Created
July 23, 2017 01:33
-
-
Save hrimfaxi/2bd58bf700211c6649cc2c8a045840f9 to your computer and use it in GitHub Desktop.
BSOD
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86 | |
| Copyright (c) Microsoft Corporation. All rights reserved. | |
| Loading Dump File [C:\Windows\MEMORY.DMP] | |
| Kernel Bitmap Dump File: Only kernel address space is available | |
| ************* Symbol Path validation summary ************** | |
| Response Time (ms) Location | |
| Deferred srv* | |
| ************* Symbol Path validation summary ************** | |
| Response Time (ms) Location | |
| Deferred srv* | |
| Symbol search path is: srv* | |
| Executable search path is: srv* | |
| Windows 8 Kernel Version 15063 MP (8 procs) Free x64 | |
| Product: WinNt, suite: TerminalServer SingleUserTS | |
| Built by: 15063.0.amd64fre.rs2_release.170317-1834 | |
| Machine Name: | |
| Kernel base = 0xfffff800`0680b000 PsLoadedModuleList = 0xfffff800`06b575e0 | |
| Debug session time: Sun Jul 23 09:13:11.750 2017 (UTC + 8:00) | |
| System Uptime: 0 days 22:07:16.585 | |
| Loading Kernel Symbols | |
| ............................................................... | |
| ................................................................ | |
| ........................................................ | |
| Loading User Symbols | |
| PEB address is NULL ! | |
| Loading unloaded module list | |
| ....................................... | |
| ******************************************************************************* | |
| * * | |
| * Bugcheck Analysis * | |
| * * | |
| ******************************************************************************* | |
| Use !analyze -v to get detailed debugging information. | |
| BugCheck 154, {ffffb0808e66f000, ffff8a81fcd6b230, 2, 0} | |
| Probably caused by : memory_corruption | |
| Followup: memory_corruption | |
| --------- | |
| 4: kd> !analyze -v | |
| ******************************************************************************* | |
| * * | |
| * Bugcheck Analysis * | |
| * * | |
| ******************************************************************************* | |
| UNEXPECTED_STORE_EXCEPTION (154) | |
| The store component caught an unexpected exception. | |
| Arguments: | |
| Arg1: ffffb0808e66f000, Pointer to the store context or data manager | |
| Arg2: ffff8a81fcd6b230, Exception information | |
| Arg3: 0000000000000002, Reserved | |
| Arg4: 0000000000000000, Reserved | |
| Debugging Details: | |
| ------------------ | |
| DEFAULT_BUCKET_ID: CODE_CORRUPTION | |
| BUGCHECK_STR: 0x154 | |
| PROCESS_NAME: MemCompression | |
| CURRENT_IRQL: 1 | |
| ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre | |
| EXCEPTION_RECORD: 0000000000000001 -- (.exr 0x1) | |
| Cannot read Exception record @ 0000000000000001 | |
| TRAP_FRAME: ffff8a81fcd6ccd0 -- (.trap 0xffff8a81fcd6ccd0) | |
| NOTE: The trap frame does not contain all registers. | |
| Some register values may be zeroed or incorrect. | |
| rax=ffffd18631ef3820 rbx=0000000000000000 rcx=ffffd18631ef3810 | |
| rdx=ffffd18631ef2010 rsi=0000000000000000 rdi=0000000000000000 | |
| rip=fffff80006a8a249 rsp=ffff8a81fcd6ce60 rbp=0000000000000000 | |
| r8=ffffd18631ef3000 r9=ffffd18631f1d820 r10=0000000000000001 | |
| r11=ffffd18631ef5820 r12=0000000000000000 r13=0000000000000000 | |
| r14=0000000000000000 r15=0000000000000000 | |
| iopl=0 nv up ei pl zr na po nc | |
| nt!ExDeferredFreePool+0x229: | |
| fffff800`06a8a249 493901 cmp qword ptr [r9],rax ds:ffffd186`31f1d820=0000000000000000 | |
| Resetting default scope | |
| LAST_CONTROL_TRANSFER: from fffff80006a52082 to fffff800069774c0 | |
| STACK_TEXT: | |
| ffff8a81`fcd6ce60 fffff800`06a8b801 : ffffd186`31ef7010 ffffb080`88e3e000 ffff8a81`fcd6cf79 ffffd186`31ef9000 : nt!ExDeferredFreePool+0x229 | |
| ffff8a81`fcd6cee0 fffff800`068a3e1f : ffffffff`ffffffff b0809256`3d7004c0 ffffd186`00000000 fffff808`00000001 : nt!ExFreePoolWithTag+0x7e1 | |
| ffff8a81`fcd6cfe0 fffff800`068ca241 : ffffb080`92563d70 ffff8a81`fcd6d120 00000000`00000000 fffff800`068ca364 : nt!MiDeleteSubsectionPages+0x57f | |
| ffff8a81`fcd6d0d0 fffff800`06ce4908 : 00000000`00000000 00000000`00088089 ffffb080`92563d70 ffffb080`92563cf0 : nt!MiDeleteSegmentPages+0x5d | |
| ffff8a81`fcd6d120 fffff800`06889b16 : 00000000`00000002 00000000`00000000 ffffb080`92563cf0 fffff800`0686d948 : nt!MiSegmentDelete+0x78 | |
| ffff8a81`fcd6d170 fffff800`06cb906e : ffffd186`2cd23910 00000000`00000000 00000000`00000000 00000000`00000001 : nt!MiCheckControlArea+0x1f6 | |
| ffff8a81`fcd6d1d0 fffff800`0686eb86 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd186`2cd23940 : nt!ObpRemoveObjectRoutine+0x7e | |
| ffff8a81`fcd6d230 fffff800`068b4820 : 00000000`746c6644 ffffb080`91253160 00000000`00000000 ffffb080`9256b540 : nt!ObfDereferenceObjectWithTag+0xc6 | |
| ffff8a81`fcd6d270 fffff800`068b3834 : ffffb080`9256b540 ffffb080`91253160 00000000`00000000 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x13c | |
| ffff8a81`fcd6d2c0 fffff808`16caec26 : 00000000`00000000 ffffd186`31eeea00 ffffb080`91253160 00000000`00100000 : nt!CcUninitializeCacheMap+0x204 | |
| ffff8a81`fcd6d350 fffff808`16cc1e18 : ffffd186`31eeea00 ffffd186`31eeea00 00000000`00000000 ffffb080`8d5777a0 : NTFS!NtfsDeleteInternalAttributeStream+0xde | |
| ffff8a81`fcd6d390 fffff808`16c082b5 : 00000000`00000000 ffffb080`8d5777a0 ffffb080`92563ec8 fffff800`0686c9f7 : NTFS!NtfsRemoveScb+0x118 | |
| ffff8a81`fcd6d3e0 fffff808`16cc1aef : ffffd186`31eeea00 00000000`00000008 ffff8a81`fcd6d4e4 ffffb080`8b738100 : NTFS!NtfsPrepareFcbForRemoval+0x75 | |
| ffff8a81`fcd6d420 fffff808`16cc036e : ffffb080`911cc018 ffffd186`31eeea00 00000000`00000000 00000000`0000005a : NTFS!NtfsTeardownStructures+0x8f | |
| ffff8a81`fcd6d4a0 fffff808`16dc8c4c : 00000000`00000008 ffff8a81`fcd6e000 ffffb080`8b738180 ffffb080`8b738180 : NTFS!NtfsFlushVolume+0x78e | |
| ffff8a81`fcd6d620 fffff808`16d38cb1 : 00000000`00000001 ffffb080`8b738180 00000000`00000001 00000000`00000001 : NTFS!NtfsPerformSurpriseRemoval+0x40 | |
| ffff8a81`fcd6d660 fffff808`16d38537 : ffffb080`911cc018 00000000`00000001 ffff8a81`fcd6d7d0 ffffb080`8b738000 : NTFS!NtfsCommonPnp+0x70d | |
| ffff8a81`fcd6d720 fffff808`1638563d : ffffb080`8f99c2a0 00000000`00000000 00000000`00000001 ffffb080`911cc018 : NTFS!NtfsFsdPnp+0x187 | |
| ffff8a81`fcd6d7c0 fffff808`163834d6 : ffff8a81`fcd6d850 00000000`00000001 00000000`0000000c 00650033`00630035 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d | |
| ffff8a81`fcd6d830 fffff800`06c7cfc9 : ffffb080`9191e060 00000000`00000000 ffff8a81`fcd6d940 00000000`00000000 : FLTMGR!FltpDispatch+0xb6 | |
| ffff8a81`fcd6d890 fffff800`06d72063 : 00000000`00000017 ffff8a81`fcd6d959 ffffb080`8f2f0130 ffffb080`9297c1d0 : nt!IopSynchronousCall+0xe5 | |
| ffff8a81`fcd6d900 fffff800`06d6d662 : ffffd186`39d6d620 00000000`00000000 00000000`00000000 fffff800`068de84e : nt!IopRemoveDevice+0xdf | |
| ffff8a81`fcd6d9c0 fffff800`06d71a4b : ffffb080`8f2f0130 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PnpSurpriseRemoveLockedDeviceNode+0xba | |
| ffff8a81`fcd6da20 fffff800`06d7172a : 00000000`00000000 ffff8a81`fcd6daa0 ffffd186`28408d00 ffffd186`2aa929d0 : nt!PnpDeleteLockedDeviceNode+0xaf | |
| ffff8a81`fcd6da60 fffff800`06d708f4 : ffffb080`8a280c80 00000005`00000002 00000000`00000000 ffffd186`28408d00 : nt!PnpDeleteLockedDeviceNodes+0xbe | |
| ffff8a81`fcd6dad0 fffff800`06c798b6 : ffff8a81`fcd6dc60 ffffd186`2aa92900 ffff8a81`fcd6dc00 00000000`00000001 : nt!PnpProcessQueryRemoveAndEject+0x490 | |
| ffff8a81`fcd6dc00 fffff800`06c83e94 : ffffd186`39d6d620 00000000`00000000 ffffb080`8c030600 ffffd186`2aa929d0 : nt!PnpProcessTargetDeviceEvent+0xf2 | |
| ffff8a81`fcd6dc30 fffff800`06848ca8 : 00000000`00000300 ffffb080`8b63c040 ffffb080`8c0306c0 fffff800`06c03380 : nt!PnpDeviceEventWorker+0x254 | |
| ffff8a81`fcd6dcc0 fffff800`068e7ac7 : 00000080`2a818b00 00000000`00000080 ffffb080`88e1e680 ffffb080`8b63c040 : nt!ExpWorkerThread+0xd8 | |
| ffff8a81`fcd6dd50 fffff800`0697c946 : ffff8a81`f5a75180 ffffb080`8b63c040 fffff800`068e7a80 ffffb080`88e59180 : nt!PspSystemThreadStartup+0x47 | |
| ffff8a81`fcd6dda0 00000000`00000000 : ffff8a81`fcd6e000 ffff8a81`fcd68000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 | |
| STACK_COMMAND: .trap 0xffff8a81fcd6ccd0 ; kb | |
| CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt | |
| fffff8000680c6bc-fffff8000680c6c0 5 bytes - nt!MiLockDownWorkingSet+54 | |
| [ d0 be 7d fb f6:a0 5f bf 7e fd ] | |
| fffff8000680c6da-fffff8000680c6db 2 bytes - nt!MiLockDownWorkingSet+72 (+0x1e) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c702 - nt!MiLockDownWorkingSet+9a (+0x28) | |
| [ fa:c4 ] | |
| fffff8000680c7f4-fffff8000680c7f5 2 bytes - nt!MiCreateForkWsles+28 (+0xf2) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c908-fffff8000680c909 2 bytes - nt!MiCreateForkWsle+60 (+0x114) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c94f - nt!MiCreateForkWsle+a7 (+0x47) | |
| [ fa:c4 ] | |
| fffff8000680cb83-fffff8000680cb84 2 bytes - nt!MiCloneVads+1ab (+0x234) | |
| [ 80 f6:00 fd ] | |
| fffff8000680cd6c-fffff8000680cd6d 2 bytes - nt!MiCloneVads+394 (+0x1e9) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d03e-fffff8000680d03f 2 bytes - nt!MiBuildForkPte+b6 (+0x2d2) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d053 - nt!MiBuildForkPte+cb (+0x15) | |
| [ fa:c4 ] | |
| fffff8000680d16b - nt!MiBuildForkPte+1e3 (+0x118) | |
| [ fa:c4 ] | |
| fffff8000680d5fb-fffff8000680d5fc 2 bytes - nt!MiUpdateForkMaps+83 (+0x490) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d6ed - nt!MiUpdateForkMaps+175 (+0xf2) | |
| [ fa:c4 ] | |
| fffff8000680d736 - nt!MiUpdateForkMaps+1be (+0x49) | |
| [ fa:c4 ] | |
| fffff8000680d844 - nt!MiBuildForkPageTable+34 (+0x10e) | |
| [ fa:c4 ] | |
| fffff8000680da05 - nt!MiDoneWithThisPageGetAnother+9d (+0x1c1) | |
| [ fa:c4 ] | |
| fffff8000680da60 - nt!MiFinishLastForkPageTable+30 (+0x5b) | |
| [ fa:c4 ] | |
| fffff8000680da6c-fffff8000680da6d 2 bytes - nt!MiFinishLastForkPageTable+3c (+0x0c) | |
| [ 80 f6:00 fd ] | |
| fffff8000680db1c-fffff8000680db1d 2 bytes - nt!MiFinishLastForkPageTable+ec (+0xb0) | |
| [ ff f6:7f fd ] | |
| fffff8000680ddd3-fffff8000680ddd4 2 bytes - nt!MiCloneReserveVadCommit+63 (+0x2b7) | |
| [ 80 f6:00 fd ] | |
| fffff8000680de88-fffff8000680de89 2 bytes - nt!MiCloneReserveVadCommit+118 (+0xb5) | |
| [ 80 f6:00 fd ] | |
| fffff8000680e087-fffff8000680e088 2 bytes - nt!MiCloneReserveVadCommit+317 (+0x1ff) | |
| [ 80 f6:00 fd ] | |
| fffff8000680e3e6 - nt!MiCaptureProtectionFromLockedProto+76 (+0x35f) | |
| [ fa:c4 ] | |
| fffff80006811fbd - nt!MiInvalidateCollidedIos+31 (+0x3bd7) | |
| [ fa:c4 ] | |
| fffff8000681200d - nt!MiInvalidateCollidedIos+81 (+0x50) | |
| [ fa:c4 ] | |
| fffff800068121c5 - nt!MiReleaseInPageRefs+29 (+0x1b8) | |
| [ fa:c4 ] | |
| fffff800068138e4-fffff800068138e5 2 bytes - nt!MiOutPageSingleKernelStack+34 (+0x171f) | |
| [ 80 f6:00 fd ] | |
| fffff80006813a03 - nt!MiOutPageSingleKernelStack+153 (+0x11f) | |
| [ fa:c4 ] | |
| fffff80006813aa3 - nt!MiOutPageSingleKernelStack+1f3 (+0xa0) | |
| [ fa:c4 ] | |
| fffff80006813f9c-fffff80006813f9d 2 bytes - nt!MiWalkVaRange+58 (+0x4f9) | |
| [ 80 f6:00 fd ] | |
| fffff800068141a3-fffff800068141a4 2 bytes - nt!MiWalkVaRange+25f (+0x207) | |
| [ 80 f6:00 fd ] | |
| fffff800068141d1-fffff800068141d2 2 bytes - nt!MiWalkVaRange+28d (+0x2e) | |
| [ 80 f6:00 fd ] | |
| fffff8000681422d-fffff8000681422e 2 bytes - nt!MiWalkVaRange+2e9 (+0x5c) | |
| [ 80 f6:00 fd ] | |
| fffff8000681426b-fffff8000681426c 2 bytes - nt!MiWalkVaRange+327 (+0x3e) | |
| [ 80 f6:00 fd ] | |
| fffff800068143b4-fffff800068143b5 2 bytes - nt!MiWalkVaRange+470 (+0x149) | |
| [ 80 f6:00 fd ] | |
| fffff800068144d8-fffff800068144d9 2 bytes - nt!MiActOnPte+b0 (+0x124) | |
| [ 80 f6:00 fd ] | |
| fffff80006814570 - nt!MiActOnPte+148 (+0x98) | |
| [ fa:c4 ] | |
| fffff8000681468e-fffff8000681468f 2 bytes - nt!MiActOnPte+266 (+0x11e) | |
| [ 80 f6:00 fd ] | |
| fffff8000681494f-fffff80006814950 2 bytes - nt!MiActOnPte+527 (+0x2c1) | |
| [ 80 f6:00 fd ] | |
| fffff80006814b4b - nt!MiRotatedToFrameBuffer+2f (+0x1fc) | |
| [ fa:c4 ] | |
| fffff80006814b8e-fffff80006814b8f 2 bytes - nt!MiRotatedToFrameBuffer+72 (+0x43) | |
| [ 80 f6:00 fd ] | |
| fffff80006814bd3-fffff80006814bd4 2 bytes - nt!MiUpdateWsleAge+17 (+0x45) | |
| [ 80 f6:00 fd ] | |
| fffff80006814d8f-fffff80006814d90 2 bytes - nt!MiGetWorkingSetInfoList+13f (+0x1bc) | |
| [ 80 f6:00 fd ] | |
| fffff80006814da2-fffff80006814da4 3 bytes - nt!MiGetWorkingSetInfoList+152 (+0x13) | |
| [ 40 fb f6:80 7e fd ] | |
| fffff80006814fa4 - nt!MiGetWorkingSetInfoList+354 (+0x202) | |
| [ fa:c4 ] | |
| fffff800068150f6-fffff800068150f7 2 bytes - nt!MiGetWorkingSetInfoList+4a6 (+0x152) | |
| [ 80 f6:00 fd ] | |
| fffff80006815157-fffff80006815158 2 bytes - nt!MiGetWorkingSetInfoList+507 (+0x61) | |
| [ 80 f6:00 fd ] | |
| fffff800068152f9-fffff800068152fb 3 bytes - nt!MiGetWorkingSetInfoList+6a9 (+0x1a2) | |
| [ 40 fb f6:80 7e fd ] | |
| fffff800068153f5 - nt!MiGetWorkingSetInfoList+7a5 (+0xfc) | |
| [ fa:c4 ] | |
| fffff800068154bf - nt!MiGetWorkingSetInfoList+86f (+0xca) | |
| [ fa:c4 ] | |
| WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output. | |
| fffff80006a8b383-fffff80006a8b385 3 bytes - nt!ExFreePoolWithTag+363 | |
| [ 40 fb f6:80 7e fd ] | |
| fffff80006a8b6b6-fffff80006a8b6b7 2 bytes - nt!ExFreePoolWithTag+696 (+0x333) | |
| [ 80 f6:00 fd ] | |
| fffff80006be9780-fffff80006be9782 3 bytes - nt!_guard_check_icall_fptr | |
| [ 50 48 94:b0 d8 97 ] | |
| fffff80006be9788-fffff80006be9789 2 bytes - nt!_guard_dispatch_icall_fptr (+0x08) | |
| [ f0 37:00 d9 ] | |
| fffff80006c0c5d1 - nt!MmDuplicateMemory+209 | |
| [ fa:c4 ] | |
| fffff80006c0c6bc - nt!MmDuplicateMemory+2f4 (+0xeb) | |
| [ fa:c4 ] | |
| fffff80006c0c8e5 - nt!MmDuplicateMemory+51d (+0x229) | |
| [ fa:c4 ] | |
| fffff80006c0c9a3 - nt!MmDuplicateMemory+5db (+0xbe) | |
| [ fa:c4 ] | |
| fffff80006c0cf00-fffff80006c0cf01 2 bytes - nt!MiMarkKernelPageTablePages+c (+0x55d) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0cf51-fffff80006c0cf52 2 bytes - nt!MiMarkKernelPageTablePages+5d (+0x51) | |
| [ 00 f7:80 fd ] | |
| fffff80006c0d3e1 - nt!MmMarkHiberPhase+71 (+0x490) | |
| [ fa:c4 ] | |
| fffff80006c0d3f8 - nt!MmMarkHiberPhase+88 (+0x17) | |
| [ fa:c4 ] | |
| fffff80006c0d78b - nt!MiMarkHiberNotCachedPages+2b (+0x393) | |
| [ fa:c4 ] | |
| fffff80006c0db97 - nt!MiMarkNonPagedHiberPhasePages+67 (+0x40c) | |
| [ fa:c4 ] | |
| fffff80006c0dc6d-fffff80006c0dc6e 2 bytes - nt!MiMarkKernelPageTablesHelper+3d (+0xd6) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0df61-fffff80006c0df62 2 bytes - nt!MiEnumerateKernelLeafPtes+d (+0x2f4) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0df6b-fffff80006c0df6c 2 bytes - nt!MiEnumerateKernelLeafPtes+17 (+0x0a) | |
| [ 00 f7:80 fd ] | |
| fffff80006c176a2-fffff80006c176a3 2 bytes - nt!MmInitializeProcessor+3a (+0x9737) | |
| [ 80 f6:00 fd ] | |
| fffff80006c1981c - nt!MmDuplicateMemory+d454 (+0x217a) | |
| [ fa:c4 ] | |
| fffff80006c198a9 - nt!MmDuplicateMemory+d4e1 (+0x8d) | |
| [ fa:c4 ] | |
| fffff80006c1993e - nt!MmDuplicateMemory+d576 (+0x95) | |
| [ fa:c4 ] | |
| fffff80006c19a58 - nt!MmDuplicateMemory+d690 (+0x11a) | |
| [ fa:c4 ] | |
| fffff80006c8c436 - nt!MmChangeImageProtection+166 | |
| [ fa:c4 ] | |
| fffff80006c949f3-fffff80006c949f4 2 bytes - nt!MiProcessCrcList+103 (+0x85bd) | |
| [ 80 f6:00 fd ] | |
| fffff80006c949fd-fffff80006c949fe 2 bytes - nt!MiProcessCrcList+10d (+0x0a) | |
| [ ff f6:7f fd ] | |
| fffff80006c94a08 - nt!MiProcessCrcList+118 (+0x0b) | |
| [ fa:c4 ] | |
| fffff80006c94acb-fffff80006c94acc 2 bytes - nt!MiProcessCrcList+1db (+0xc3) | |
| [ 80 f6:00 fd ] | |
| fffff80006c94ad5-fffff80006c94ad6 2 bytes - nt!MiProcessCrcList+1e5 (+0x0a) | |
| [ ff f6:7f fd ] | |
| fffff80006c94c74-fffff80006c94c75 2 bytes - nt!MiProcessCrcList+384 (+0x19f) | |
| [ 80 f6:00 fd ] | |
| fffff80006cb8da9 - nt!PfpPfnPrioRequest+99 (+0x24135) | |
| [ fa:c4 ] | |
| fffff80006cb8de8 - nt!PfpPfnPrioRequest+d8 (+0x3f) | |
| [ fa:c4 ] | |
| fffff80006cc0658 - nt!MiPfPrepareReadList+4a8 (+0x7870) | |
| [ fa:c4 ] | |
| fffff80006cc1607 - nt!MiPfPrepareSequentialReadList+2e7 (+0xfaf) | |
| [ fa:c4 ] | |
| fffff80006cc37ed - nt!MiRelocateImagePfn+6d (+0x21e6) | |
| [ fa:c4 ] | |
| fffff80006cc37f9-fffff80006cc37fa 2 bytes - nt!MiRelocateImagePfn+79 (+0x0c) | |
| [ 80 f6:00 fd ] | |
| fffff80006cc3814-fffff80006cc3815 2 bytes - nt!MiRelocateImagePfn+94 (+0x1b) | |
| [ ff f6:7f fd ] | |
| fffff80006cc384a-fffff80006cc384b 2 bytes - nt!MiRelocateImagePfn+ca (+0x36) | |
| [ 80 f6:00 fd ] | |
| fffff80006cdb366 - nt!MiAllocateDriverPage+9a (+0x17b1c) | |
| [ fa:c4 ] | |
| fffff80006cdb515 - nt!MmCreateProcessAddressSpace+17d (+0x1af) | |
| [ fa:c4 ] | |
| fffff80006cdb56b-fffff80006cdb56f 5 bytes - nt!MmCreateProcessAddressSpace+1d3 (+0x56) | |
| [ d0 be 7d fb f6:a0 5f bf 7e fd ] | |
| fffff80006cdb5b3-fffff80006cdb5b4 2 bytes - nt!MmCreateProcessAddressSpace+21b (+0x48) | |
| [ 80 f6:00 fd ] | |
| fffff80006ce150f-fffff80006ce1510 2 bytes - nt!MiPrefetchDriverPages+23 (+0x5f5c) | |
| [ 80 f6:00 fd ] | |
| fffff80006ce662e - nt!MiCreateImageFileMap+fa (+0x511f) | |
| [ fa:c4 ] | |
| fffff80006d314e5-fffff80006d314e6 2 bytes - nt!MiFreeInitializationCode+41 (+0x4aeb7) | |
| [ 80 f6:00 fd ] | |
| fffff80006d3163b - nt!MiFreeInitializationCode+197 (+0x156) | |
| [ fa:c4 ] | |
| fffff80006d369e4 - nt!MiValidateImagePfn+3c (+0x53a9) | |
| [ fa:c4 ] | |
| fffff80006d36a2f-fffff80006d36a30 2 bytes - nt!MiValidateImagePfn+87 (+0x4b) | |
| [ 80 f6:00 fd ] | |
| fffff80006d420f1-fffff80006d420f2 2 bytes - nt!MiSelectSystemImageAddress+25 (+0xb6c2) | |
| [ 80 f6:00 fd ] | |
| fffff80006d6a247 - nt!MiCombineAllPhysicalMemory+207 (+0x28156) | |
| [ fa:c4 ] | |
| fffff80006d6b721 - nt!MmFreeIndependentPages+51 (+0x14da) | |
| [ fa:c4 ] | |
| fffff80006d6f721-fffff80006d6f722 2 bytes - nt!MmAllocateIndependentPages+71 (+0x4000) | |
| [ 80 f6:00 fd ] | |
| fffff80006d6f7c3 - nt!MmAllocateIndependentPages+113 (+0xa2) | |
| [ fa:c4 ] | |
| fffff80006d6f984-fffff80006d6f985 2 bytes - nt!MmAllocateMappingAddress+94 (+0x1c1) | |
| [ 80 f6:00 fd ] | |
| fffff80006d7c9b4-fffff80006d7c9b5 2 bytes - nt!MmAllocateDumpHibernateResources+38 (+0xd030) | |
| [ 80 f6:00 fd ] | |
| fffff80006d844b1-fffff80006d844b2 2 bytes - nt!MiInitializeDynamicBitmap+195 (+0x7afd) | |
| [ 80 f6:00 fd ] | |
| fffff80006d844f4 - nt!MiInitializeDynamicBitmap+1d8 (+0x43) | |
| [ fa:c4 ] | |
| fffff80006d84882-fffff80006d84883 2 bytes - nt!MiSessionCreateInternal+ee (+0x38e) | |
| [ 80 f6:00 fd ] | |
| fffff80006d84ae0 - nt!MiMapNewSession+b0 (+0x25e) | |
| [ fa:c4 ] | |
| fffff80006d84b6b - nt!MiMapNewSession+13b (+0x8b) | |
| [ fa:c4 ] | |
| fffff80006d84bbd - nt!MiMapNewSession+18d (+0x52) | |
| [ fa:c4 ] | |
| fffff80006d88b8b-fffff80006d88b8c 2 bytes - nt!MiReleaseDriverPtes+11b (+0x3fce) | |
| [ 80 f6:00 fd ] | |
| fffff80006db214e-fffff80006db214f 2 bytes - nt!MiCreateLargePfnBitMaps+8e (+0x295c3) | |
| [ 80 f6:00 fd ] | |
| fffff80006db6a23-fffff80006db6a24 2 bytes - nt!MiMarkBootGuardPage+3b (+0x48d5) | |
| [ 80 f6:00 fd ] | |
| fffff80006db6a4e - nt!MiMarkBootGuardPage+66 (+0x2b) | |
| [ fa:c4 ] | |
| fffff80006db93d5-fffff80006db93d6 2 bytes - nt!MmReserveViewInSystemCache+29 (+0x2987) | |
| [ 80 f6:00 fd ] | |
| fffff80006e00621 - nt!MiUnloadSystemImage+176d75 (+0x4724c) | |
| [ fa:c4 ] | |
| fffff80006e0147d - nt!MmChangeImageProtection+1751ad (+0xe5c) | |
| [ fa:c4 ] | |
| fffff80006e014b8 - nt!MmChangeImageProtection+1751e8 (+0x3b) | |
| [ fa:c4 ] | |
| fffff80006e18b20 - nt!MiCreatePagingFileMap+1340f0 (+0x17668) | |
| [ fa:c4 ] | |
| fffff80006e19cfd - nt!MiRelocateImage+1325cd (+0x11dd) | |
| [ fa:c4 ] | |
| fffff80006e37fb5-fffff80006e37fb6 2 bytes - nt!MiGetSystemAddressForImage+f6111 (+0x1e2b8) | |
| [ 80 f6:00 fd ] | |
| fffff80006e38442-fffff80006e38443 2 bytes - nt!MiGetSystemAddressForImage+f659e (+0x48d) | |
| [ 80 f6:00 fd ] | |
| WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output. | |
| 3144 errors : !nt (fffff8000680c6bc-fffff80006ec88ea) | |
| MODULE_NAME: memory_corruption | |
| IMAGE_NAME: memory_corruption | |
| FOLLOWUP_NAME: memory_corruption | |
| DEBUG_FLR_IMAGE_TIMESTAMP: 0 | |
| MEMORY_CORRUPTOR: LARGE | |
| FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE | |
| BUCKET_ID: MEMORY_CORRUPTION_LARGE | |
| ANALYSIS_SOURCE: KM | |
| FAILURE_ID_HASH_STRING: km:memory_corruption_large | |
| FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c} | |
| Followup: memory_corruption | |
| --------- | |
| 4: kd> !analyze -v | |
| ******************************************************************************* | |
| * * | |
| * Bugcheck Analysis * | |
| * * | |
| ******************************************************************************* | |
| UNEXPECTED_STORE_EXCEPTION (154) | |
| The store component caught an unexpected exception. | |
| Arguments: | |
| Arg1: ffffb0808e66f000, Pointer to the store context or data manager | |
| Arg2: ffff8a81fcd6b230, Exception information | |
| Arg3: 0000000000000002, Reserved | |
| Arg4: 0000000000000000, Reserved | |
| Debugging Details: | |
| ------------------ | |
| DEFAULT_BUCKET_ID: CODE_CORRUPTION | |
| BUGCHECK_STR: 0x154 | |
| PROCESS_NAME: MemCompression | |
| CURRENT_IRQL: 1 | |
| ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre | |
| EXCEPTION_RECORD: 0000000000000001 -- (.exr 0x1) | |
| Cannot read Exception record @ 0000000000000001 | |
| TRAP_FRAME: ffff8a81fcd6ccd0 -- (.trap 0xffff8a81fcd6ccd0) | |
| NOTE: The trap frame does not contain all registers. | |
| Some register values may be zeroed or incorrect. | |
| rax=ffffd18631ef3820 rbx=0000000000000000 rcx=ffffd18631ef3810 | |
| rdx=ffffd18631ef2010 rsi=0000000000000000 rdi=0000000000000000 | |
| rip=fffff80006a8a249 rsp=ffff8a81fcd6ce60 rbp=0000000000000000 | |
| r8=ffffd18631ef3000 r9=ffffd18631f1d820 r10=0000000000000001 | |
| r11=ffffd18631ef5820 r12=0000000000000000 r13=0000000000000000 | |
| r14=0000000000000000 r15=0000000000000000 | |
| iopl=0 nv up ei pl zr na po nc | |
| nt!ExDeferredFreePool+0x229: | |
| fffff800`06a8a249 493901 cmp qword ptr [r9],rax ds:ffffd186`31f1d820=0000000000000000 | |
| Resetting default scope | |
| LAST_CONTROL_TRANSFER: from fffff80006a52082 to fffff800069774c0 | |
| STACK_TEXT: | |
| ffff8a81`fcd6ce60 fffff800`06a8b801 : ffffd186`31ef7010 ffffb080`88e3e000 ffff8a81`fcd6cf79 ffffd186`31ef9000 : nt!ExDeferredFreePool+0x229 | |
| ffff8a81`fcd6cee0 fffff800`068a3e1f : ffffffff`ffffffff b0809256`3d7004c0 ffffd186`00000000 fffff808`00000001 : nt!ExFreePoolWithTag+0x7e1 | |
| ffff8a81`fcd6cfe0 fffff800`068ca241 : ffffb080`92563d70 ffff8a81`fcd6d120 00000000`00000000 fffff800`068ca364 : nt!MiDeleteSubsectionPages+0x57f | |
| ffff8a81`fcd6d0d0 fffff800`06ce4908 : 00000000`00000000 00000000`00088089 ffffb080`92563d70 ffffb080`92563cf0 : nt!MiDeleteSegmentPages+0x5d | |
| ffff8a81`fcd6d120 fffff800`06889b16 : 00000000`00000002 00000000`00000000 ffffb080`92563cf0 fffff800`0686d948 : nt!MiSegmentDelete+0x78 | |
| ffff8a81`fcd6d170 fffff800`06cb906e : ffffd186`2cd23910 00000000`00000000 00000000`00000000 00000000`00000001 : nt!MiCheckControlArea+0x1f6 | |
| ffff8a81`fcd6d1d0 fffff800`0686eb86 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd186`2cd23940 : nt!ObpRemoveObjectRoutine+0x7e | |
| ffff8a81`fcd6d230 fffff800`068b4820 : 00000000`746c6644 ffffb080`91253160 00000000`00000000 ffffb080`9256b540 : nt!ObfDereferenceObjectWithTag+0xc6 | |
| ffff8a81`fcd6d270 fffff800`068b3834 : ffffb080`9256b540 ffffb080`91253160 00000000`00000000 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x13c | |
| ffff8a81`fcd6d2c0 fffff808`16caec26 : 00000000`00000000 ffffd186`31eeea00 ffffb080`91253160 00000000`00100000 : nt!CcUninitializeCacheMap+0x204 | |
| ffff8a81`fcd6d350 fffff808`16cc1e18 : ffffd186`31eeea00 ffffd186`31eeea00 00000000`00000000 ffffb080`8d5777a0 : NTFS!NtfsDeleteInternalAttributeStream+0xde | |
| ffff8a81`fcd6d390 fffff808`16c082b5 : 00000000`00000000 ffffb080`8d5777a0 ffffb080`92563ec8 fffff800`0686c9f7 : NTFS!NtfsRemoveScb+0x118 | |
| ffff8a81`fcd6d3e0 fffff808`16cc1aef : ffffd186`31eeea00 00000000`00000008 ffff8a81`fcd6d4e4 ffffb080`8b738100 : NTFS!NtfsPrepareFcbForRemoval+0x75 | |
| ffff8a81`fcd6d420 fffff808`16cc036e : ffffb080`911cc018 ffffd186`31eeea00 00000000`00000000 00000000`0000005a : NTFS!NtfsTeardownStructures+0x8f | |
| ffff8a81`fcd6d4a0 fffff808`16dc8c4c : 00000000`00000008 ffff8a81`fcd6e000 ffffb080`8b738180 ffffb080`8b738180 : NTFS!NtfsFlushVolume+0x78e | |
| ffff8a81`fcd6d620 fffff808`16d38cb1 : 00000000`00000001 ffffb080`8b738180 00000000`00000001 00000000`00000001 : NTFS!NtfsPerformSurpriseRemoval+0x40 | |
| ffff8a81`fcd6d660 fffff808`16d38537 : ffffb080`911cc018 00000000`00000001 ffff8a81`fcd6d7d0 ffffb080`8b738000 : NTFS!NtfsCommonPnp+0x70d | |
| ffff8a81`fcd6d720 fffff808`1638563d : ffffb080`8f99c2a0 00000000`00000000 00000000`00000001 ffffb080`911cc018 : NTFS!NtfsFsdPnp+0x187 | |
| ffff8a81`fcd6d7c0 fffff808`163834d6 : ffff8a81`fcd6d850 00000000`00000001 00000000`0000000c 00650033`00630035 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d | |
| ffff8a81`fcd6d830 fffff800`06c7cfc9 : ffffb080`9191e060 00000000`00000000 ffff8a81`fcd6d940 00000000`00000000 : FLTMGR!FltpDispatch+0xb6 | |
| ffff8a81`fcd6d890 fffff800`06d72063 : 00000000`00000017 ffff8a81`fcd6d959 ffffb080`8f2f0130 ffffb080`9297c1d0 : nt!IopSynchronousCall+0xe5 | |
| ffff8a81`fcd6d900 fffff800`06d6d662 : ffffd186`39d6d620 00000000`00000000 00000000`00000000 fffff800`068de84e : nt!IopRemoveDevice+0xdf | |
| ffff8a81`fcd6d9c0 fffff800`06d71a4b : ffffb080`8f2f0130 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PnpSurpriseRemoveLockedDeviceNode+0xba | |
| ffff8a81`fcd6da20 fffff800`06d7172a : 00000000`00000000 ffff8a81`fcd6daa0 ffffd186`28408d00 ffffd186`2aa929d0 : nt!PnpDeleteLockedDeviceNode+0xaf | |
| ffff8a81`fcd6da60 fffff800`06d708f4 : ffffb080`8a280c80 00000005`00000002 00000000`00000000 ffffd186`28408d00 : nt!PnpDeleteLockedDeviceNodes+0xbe | |
| ffff8a81`fcd6dad0 fffff800`06c798b6 : ffff8a81`fcd6dc60 ffffd186`2aa92900 ffff8a81`fcd6dc00 00000000`00000001 : nt!PnpProcessQueryRemoveAndEject+0x490 | |
| ffff8a81`fcd6dc00 fffff800`06c83e94 : ffffd186`39d6d620 00000000`00000000 ffffb080`8c030600 ffffd186`2aa929d0 : nt!PnpProcessTargetDeviceEvent+0xf2 | |
| ffff8a81`fcd6dc30 fffff800`06848ca8 : 00000000`00000300 ffffb080`8b63c040 ffffb080`8c0306c0 fffff800`06c03380 : nt!PnpDeviceEventWorker+0x254 | |
| ffff8a81`fcd6dcc0 fffff800`068e7ac7 : 00000080`2a818b00 00000000`00000080 ffffb080`88e1e680 ffffb080`8b63c040 : nt!ExpWorkerThread+0xd8 | |
| ffff8a81`fcd6dd50 fffff800`0697c946 : ffff8a81`f5a75180 ffffb080`8b63c040 fffff800`068e7a80 ffffb080`88e59180 : nt!PspSystemThreadStartup+0x47 | |
| ffff8a81`fcd6dda0 00000000`00000000 : ffff8a81`fcd6e000 ffff8a81`fcd68000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 | |
| STACK_COMMAND: .trap 0xffff8a81fcd6ccd0 ; kb | |
| CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt | |
| fffff8000680c6bc-fffff8000680c6c0 5 bytes - nt!MiLockDownWorkingSet+54 | |
| [ d0 be 7d fb f6:a0 5f bf 7e fd ] | |
| fffff8000680c6da-fffff8000680c6db 2 bytes - nt!MiLockDownWorkingSet+72 (+0x1e) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c702 - nt!MiLockDownWorkingSet+9a (+0x28) | |
| [ fa:c4 ] | |
| fffff8000680c7f4-fffff8000680c7f5 2 bytes - nt!MiCreateForkWsles+28 (+0xf2) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c908-fffff8000680c909 2 bytes - nt!MiCreateForkWsle+60 (+0x114) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c94f - nt!MiCreateForkWsle+a7 (+0x47) | |
| [ fa:c4 ] | |
| fffff8000680cb83-fffff8000680cb84 2 bytes - nt!MiCloneVads+1ab (+0x234) | |
| [ 80 f6:00 fd ] | |
| fffff8000680cd6c-fffff8000680cd6d 2 bytes - nt!MiCloneVads+394 (+0x1e9) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d03e-fffff8000680d03f 2 bytes - nt!MiBuildForkPte+b6 (+0x2d2) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d053 - nt!MiBuildForkPte+cb (+0x15) | |
| [ fa:c4 ] | |
| fffff8000680d16b - nt!MiBuildForkPte+1e3 (+0x118) | |
| [ fa:c4 ] | |
| fffff8000680d5fb-fffff8000680d5fc 2 bytes - nt!MiUpdateForkMaps+83 (+0x490) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d6ed - nt!MiUpdateForkMaps+175 (+0xf2) | |
| [ fa:c4 ] | |
| fffff8000680d736 - nt!MiUpdateForkMaps+1be (+0x49) | |
| [ fa:c4 ] | |
| fffff8000680d844 - nt!MiBuildForkPageTable+34 (+0x10e) | |
| [ fa:c4 ] | |
| fffff8000680da05 - nt!MiDoneWithThisPageGetAnother+9d (+0x1c1) | |
| [ fa:c4 ] | |
| fffff8000680da60 - nt!MiFinishLastForkPageTable+30 (+0x5b) | |
| [ fa:c4 ] | |
| fffff8000680da6c-fffff8000680da6d 2 bytes - nt!MiFinishLastForkPageTable+3c (+0x0c) | |
| [ 80 f6:00 fd ] | |
| fffff8000680db1c-fffff8000680db1d 2 bytes - nt!MiFinishLastForkPageTable+ec (+0xb0) | |
| [ ff f6:7f fd ] | |
| fffff8000680ddd3-fffff8000680ddd4 2 bytes - nt!MiCloneReserveVadCommit+63 (+0x2b7) | |
| [ 80 f6:00 fd ] | |
| fffff8000680de88-fffff8000680de89 2 bytes - nt!MiCloneReserveVadCommit+118 (+0xb5) | |
| [ 80 f6:00 fd ] | |
| fffff8000680e087-fffff8000680e088 2 bytes - nt!MiCloneReserveVadCommit+317 (+0x1ff) | |
| [ 80 f6:00 fd ] | |
| fffff8000680e3e6 - nt!MiCaptureProtectionFromLockedProto+76 (+0x35f) | |
| [ fa:c4 ] | |
| fffff80006811fbd - nt!MiInvalidateCollidedIos+31 (+0x3bd7) | |
| [ fa:c4 ] | |
| fffff8000681200d - nt!MiInvalidateCollidedIos+81 (+0x50) | |
| [ fa:c4 ] | |
| fffff800068121c5 - nt!MiReleaseInPageRefs+29 (+0x1b8) | |
| [ fa:c4 ] | |
| fffff800068138e4-fffff800068138e5 2 bytes - nt!MiOutPageSingleKernelStack+34 (+0x171f) | |
| [ 80 f6:00 fd ] | |
| fffff80006813a03 - nt!MiOutPageSingleKernelStack+153 (+0x11f) | |
| [ fa:c4 ] | |
| fffff80006813aa3 - nt!MiOutPageSingleKernelStack+1f3 (+0xa0) | |
| [ fa:c4 ] | |
| fffff80006813f9c-fffff80006813f9d 2 bytes - nt!MiWalkVaRange+58 (+0x4f9) | |
| [ 80 f6:00 fd ] | |
| fffff800068141a3-fffff800068141a4 2 bytes - nt!MiWalkVaRange+25f (+0x207) | |
| [ 80 f6:00 fd ] | |
| fffff800068141d1-fffff800068141d2 2 bytes - nt!MiWalkVaRange+28d (+0x2e) | |
| [ 80 f6:00 fd ] | |
| fffff8000681422d-fffff8000681422e 2 bytes - nt!MiWalkVaRange+2e9 (+0x5c) | |
| [ 80 f6:00 fd ] | |
| fffff8000681426b-fffff8000681426c 2 bytes - nt!MiWalkVaRange+327 (+0x3e) | |
| [ 80 f6:00 fd ] | |
| fffff800068143b4-fffff800068143b5 2 bytes - nt!MiWalkVaRange+470 (+0x149) | |
| [ 80 f6:00 fd ] | |
| fffff800068144d8-fffff800068144d9 2 bytes - nt!MiActOnPte+b0 (+0x124) | |
| [ 80 f6:00 fd ] | |
| fffff80006814570 - nt!MiActOnPte+148 (+0x98) | |
| [ fa:c4 ] | |
| fffff8000681468e-fffff8000681468f 2 bytes - nt!MiActOnPte+266 (+0x11e) | |
| [ 80 f6:00 fd ] | |
| fffff8000681494f-fffff80006814950 2 bytes - nt!MiActOnPte+527 (+0x2c1) | |
| [ 80 f6:00 fd ] | |
| fffff80006814b4b - nt!MiRotatedToFrameBuffer+2f (+0x1fc) | |
| [ fa:c4 ] | |
| fffff80006814b8e-fffff80006814b8f 2 bytes - nt!MiRotatedToFrameBuffer+72 (+0x43) | |
| [ 80 f6:00 fd ] | |
| fffff80006814bd3-fffff80006814bd4 2 bytes - nt!MiUpdateWsleAge+17 (+0x45) | |
| [ 80 f6:00 fd ] | |
| fffff80006814d8f-fffff80006814d90 2 bytes - nt!MiGetWorkingSetInfoList+13f (+0x1bc) | |
| [ 80 f6:00 fd ] | |
| fffff80006814da2-fffff80006814da4 3 bytes - nt!MiGetWorkingSetInfoList+152 (+0x13) | |
| [ 40 fb f6:80 7e fd ] | |
| fffff80006814fa4 - nt!MiGetWorkingSetInfoList+354 (+0x202) | |
| [ fa:c4 ] | |
| fffff800068150f6-fffff800068150f7 2 bytes - nt!MiGetWorkingSetInfoList+4a6 (+0x152) | |
| [ 80 f6:00 fd ] | |
| fffff80006815157-fffff80006815158 2 bytes - nt!MiGetWorkingSetInfoList+507 (+0x61) | |
| [ 80 f6:00 fd ] | |
| fffff800068152f9-fffff800068152fb 3 bytes - nt!MiGetWorkingSetInfoList+6a9 (+0x1a2) | |
| [ 40 fb f6:80 7e fd ] | |
| fffff800068153f5 - nt!MiGetWorkingSetInfoList+7a5 (+0xfc) | |
| [ fa:c4 ] | |
| fffff800068154bf - nt!MiGetWorkingSetInfoList+86f (+0xca) | |
| [ fa:c4 ] | |
| WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output. | |
| fffff80006a8b383-fffff80006a8b385 3 bytes - nt!ExFreePoolWithTag+363 | |
| [ 40 fb f6:80 7e fd ] | |
| fffff80006a8b6b6-fffff80006a8b6b7 2 bytes - nt!ExFreePoolWithTag+696 (+0x333) | |
| [ 80 f6:00 fd ] | |
| fffff80006be9780-fffff80006be9782 3 bytes - nt!_guard_check_icall_fptr | |
| [ 50 48 94:b0 d8 97 ] | |
| fffff80006be9788-fffff80006be9789 2 bytes - nt!_guard_dispatch_icall_fptr (+0x08) | |
| [ f0 37:00 d9 ] | |
| fffff80006c0c5d1 - nt!MmDuplicateMemory+209 | |
| [ fa:c4 ] | |
| fffff80006c0c6bc - nt!MmDuplicateMemory+2f4 (+0xeb) | |
| [ fa:c4 ] | |
| fffff80006c0c8e5 - nt!MmDuplicateMemory+51d (+0x229) | |
| [ fa:c4 ] | |
| fffff80006c0c9a3 - nt!MmDuplicateMemory+5db (+0xbe) | |
| [ fa:c4 ] | |
| fffff80006c0cf00-fffff80006c0cf01 2 bytes - nt!MiMarkKernelPageTablePages+c (+0x55d) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0cf51-fffff80006c0cf52 2 bytes - nt!MiMarkKernelPageTablePages+5d (+0x51) | |
| [ 00 f7:80 fd ] | |
| fffff80006c0d3e1 - nt!MmMarkHiberPhase+71 (+0x490) | |
| [ fa:c4 ] | |
| fffff80006c0d3f8 - nt!MmMarkHiberPhase+88 (+0x17) | |
| [ fa:c4 ] | |
| fffff80006c0d78b - nt!MiMarkHiberNotCachedPages+2b (+0x393) | |
| [ fa:c4 ] | |
| fffff80006c0db97 - nt!MiMarkNonPagedHiberPhasePages+67 (+0x40c) | |
| [ fa:c4 ] | |
| fffff80006c0dc6d-fffff80006c0dc6e 2 bytes - nt!MiMarkKernelPageTablesHelper+3d (+0xd6) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0df61-fffff80006c0df62 2 bytes - nt!MiEnumerateKernelLeafPtes+d (+0x2f4) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0df6b-fffff80006c0df6c 2 bytes - nt!MiEnumerateKernelLeafPtes+17 (+0x0a) | |
| [ 00 f7:80 fd ] | |
| fffff80006c176a2-fffff80006c176a3 2 bytes - nt!MmInitializeProcessor+3a (+0x9737) | |
| [ 80 f6:00 fd ] | |
| fffff80006c1981c - nt!MmDuplicateMemory+d454 (+0x217a) | |
| [ fa:c4 ] | |
| fffff80006c198a9 - nt!MmDuplicateMemory+d4e1 (+0x8d) | |
| [ fa:c4 ] | |
| fffff80006c1993e - nt!MmDuplicateMemory+d576 (+0x95) | |
| [ fa:c4 ] | |
| fffff80006c19a58 - nt!MmDuplicateMemory+d690 (+0x11a) | |
| [ fa:c4 ] | |
| fffff80006c8c436 - nt!MmChangeImageProtection+166 | |
| [ fa:c4 ] | |
| fffff80006c949f3-fffff80006c949f4 2 bytes - nt!MiProcessCrcList+103 (+0x85bd) | |
| [ 80 f6:00 fd ] | |
| fffff80006c949fd-fffff80006c949fe 2 bytes - nt!MiProcessCrcList+10d (+0x0a) | |
| [ ff f6:7f fd ] | |
| fffff80006c94a08 - nt!MiProcessCrcList+118 (+0x0b) | |
| [ fa:c4 ] | |
| fffff80006c94acb-fffff80006c94acc 2 bytes - nt!MiProcessCrcList+1db (+0xc3) | |
| [ 80 f6:00 fd ] | |
| fffff80006c94ad5-fffff80006c94ad6 2 bytes - nt!MiProcessCrcList+1e5 (+0x0a) | |
| [ ff f6:7f fd ] | |
| fffff80006c94c74-fffff80006c94c75 2 bytes - nt!MiProcessCrcList+384 (+0x19f) | |
| [ 80 f6:00 fd ] | |
| fffff80006cb8da9 - nt!PfpPfnPrioRequest+99 (+0x24135) | |
| [ fa:c4 ] | |
| fffff80006cb8de8 - nt!PfpPfnPrioRequest+d8 (+0x3f) | |
| [ fa:c4 ] | |
| fffff80006cc0658 - nt!MiPfPrepareReadList+4a8 (+0x7870) | |
| [ fa:c4 ] | |
| fffff80006cc1607 - nt!MiPfPrepareSequentialReadList+2e7 (+0xfaf) | |
| [ fa:c4 ] | |
| fffff80006cc37ed - nt!MiRelocateImagePfn+6d (+0x21e6) | |
| [ fa:c4 ] | |
| fffff80006cc37f9-fffff80006cc37fa 2 bytes - nt!MiRelocateImagePfn+79 (+0x0c) | |
| [ 80 f6:00 fd ] | |
| fffff80006cc3814-fffff80006cc3815 2 bytes - nt!MiRelocateImagePfn+94 (+0x1b) | |
| [ ff f6:7f fd ] | |
| fffff80006cc384a-fffff80006cc384b 2 bytes - nt!MiRelocateImagePfn+ca (+0x36) | |
| [ 80 f6:00 fd ] | |
| fffff80006cdb366 - nt!MiAllocateDriverPage+9a (+0x17b1c) | |
| [ fa:c4 ] | |
| fffff80006cdb515 - nt!MmCreateProcessAddressSpace+17d (+0x1af) | |
| [ fa:c4 ] | |
| fffff80006cdb56b-fffff80006cdb56f 5 bytes - nt!MmCreateProcessAddressSpace+1d3 (+0x56) | |
| [ d0 be 7d fb f6:a0 5f bf 7e fd ] | |
| fffff80006cdb5b3-fffff80006cdb5b4 2 bytes - nt!MmCreateProcessAddressSpace+21b (+0x48) | |
| [ 80 f6:00 fd ] | |
| fffff80006ce150f-fffff80006ce1510 2 bytes - nt!MiPrefetchDriverPages+23 (+0x5f5c) | |
| [ 80 f6:00 fd ] | |
| fffff80006ce662e - nt!MiCreateImageFileMap+fa (+0x511f) | |
| [ fa:c4 ] | |
| fffff80006d314e5-fffff80006d314e6 2 bytes - nt!MiFreeInitializationCode+41 (+0x4aeb7) | |
| [ 80 f6:00 fd ] | |
| fffff80006d3163b - nt!MiFreeInitializationCode+197 (+0x156) | |
| [ fa:c4 ] | |
| fffff80006d369e4 - nt!MiValidateImagePfn+3c (+0x53a9) | |
| [ fa:c4 ] | |
| fffff80006d36a2f-fffff80006d36a30 2 bytes - nt!MiValidateImagePfn+87 (+0x4b) | |
| [ 80 f6:00 fd ] | |
| fffff80006d420f1-fffff80006d420f2 2 bytes - nt!MiSelectSystemImageAddress+25 (+0xb6c2) | |
| [ 80 f6:00 fd ] | |
| fffff80006d6a247 - nt!MiCombineAllPhysicalMemory+207 (+0x28156) | |
| [ fa:c4 ] | |
| fffff80006d6b721 - nt!MmFreeIndependentPages+51 (+0x14da) | |
| [ fa:c4 ] | |
| fffff80006d6f721-fffff80006d6f722 2 bytes - nt!MmAllocateIndependentPages+71 (+0x4000) | |
| [ 80 f6:00 fd ] | |
| fffff80006d6f7c3 - nt!MmAllocateIndependentPages+113 (+0xa2) | |
| [ fa:c4 ] | |
| fffff80006d6f984-fffff80006d6f985 2 bytes - nt!MmAllocateMappingAddress+94 (+0x1c1) | |
| [ 80 f6:00 fd ] | |
| fffff80006d7c9b4-fffff80006d7c9b5 2 bytes - nt!MmAllocateDumpHibernateResources+38 (+0xd030) | |
| [ 80 f6:00 fd ] | |
| fffff80006d844b1-fffff80006d844b2 2 bytes - nt!MiInitializeDynamicBitmap+195 (+0x7afd) | |
| [ 80 f6:00 fd ] | |
| fffff80006d844f4 - nt!MiInitializeDynamicBitmap+1d8 (+0x43) | |
| [ fa:c4 ] | |
| fffff80006d84882-fffff80006d84883 2 bytes - nt!MiSessionCreateInternal+ee (+0x38e) | |
| [ 80 f6:00 fd ] | |
| fffff80006d84ae0 - nt!MiMapNewSession+b0 (+0x25e) | |
| [ fa:c4 ] | |
| fffff80006d84b6b - nt!MiMapNewSession+13b (+0x8b) | |
| [ fa:c4 ] | |
| fffff80006d84bbd - nt!MiMapNewSession+18d (+0x52) | |
| [ fa:c4 ] | |
| fffff80006d88b8b-fffff80006d88b8c 2 bytes - nt!MiReleaseDriverPtes+11b (+0x3fce) | |
| [ 80 f6:00 fd ] | |
| fffff80006db214e-fffff80006db214f 2 bytes - nt!MiCreateLargePfnBitMaps+8e (+0x295c3) | |
| [ 80 f6:00 fd ] | |
| fffff80006db6a23-fffff80006db6a24 2 bytes - nt!MiMarkBootGuardPage+3b (+0x48d5) | |
| [ 80 f6:00 fd ] | |
| fffff80006db6a4e - nt!MiMarkBootGuardPage+66 (+0x2b) | |
| [ fa:c4 ] | |
| fffff80006db93d5-fffff80006db93d6 2 bytes - nt!MmReserveViewInSystemCache+29 (+0x2987) | |
| [ 80 f6:00 fd ] | |
| fffff80006e00621 - nt!MiUnloadSystemImage+176d75 (+0x4724c) | |
| [ fa:c4 ] | |
| fffff80006e0147d - nt!MmChangeImageProtection+1751ad (+0xe5c) | |
| [ fa:c4 ] | |
| fffff80006e014b8 - nt!MmChangeImageProtection+1751e8 (+0x3b) | |
| [ fa:c4 ] | |
| fffff80006e18b20 - nt!MiCreatePagingFileMap+1340f0 (+0x17668) | |
| [ fa:c4 ] | |
| fffff80006e19cfd - nt!MiRelocateImage+1325cd (+0x11dd) | |
| [ fa:c4 ] | |
| fffff80006e37fb5-fffff80006e37fb6 2 bytes - nt!MiGetSystemAddressForImage+f6111 (+0x1e2b8) | |
| [ 80 f6:00 fd ] | |
| fffff80006e38442-fffff80006e38443 2 bytes - nt!MiGetSystemAddressForImage+f659e (+0x48d) | |
| [ 80 f6:00 fd ] | |
| WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output. | |
| 3144 errors : !nt (fffff8000680c6bc-fffff80006ec88ea) | |
| MODULE_NAME: memory_corruption | |
| IMAGE_NAME: memory_corruption | |
| FOLLOWUP_NAME: memory_corruption | |
| DEBUG_FLR_IMAGE_TIMESTAMP: 0 | |
| MEMORY_CORRUPTOR: LARGE | |
| FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE | |
| BUCKET_ID: MEMORY_CORRUPTION_LARGE | |
| ANALYSIS_SOURCE: KM | |
| FAILURE_ID_HASH_STRING: km:memory_corruption_large | |
| FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c} | |
| Followup: memory_corruption | |
| --------- | |
| 4: kd> !analyze -v | |
| ******************************************************************************* | |
| * * | |
| * Bugcheck Analysis * | |
| * * | |
| ******************************************************************************* | |
| UNEXPECTED_STORE_EXCEPTION (154) | |
| The store component caught an unexpected exception. | |
| Arguments: | |
| Arg1: ffffb0808e66f000, Pointer to the store context or data manager | |
| Arg2: ffff8a81fcd6b230, Exception information | |
| Arg3: 0000000000000002, Reserved | |
| Arg4: 0000000000000000, Reserved | |
| Debugging Details: | |
| ------------------ | |
| DEFAULT_BUCKET_ID: CODE_CORRUPTION | |
| BUGCHECK_STR: 0x154 | |
| PROCESS_NAME: MemCompression | |
| CURRENT_IRQL: 1 | |
| ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre | |
| EXCEPTION_RECORD: 0000000000000001 -- (.exr 0x1) | |
| Cannot read Exception record @ 0000000000000001 | |
| TRAP_FRAME: ffff8a81fcd6ccd0 -- (.trap 0xffff8a81fcd6ccd0) | |
| NOTE: The trap frame does not contain all registers. | |
| Some register values may be zeroed or incorrect. | |
| rax=ffffd18631ef3820 rbx=0000000000000000 rcx=ffffd18631ef3810 | |
| rdx=ffffd18631ef2010 rsi=0000000000000000 rdi=0000000000000000 | |
| rip=fffff80006a8a249 rsp=ffff8a81fcd6ce60 rbp=0000000000000000 | |
| r8=ffffd18631ef3000 r9=ffffd18631f1d820 r10=0000000000000001 | |
| r11=ffffd18631ef5820 r12=0000000000000000 r13=0000000000000000 | |
| r14=0000000000000000 r15=0000000000000000 | |
| iopl=0 nv up ei pl zr na po nc | |
| nt!ExDeferredFreePool+0x229: | |
| fffff800`06a8a249 493901 cmp qword ptr [r9],rax ds:ffffd186`31f1d820=0000000000000000 | |
| Resetting default scope | |
| LAST_CONTROL_TRANSFER: from fffff80006a52082 to fffff800069774c0 | |
| STACK_TEXT: | |
| ffff8a81`fcd6ce60 fffff800`06a8b801 : ffffd186`31ef7010 ffffb080`88e3e000 ffff8a81`fcd6cf79 ffffd186`31ef9000 : nt!ExDeferredFreePool+0x229 | |
| ffff8a81`fcd6cee0 fffff800`068a3e1f : ffffffff`ffffffff b0809256`3d7004c0 ffffd186`00000000 fffff808`00000001 : nt!ExFreePoolWithTag+0x7e1 | |
| ffff8a81`fcd6cfe0 fffff800`068ca241 : ffffb080`92563d70 ffff8a81`fcd6d120 00000000`00000000 fffff800`068ca364 : nt!MiDeleteSubsectionPages+0x57f | |
| ffff8a81`fcd6d0d0 fffff800`06ce4908 : 00000000`00000000 00000000`00088089 ffffb080`92563d70 ffffb080`92563cf0 : nt!MiDeleteSegmentPages+0x5d | |
| ffff8a81`fcd6d120 fffff800`06889b16 : 00000000`00000002 00000000`00000000 ffffb080`92563cf0 fffff800`0686d948 : nt!MiSegmentDelete+0x78 | |
| ffff8a81`fcd6d170 fffff800`06cb906e : ffffd186`2cd23910 00000000`00000000 00000000`00000000 00000000`00000001 : nt!MiCheckControlArea+0x1f6 | |
| ffff8a81`fcd6d1d0 fffff800`0686eb86 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffd186`2cd23940 : nt!ObpRemoveObjectRoutine+0x7e | |
| ffff8a81`fcd6d230 fffff800`068b4820 : 00000000`746c6644 ffffb080`91253160 00000000`00000000 ffffb080`9256b540 : nt!ObfDereferenceObjectWithTag+0xc6 | |
| ffff8a81`fcd6d270 fffff800`068b3834 : ffffb080`9256b540 ffffb080`91253160 00000000`00000000 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x13c | |
| ffff8a81`fcd6d2c0 fffff808`16caec26 : 00000000`00000000 ffffd186`31eeea00 ffffb080`91253160 00000000`00100000 : nt!CcUninitializeCacheMap+0x204 | |
| ffff8a81`fcd6d350 fffff808`16cc1e18 : ffffd186`31eeea00 ffffd186`31eeea00 00000000`00000000 ffffb080`8d5777a0 : NTFS!NtfsDeleteInternalAttributeStream+0xde | |
| ffff8a81`fcd6d390 fffff808`16c082b5 : 00000000`00000000 ffffb080`8d5777a0 ffffb080`92563ec8 fffff800`0686c9f7 : NTFS!NtfsRemoveScb+0x118 | |
| ffff8a81`fcd6d3e0 fffff808`16cc1aef : ffffd186`31eeea00 00000000`00000008 ffff8a81`fcd6d4e4 ffffb080`8b738100 : NTFS!NtfsPrepareFcbForRemoval+0x75 | |
| ffff8a81`fcd6d420 fffff808`16cc036e : ffffb080`911cc018 ffffd186`31eeea00 00000000`00000000 00000000`0000005a : NTFS!NtfsTeardownStructures+0x8f | |
| ffff8a81`fcd6d4a0 fffff808`16dc8c4c : 00000000`00000008 ffff8a81`fcd6e000 ffffb080`8b738180 ffffb080`8b738180 : NTFS!NtfsFlushVolume+0x78e | |
| ffff8a81`fcd6d620 fffff808`16d38cb1 : 00000000`00000001 ffffb080`8b738180 00000000`00000001 00000000`00000001 : NTFS!NtfsPerformSurpriseRemoval+0x40 | |
| ffff8a81`fcd6d660 fffff808`16d38537 : ffffb080`911cc018 00000000`00000001 ffff8a81`fcd6d7d0 ffffb080`8b738000 : NTFS!NtfsCommonPnp+0x70d | |
| ffff8a81`fcd6d720 fffff808`1638563d : ffffb080`8f99c2a0 00000000`00000000 00000000`00000001 ffffb080`911cc018 : NTFS!NtfsFsdPnp+0x187 | |
| ffff8a81`fcd6d7c0 fffff808`163834d6 : ffff8a81`fcd6d850 00000000`00000001 00000000`0000000c 00650033`00630035 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x18d | |
| ffff8a81`fcd6d830 fffff800`06c7cfc9 : ffffb080`9191e060 00000000`00000000 ffff8a81`fcd6d940 00000000`00000000 : FLTMGR!FltpDispatch+0xb6 | |
| ffff8a81`fcd6d890 fffff800`06d72063 : 00000000`00000017 ffff8a81`fcd6d959 ffffb080`8f2f0130 ffffb080`9297c1d0 : nt!IopSynchronousCall+0xe5 | |
| ffff8a81`fcd6d900 fffff800`06d6d662 : ffffd186`39d6d620 00000000`00000000 00000000`00000000 fffff800`068de84e : nt!IopRemoveDevice+0xdf | |
| ffff8a81`fcd6d9c0 fffff800`06d71a4b : ffffb080`8f2f0130 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PnpSurpriseRemoveLockedDeviceNode+0xba | |
| ffff8a81`fcd6da20 fffff800`06d7172a : 00000000`00000000 ffff8a81`fcd6daa0 ffffd186`28408d00 ffffd186`2aa929d0 : nt!PnpDeleteLockedDeviceNode+0xaf | |
| ffff8a81`fcd6da60 fffff800`06d708f4 : ffffb080`8a280c80 00000005`00000002 00000000`00000000 ffffd186`28408d00 : nt!PnpDeleteLockedDeviceNodes+0xbe | |
| ffff8a81`fcd6dad0 fffff800`06c798b6 : ffff8a81`fcd6dc60 ffffd186`2aa92900 ffff8a81`fcd6dc00 00000000`00000001 : nt!PnpProcessQueryRemoveAndEject+0x490 | |
| ffff8a81`fcd6dc00 fffff800`06c83e94 : ffffd186`39d6d620 00000000`00000000 ffffb080`8c030600 ffffd186`2aa929d0 : nt!PnpProcessTargetDeviceEvent+0xf2 | |
| ffff8a81`fcd6dc30 fffff800`06848ca8 : 00000000`00000300 ffffb080`8b63c040 ffffb080`8c0306c0 fffff800`06c03380 : nt!PnpDeviceEventWorker+0x254 | |
| ffff8a81`fcd6dcc0 fffff800`068e7ac7 : 00000080`2a818b00 00000000`00000080 ffffb080`88e1e680 ffffb080`8b63c040 : nt!ExpWorkerThread+0xd8 | |
| ffff8a81`fcd6dd50 fffff800`0697c946 : ffff8a81`f5a75180 ffffb080`8b63c040 fffff800`068e7a80 ffffb080`88e59180 : nt!PspSystemThreadStartup+0x47 | |
| ffff8a81`fcd6dda0 00000000`00000000 : ffff8a81`fcd6e000 ffff8a81`fcd68000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 | |
| STACK_COMMAND: .trap 0xffff8a81fcd6ccd0 ; kb | |
| CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt | |
| fffff8000680c6bc-fffff8000680c6c0 5 bytes - nt!MiLockDownWorkingSet+54 | |
| [ d0 be 7d fb f6:a0 5f bf 7e fd ] | |
| fffff8000680c6da-fffff8000680c6db 2 bytes - nt!MiLockDownWorkingSet+72 (+0x1e) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c702 - nt!MiLockDownWorkingSet+9a (+0x28) | |
| [ fa:c4 ] | |
| fffff8000680c7f4-fffff8000680c7f5 2 bytes - nt!MiCreateForkWsles+28 (+0xf2) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c908-fffff8000680c909 2 bytes - nt!MiCreateForkWsle+60 (+0x114) | |
| [ 80 f6:00 fd ] | |
| fffff8000680c94f - nt!MiCreateForkWsle+a7 (+0x47) | |
| [ fa:c4 ] | |
| fffff8000680cb83-fffff8000680cb84 2 bytes - nt!MiCloneVads+1ab (+0x234) | |
| [ 80 f6:00 fd ] | |
| fffff8000680cd6c-fffff8000680cd6d 2 bytes - nt!MiCloneVads+394 (+0x1e9) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d03e-fffff8000680d03f 2 bytes - nt!MiBuildForkPte+b6 (+0x2d2) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d053 - nt!MiBuildForkPte+cb (+0x15) | |
| [ fa:c4 ] | |
| fffff8000680d16b - nt!MiBuildForkPte+1e3 (+0x118) | |
| [ fa:c4 ] | |
| fffff8000680d5fb-fffff8000680d5fc 2 bytes - nt!MiUpdateForkMaps+83 (+0x490) | |
| [ 80 f6:00 fd ] | |
| fffff8000680d6ed - nt!MiUpdateForkMaps+175 (+0xf2) | |
| [ fa:c4 ] | |
| fffff8000680d736 - nt!MiUpdateForkMaps+1be (+0x49) | |
| [ fa:c4 ] | |
| fffff8000680d844 - nt!MiBuildForkPageTable+34 (+0x10e) | |
| [ fa:c4 ] | |
| fffff8000680da05 - nt!MiDoneWithThisPageGetAnother+9d (+0x1c1) | |
| [ fa:c4 ] | |
| fffff8000680da60 - nt!MiFinishLastForkPageTable+30 (+0x5b) | |
| [ fa:c4 ] | |
| fffff8000680da6c-fffff8000680da6d 2 bytes - nt!MiFinishLastForkPageTable+3c (+0x0c) | |
| [ 80 f6:00 fd ] | |
| fffff8000680db1c-fffff8000680db1d 2 bytes - nt!MiFinishLastForkPageTable+ec (+0xb0) | |
| [ ff f6:7f fd ] | |
| fffff8000680ddd3-fffff8000680ddd4 2 bytes - nt!MiCloneReserveVadCommit+63 (+0x2b7) | |
| [ 80 f6:00 fd ] | |
| fffff8000680de88-fffff8000680de89 2 bytes - nt!MiCloneReserveVadCommit+118 (+0xb5) | |
| [ 80 f6:00 fd ] | |
| fffff8000680e087-fffff8000680e088 2 bytes - nt!MiCloneReserveVadCommit+317 (+0x1ff) | |
| [ 80 f6:00 fd ] | |
| fffff8000680e3e6 - nt!MiCaptureProtectionFromLockedProto+76 (+0x35f) | |
| [ fa:c4 ] | |
| fffff80006811fbd - nt!MiInvalidateCollidedIos+31 (+0x3bd7) | |
| [ fa:c4 ] | |
| fffff8000681200d - nt!MiInvalidateCollidedIos+81 (+0x50) | |
| [ fa:c4 ] | |
| fffff800068121c5 - nt!MiReleaseInPageRefs+29 (+0x1b8) | |
| [ fa:c4 ] | |
| fffff800068138e4-fffff800068138e5 2 bytes - nt!MiOutPageSingleKernelStack+34 (+0x171f) | |
| [ 80 f6:00 fd ] | |
| fffff80006813a03 - nt!MiOutPageSingleKernelStack+153 (+0x11f) | |
| [ fa:c4 ] | |
| fffff80006813aa3 - nt!MiOutPageSingleKernelStack+1f3 (+0xa0) | |
| [ fa:c4 ] | |
| fffff80006813f9c-fffff80006813f9d 2 bytes - nt!MiWalkVaRange+58 (+0x4f9) | |
| [ 80 f6:00 fd ] | |
| fffff800068141a3-fffff800068141a4 2 bytes - nt!MiWalkVaRange+25f (+0x207) | |
| [ 80 f6:00 fd ] | |
| fffff800068141d1-fffff800068141d2 2 bytes - nt!MiWalkVaRange+28d (+0x2e) | |
| [ 80 f6:00 fd ] | |
| fffff8000681422d-fffff8000681422e 2 bytes - nt!MiWalkVaRange+2e9 (+0x5c) | |
| [ 80 f6:00 fd ] | |
| fffff8000681426b-fffff8000681426c 2 bytes - nt!MiWalkVaRange+327 (+0x3e) | |
| [ 80 f6:00 fd ] | |
| fffff800068143b4-fffff800068143b5 2 bytes - nt!MiWalkVaRange+470 (+0x149) | |
| [ 80 f6:00 fd ] | |
| fffff800068144d8-fffff800068144d9 2 bytes - nt!MiActOnPte+b0 (+0x124) | |
| [ 80 f6:00 fd ] | |
| fffff80006814570 - nt!MiActOnPte+148 (+0x98) | |
| [ fa:c4 ] | |
| fffff8000681468e-fffff8000681468f 2 bytes - nt!MiActOnPte+266 (+0x11e) | |
| [ 80 f6:00 fd ] | |
| fffff8000681494f-fffff80006814950 2 bytes - nt!MiActOnPte+527 (+0x2c1) | |
| [ 80 f6:00 fd ] | |
| fffff80006814b4b - nt!MiRotatedToFrameBuffer+2f (+0x1fc) | |
| [ fa:c4 ] | |
| fffff80006814b8e-fffff80006814b8f 2 bytes - nt!MiRotatedToFrameBuffer+72 (+0x43) | |
| [ 80 f6:00 fd ] | |
| fffff80006814bd3-fffff80006814bd4 2 bytes - nt!MiUpdateWsleAge+17 (+0x45) | |
| [ 80 f6:00 fd ] | |
| fffff80006814d8f-fffff80006814d90 2 bytes - nt!MiGetWorkingSetInfoList+13f (+0x1bc) | |
| [ 80 f6:00 fd ] | |
| fffff80006814da2-fffff80006814da4 3 bytes - nt!MiGetWorkingSetInfoList+152 (+0x13) | |
| [ 40 fb f6:80 7e fd ] | |
| fffff80006814fa4 - nt!MiGetWorkingSetInfoList+354 (+0x202) | |
| [ fa:c4 ] | |
| fffff800068150f6-fffff800068150f7 2 bytes - nt!MiGetWorkingSetInfoList+4a6 (+0x152) | |
| [ 80 f6:00 fd ] | |
| fffff80006815157-fffff80006815158 2 bytes - nt!MiGetWorkingSetInfoList+507 (+0x61) | |
| [ 80 f6:00 fd ] | |
| fffff800068152f9-fffff800068152fb 3 bytes - nt!MiGetWorkingSetInfoList+6a9 (+0x1a2) | |
| [ 40 fb f6:80 7e fd ] | |
| fffff800068153f5 - nt!MiGetWorkingSetInfoList+7a5 (+0xfc) | |
| [ fa:c4 ] | |
| fffff800068154bf - nt!MiGetWorkingSetInfoList+86f (+0xca) | |
| [ fa:c4 ] | |
| WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output. | |
| fffff80006a8b383-fffff80006a8b385 3 bytes - nt!ExFreePoolWithTag+363 | |
| [ 40 fb f6:80 7e fd ] | |
| fffff80006a8b6b6-fffff80006a8b6b7 2 bytes - nt!ExFreePoolWithTag+696 (+0x333) | |
| [ 80 f6:00 fd ] | |
| fffff80006be9780-fffff80006be9782 3 bytes - nt!_guard_check_icall_fptr | |
| [ 50 48 94:b0 d8 97 ] | |
| fffff80006be9788-fffff80006be9789 2 bytes - nt!_guard_dispatch_icall_fptr (+0x08) | |
| [ f0 37:00 d9 ] | |
| fffff80006c0c5d1 - nt!MmDuplicateMemory+209 | |
| [ fa:c4 ] | |
| fffff80006c0c6bc - nt!MmDuplicateMemory+2f4 (+0xeb) | |
| [ fa:c4 ] | |
| fffff80006c0c8e5 - nt!MmDuplicateMemory+51d (+0x229) | |
| [ fa:c4 ] | |
| fffff80006c0c9a3 - nt!MmDuplicateMemory+5db (+0xbe) | |
| [ fa:c4 ] | |
| fffff80006c0cf00-fffff80006c0cf01 2 bytes - nt!MiMarkKernelPageTablePages+c (+0x55d) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0cf51-fffff80006c0cf52 2 bytes - nt!MiMarkKernelPageTablePages+5d (+0x51) | |
| [ 00 f7:80 fd ] | |
| fffff80006c0d3e1 - nt!MmMarkHiberPhase+71 (+0x490) | |
| [ fa:c4 ] | |
| fffff80006c0d3f8 - nt!MmMarkHiberPhase+88 (+0x17) | |
| [ fa:c4 ] | |
| fffff80006c0d78b - nt!MiMarkHiberNotCachedPages+2b (+0x393) | |
| [ fa:c4 ] | |
| fffff80006c0db97 - nt!MiMarkNonPagedHiberPhasePages+67 (+0x40c) | |
| [ fa:c4 ] | |
| fffff80006c0dc6d-fffff80006c0dc6e 2 bytes - nt!MiMarkKernelPageTablesHelper+3d (+0xd6) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0df61-fffff80006c0df62 2 bytes - nt!MiEnumerateKernelLeafPtes+d (+0x2f4) | |
| [ 80 f6:00 fd ] | |
| fffff80006c0df6b-fffff80006c0df6c 2 bytes - nt!MiEnumerateKernelLeafPtes+17 (+0x0a) | |
| [ 00 f7:80 fd ] | |
| fffff80006c176a2-fffff80006c176a3 2 bytes - nt!MmInitializeProcessor+3a (+0x9737) | |
| [ 80 f6:00 fd ] | |
| fffff80006c1981c - nt!MmDuplicateMemory+d454 (+0x217a) | |
| [ fa:c4 ] | |
| fffff80006c198a9 - nt!MmDuplicateMemory+d4e1 (+0x8d) | |
| [ fa:c4 ] | |
| fffff80006c1993e - nt!MmDuplicateMemory+d576 (+0x95) | |
| [ fa:c4 ] | |
| fffff80006c19a58 - nt!MmDuplicateMemory+d690 (+0x11a) | |
| [ fa:c4 ] | |
| fffff80006c8c436 - nt!MmChangeImageProtection+166 | |
| [ fa:c4 ] | |
| fffff80006c949f3-fffff80006c949f4 2 bytes - nt!MiProcessCrcList+103 (+0x85bd) | |
| [ 80 f6:00 fd ] | |
| fffff80006c949fd-fffff80006c949fe 2 bytes - nt!MiProcessCrcList+10d (+0x0a) | |
| [ ff f6:7f fd ] | |
| fffff80006c94a08 - nt!MiProcessCrcList+118 (+0x0b) | |
| [ fa:c4 ] | |
| fffff80006c94acb-fffff80006c94acc 2 bytes - nt!MiProcessCrcList+1db (+0xc3) | |
| [ 80 f6:00 fd ] | |
| fffff80006c94ad5-fffff80006c94ad6 2 bytes - nt!MiProcessCrcList+1e5 (+0x0a) | |
| [ ff f6:7f fd ] | |
| fffff80006c94c74-fffff80006c94c75 2 bytes - nt!MiProcessCrcList+384 (+0x19f) | |
| [ 80 f6:00 fd ] | |
| fffff80006cb8da9 - nt!PfpPfnPrioRequest+99 (+0x24135) | |
| [ fa:c4 ] | |
| fffff80006cb8de8 - nt!PfpPfnPrioRequest+d8 (+0x3f) | |
| [ fa:c4 ] | |
| fffff80006cc0658 - nt!MiPfPrepareReadList+4a8 (+0x7870) | |
| [ fa:c4 ] | |
| fffff80006cc1607 - nt!MiPfPrepareSequentialReadList+2e7 (+0xfaf) | |
| [ fa:c4 ] | |
| fffff80006cc37ed - nt!MiRelocateImagePfn+6d (+0x21e6) | |
| [ fa:c4 ] | |
| fffff80006cc37f9-fffff80006cc37fa 2 bytes - nt!MiRelocateImagePfn+79 (+0x0c) | |
| [ 80 f6:00 fd ] | |
| fffff80006cc3814-fffff80006cc3815 2 bytes - nt!MiRelocateImagePfn+94 (+0x1b) | |
| [ ff f6:7f fd ] | |
| fffff80006cc384a-fffff80006cc384b 2 bytes - nt!MiRelocateImagePfn+ca (+0x36) | |
| [ 80 f6:00 fd ] | |
| fffff80006cdb366 - nt!MiAllocateDriverPage+9a (+0x17b1c) | |
| [ fa:c4 ] | |
| fffff80006cdb515 - nt!MmCreateProcessAddressSpace+17d (+0x1af) | |
| [ fa:c4 ] | |
| fffff80006cdb56b-fffff80006cdb56f 5 bytes - nt!MmCreateProcessAddressSpace+1d3 (+0x56) | |
| [ d0 be 7d fb f6:a0 5f bf 7e fd ] | |
| fffff80006cdb5b3-fffff80006cdb5b4 2 bytes - nt!MmCreateProcessAddressSpace+21b (+0x48) | |
| [ 80 f6:00 fd ] | |
| fffff80006ce150f-fffff80006ce1510 2 bytes - nt!MiPrefetchDriverPages+23 (+0x5f5c) | |
| [ 80 f6:00 fd ] | |
| fffff80006ce662e - nt!MiCreateImageFileMap+fa (+0x511f) | |
| [ fa:c4 ] | |
| fffff80006d314e5-fffff80006d314e6 2 bytes - nt!MiFreeInitializationCode+41 (+0x4aeb7) | |
| [ 80 f6:00 fd ] | |
| fffff80006d3163b - nt!MiFreeInitializationCode+197 (+0x156) | |
| [ fa:c4 ] | |
| fffff80006d369e4 - nt!MiValidateImagePfn+3c (+0x53a9) | |
| [ fa:c4 ] | |
| fffff80006d36a2f-fffff80006d36a30 2 bytes - nt!MiValidateImagePfn+87 (+0x4b) | |
| [ 80 f6:00 fd ] | |
| fffff80006d420f1-fffff80006d420f2 2 bytes - nt!MiSelectSystemImageAddress+25 (+0xb6c2) | |
| [ 80 f6:00 fd ] | |
| fffff80006d6a247 - nt!MiCombineAllPhysicalMemory+207 (+0x28156) | |
| [ fa:c4 ] | |
| fffff80006d6b721 - nt!MmFreeIndependentPages+51 (+0x14da) | |
| [ fa:c4 ] | |
| fffff80006d6f721-fffff80006d6f722 2 bytes - nt!MmAllocateIndependentPages+71 (+0x4000) | |
| [ 80 f6:00 fd ] | |
| fffff80006d6f7c3 - nt!MmAllocateIndependentPages+113 (+0xa2) | |
| [ fa:c4 ] | |
| fffff80006d6f984-fffff80006d6f985 2 bytes - nt!MmAllocateMappingAddress+94 (+0x1c1) | |
| [ 80 f6:00 fd ] | |
| fffff80006d7c9b4-fffff80006d7c9b5 2 bytes - nt!MmAllocateDumpHibernateResources+38 (+0xd030) | |
| [ 80 f6:00 fd ] | |
| fffff80006d844b1-fffff80006d844b2 2 bytes - nt!MiInitializeDynamicBitmap+195 (+0x7afd) | |
| [ 80 f6:00 fd ] | |
| fffff80006d844f4 - nt!MiInitializeDynamicBitmap+1d8 (+0x43) | |
| [ fa:c4 ] | |
| fffff80006d84882-fffff80006d84883 2 bytes - nt!MiSessionCreateInternal+ee (+0x38e) | |
| [ 80 f6:00 fd ] | |
| fffff80006d84ae0 - nt!MiMapNewSession+b0 (+0x25e) | |
| [ fa:c4 ] | |
| fffff80006d84b6b - nt!MiMapNewSession+13b (+0x8b) | |
| [ fa:c4 ] | |
| fffff80006d84bbd - nt!MiMapNewSession+18d (+0x52) | |
| [ fa:c4 ] | |
| fffff80006d88b8b-fffff80006d88b8c 2 bytes - nt!MiReleaseDriverPtes+11b (+0x3fce) | |
| [ 80 f6:00 fd ] | |
| fffff80006db214e-fffff80006db214f 2 bytes - nt!MiCreateLargePfnBitMaps+8e (+0x295c3) | |
| [ 80 f6:00 fd ] | |
| fffff80006db6a23-fffff80006db6a24 2 bytes - nt!MiMarkBootGuardPage+3b (+0x48d5) | |
| [ 80 f6:00 fd ] | |
| fffff80006db6a4e - nt!MiMarkBootGuardPage+66 (+0x2b) | |
| [ fa:c4 ] | |
| fffff80006db93d5-fffff80006db93d6 2 bytes - nt!MmReserveViewInSystemCache+29 (+0x2987) | |
| [ 80 f6:00 fd ] | |
| fffff80006e00621 - nt!MiUnloadSystemImage+176d75 (+0x4724c) | |
| [ fa:c4 ] | |
| fffff80006e0147d - nt!MmChangeImageProtection+1751ad (+0xe5c) | |
| [ fa:c4 ] | |
| fffff80006e014b8 - nt!MmChangeImageProtection+1751e8 (+0x3b) | |
| [ fa:c4 ] | |
| fffff80006e18b20 - nt!MiCreatePagingFileMap+1340f0 (+0x17668) | |
| [ fa:c4 ] | |
| fffff80006e19cfd - nt!MiRelocateImage+1325cd (+0x11dd) | |
| [ fa:c4 ] | |
| fffff80006e37fb5-fffff80006e37fb6 2 bytes - nt!MiGetSystemAddressForImage+f6111 (+0x1e2b8) | |
| [ 80 f6:00 fd ] | |
| fffff80006e38442-fffff80006e38443 2 bytes - nt!MiGetSystemAddressForImage+f659e (+0x48d) | |
| [ 80 f6:00 fd ] | |
| WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output. | |
| 3144 errors : !nt (fffff8000680c6bc-fffff80006ec88ea) | |
| MODULE_NAME: memory_corruption | |
| IMAGE_NAME: memory_corruption | |
| FOLLOWUP_NAME: memory_corruption | |
| DEBUG_FLR_IMAGE_TIMESTAMP: 0 | |
| MEMORY_CORRUPTOR: LARGE | |
| FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE | |
| BUCKET_ID: MEMORY_CORRUPTION_LARGE | |
| ANALYSIS_SOURCE: KM | |
| FAILURE_ID_HASH_STRING: km:memory_corruption_large | |
| FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c} | |
| Followup: memory_corruption | |
| --------- | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment