0xffff988b1e44bf80 : 0xfffff8047d6a5000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff988b1e44bf98 : 0xfffff8047d95fad4 : nt!MiLargePageFault+0x1ec
0xffff988b1e44bfa8 : 0xfffff8047d7a1674 : nt!KiSelectNextThread+0x70
0xffff988b1e44c0d8 : 0xfffff8047d77ef47 : nt!KiSwapThread+0x297
0xffff988b1e44c198 : 0xfffff8047d77eab9 : nt!KiCommitThreadWait+0x549
0xffff988b1e44c1c8 : 0xfffff8047d60aaf5 : hal!HalPerformEndOfInterrupt+0x25
0xffff988b1e44c238 : 0xfffff8047d77c782 : nt!KeWaitForMultipleObjects+0x582
0xffff988b1e44c268 : 0xfffff8047d85f77f : nt!KiIpiInterrupt+0x34f
0xffff988b1e44c308 : 0xfffff8047dd02eea : nt!ObWaitForMultipleObjects+0x2aa
0xffff988b1e44c3f8 : 0xfffff8047d85ff2f : nt!SwapContext+0x1af
0xffff988b1e44c438 : 0xfffff8047d85faa6 : nt!KiSwapContext+0x76
0xffff988b1e44c578 : 0xfffff8047d77efa4 : nt!KiSwapThread+0x2f4
0xffff988b1e44c598 : 0xfffff8047dcb9393 : nt!PspChargeProcessWakeCounter+0x133
0xffff988b1e44c638 : 0xfffff8047d77eab9 : nt!KiCommitThreadWait+0x549
0xffff988b1e44c658 : 0xfffff8047dcb7f57 : nt!AlpcpCompleteDispatchMessage+0x2d7
0xffff988b1e44c6d8 : 0xfffff8047d77d840 : nt!KeWaitForSingleObject+0x520
0xffff988b1e44c738 : 0xfffff8047d728cf9 : nt!KiExitDispatcher+0x49
0xffff988b1e44c758 : 0xfffff8047d73fe01 : nt!KiWakeQueueWaiter+0x61
0xffff988b1e44c7a8 : 0xfffff8047d73f29f : nt!AlpcpSignalAndWait+0x24f
0xffff988b1e44c808 : 0xfffff8047dd02c07 : nt!NtWaitForMultipleObjects+0xf7
0xffff988b1e44c828 : 0xfffff8047dcb5a8b : nt!AlpcpExposeAttributes+0x21b
0xffff988b1e44c838 : 0xfffff8047dc3e600 : nt!NtApphelpCacheControl+0x100
0xffff988b1e44c880 : 0xfffff8047d9f45f0 : nt!AlpcMessageType
0xffff988b1e44c8a8 : 0xfffff8047dcb6adc : nt!AlpcpProcessSynchronousRequest+0x5fc
0xffff988b1e44c8e8 : 0xfffff8047e000000 : "nt!TxtpJustifyRectangle <PERF> (nt+0x95b000)"
0xffff988b1e44c9a8 : 0xfffff8047d725bbf : nt!KeReleaseMutant+0x18f
0xffff988b1e44c9b8 : 0xfffff8047d77da00 : nt!KeWaitForSingleObject+0x6e0
0xffff988b1e44c9c8 : 0xfffff8047dcb473a : nt!NtAlpcSendWaitReceivePort+0x11a
0xffff988b1e44ca38 : 0xfffff8047dcc645e : nt!ObReferenceObjectByHandle+0x2e
0xffff988b1e44ca88 : 0xfffff8047d86a088 : nt!KiSystemServiceCopyEnd+0x28
0xffff988b1e44caf8 : 0xfffff8047d869e32 : nt!KiSystemServiceUser+0x47
0xffff988b1e44cb00 : 0xffffe18cb8268080 : Trap @ ffff988b1e44cb00
Enable Driver Verifier, select "Create custom settings (for code developers)", select all standard settings, and select "Force pending I/O requests", "IRP Logging", select "Select driver names from a list", select all drivers except Microsoft drivers and reboot computer
Code:
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\070619-25843-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*
Symbol search path is: SRV*
Executable search path is:
Windows 10 Kernel Version 17763 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff802`192b2000 PsLoadedModuleList = 0xfffff802`196cd5d0
Debug session time: Fri Jul 5 21:48:09.707 2019 (UTC + 2:00)
System Uptime: 0 days 0:13:59.437
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
......
For analysis of this file, run !analyze -v
0: kd> !analyze
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff80200000001, f, 1, fffff80219394088}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff80200000001, memory referenced
Arg2: 000000000000000f, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80219394088, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.17763.557 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 1101
BIOS_DATE: 07/31/2014
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: B75M-A
BASEBOARD_VERSION: Rev X.0x
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: fffff80200000001
BUGCHECK_P2: f
BUGCHECK_P3: 1
BUGCHECK_P4: fffff80219394088
WRITE_ADDRESS: GetUlongFromAddress: unable to read from fffff80219779380
fffff802197f4390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff80200000001
CURRENT_IRQL: f
FAULTING_IP:
nt!KiInsertQueueDpc+178
fffff802`19394088 488908 mov qword ptr [rax],rcx
CPU_COUNT: 4
CPU_MHZ: d40
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3a
CPU_STEPPING: 9
CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 20'00000000 (cache) 20'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: AV
PROCESS_NAME: r5apex.exe
ANALYSIS_SESSION_HOST: MICHAL
ANALYSIS_SESSION_TIME: 07-06-2019 19:44:36.0483
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
TRAP_FRAME: fffff8021b853c70 -- (.trap 0xfffff8021b853c70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80200000001 rbx=0000000000000000 rcx=ffff8d06cf6c3418
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80219394088 rsp=fffff8021b853e00 rbp=fffff80218110180
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!KiInsertQueueDpc+0x178:
fffff802`19394088 488908 mov qword ptr [rax],rcx ds:fffff802`00000001=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80219477669 to fffff80219465ef0
STACK_TEXT:
fffff802`1b853b28 fffff802`19477669 : 00000000`0000000a fffff802`00000001 00000000`0000000f 00000000`00000001 : nt!KeBugCheckEx
fffff802`1b853b30 fffff802`19473a8e : 00000000`00000000 fffff802`00400a02 fffff802`22a374c0 00000000`0000b101 : nt!KiBugCheckDispatch+0x69
fffff802`1b853c70 fffff802`19394088 : 000001fc`70bde2d0 00000000`00000000 00000000`00000024 00000000`00400a02 : nt!KiPageFault+0x44e
fffff802`1b853e00 fffff802`19393f01 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInsertQueueDpc+0x178
fffff802`1b853ea0 fffff802`27677909 : 00000000`00000000 fffff802`192cd13c ffff3f4a`f28c4dcc ffff8d06`cb3d5000 : nt!KeInsertQueueDpc+0x11
fffff802`1b853ee0 fffff802`193e52f5 : ffffe481`752fc8c0 fffff802`19217481 00000000`00000000 fffff802`1927eac0 : USBPORT!USBPORT_InterruptService+0x89
fffff802`1b853f20 fffff802`194674cc : fffffe81`d5f2cb80 ffffe481`752fc8c0 ffffe481`752fc8c0 ffffe481`752fc8c0 : nt!KiCallInterruptServiceRoutine+0xa5
fffff802`1b853f70 fffff802`19467137 : ffff8d06`d739b080 00000000`00000000 00000000`00000000 ffff8d06`fea21360 : nt!KiScanInterruptObjectList+0x14c
fffffe81`d5f2cb00 00007ff7`439001f4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiChainedDispatch+0x37
000000e1`e680f8a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff7`439001f4
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8021939405a - nt!KiInsertQueueDpc+14a
[ 18:08 ]
1 error : !nt (fffff8021939405a)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_ONE_BIT
TARGET_TIME: 2019-07-05T19:48:09.000Z
OSBUILD: 17763
OSSERVICEPACK: 557
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1997-06-17 19:06:04
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.17763.557
ANALYSIS_SESSION_ELAPSED_TIME: 2f47
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_one_bit
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: memory_corruption
---------
0: kd> .load pde
=========================================================================================
PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
0: kd> !dpx
Start memory scan : 0xfffff8021b853b28 ($csp)
End memory scan : 0xfffff8021b854000 (ISR Stack Base)
rsp : 0xfffff8021b853b28 : 0xfffff80219477669 : nt!KiBugCheckDispatch+0x69
0xfffff8021b853b28 : 0xfffff80219477669 : nt!KiBugCheckDispatch+0x69
0xfffff8021b853b50 : 0xfffff80219394088 : nt!KiInsertQueueDpc+0x178
0xfffff8021b853c68 : 0xfffff80219473a8e : nt!KiPageFault+0x44e
0xfffff8021b853c80 : 0xfffff80222a374c0 : ndis!ndisMiniportMessageIsr
0xfffff8021b853d58 : 0xfffff802193e5c23 : nt!EtwpPrepareDirtyBuffer+0x2b
0xfffff8021b853d88 : 0xfffff802193e5768 : nt!EtwpSwitchBuffer+0xcc
0xfffff8021b853db0 : 0xfffff802193eb600 : nt!EtwpGetCycleCount
0xfffff8021b853db8 : 0xfffff8021932bd39 : nt!EtwpReserveTraceBuffer+0xf9
0xfffff8021b853dd8 : 0xfffff80219394088 : nt!KiInsertQueueDpc+0x178
0xfffff8021b853e48 : 0xfffff8021932ba4f : nt!EtwpLogKernelEvent+0x23f
0xfffff8021b853e98 : 0xfffff80219393f01 : nt!KeInsertQueueDpc+0x11
0xfffff8021b853ec8 : 0xfffff80245c80000 : "qwavedrv!CmRegUtilWstrValueGetDword <PERF> (qwavedrv+0x10000)"
0xfffff8021b853ed0 : 0xfffff80227649780 : usbehci!EHCI_InterruptService
0xfffff8021b853ed8 : 0xfffff80227677909 : USBPORT!USBPORT_InterruptService+0x89
0xfffff8021b853ee8 : 0xfffff802192cd13c : nt!PerfInfoLogInterrupt+0xfc
0xfffff8021b853f08 : 0xfffff80245c80000 : "qwavedrv!CmRegUtilWstrValueGetDword <PERF> (qwavedrv+0x10000)"
0xfffff8021b853f18 : 0xfffff802193e52f5 : nt!KiCallInterruptServiceRoutine+0xa5
0xfffff8021b853f28 : 0xfffff80219217481 : hal!HalpTimerClockIpiRoutine+0x21
0xfffff8021b853f38 : 0xfffff8021927eac0 : hal!HalpKInterruptHeap+0x700
0xfffff8021b853f68 : 0xfffff802194674cc : nt!KiScanInterruptObjectList+0x14c
0xfffff8021b853fb8 : 0xfffff8021927eac0 : hal!HalpKInterruptHeap+0x700
0xfffff8021b853fd8 : 0xfffff80219467137 : nt!KiChainedDispatch+0x37
Code:
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\070619-27984-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*
Symbol search path is: SRV*
Executable search path is:
Windows 10 Kernel Version 17763 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff801`45e0a000 PsLoadedModuleList = 0xfffff801`462255d0
Debug session time: Fri Jul 5 21:33:48.924 2019 (UTC + 2:00)
System Uptime: 0 days 7:57:15.655
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.............
For analysis of this file, run !analyze -v
3: kd> !analyze
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c000001d, fffff80145f22e9b, ffff820610b94d10, 0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff80145f22e9b, Address of the instruction which caused the bugcheck
Arg3: ffff820610b94d10, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 10.0.17763.557 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 1101
BIOS_DATE: 07/31/2014
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: B75M-A
BASEBOARD_VERSION: Rev X.0x
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: c000001d
BUGCHECK_P2: fffff80145f22e9b
BUGCHECK_P3: ffff820610b94d10
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
nt!KiComputeThreadAffinity+4b
fffff801`45f22e9b f0488d47ff lock lea rax,[rdi-1]
CONTEXT: ffff820610b94d10 -- (.cxr 0xffff820610b94d10)
rax=000000000000002c rbx=ffffa48703f65080 rcx=fffff8014634d3f0
rdx=ffff820610b95790 rsi=0000000000000000 rdi=000000000000000f
rip=fffff80145f22e9b rsp=ffff820610b95700 rbp=0000000000000000
r8=fffff8014634ed80 r9=fffff80145e0a000 r10=0000000000000e00
r11=ffff820610b95878 r12=ffffba01d9865180 r13=0000000000000000
r14=ffffa48703f652c0 r15=fffff8014634ed80
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!KiComputeThreadAffinity+0x4b:
fffff801`45f22e9b f0488d47ff lock lea rax,[rdi-1]
Resetting default scope
BUGCHECK_STR: 0x3B_c000001d
CPU_COUNT: 4
CPU_MHZ: d40
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3a
CPU_STEPPING: 9
CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 20'00000000 (cache) 20'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXPNP: 1 (!blackboxpnp)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: r5apex.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: MICHAL
ANALYSIS_SESSION_TIME: 07-06-2019 19:49:09.0866
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff80145e2a43c to fffff80145f22e9b
STACK_TEXT:
ffff8206`10b95700 fffff801`45e2a43c : 00000000`00000003 ffff8206`10b957c0 00000000`00000000 ffff8206`10b95a40 : nt!KiComputeThreadAffinity+0x4b
ffff8206`10b95750 fffff801`45e2a142 : ffffba01`d9865180 ffffa487`03f65080 000000ce`970ee410 00000000`0000000f : nt!KiSetAffinityThread+0x130
ffff8206`10b95800 fffff801`46433f18 : ffffa487`1a0ed500 00000000`00000400 00000000`0000000f ffff8206`10b95b80 : nt!KeSetLegacyAffinityThread+0xc2
ffff8206`10b95880 fffff801`45fcf088 : ffffa487`03f65080 000000ce`00000000 ffffa487`1420a990 0000029a`2bdd6901 : nt!NtSetInformationThread+0xd68
ffff8206`10b95b00 00007ff9`c9f8f904 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000ce`970ee3d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`c9f8f904
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80145f22e9a - nt!KiComputeThreadAffinity+4a
[ 8b:9b ]
1 error : !nt (fffff80145f22e9a)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
STACK_COMMAND: .cxr 0xffff820610b94d10 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_ONE_BIT
TARGET_TIME: 2019-07-05T19:33:48.000Z
OSBUILD: 17763
OSSERVICEPACK: 557
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1997-06-17 19:06:04
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.17763.557
ANALYSIS_SESSION_ELAPSED_TIME: 2773
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_one_bit
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: memory_corruption
---------
3: kd> .load pde
=========================================================================================
PDE v11.3 - Copyright 2017 Andrew Richards
=========================================================================================
3: kd> !dpx
Start memory scan : 0xffff820610b943d8 ($csp)
End memory scan : 0xffff820610b96000 (Kernel Stack Base)
rsp : 0xffff820610b943d8 : 0xfffff80145fcf669 : nt!KiBugCheckDispatch+0x69
0xffff820610b943d8 : 0xfffff80145fcf669 : nt!KiBugCheckDispatch+0x69
0xffff820610b943f0 : 0xfffff80145f22e9b : nt!KiComputeThreadAffinity+0x4b
0xffff820610b944b0 : 0xffff820610b94b50 : 0xfffff80145fcf088 : nt!KiSystemServiceCopyEnd+0x28
0xffff820610b944b8 : 0xfffff80145f983cb : nt!_C_specific_handler+0x3b
0xffff820610b944f8 : 0xfffff80145fcf088 : nt!KiSystemServiceCopyEnd+0x28
0xffff820610b94518 : 0xfffff80145fceabc : nt!KiSystemServiceHandler+0x7c
0xffff820610b94520 : 0xffff820610b94b50 : 0xfffff80145fcf088 : nt!KiSystemServiceCopyEnd+0x28
0xffff820610b94528 : 0xfffff80145fba182 : nt!_GSHandlerCheck_SEH+0x6a
0xffff820610b94550 : 0xfffff80145fcea40 : nt!KiSystemServiceHandler
0xffff820610b94558 : 0xfffff80145fc69f2 : nt!RtlpExecuteHandlerForException+0x12
0xffff820610b94560 : 0xfffff801462ed000 : "nt!Ports <PERF> (nt+0x4e3000)"
0xffff820610b94568 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94580 : 0xffff820610b94b50 : 0xfffff80145fcf088 : nt!KiSystemServiceCopyEnd+0x28
0xffff820610b94588 : 0xfffff80145f1f3a0 : nt!RtlDispatchException+0x430
0xffff820610b945b0 : 0xfffff80145f65080 : nt!ExpApplyRewaitBoost
0xffff820610b945c8 : 0xfffff80145e2880d : nt!ExpWaitForResource+0x6d
0xffff820610b94648 : 0xfffff80145ede80b : nt!ExpAcquireResourceExclusiveLite+0x41b
0xffff820610b94658 : 0xfffffb5a3d3a442b : win32kbase!InputTraceLogging::Perf::CritAcquire::~CritAcquire+0x3b
0xffff820610b946e0 : 0xfffff80145e81630 : nt!KeIsAttachedProcess
0xffff820610b94710 : 0xfffff80145e24c60 : nt!PsGetThreadWin32Thread
0xffff820610b94718 : 0xfffffb5a3d3af137 : win32kbase!W32GetThreadWin32Thread+0x27
0xffff820610b94748 : 0xfffffb5a3d3af094 : win32kbase!ThreadUnlock1+0x14
0xffff820610b94768 : 0xfffff80145fc4b1f : nt!KiDispatchInterrupt+0xf
0xffff820610b947a0 : 0xfffff80145e81630 : nt!KeIsAttachedProcess
0xffff820610b947a8 : 0xfffffb5a3d444602 : win32kbase!IsThreadCrossSessionAttached+0x12
0xffff820610b948b0 : 0xfffff80145e81630 : nt!KeIsAttachedProcess
0xffff820610b948b8 : 0xfffffb5a3d14ad16 : win32kfull!IsThreadCrossSessionAttached+0x12
0xffff820610b948e0 : 0xfffff80145e24c60 : nt!PsGetThreadWin32Thread
0xffff820610b948e8 : 0xfffffb5a3d03db34 : win32kfull!W32SetCurrentThreadDpiAwarenessContext+0x64
0xffff820610b94948 : 0xfffffb5a3d03da9b : win32kfull!xxxHkCallHook+0x7bb
0xffff820610b949c0 : 0xfffff80145e81630 : nt!KeIsAttachedProcess
0xffff820610b949c8 : 0xfffffb5a3d444602 : win32kbase!IsThreadCrossSessionAttached+0x12
0xffff820610b949f0 : 0xfffff80145e24c60 : nt!PsGetThreadWin32Thread
0xffff820610b949f8 : 0xfffffb5a3d3af137 : win32kbase!W32GetThreadWin32Thread+0x27
0xffff820610b94a18 : 0xfffffb5a3d565308 : win32kbase!gDomainTlLock
0xffff820610b94a28 : 0xfffff80145eebb08 : nt!KeQueryCurrentStackInformation+0x68
0xffff820610b94a48 : 0xfffff80145f1fc60 : nt!RtlGetExtendedContextLength2+0x3c
0xffff820610b94a58 : 0xfffff80145eeba84 : nt!RtlpGetStackLimits+0x14
0xffff820610b94a88 : 0xfffff80145f1f016 : nt!RtlDispatchException+0xa6
0xffff820610b94a98 : 0xfffffb5a3d444602 : win32kbase!IsThreadCrossSessionAttached+0x12
0xffff820610b94ab8 : 0xfffffb5a3d3bb6f6 : win32kbase!TraceLoggingProviderEnabled+0x1e
0xffff820610b94ad8 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94b28 : 0xfffff80146303fa4 : "nt!Ports <PERF> (nt+0x4f9fa4)"
0xffff820610b94b48 : 0xffff820610b94c50 : 0xffff820610b94c60 : 0xfffff80145f22e9b : nt!KiComputeThreadAffinity+0x4b
0xffff820610b94b50 : 0xfffff80145fcf088 : nt!KiSystemServiceCopyEnd+0x28
0xffff820610b94b58 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94b60 : 0xfffff80146303fa4 : "nt!Ports <PERF> (nt+0x4f9fa4)"
0xffff820610b94b80 : 0xfffff80145fcea40 : nt!KiSystemServiceHandler
0xffff820610b94bb8 : 0xfffff80145e2a080 : nt!KeSetLegacyAffinityThread
0xffff820610b94bc8 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94bd0 : 0xfffff801462f9f9c : "nt!Ports <PERF> (nt+0x4eff9c)"
0xffff820610b94bd8 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94be0 : 0xfffff801462eeb90 : "nt!Ports <PERF> (nt+0x4e4b90)"
0xffff820610b94be8 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94bf0 : 0xfffff801462eeb84 : "nt!Ports <PERF> (nt+0x4e4b84)"
0xffff820610b94bf8 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94c00 : 0xfffff8014631f688 : "nt!Ports <PERF> (nt+0x515688)"
0xffff820610b94c08 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94c10 : 0xfffff80146303fa4 : "nt!Ports <PERF> (nt+0x4f9fa4)"
0xffff820610b94c28 : 0xfffff80145e2d061 : nt!KiPreprocessFault+0xb1
0xffff820610b94c38 : 0xfffffb5a3d03fe3f : win32kfull!xxxSendMessageToClient+0x47f
0xffff820610b94c48 : 0xfffffb5a3d444600 : win32kbase!IsThreadCrossSessionAttached+0x10
0xffff820610b94c50 : 0xffff820610b94c60 : 0xfffff80145f22e9b : nt!KiComputeThreadAffinity+0x4b
0xffff820610b94c58 : 0xfffff80145f1fd3a : nt!RtlInitializeExtendedContext2+0x32
0xffff820610b94c60 : 0xfffff80145f22e9b : nt!KiComputeThreadAffinity+0x4b
0xffff820610b94c68 : 0xfffff80145f22eab : nt!KiComputeThreadAffinity+0x5b
0xffff820610b94c70 : 0xfffff80145f22e9e : nt!KiComputeThreadAffinity+0x4e
0xffff820610b94c88 : 0xfffff80145f22e9d : nt!KiComputeThreadAffinity+0x4d
0xffff820610b94c98 : 0xfffff80145e2cf2e : nt!KdTrap+0x22
0xffff820610b94ca0 : 0xfffff8014634ed00 : nt!ExpNonPagedPoolDescriptor+0x1b0
0xffff820610b94cd8 : 0xfffff80145e2cbb4 : nt!KiDispatchException+0x144
0xffff820610b94d68 : 0xfffff80145ee3fa4 : nt!KiSwapThread+0x2f4
0xffff820610b94d90 : 0xfffff8014634d3f0 : nt!KiCpuSetSequence
0xffff820610b94dc8 : 0xfffff8014634ed80 : nt!KiProcessorBlock
0xffff820610b94dd0 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b94de0 : 0xffff820610b95878 : 0xfffff80146433f18 : nt!NtSetInformationThread+0xd68
0xffff820610b94e00 : 0xfffff8014634ed80 : nt!KiProcessorBlock
0xffff820610b94e08 : 0xfffff80145f22e9b : nt!KiComputeThreadAffinity+0x4b
0xffff820610b94e20 : 0xfffff80145e81630 : nt!KeIsAttachedProcess
0xffff820610b94e50 : 0xfffff80145e24c60 : nt!PsGetThreadWin32Thread
0xffff820610b94e58 : 0xfffffb5a3d3af137 : win32kbase!W32GetThreadWin32Thread+0x27
0xffff820610b94e88 : 0xfffffb5a3d3af094 : win32kbase!ThreadUnlock1+0x14
0xffff820610b94ea8 : 0xfffff80145fc4b1f : nt!KiDispatchInterrupt+0xf
0xffff820610b95118 : 0xfffff80145e85b8b : nt!ExAllocateHeapPool+0x98b
0xffff820610b95168 : 0xfffff80145f1fc60 : nt!RtlGetExtendedContextLength2+0x3c
0xffff820610b95180 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b95198 : 0xfffff80146155753 : nt!ExFreePoolWithTag+0xad3
0xffff820610b951a8 : 0xfffff80145f1fb59 : nt!RtlGetExtendedContextLength+0x2d
0xffff820610b95208 : 0xfffff8014615406d : nt!ExAllocatePoolWithTag+0x3d
0xffff820610b95240 : 0xfffff80146880a10 : hal!HalpTscQueryCounterOrdered
Unable to load image EasyAntiCheat.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for EasyAntiCheat.sys
0xffff820610b952a8 : 0xffff820610b954c0 : 0xfffff8014634ed80 : nt!KiProcessorBlock
0xffff820610b952c8 : 0xfffff80145e83d39 : nt!EtwpReserveTraceBuffer+0xf9
0xffff820610b952f8 : 0xfffff8014666e891 : nt!ObpPostInterceptHandleCreate+0x9d
0xffff820610b95358 : 0xfffff8014634ed80 : nt!KiProcessorBlock
0xffff820610b95388 : 0xfffff80145fcf742 : nt!KiExceptionDispatch+0xc2
0xffff820610b954c0 : 0xfffff8014634ed80 : nt!KiProcessorBlock
0xffff820610b954d8 : 0xfffff80145f22e9b : nt!KiComputeThreadAffinity+0x4b
0xffff820610b954f8 : 0xffff820610b95878 : 0xfffff80146433f18 : nt!NtSetInformationThread+0xd68
0xffff820610b95530 : 0xffff820610b954d8 : 0xfffff80145f22e9b : nt!KiComputeThreadAffinity+0x4b
0xffff820610b95568 : 0xfffff80145fc9f8e : nt!KiInvalidOpcodeFault+0x30e
0xffff820610b95570 : 0xffff820610b958b8 : Trap @ ffff820610b95570
0xffff820610b955a8 : 0xfffff8014634d3f0 : nt!KiCpuSetSequence
0xffff820610b955b8 : 0xfffff8014634ed80 : nt!KiProcessorBlock
0xffff820610b955c0 : 0xfffff80145e0a000 : "nt!MmFreeIndependentPages <PERF> (nt+0x0)"
0xffff820610b955d0 : 0xffff820610b95878 : 0xfffff80146433f18 : nt!NtSetInformationThread+0xd68
0xffff820610b95658 : 0xfffff80145ee3fa4 : nt!KiSwapThread+0x2f4
0xffff820610b956b0 : 0xfffff80146161898 : nt!KERNEL_AUDIT_API_OPENTHREAD
0xffff820610b956d8 : 0xfffff80145f22e9b : nt!KiComputeThreadAffinity+0x4b
0xffff820610b95748 : 0xfffff80145e2a43c : nt!KiSetAffinityThread+0x130
0xffff820610b957f8 : 0xfffff80145e2a142 : nt!KeSetLegacyAffinityThread+0xc2
0xffff820610b95878 : 0xfffff80146433f18 : nt!NtSetInformationThread+0xd68
0xffff820610b95a88 : 0xfffff80145fcf201 : nt!KiSystemServiceExit+0x171
0xffff820610b95ab8 : 0xfffff801464b0863 : nt!NtOpenThread+0x23
0xffff820610b95af8 : 0xfffff80145fcf088 : nt!KiSystemServiceCopyEnd+0x28
0xffff820610b95b00 : 0xffffa48703f65080 : Trap @ ffff820610b95b00
The second memory dump with the EasyAntiCheat driver, but I do not think he owes it
In addition, it is also worth updating Windows 10 to version 1903 (https://support.microsoft.com/en-gb/...date-assistant) and the motherboard BIOS to the latest version (https://dlcdnets.asus.com/pub/ASUS/m...-ASUS-1101.zip)
Quote