@cwsink
How did you debug those dumps? One of them shows that the driver from the Radeon graphics card is guilty
Code:
Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\032119-10203-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 17763 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 17763.1.amd64fre.rs5_release.180914-1434
Machine Name:
Kernel base = 0xfffff800`40ea4000 PsLoadedModuleList = 0xfffff800`412c39b0
Debug session time: Thu Mar 21 19:21:07.137 2019 (UTC + 1:00)
System Uptime: 0 days 0:03:56.923
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff8005a12810f, fffffb0fc529a3f8, fffffb0fc5299c40}
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
Probably caused by : atikmdag.sys ( atikmdag+13810f )
Followup: MachineOwner
---------
10: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8005a12810f, The address that the exception occurred at
Arg3: fffffb0fc529a3f8, Exception Record Address
Arg4: fffffb0fc5299c40, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 17763.1.amd64fre.rs5_release.180914-1434
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: ASUS_MB_CNL
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 0805
BIOS_DATE: 01/29/2019
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: ROG STRIX Z390-E GAMING
BASEBOARD_VERSION: Rev 1.xx
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8005a12810f
BUGCHECK_P3: fffffb0fc529a3f8
BUGCHECK_P4: fffffb0fc5299c40
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
atikmdag+13810f
fffff800`5a12810f 488b01 mov rax,qword ptr [rcx]
EXCEPTION_RECORD: fffffb0fc529a3f8 -- (.exr 0xfffffb0fc529a3f8)
ExceptionAddress: fffff8005a12810f (atikmdag+0x000000000013810f)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000010
Attempt to read from address 0000000000000010
CONTEXT: fffffb0fc5299c40 -- (.cxr 0xfffffb0fc5299c40)
rax=0000000000000000 rbx=ffff8489e3b13000 rcx=0000000000000010
rdx=000000000000001d rsi=ffffc300ccc35000 rdi=ffffc300ccc35000
rip=fffff8005a12810f rsp=fffffb0fc529a630 rbp=0000000000000000
r8=fffffffffffffcff r9=ffff8489ed427000 r10=0000000000000004
r11=fffffb0fc529a510 r12=0000000000000001 r13=0000000000000000
r14=ffff8489e3b13000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210202
atikmdag+0x13810f:
fffff800`5a12810f 488b01 mov rax,qword ptr [rcx] ds:002b:00000000`00000010=????????????????
Resetting default scope
CPU_COUNT: c
CPU_MHZ: e70
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: a
CPU_MICROCODE: 6,9e,a,0 (F,M,S,R) SIG: 9A'00000000 (cache) 9A'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 0
FOLLOWUP_IP:
atikmdag+13810f
fffff800`5a12810f 488b01 mov rax,qword ptr [rcx]
BUGCHECK_STR: AV
READ_ADDRESS: fffff80041368390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000010
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000010
ANALYSIS_SESSION_HOST: MICHAL
ANALYSIS_SESSION_TIME: 03-22-2019 12:48:08.0770
ANALYSIS_VERSION: 10.0.17763.132 amd64fre
LAST_CONTROL_TRANSFER: from ffffc300b1200300 to fffff8005a12810f
STACK_TEXT:
fffffb0f`c529a630 ffffc300`b1200300 : fffff800`5a131691 00000000`00020000 fffff800`5a124333 ffff8489`e3b13000 : atikmdag+0x13810f
fffffb0f`c529a638 fffff800`5a131691 : 00000000`00020000 fffff800`5a124333 ffff8489`e3b13000 fffff800`5a12429f : 0xffffc300`b1200300
fffffb0f`c529a640 00000000`00020000 : fffff800`5a124333 ffff8489`e3b13000 fffff800`5a12429f ffffc300`ccc35000 : atikmdag+0x141691
fffffb0f`c529a648 fffff800`5a124333 : ffff8489`e3b13000 fffff800`5a12429f ffffc300`ccc35000 ffffc300`ccc35000 : 0x20000
fffffb0f`c529a650 ffff8489`e3b13000 : fffff800`5a12429f ffffc300`ccc35000 ffffc300`ccc35000 ffffc300`ccc35000 : atikmdag+0x134333
fffffb0f`c529a658 fffff800`5a12429f : ffffc300`ccc35000 ffffc300`ccc35000 ffffc300`ccc35000 fffff800`5a0b032b : 0xffff8489`e3b13000
fffffb0f`c529a660 ffffc300`ccc35000 : ffffc300`ccc35000 ffffc300`ccc35000 fffff800`5a0b032b fffffb0f`c529a780 : atikmdag+0x13429f
fffffb0f`c529a668 ffffc300`ccc35000 : ffffc300`ccc35000 fffff800`5a0b032b fffffb0f`c529a780 fffff800`5a12f030 : 0xffffc300`ccc35000
fffffb0f`c529a670 ffffc300`ccc35000 : fffff800`5a0b032b fffffb0f`c529a780 fffff800`5a12f030 00000000`00000103 : 0xffffc300`ccc35000
fffffb0f`c529a678 fffff800`5a0b032b : fffffb0f`c529a780 fffff800`5a12f030 00000000`00000103 fffffb0f`c529a780 : 0xffffc300`ccc35000
fffffb0f`c529a680 fffffb0f`c529a780 : fffff800`5a12f030 00000000`00000103 fffffb0f`c529a780 00000000`00000000 : atikmdag+0xc032b
fffffb0f`c529a688 fffff800`5a12f030 : 00000000`00000103 fffffb0f`c529a780 00000000`00000000 ffff8489`e3844c50 : 0xfffffb0f`c529a780
fffffb0f`c529a690 00000000`00000103 : fffffb0f`c529a780 00000000`00000000 ffff8489`e3844c50 00000000`00000000 : atikmdag+0x13f030
fffffb0f`c529a698 fffffb0f`c529a780 : 00000000`00000000 ffff8489`e3844c50 00000000`00000000 fffff800`5a12d1b7 : 0x103
fffffb0f`c529a6a0 00000000`00000000 : ffff8489`e3844c50 00000000`00000000 fffff800`5a12d1b7 fffffb0f`c529a780 : 0xfffffb0f`c529a780
THREAD_SHA1_HASH_MOD_FUNC: a24c7549a990cae543ae6277f834d8ffb987f73e
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 8f6ebfbbc775c2bd80d9374be282b6c55d5917af
THREAD_SHA1_HASH_MOD: a24c7549a990cae543ae6277f834d8ffb987f73e
FAULT_INSTR_CODE: ff018b48
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atikmdag+13810f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME: atikmdag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5c901e6f
STACK_COMMAND: .cxr 0xfffffb0fc5299c40 ; kb
BUCKET_ID_FUNC_OFFSET: 13810f
FAILURE_BUCKET_ID: AV_atikmdag!unknown_function
BUCKET_ID: AV_atikmdag!unknown_function
PRIMARY_PROBLEM_CLASS: AV_atikmdag!unknown_function
TARGET_TIME: 2019-03-21T18:21:07.000Z
OSBUILD: 17763
OSSERVICEPACK: 107
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 180914-1434
BUILDLAB_STR: rs5_release
BUILDOSVER_STR: 10.0.17763.1.amd64fre.rs5_release.180914-1434
ANALYSIS_SESSION_ELAPSED_TIME: 1035e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_atikmdag!unknown_function
FAILURE_ID_HASH: {0252e3ed-fc29-a2ca-0f7a-b32a5492113a}
Followup: MachineOwner
---------
10: kd> .exr fffff8005a12810f
ExceptionAddress: 0001ba018b480a74
ExceptionCode: ff018b48
ExceptionFlags: 8b481050
NumberParameters: 285147136
Parameter[0]: d6e8cb8b48000018
Parameter[1]: 30246c8b48fffe0d
Parameter[2]: f72d7c000020003d
Parameter[3]: 0004000000191087
Parameter[4]: 0080978b48217400
Parameter[5]: 8b48204b8d480000
Parameter[6]: 046090ffdaf74801
Parameter[7]: 00001910a7810000
Parameter[8]: 245c8b48fffffbff
Parameter[9]: ccc35f20c4834840
Parameter[10]: cccccccccccccccc
Parameter[11]: cccccccccccccccc
Parameter[12]: feb83041b70f44cc
Parameter[13]: 0fc02344660000ff
Parameter[14]: 4466c00b4466c2b6
This driver looks the latest
Code:
10: kd> lmvm atikmdag
Browse full module list
start end module name
fffff800`59ff0000 fffff800`5d2b7000 atikmdag T (no symbols)
Loaded symbol image file: atikmdag.sys
Image path: \SystemRoot\System32\DriverStore\FileRepository\u0340461.inf_amd64_c6db5d91b1f3fdf9\B340443\atikmdag.sys
Image name: atikmdag.sys
Browse all global symbols functions data
Timestamp: Mon Mar 18 23:40:47 2019 (5C901E6F)
CheckSum: 0326F7AB
ImageSize: 032C7000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
In turn, this second memory dump actually indicates damaged memory
Code:
Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\032119-11187-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 17763 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 17763.1.amd64fre.rs5_release.180914-1434
Machine Name:
Kernel base = 0xfffff803`5ecb2000 PsLoadedModuleList = 0xfffff803`5f0d19b0
Debug session time: Thu Mar 21 21:12:26.223 2019 (UTC + 1:00)
System Uptime: 0 days 0:03:23.008
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41792, ffffb43fff254000, 10, 0}
Probably caused by : memory_corruption ( ONE_BIT )
Followup: MachineOwner
---------
9: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffb43fff254000
Arg3: 0000000000000010
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 17763.1.amd64fre.rs5_release.180914-1434
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: ASUS_MB_CNL
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 0805
BIOS_DATE: 01/29/2019
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: ROG STRIX Z390-E GAMING
BASEBOARD_VERSION: Rev 1.xx
DUMP_TYPE: 2
BUGCHECK_P1: 41792
BUGCHECK_P2: ffffb43fff254000
BUGCHECK_P3: 10
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BUGCHECK_STR: 0x1a_41792
CPU_COUNT: c
CPU_MHZ: e70
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: a
CPU_MICROCODE: 6,9e,a,0 (F,M,S,R) SIG: 9A'00000000 (cache) 9A'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: MICHAL
ANALYSIS_SESSION_TIME: 03-22-2019 12:58:50.0154
ANALYSIS_VERSION: 10.0.17763.132 amd64fre
STACK_TEXT:
fffffa86`0a136b78 fffff803`5eea44f8 : 00000000`0000001a 00000000`00041792 ffffb43f`ff254000 00000000`00000010 : nt!KeBugCheckEx
fffffa86`0a136b80 fffff803`5ecfcfb7 : fffffa86`0a136d19 00000000`00000010 0000007f`fffffff8 00000000`00000000 : nt!MiDeleteVa+0x1a1ba8
fffffa86`0a136c90 fffff803`5ecfd3aa : fffffa86`0a1371b0 ffffb45a`00000000 fffffa86`00000000 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x2c7
fffffa86`0a136d80 fffff803`5ecfd3aa : fffffa86`0a1371b0 00000000`00000000 fffffa86`00000001 8a000002`00000000 : nt!MiWalkPageTablesRecursively+0x6ba
fffffa86`0a136e70 fffff803`5ecfd3aa : fffffa86`0a1371b0 00000000`00000000 fffffa86`00000002 ffffb45a`00000000 : nt!MiWalkPageTablesRecursively+0x6ba
fffffa86`0a136f60 fffff803`5ecfc86a : fffffa86`0a1371b0 00000000`00000000 ffff938f`00000003 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x6ba
fffffa86`0a137050 fffff803`5ecff17d : fffffa86`0a1371b0 00000000`00000001 00000000`00000000 ffff938f`00000000 : nt!MiWalkPageTables+0x1ea
fffffa86`0a137140 fffff803`5ecffcd5 : 00000000`00000000 ffff938f`247ef8b0 fffffa86`00000001 00000000`00000000 : nt!MiDeletePagablePteRange+0x1dd
fffffa86`0a137380 fffff803`5f1c7391 : fffff803`5f0f3940 00000000`00000000 ffff938f`235f54b0 ffff938f`19545b60 : nt!MiDeleteVad+0x7c5
fffffa86`0a1374f0 fffff803`5f1c6f78 : ffff938f`235f54b0 ffff938f`19545b60 ffff938f`28a96080 00000000`00000000 : nt!MiUnmapVad+0x49
fffffa86`0a137520 fffff803`5f249097 : ffff938f`2841e410 ffff938f`2841e410 ffff938f`235f54b0 ffff938f`19545b60 : nt!MiCleanVad+0x30
fffffa86`0a137550 fffff803`5f22506d : ffffffff`00000000 ffffffff`ffffffff fffffa86`0a137701 ffff938f`247ef540 : nt!MmCleanProcessAddressSpace+0x113
fffffa86`0a1375d0 fffff803`5f2429b8 : ffff938f`247ef540 ffffa40d`d0fdf8a0 fffffa86`0a1377e9 00000000`00000000 : nt!PspRundownSingleProcess+0x129
fffffa86`0a137650 fffff803`5f1cf5f3 : 00000000`c0000005 00000000`00000001 000000d0`b503a000 00000000`00000000 : nt!PspExitThread+0x5c8
fffffa86`0a137750 fffff803`5ed79240 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x33
fffffa86`0a137790 fffff803`5ee67460 : 00000000`00000001 fffffa86`0a137850 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x470
fffffa86`0a137850 fffff803`5ee7432f : ffff938f`746c6644 000000d0`b8fffbc8 00000000`ffffffff ffffa40d`00001cff : nt!KiInitiateUserApc+0x70
fffffa86`0a137990 00007ffe`af749904 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
000000d0`b8fffb58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`af749904
THREAD_SHA1_HASH_MOD_FUNC: c091b23167a9747ad03bff889b67c15ac126f525
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b6e468602128c66080e9a86ef40a538e0e5b3d87
THREAD_SHA1_HASH_MOD: 82d14546c43bd06881f781d6d197c4c7f7ceb9cb
SYMBOL_NAME: ONE_BIT
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_ONE_BIT
TARGET_TIME: 2019-03-21T20:12:26.000Z
OSBUILD: 17763
OSSERVICEPACK: 107
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 180914-1434
BUILDLAB_STR: rs5_release
BUILDOSVER_STR: 10.0.17763.1.amd64fre.rs5_release.180914-1434
ANALYSIS_SESSION_ELAPSED_TIME: 1715
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_one_bit
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------
9: kd> !pte ffffb43fff254000
VA 00007ffe4a800000
PXE at FFFFB45A2D1687F8 PPE at FFFFB45A2D0FFFC8 PDE at FFFFB45A1FFF92A0 PTE at FFFFB43FFF254000
Unable to get PPE FFFFB45A2D0FFFC8
And I probably can not debug a third memory dump
Code:
Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\032119-13015-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 17763 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 17763.1.amd64fre.rs5_release.180914-1434
Machine Name:
Kernel base = 0xfffff805`1e81f000 PsLoadedModuleList = 0xfffff805`1ec3e9b0
Debug session time: Thu Mar 21 17:45:17.389 2019 (UTC + 1:00)
System Uptime: 0 days 0:14:36.967
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
Loading unloaded module list
........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 139, {3, ffff810bf4187d10, ffff810bf4187c68, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff810bf4187d10, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff810bf4187c68, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 17763.1.amd64fre.rs5_release.180914-1434
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: ASUS_MB_CNL
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 0805
BIOS_DATE: 01/29/2019
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: ROG STRIX Z390-E GAMING
BASEBOARD_VERSION: Rev 1.xx
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffff810bf4187d10
BUGCHECK_P3: ffff810bf4187c68
BUGCHECK_P4: 0
TRAP_FRAME: ffff810bf4187d10 -- (.trap 0xffff810bf4187d10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffb881663c1d88 rbx=0000000000000000 rcx=0000000000000003
rdx=fffff8051ec5c060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8051ef16ce4 rsp=ffff810bf4187ea0 rbp=0000000000000000
r8=ffff810bf4187ea8 r9=0000000000000000 r10=00000000000003b1
r11=ffffb8815567b000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!CmpAllocateKeyControlBlock+0x1a5988:
fffff805`1ef16ce4 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff810bf4187c68 -- (.exr 0xffff810bf4187c68)
ExceptionAddress: fffff8051ef16ce4 (nt!CmpAllocateKeyControlBlock+0x00000000001a5988)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: c
CPU_MHZ: e70
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: a
CPU_MICROCODE: 6,9e,a,0 (F,M,S,R) SIG: 9A'00000000 (cache) 9A'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXPNP: 1 (!blackboxpnp)
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: Registry
CURRENT_IRQL: 1
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: MICHAL
ANALYSIS_SESSION_TIME: 03-22-2019 13:11:49.0247
ANALYSIS_VERSION: 10.0.17763.132 amd64fre
LAST_CONTROL_TRANSFER: from fffff8051e9e1869 to fffff8051e9d0040
STACK_TEXT:
ffff810b`f41879e8 fffff805`1e9e1869 : 00000000`00000139 00000000`00000003 ffff810b`f4187d10 ffff810b`f4187c68 : nt!KeBugCheckEx
ffff810b`f41879f0 fffff805`1e9e1c10 : ffff8300`08546400 fffff805`1e8dbf29 ffff8300`08546080 ffffb881`53601290 : nt!KiBugCheckDispatch+0x69
ffff810b`f4187b30 fffff805`1e9e0008 : 00000000`000000dc 00000000`00000001 ffff810b`f41881d0 00000000`00000003 : nt!KiFastFailDispatch+0xd0
ffff810b`f4187d10 fffff805`1ef16ce4 : 00000000`00000000 00000154`00000000 ffffb881`00000002 ffff810b`f4188200 : nt!KiRaiseSecurityCheckFailure+0x308
ffff810b`f4187ea0 fffff805`1ed70bca : 00000000`fe585b10 ffffb881`65bc7e48 ffffb881`5567b000 00000000`00000000 : nt!CmpAllocateKeyControlBlock+0x1a5988
ffff810b`f4187ed0 fffff805`1ed6fb64 : 00000000`fe585b10 ffffb881`5567b000 00000000`8c400d1b 00000000`00000000 : nt!CmpCreateKeyControlBlock+0x9a
ffff810b`f4187f40 fffff805`1edc03ae : ffffb881`65bc7e48 ffff810b`f4188180 ffff810b`f4188140 ffff810b`f41881a0 : nt!CmpWalkOneLevel+0x644
ffff810b`f4188060 fffff805`1edc23da : ffff810b`0000001c ffff810b`f4188380 ffff810b`f4188350 00000000`00000000 : nt!CmpDoParseKey+0x4ce
ffff810b`f41882d0 fffff805`1edc8029 : fffff805`1edc2170 ffffb881`00000000 ffff8300`0880ca00 ffffb881`58efe201 : nt!CmpParseKey+0x26a
ffff810b`f4188460 fffff805`1edc662f : ffff8300`0880ca00 ffff810b`f41886c8 00000000`00000040 ffff830f`fd7f70c0 : nt!ObpLookupObjectName+0x719
ffff810b`f4188630 fffff805`1edc4cb8 : 00000000`00000001 ffff830f`fd7f70c0 00000000`00000000 00000000`00000001 : nt!ObOpenObjectByNameEx+0x1df
ffff810b`f4188770 fffff805`1ee1e59f : 00000000`00000000 00000000`129e7db8 00000245`106cb730 00000245`10c0bbe0 : nt!CmOpenKey+0x298
ffff810b`f41889c0 fffff805`1e9e1285 : ffff8300`08546080 ffff810b`00000000 ffff8300`09efb320 00000094`438fc9f0 : nt!NtOpenKeyEx+0xf
ffff810b`f4188a00 00007ff8`6d6c08c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000094`438fc598 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`6d6c08c4
THREAD_SHA1_HASH_MOD_FUNC: 55aa01f04868b12100170eaea01342b346ecbeaa
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 71f202365ca23ad6dfd158c480cd26cbf73fc03c
THREAD_SHA1_HASH_MOD: 7f608ac2fbce9034a3386b1d51652e4911d30234
FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff805`1e9e1c10 c644242000 mov byte ptr [rsp+20h],0
FAULT_INSTR_CODE: 202444c6
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiFastFailDispatch+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.17763.107
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
TARGET_TIME: 2019-03-21T16:45:17.000Z
OSBUILD: 17763
OSSERVICEPACK: 107
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 180914-1434
BUILDLAB_STR: rs5_release
BUILDOSVER_STR: 10.0.17763.1.amd64fre.rs5_release.180914-1434
ANALYSIS_SESSION_ELAPSED_TIME: 957
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_nt!kifastfaildispatch
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
---------
The KERNEL_SECURITY_CHECK_FAILURE bug check has a value of 0x00000139. This bug check indicates that the kernel has detected the corruption of a critical data structure.
Parameter 1 = 0x3 - A LIST_ENTRY was corrupted (for example, a double remove). For more information, see the following Cause section. (source:
Bug Check 0x139 KERNEL_SECURITY_CHECK_FAILURE - Windows drivers)
In section Cause you can read that:
LIST_ENTRY corruption can be difficult to track down and this bug check, indicates that an inconsistency has been introduced into a doubly-linked list (detected when an individual list entry element is added to or removed from the list). Unfortunately, the inconsistency is not necessarily detected at the time when the corruption occurred, so some detective work may be necessary to identify the root cause.
Common causes of list entry corruption include:
- A driver has corrupted a kernel synchronization object, such as a KEVENT (for example double initializing a KEVENT while a thread was still waiting on that same KEVENT, or allowing a stack-based KEVENT to go out of scope while another thread was using that KEVENT). This type of bug check typically occurs in nt!Ke* or nt!Ki* code. It can happen when a thread finishes waiting on a synchronization object or when code attempts to put a synchronization object in the signaled state. Usually, the synchronization object being signaled is the one that has been corrupted. Sometimes, Driver Verifier with special pool can help track down the culprit (if the corrupted synchronization object is in a pool block that has already been freed).
- A driver has corrupted a periodic KTIMER. This type of bug check typically occurs in nt!Ke* or nt!Ki* code and involves signaling a timer, or inserting or removing a timer from a timer table. The timer being manipulated may be the corrupted one, but it might be necessary to inspect the timer table with !timer (or manually walking the timer list links) to identify which timer has been corrupted. Sometimes, Driver Verifier with special pool can help track down the culprit (if the corrupted KTIMER is in a pool block that has already been freed).
- A driver has mismanaged an internal LIST_ENTRY-style linked list. A typical example would be calling RemoveEntryList twice on the same list entry without reinserting the list entry between the two RemoveEntryListcalls. Other variations are possible, such as double inserting an entry into the same list.
- A driver has freed a data structure that contains a LIST_ENTRY without removing the data structure from its corresponding list, causing corruption to be detected later when the list is examined after the old pool block has been reused.
- A driver has used a LIST_ENTRY-style list in a concurrent fashion without proper synchronization, resulting in a torn update to the list.
In most cases, you can identify the corrupted data structure by walking the linked list both forward and backwards (the
dland
dlb commands are useful for this purpose) and comparing the results. Where the list is inconsistent between a forward and backward walk is typically the location of the corruption. Since a linked list update operation can modify the list links of a neighboring element, you should look at the neighbors of a corrupted list entry closely, as they may be the underlying culprit.
Because many system components internally utilize LIST_ENTRY lists, various types of resource mismanagement by a driver using system APIs might cause linked list corruption in a system-managed linked list.
OK so i use !timer command but in minidump don't works
Code:
7: kd> !timer
fffff78000000000: Unable to get shared data
That's why I'm trying to use the dl and dlb commands, but I do not know from which address I should start
Code:
7: kd> dl
fffff805`1e9d0040 54894808`244c8948 4c182444`894c1024
fffff805`1e9d0050 ec83489c`20244c89 20250c8b`4865fa30
7: kd> dlb
I checked trap frame and i found this:
Code:
7: kd> .trap 0xffff810bf4187d10
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffb881663c1d88 rbx=0000000000000000 rcx=0000000000000003
rdx=fffff8051ec5c060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8051ef16ce4 rsp=ffff810bf4187ea0 rbp=0000000000000000
r8=ffff810bf4187ea8 r9=0000000000000000 r10=00000000000003b1
r11=ffffb8815567b000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!CmpAllocateKeyControlBlock+0x1a5988:
fffff805`1ef16ce4 cd29 int 29h
7: kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
# RetAddr : Args to Child : Call Site
00 fffff805`1ed70bca : 00000000`fe585b10 ffffb881`65bc7e48 ffffb881`5567b000 00000000`00000000 : nt!CmpAllocateKeyControlBlock+0x1a5988
01 fffff805`1ed6fb64 : 00000000`fe585b10 ffffb881`5567b000 00000000`8c400d1b 00000000`00000000 : nt!CmpCreateKeyControlBlock+0x9a
02 fffff805`1edc03ae : ffffb881`65bc7e48 ffff810b`f4188180 ffff810b`f4188140 ffff810b`f41881a0 : nt!CmpWalkOneLevel+0x644
03 fffff805`1edc23da : ffff810b`0000001c ffff810b`f4188380 ffff810b`f4188350 00000000`00000000 : nt!CmpDoParseKey+0x4ce
04 fffff805`1edc8029 : fffff805`1edc2170 ffffb881`00000000 ffff8300`0880ca00 ffffb881`58efe201 : nt!CmpParseKey+0x26a
05 fffff805`1edc662f : ffff8300`0880ca00 ffff810b`f41886c8 00000000`00000040 ffff830f`fd7f70c0 : nt!ObpLookupObjectName+0x719
06 fffff805`1edc4cb8 : 00000000`00000001 ffff830f`fd7f70c0 00000000`00000000 00000000`00000001 : nt!ObOpenObjectByNameEx+0x1df
07 fffff805`1ee1e59f : 00000000`00000000 00000000`129e7db8 00000245`106cb730 00000245`10c0bbe0 : nt!CmOpenKey+0x298
08 fffff805`1e9e1285 : ffff8300`08546080 ffff810b`00000000 ffff8300`09efb320 00000094`438fc9f0 : nt!NtOpenKeyEx+0xf
09 00007ff8`6d6c08c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0a 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`6d6c08c4
I probably need a full memory dump here (?)
Oh, i forgot. From what I can see you are using Driver Verifier. Enable the special pool option in it
Code:
7: kd> !verifier
Verify Flags Level 0x00000000
STANDARD FLAGS:
[X] (0x00000000) Automatic Checks
[ ] (0x00000001) Special pool
[ ] (0x00000002) Force IRQL checking
[ ] (0x00000008) Pool tracking
[ ] (0x00000010) I/O verification
[ ] (0x00000020) Deadlock detection
[ ] (0x00000080) DMA checking
[ ] (0x00000100) Security checks
[ ] (0x00000800) Miscellaneous checks
[ ] (0x00020000) DDI compliance checking
ADDITIONAL FLAGS:
[ ] (0x00000004) Randomized low resources simulation
[ ] (0x00000200) Force pending I/O requests
[ ] (0x00000400) IRP logging
[ ] (0x00002000) Invariant MDL checking for stack
[ ] (0x00004000) Invariant MDL checking for driver
[ ] (0x00008000) Power framework delay fuzzing
[ ] (0x00010000) Port/miniport interface checking
[ ] (0x00040000) Systematic low resources simulation
[ ] (0x00080000) DDI compliance checking (additional)
[ ] (0x00200000) NDIS/WIFI verification
[ ] (0x00800000) Kernel synchronization delay fuzzing
[ ] (0x01000000) VM switch verification
[ ] (0x02000000) Code integrity checks
[X] Indicates flag is enabled
Summary of All Verifier Statistics
RaiseIrqls 0x0
AcquireSpinLocks 0x0
Synch Executions 0x0
Trims 0x0
Pool Allocations Attempted 0x0
Pool Allocations Succeeded 0x0
Pool Allocations Succeeded SpecialPool 0x0
Pool Allocations With NO TAG 0x0
Pool Allocations Failed 0x0
Current paged pool allocations 0x0 for 00000000 bytes
Peak paged pool allocations 0x0 for 00000000 bytes
Current nonpaged pool allocations 0x0 for 00000000 bytes
Peak nonpaged pool allocations 0x0 for 00000000 bytes