Skip to content

Instantly share code, notes, and snippets.

@vozersky
Created December 6, 2017 17:51
Show Gist options
  • Save vozersky/539de44da9d8f9638836e96e5b61c3d3 to your computer and use it in GitHub Desktop.
Save vozersky/539de44da9d8f9638836e96e5b61c3d3 to your computer and use it in GitHub Desktop.
Windows 8 Kernel Version 16299 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff802`9ec0a000 PsLoadedModuleList = 0xfffff802`9ef6c010
Debug session time: Tue Dec 5 15:12:03.608 2017 (UTC - 5:00)
System Uptime: 0 days 11:53:51.331
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80950473fb7, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000000000000002c, Parameter 1 of the exception
Debugging Details:
------------------
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
CLASSPNP!ServiceTransferRequest+b7
fffff809`50473fb7 458b722c mov r14d,dword ptr [r10+2Ch]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 000000000000002c
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
000000000000002c
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
BUGCHECK_STR: 0x1e_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: avp.exe
CURRENT_IRQL: 0
TRAP_FRAME: ffff9e8c68c05348 -- (.trap 0xffff9e8c68c05348)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=000000000000002c rsp=fffff80950474193 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl nz na pe nc
e000:00000000`0000002c ?? ???
Resetting default scope
UNALIGNED_STACK_POINTER: fffff80950474193
LAST_CONTROL_TRANSFER: from fffff8029ed880d1 to fffff8029ed6e0e0
CONTEXT: 00000000a0be8348 -- (.cxr 0xa0be8348)
Unable to read context, Win32 error 0n30
STACK_TEXT:
ffff9e8c`68c04b48 fffff802`9ed880d1 : 00000000`0000001e ffffffff`c0000005 fffff809`50473fb7 00000000`00000000 : nt!KeBugCheckEx
ffff9e8c`68c04b50 fffff802`9ed79ace : 00000000`00000000 00000000`0000002c ffff9e8c`68c05348 00000000`00000000 : nt!KiDispatchException+0x162931
ffff9e8c`68c05200 fffff802`9ed77d57 : ffffc70d`e29773c0 fffff802`9ed236be ffffc70d`e2977260 ffffc70d`e2977260 : nt!KiExceptionDispatch+0xce
ffff9e8c`68c053e0 fffff809`50473fb7 : ffffc70d`e9183620 fffff809`50473acb 00000000`00000000 ffffc70d`dd1d01b0 : nt!KiPageFault+0x217
ffff9e8c`68c05570 fffff809`50473a74 : ffffc70d`dd1d0060 ffff9e8c`68c05600 00000000`00000000 00000000`00000103 : CLASSPNP!ServiceTransferRequest+0xb7
ffff9e8c`68c05620 fffff809`504738f4 : ffffc70d`e908a448 fffff780`00000008 00000063`b97686b0 fffff802`9ecefa3e : CLASSPNP!ClassReadWrite+0x174
ffff9e8c`68c05750 fffff802`9ec428d9 : 00000000`0032aa16 ffffc70d`dd101cb0 ffffc70d`dd10f9f0 ffffc70d`e79bb930 : CLASSPNP!ClassGlobalDispatch+0x24
ffff9e8c`68c05780 fffff809`4dfe33ae : 00000000`00000000 ffffc70d`dd115850 ffffc70d`dd1159a0 00000000`00000001 : nt!IofCallDriver+0x59
ffff9e8c`68c057c0 fffff802`9ec428d9 : 00000001`00000001 00000021`1caf9e8f 00000000`00000002 ffffc70d`dd111820 : partmgr!PmGlobalDispatch+0xfe
ffff9e8c`68c05840 fffff809`4dfe3a88 : ffffc70d`dd101b60 ffffc70d`dd101cb0 ffffdd06`49a641a0 fffff780`00000008 : nt!IofCallDriver+0x59
ffff9e8c`68c05880 fffff809`4dfe3316 : 00000000`00000000 ffffc70d`e79bb930 ffffc70d`dd101b60 ffffc70d`dd101cb0 : partmgr!PartitionIo+0x178
ffff9e8c`68c05910 fffff802`9ec428d9 : ffffc70d`e79bbc10 fffff809`4dfe1bbb 00000000`00000000 ffffc70d`dd0fcdc0 : partmgr!PmGlobalDispatch+0x66
ffff9e8c`68c05990 fffff809`4e0a1103 : ffffc70d`dd0fcdc0 00000000`00000001 00000021`1caf9e8d 00000000`00000200 : nt!IofCallDriver+0x59
ffff9e8c`68c059d0 fffff802`9ec428d9 : ffffc70d`e79bb930 ffffc70d`dd271180 ffffc70d`dbc7c010 fffff809`50423862 : volmgr!VmReadWrite+0xf3
ffff9e8c`68c05a10 fffff809`4e8c50c8 : ffffc70d`dd271180 ffffc70d`e79bb930 ffffc70d`e79bb930 fffff809`50423dd6 : nt!IofCallDriver+0x59
ffff9e8c`68c05a50 fffff809`4e8c4dd7 : ffff9e8c`68c05c80 ffff9e8c`68c05ca0 00000000`00002000 ffffc70d`e79bb930 : fvevol!FveFilterRundownReadWrite+0x2d8
ffff9e8c`68c05b30 fffff802`9ec428d9 : ffff9e8c`68c05be0 00000000`00000000 ffff9e8c`00002000 00000000`00000000 : fvevol!FveFilterRundownRead+0x27
ffff9e8c`68c05b60 fffff809`50424039 : 00000000`00000000 ffffc70d`dd2b0d90 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x59
ffff9e8c`68c05ba0 fffff809`50425236 : 00000000`00000002 ffff9e8c`68c05ce0 ffffc70d`e79bb930 ffff9e8c`68c05c80 : iorate!IoRateIssueAndRecordIo+0x79
ffff9e8c`68c05be0 fffff809`5042247f : ffff9e8c`68c05d28 fffff802`9ec428d9 ffffc70d`dd2af9b0 ffffc70d`dd2afb00 : iorate!IoRateProcessIrp+0x186
ffff9e8c`68c05d30 fffff802`9ec428d9 : ffffc70d`e91839c0 fffff809`4e122699 ffffc70d`dd2afb00 00000000`b7c50000 : iorate!memset+0x13f
ffff9e8c`68c05d70 fffff809`4e97102d : 00000000`b7c51001 fffff809`4e125cd7 ffffc70d`e9183620 ffffc70d`e91839c0 : nt!IofCallDriver+0x59
ffff9e8c`68c05db0 fffff802`9ec428d9 : ffff8e8c`00000020 00000000`00000104 00000000`00000001 ffffc70d`dd2afb00 : volume!VolumePassThrough+0x1d
ffff9e8c`68c05de0 fffff809`4e1261dd : ffffc70d`dd2a6190 ffff9e8c`68ee4b00 ffffc70d`dd2afb00 ffffc70d`e9183620 : nt!IofCallDriver+0x59
ffff9e8c`68c05e20 ffffc70d`dd2a6190 : ffff9e8c`68ee4b00 ffffc70d`dd2afb00 ffffc70d`e9183620 ffffc70d`00000020 : klbackupdisk+0x61dd
ffff9e8c`68c05e28 ffff9e8c`68ee4b00 : ffffc70d`dd2afb00 ffffc70d`e9183620 ffffc70d`00000020 fffff809`4e9838ea : 0xffffc70d`dd2a6190
ffff9e8c`68c05e30 ffffc70d`dd2afb00 : ffffc70d`e9183620 ffffc70d`00000020 fffff809`4e9838ea ffffc70d`e79bb930 : 0xffff9e8c`68ee4b00
ffff9e8c`68c05e38 ffffc70d`e9183620 : ffffc70d`00000020 fffff809`4e9838ea ffffc70d`e79bb930 ffffc70d`e235b080 : 0xffffc70d`dd2afb00
ffff9e8c`68c05e40 ffffc70d`00000020 : fffff809`4e9838ea ffffc70d`e79bb930 ffffc70d`e235b080 ffff9e8c`68ee4b00 : 0xffffc70d`e9183620
ffff9e8c`68c05e48 fffff809`4e9838ea : ffffc70d`e79bb930 ffffc70d`e235b080 ffff9e8c`68ee4b00 fffff802`9ec428d9 : 0xffffc70d`00000020
ffff9e8c`68c05e50 ffffc70d`e79bb930 : ffffc70d`dd2a6190 00000000`00000000 ffffc70d`debe0000 fffff809`4e50c16c : volsnap!ExAllocateFromNPagedLookasideList+0x12
ffff9e8c`68c05e80 ffffc70d`dd2a6190 : 00000000`00000000 ffffc70d`debe0000 fffff809`4e50c16c ffffc70d`e3f221b0 : 0xffffc70d`e79bb930
ffff9e8c`68c05e88 00000000`00000000 : ffffc70d`debe0000 fffff809`4e50c16c ffffc70d`e3f221b0 fffff809`4e985b7c : 0xffffc70d`dd2a6190
FOLLOWUP_IP:
CLASSPNP!ServiceTransferRequest+b7
fffff809`50473fb7 458b722c mov r14d,dword ptr [r10+2Ch]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: CLASSPNP!ServiceTransferRequest+b7
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: CLASSPNP
IMAGE_NAME: CLASSPNP.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xa0be8348 ; kb
FAILURE_BUCKET_ID: X64_0x1e_c0000005_CLASSPNP!ServiceTransferRequest+b7
BUCKET_ID: X64_0x1e_c0000005_CLASSPNP!ServiceTransferRequest+b7
Followup: MachineOwner
---------
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment