New
#1
BSOD Help please SYSTEM_SERVICE_EXCEPTION (3b)
Having a blue screen problem, here is my mini dump. I used two different version of windbg and they are slightly different ( i think haha)
Thank you for any help you may have!
************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : false
AllowNugetExeUpdate : false
- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true
************* Waiting for Debugger Extensions Gallery to Initialize **************
.
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 36
Microsoft (R) Windows Debugger Version 10.0.25324.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\043023-15890-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (20 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Kernel base = 0xfffff802`0cc00000 PsLoadedModuleList = 0xfffff802`0d82a2d0
Debug session time: Sun Apr 30 11:48:48.842 2023 (UTC - 7:00)
System Uptime: 0 days 2:30:00.477
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802`0cffbc10 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff58c`9906d210=000000000000003b
14: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: ffffca820ccaabf7, Address of the instruction which caused the BugCheck
Arg3: fffff58c9906db10, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2327
Key : Analysis.Elapsed.mSec
Value: 2335
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 515
Key : Analysis.Init.Elapsed.mSec
Value: 4725
Key : Analysis.Memory.CommitPeak.Mb
Value: 93
Key : Bugcheck.Code.LegacyAPI
Value: 0x3b
Key : Failure.Bucket
Value: AV_nt!KiSystemServiceHandler
Key : Failure.Hash
Value: {a1028ce5-4e89-d306-9b81-f7b07dbfbbc7}
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: ffffca820ccaabf7
BUGCHECK_P3: fffff58c9906db10
BUGCHECK_P4: 0
FILE_IN_CAB: 043023-15890-01.dmp
CONTEXT: fffff58c9906db10 -- (.cxr 0xfffff58c9906db10)
rax=ffffca820cd01408 rbx=00000296797c94a8 rcx=fffff58c9906e660
rdx=00000296797c94a0 rsi=0000000000000088 rdi=00000296797c9528
rip=ffffca820ccaabf7 rsp=fffff58c9906e5c0 rbp=fffff58c9906e660
r8=0000000000000088 r9=fffff58c9906e650 r10=ffffca820ccab154
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050283
ffffca82`0ccaabf7 833b00 cmp dword ptr [rbx],0 ds:002b:00000296`797c94a8=????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Agent.exe
STACK_TEXT:
fffff58c`9906d208 fffff802`0d00fc29 : 00000000`0000003b 00000000`c0000005 ffffca82`0ccaabf7 fffff58c`9906db10 : nt!KeBugCheckEx
fffff58c`9906d210 fffff802`0d00edfc : 00000000`00000000 ffffb686`6a2ea0c0 00000000`000048dc ffffb686`67615080 : nt!KiBugCheckDispatch+0x69
fffff58c`9906d350 fffff802`0d0062ff : 00000000`00000000 fffff58c`9906d400 fffff802`0cc00000 fffff58c`9906d9b0 : nt!KiSystemServiceHandler+0x7c
fffff58c`9906d390 fffff802`0cee58c7 : fffff802`0cce3c28 fffff802`0cc00000 fffff58c`9906d900 00000000`00000000 : nt!RtlpExecuteHandlerForException+0xf
fffff58c`9906d3c0 fffff802`0cee7896 : fffff58c`9906e388 fffff58c`9906e010 fffff58c`9906e388 00000000`00000000 : nt!RtlDispatchException+0x297
fffff58c`9906dae0 ffffca82`0ccab9ec : 00000000`00000003 fffff58c`9906e430 ffffb686`6a2ea740 00000000`00000000 : nt!KiDispatchException+0x186
fffff58c`9906e1a0 00000000`00000003 : fffff58c`9906e430 ffffb686`6a2ea740 00000000`00000000 ffffb686`6a2ea801 : 0xffffca82`0ccab9ec
fffff58c`9906e1a8 fffff58c`9906e430 : ffffb686`6a2ea740 00000000`00000000 ffffb686`6a2ea801 fffff802`0ce70b16 : 0x3
fffff58c`9906e1b0 ffffb686`6a2ea740 : 00000000`00000000 ffffb686`6a2ea801 fffff802`0ce70b16 fffff58c`9906e350 : 0xfffff58c`9906e430
fffff58c`9906e1b8 00000000`00000000 : ffffb686`6a2ea801 fffff802`0ce70b16 fffff58c`9906e350 ffffb45a`2d168028 : 0xffffb686`6a2ea740
SYMBOL_NAME: nt!KiSystemServiceHandler+7c
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.2846
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 7c
FAILURE_BUCKET_ID: AV_nt!KiSystemServiceHandler
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a1028ce5-4e89-d306-9b81-f7b07dbfbbc7}
Followup: MachineOwner
---------
and here is the other one
Microsoft (R) Windows Debugger Version 10.0.22621.755 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\043023-15890-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (20 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802`0cc00000 PsLoadedModuleList = 0xfffff802`0d82a2d0
Debug session time: Sun Apr 30 11:48:48.842 2023 (UTC - 7:00)
System Uptime: 0 days 2:30:00.477
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.................
For analysis of this file, run !analyze -v
14: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: ffffca820ccaabf7, Address of the instruction which caused the BugCheck
Arg3: fffff58c9906db10, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4514
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4078
Key : Analysis.Init.CPU.mSec
Value: 937
Key : Analysis.Init.Elapsed.mSec
Value: 18837
Key : Analysis.Memory.CommitPeak.Mb
Value: 88
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 043023-15890-01.dmp
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: ffffca820ccaabf7
BUGCHECK_P3: fffff58c9906db10
BUGCHECK_P4: 0
CONTEXT: fffff58c9906db10 -- (.cxr 0xfffff58c9906db10)
rax=ffffca820cd01408 rbx=00000296797c94a8 rcx=fffff58c9906e660
rdx=00000296797c94a0 rsi=0000000000000088 rdi=00000296797c9528
rip=ffffca820ccaabf7 rsp=fffff58c9906e5c0 rbp=fffff58c9906e660
r8=0000000000000088 r9=fffff58c9906e650 r10=ffffca820ccab154
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050283
ffffca82`0ccaabf7 833b00 cmp dword ptr [rbx],0 ds:002b:00000296`797c94a8=????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Agent.exe
STACK_TEXT:
fffff58c`9906d208 fffff802`0d00fc29 : 00000000`0000003b 00000000`c0000005 ffffca82`0ccaabf7 fffff58c`9906db10 : nt!KeBugCheckEx
fffff58c`9906d210 fffff802`0d00edfc : 00000000`00000000 ffffb686`6a2ea0c0 00000000`000048dc ffffb686`67615080 : nt!KiBugCheckDispatch+0x69
fffff58c`9906d350 fffff802`0d0062ff : 00000000`00000000 fffff58c`9906d400 fffff802`0cc00000 fffff58c`9906d9b0 : nt!KiSystemServiceHandler+0x7c
fffff58c`9906d390 fffff802`0cee58c7 : fffff802`0cce3c28 fffff802`0cc00000 fffff58c`9906d900 00000000`00000000 : nt!RtlpExecuteHandlerForException+0xf
fffff58c`9906d3c0 fffff802`0cee7896 : fffff58c`9906e388 fffff58c`9906e010 fffff58c`9906e388 00000000`00000000 : nt!RtlDispatchException+0x297
fffff58c`9906dae0 ffffca82`0ccab9ec : 00000000`00000003 fffff58c`9906e430 ffffb686`6a2ea740 00000000`00000000 : nt!KiDispatchException+0x186
fffff58c`9906e1a0 00000000`00000003 : fffff58c`9906e430 ffffb686`6a2ea740 00000000`00000000 ffffb686`6a2ea801 : 0xffffca82`0ccab9ec
fffff58c`9906e1a8 fffff58c`9906e430 : ffffb686`6a2ea740 00000000`00000000 ffffb686`6a2ea801 fffff802`0ce70b16 : 0x3
fffff58c`9906e1b0 ffffb686`6a2ea740 : 00000000`00000000 ffffb686`6a2ea801 fffff802`0ce70b16 fffff58c`9906e350 : 0xfffff58c`9906e430
fffff58c`9906e1b8 00000000`00000000 : ffffb686`6a2ea801 fffff802`0ce70b16 fffff58c`9906e350 ffffb45a`2d168028 : 0xffffb686`6a2ea740
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8020d1cccd3-fffff8020d1cccd9 7 bytes - nt!IopWriteFile+257
[ cc cc cc cc cc cc cc:45 ff 25 3a 64 3b 00 ]
fffff8020d1ccd9c-fffff8020d1ccda2 7 bytes - nt!PnpNotifyTargetDeviceChangeNotifyEntry+c0 (+0xc9)
[ cc cc cc cc cc cc cc:45 ff 25 f0 5f 3b 00 ]
fffff8020d582c44-fffff8020d582c4b 8 bytes - nt!MIDL_user_free+14 (+0x3b5ea8)
[ cc cc cc cc cc cc cc cc:44 c5 ca 0c 82 ca ff ff ]
22 errors : !nt (fffff8020d1cccd3-fffff8020d582c4b)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
MEMORY_CORRUPTOR: LARGE
STACK_COMMAND: .cxr; .ecxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------