Page Fault in NonPaged Area

Hi guys!

I've been getting blue screens in the past few days only when playing csgo (80% sure as when I browse normally, it doesn't happen). Every game I would get at least one BSOD (I've played over 10 games and this still occurs). This is a relatively new PC built last year and I haven't had any issues up until now. I also have not installed any major updates or new software.

I've tried the following:

• run chkdsk /f /r
• sfc /scannow
• Changed the ram slots from slots 2 and 4 to 1 and 3
• disable docp and undervolt on my GPU
• updated bios
• HCI memtest (400% coverage) and testmem 5 no errors
• All other stress tests and benchmarks do not crash the system
• cleaned the dimm slots and ram

I haven't tried other games yet to see if the crash still occurs.

Processor - AMD Ryzen 5 5600X

MOBO - TUF GAMING B550M-PLUS (WI-FI)

GPU - Red Devil 6750 xt

GPU Driver - 22.11.2

RAM - 16 gb (2 x 8) Corsair Vengeance LPX 3200 mhz

Version - 10.0.19044 Build 19044


On the bsod it says, What failed - MessageTransfer.sys

I can't seem to directly upload the zip of the logs (it says upload failed), so here's another link
DESKTOP-(2023-08-13_14-37-29).zip - Google Drive

Thanks!

Often times a BSOD is caused by hardware or a driver. So, it could be a dying hard drive, RAM or a GPU all giving up the ghost. It could also be a driver from software you recently installed that's interacting with the game.

You can try running Whocrashed and see what it says. You can test the RAM overnight with the more through Memtest86 using all four tests. If Whocrashed indicates memory issues - which it sounds like it is. Then you must test each stick of RAM one at a time. If each stick checks out then it may be how one stick of RAM is interacting with another stick of RAM. I have had this issue myself yet all sticks were the same (exactly the same), just the serial number was slightly different with one stick compared to the rest. So I don't know if that's a manufacturer fabrication thing or what. Was a very odd thing to see, but I found it and now I have no more BSODs in game. It's why I'm down to 12GB of RAM instead of what I had of 16GB. So far I have yet to buy more RAM. Just haven't had a need at the moment...

Also, don't let Windows update your hardware drivers. Like the GPU. How to stop automatic driver installation on Windows 10 - Pureinfotech

Do you have any odd network adapters installed? Software or hardware?

A failing PSU can cause memory issues... You want to make sure the voltages are withen 5%. So 3.3v, 5v and 12v all need to be withen 5%.


Top at or don't exceed.

3.465v

5.25v

12.6v




Bottom at or no less than.


3.135v

4.75v

11.4v

The dumps are quite clear on this, the problem is a driver called MessageTransfer.sys, which appears to be part of a game supplied by Perfect World Arena. This driver is on the call stack of all the dumps (which are identical)...

Code:

2: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffffef0b`98666ed8 fffff803`8124af53     nt!KeBugCheckEx
01 ffffef0b`98666ee0 fffff803`8106e7b0     nt!MiSystemFault+0x1b2563
02 ffffef0b`98666fe0 fffff803`8120bad8     nt!MmAccessFault+0x400
03 ffffef0b`98667180 fffff803`a0dfa9e7     nt!KiPageFault+0x358
04 ffffef0b`98667318 fffff803`a0df4639     MessageTransfer+0x1a9e7
05 ffffef0b`98667320 00000000`00000000     MessageTransfer+0x14639

You read these stacks from the bottom up (it's a push-down stack). You can see MessageTransfer.sys is called twice and then we get the page fault - which shouldn't happen in non-pageable memory. If we look in detail at the second MessageTransfer.sys call...

Code:

2: kd> .frame /r 4
04 ffffef0b`98667318 fffff803`a0df4639     MessageTransfer+0x1a9e7
rax=ffffffff83f30048 rbx=0000000016c7efc4 rcx=ffffffff83f30050
rdx=ffff940572b51fb8 rsi=ffff9404f6a82000 rdi=0000000000000258
rip=fffff803a0dfa9e7 rsp=ffffef0b98667318 rbp=0000000000000000
 r8=000000000007a000  r9=0000000000000000 r10=0000000000000002
r11=ffff9404f6afc000 r12=0000000055470000 r13=0000000000002048
r14=000000000007a000 r15=ffffffff83f30048
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00040246
MessageTransfer+0x1a9e7:
fffff803`a0dfa9e7 0f1100          movups  xmmword ptr [rax],xmm0 ds:002b:ffffffff`83f30048=????????????????????????????????

The problem happened in this call, the movups instruction using two registers as pointers (RAX and XMM0). We don't see the value in XMM0 here (we can tell it must be all zeroes), but that address in the RAX register doesn't look to be a valid address. The resulting memory pointer results in an invalid address, indicated here by the ??????????. MessageTransfer.sys has fouled up its memory pointers.

The version of MessageTranser.sys that you have installed appears recent, so I'm thinking you only recently installed this game?...

Code:

2: kd> lmvm MessageTransfer
Browse full module list
start             end                 module name
fffff803`a0de0000 fffff803`a137a000   MessageTransfer T (no symbols)           
    Loaded symbol image file: MessageTransfer.sys
    Image path: \??\C:\Program Files (x86)\perfectworldarena\plugin\MessageTransfer.sys
    Image name: MessageTransfer.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Aug  4 10:54:07 2023 (64CCAE9F)
    CheckSum:         003917EB
    ImageSize:        0059A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

You need to contact the game vendor, or see whether they have an online forum, and report this to them. Either that or uninstall the game...

ubuysa said:

The dumps are quite clear on this, the problem is a driver called MessageTransfer.sys, which appears to be part of a game supplied by Perfect World Arena. This driver is on the call stack of all the dumps (which are identical)...

Code:

2: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffffef0b`98666ed8 fffff803`8124af53     nt!KeBugCheckEx
01 ffffef0b`98666ee0 fffff803`8106e7b0     nt!MiSystemFault+0x1b2563
02 ffffef0b`98666fe0 fffff803`8120bad8     nt!MmAccessFault+0x400
03 ffffef0b`98667180 fffff803`a0dfa9e7     nt!KiPageFault+0x358
04 ffffef0b`98667318 fffff803`a0df4639     MessageTransfer+0x1a9e7
05 ffffef0b`98667320 00000000`00000000     MessageTransfer+0x14639

You read these stacks from the bottom up (it's a push-down stack). You can see MessageTransfer.sys is called twice and then we get the page fault - which shouldn't happen in non-pageable memory. If we look in detail at the second MessageTransfer.sys call...

Code:

2: kd> .frame /r 4
04 ffffef0b`98667318 fffff803`a0df4639     MessageTransfer+0x1a9e7
rax=ffffffff83f30048 rbx=0000000016c7efc4 rcx=ffffffff83f30050
rdx=ffff940572b51fb8 rsi=ffff9404f6a82000 rdi=0000000000000258
rip=fffff803a0dfa9e7 rsp=ffffef0b98667318 rbp=0000000000000000
 r8=000000000007a000  r9=0000000000000000 r10=0000000000000002
r11=ffff9404f6afc000 r12=0000000055470000 r13=0000000000002048
r14=000000000007a000 r15=ffffffff83f30048
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00040246
MessageTransfer+0x1a9e7:
fffff803`a0dfa9e7 0f1100          movups  xmmword ptr [rax],xmm0 ds:002b:ffffffff`83f30048=????????????????????????????????

The problem happened in this call, the movups instruction using two registers as pointers (RAX and XMM0). We don't see the value in XMM0 here (we can tell it must be all zeroes), but that address in the RAX register doesn't look to be a valid address. The resulting memory pointer results in an invalid address, indicated here by the ??????????. MessageTransfer.sys has fouled up its memory pointers.

The version of MessageTranser.sys that you have installed appears recent, so I'm thinking you only recently installed this game?...

Code:

2: kd> lmvm MessageTransfer
Browse full module list
start             end                 module name
fffff803`a0de0000 fffff803`a137a000   MessageTransfer T (no symbols)           
    Loaded symbol image file: MessageTransfer.sys
    Image path: \??\C:\Program Files (x86)\perfectworldarena\plugin\MessageTransfer.sys
    Image name: MessageTransfer.sys
    Browse all global symbols  functions  data
    Timestamp:        Fri Aug  4 10:54:07 2023 (64CCAE9F)
    CheckSum:         003917EB
    ImageSize:        0059A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

You need to contact the game vendor, or see whether they have an online forum, and report this to them. Either that or uninstall the game...

Ye I figured it out, its probably the game's anticheat causing the problems. Thanks for the help!