*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80002ec11a7, 1, 23883}
Probably caused by :
memory_corruption Followup:
memory_corruption ---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002ec11a7, The address that the exception occurred at
Arg3: 0000000000000001, Parameter 0 of the exception
Arg4: 0000000000023883, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!KeInitThread+9f
fffff800`02ec11a7 ff8983380200 dec dword ptr [rcx+23883h]
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000023883
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebd0e0
0000000000023883
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME:
explorer.exe CURRENT_IRQL: 0
TRAP_FRAME: fffff880073048c0 -- (.trap 0xfffff880073048c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80070262a0 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ec11a7 rsp=fffff88007304a58 rbp=fffffa80082ea060
r8=fffff80002f52040 r9=0000000000000000 r10=fffffa8008519970
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KeInitThread+0x9f:
fffff800`02ec11a7 ff8983380200 dec dword ptr [rcx+23883h] ds:a060:00000000`00023883=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cc6a17 to fffff80002c86f00
STACK_TEXT:
fffff880`07304038 fffff800`02cc6a17 : 00000000`0000001e ffffffff`c0000005 fffff800`02ec11a7 00000000`00000001 : nt!KeBugCheckEx
fffff880`07304040 fffff800`02c86542 : fffff880`07304818 fffffa80`07026060 fffff880`073048c0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x460da
fffff880`073046e0 fffff800`02c850ba : 00000000`00000001 fffffa80`07026060 00000000`0ad20000 fffffa80`057c3860 : nt!KiExceptionDispatch+0xc2
fffff880`073048c0 fffff800`02ec11a7 : 00000000`00000000 00000000`00000000 00000000`0ad20000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`07304a58 00000000`00000000 : fffff800`02f4f573 fffffa80`07026060 00000000`00001000 00000000`07020000 : nt!KeInitThread+0x9f
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -db !nt
13 errors : !nt (fffff80002ec1187-fffff80002ec127f)
fffff80002ec1180 e0 fe 0b c1 89 83 00 *00 00 00 83 8b 00 01 00 00 ................
fffff80002ec1190 40 83 4b 4c 01 48 8d *00 50 48 89 8b 30 02 00 00 @.KL.H..PH..0...
fffff80002ec11a0 48 8d 83 40 02 00 00 *ff 89 83 38 02 00 00 48 *ff
[email protected].
fffff80002ec11b0 49 08 48 89 09 48 8d *20 60 48 89 40 08 48 89 00 I.H..H. `
[email protected]..
...
fffff80002ec1240 be ff ff 8b c8 49 d3 *e5 4c 33 c8 4d 89 4a 30 *00 .....I..L3.M.J0.
fffff80002ec1250 8d 93 98 01 00 00 b8 *00 01 00 00 66 89 42 28 *00 ...........f.B(.
fffff80002ec1260 42 2a 01 c6 42 2b 02 *00 8d 4a 08 48 8b 01 48 *00 B*..B+...J.H..H.
fffff80002ec1270 02 48 89 4a 08 48 89 *00 08 48 89 11 48 83 a3 *00 .H.J.H...H..H...
MODULE_NAME:
memory_corruption IMAGE_NAME:
memory_corruption FOLLOWUP_NAME:
memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
FAILURE_BUCKET_ID:
X64_MEMORY_CORRUPTION_STRIDE BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
Followup: memory_corruption
---------