*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa6009777000, 1, fffff80001ca7d44, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2d3dc )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa6009777000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80001ca7d44, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001e7d080
fffffa6009777000
FAULTING_IP:
nt!memcpy+64
fffff800`01ca7d44 488901 mov qword ptr [rcx],rax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: FileSightSvc.ex
CURRENT_IRQL: 0
TRAP_FRAME: fffffa60060716b0 -- (.trap 0xfffffa60060716b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=008a003800000000 rbx=0000000000000000 rcx=fffffa6009777000
rdx=0000001ffc451b94 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001ca7d44 rsp=fffffa6006071848 rbp=fffffa6006071ca0
r8=000000000000000e r9=00001fffdfffad1d r10=0000000000b400b2
r11=fffffa600974d8e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!memcpy+0x64:
fffff800`01ca7d44 488901 mov qword ptr [rcx],rax ds:fffffa60`09777000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80001d11850 to fffff80001cb0450
STACK_TEXT:
fffffa60`060715c8 fffff800`01d11850 : 00000000`00000050 fffffa60`09777000 00000000`00000001 fffffa60`060716b0 : nt!KeBugCheckEx
fffffa60`060715d0 fffff800`01caefd9 : 00000000`00000001 00000000`00000000 00000000`00001000 00000000`00000050 : nt! ?? ::FNODOBFM::`string'+0x2d3dc
fffffa60`060716b0 fffff800`01ca7d44 : fffff800`01c790bb 00000000`00000050 fffffa60`06071ca0 fffffa80`054ee370 : nt!KiPageFault+0x119
fffffa60`06071848 fffff800`01c790bb : 00000000`00000050 fffffa60`06071ca0 fffffa80`054ee370 fffffa60`005ee7f0 : nt!memcpy+0x64
fffffa60`06071850 fffff800`01f1fcac : 00000000`005532a8 00000000`00036400 fffffa60`060719a0 00000000`00000000 : nt!ExpGetProcessInformation+0x50b
fffffa60`06071960 fffff800`01cafef3 : fffffa80`068bcbb0 00000000`00000005 00000000`00369e99 00000000`0185e740 : nt!NtQuerySystemInformation+0xb7c
fffffa60`06071c20 00000000`7752707a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0185e718 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7752707a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+2d3dc
fffff800`01d11850 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+2d3dc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b1e8a6a
FAILURE_BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+2d3dc
BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+2d3dc
Followup: MachineOwner
|
