Skip to content

Instantly share code, notes, and snippets.

@wdormann
Created October 20, 2017 13:10
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save wdormann/c11750585c5c0eda2b09438ca30271ab to your computer and use it in GitHub Desktop.
Save wdormann/c11750585c5c0eda2b09438ca30271ab to your computer and use it in GitHub Desktop.
Win10 BSOD after importing EMET profile
Microsoft (R) Windows Debugger Version 10.0.17016.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\test\Documents\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 16299 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff800`33406000 PsLoadedModuleList = 0xfffff800`33767fd0
Debug session time: Fri Oct 20 05:49:35.608 2017 (UTC - 7:00)
System Uptime: 0 days 0:00:08.242
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C0000145, {ffffffffc0000034, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!NtSetSystemPowerState+b90 )
Followup: MachineOwner
---------
nt!KeBugCheckEx:
fffff800`33569960 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8b0d`73f9c6b0=000000000000004c
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Unknown bugcheck code (c0000145)
Unknown bugcheck description
Arguments:
Arg1: ffffffffc0000034
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 10.0.16299.19 (WinBuild.160101.0800)
SYSTEM_MANUFACTURER: VMware, Inc.
VIRTUAL_MACHINE: VMware
SYSTEM_PRODUCT_NAME: VMware Virtual Platform
SYSTEM_VERSION: None
BIOS_VENDOR: Phoenix Technologies LTD
BIOS_VERSION: 6.00
BIOS_DATE: 07/02/2015
BASEBOARD_MANUFACTURER: Intel Corporation
BASEBOARD_PRODUCT: 440BX Desktop Reference Platform
BASEBOARD_VERSION: None
BUGCHECK_STR: 0xc0000145
ERROR_CODE: (NTSTATUS) 0xc0000145 - {Application Error} The application was unable to start correctly (0x%lx). Click OK to close the application.
EXCEPTION_CODE: (NTSTATUS) 0xc0000145 - {Application Error} The application was unable to start correctly (0x%lx). Click OK to close the application.
EXCEPTION_CODE_STR: c0000145
EXCEPTION_PARAMETER1: ffffffffc0000034
EXCEPTION_PARAMETER2: 0000000000000000
EXCEPTION_PARAMETER3: 0000000000000000
EXCEPTION_PARAMETER4: 0
DUMP_TYPE: 1
BUGCHECK_P1: ffffffffc0000034
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
CPU_COUNT: 4
CPU_MHZ: a23
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 46
CPU_STEPPING: 1
CPU_MICROCODE: 6,46,1,0 (F,M,S,R) SIG: F'00000000 (cache) F'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: smss.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-9AVSR0A
ANALYSIS_SESSION_TIME: 10-20-2017 06:08:49.0541
ANALYSIS_VERSION: 10.0.17016.1000 amd64fre
LAST_CONTROL_TRANSFER: from fffff8003382daff to fffff80033569960
STACK_TEXT:
ffff8b0d`73f9c6a8 fffff800`3382daff : 00000000`0000004c 00000000`c0000145 ffff8b0d`73fb13f8 ffffe100`0dd7db10 : nt!KeBugCheckEx
ffff8b0d`73f9c6b0 fffff800`33834bd0 : 00000000`00000000 ffff8b0d`73f9c7f0 00000000`00000002 ffff8b0d`73f9c7f0 : nt!PopGracefulShutdown+0x28f
ffff8b0d`73f9c6f0 fffff800`33574d53 : 00000000`00000004 fffff800`00000006 00000000`c0000004 00000000`00000000 : nt!NtSetSystemPowerState+0xb90
ffff8b0d`73f9c8a0 fffff800`3356cbf0 : fffff800`33af9bb0 00000000`00000000 00000000`c0000004 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
ffff8b0d`73f9ca38 fffff800`33af9bb0 : 00000000`00000000 00000000`c0000004 00000000`00000000 fffff800`337635c0 : nt!KiServiceLinkage
ffff8b0d`73f9ca40 fffff800`33af9e0d : ffffe100`0f5e6040 fffff800`33460c04 ffffe100`0f668410 00000000`00000000 : nt!PopIssueActionRequest+0x1cc
ffff8b0d`73f9cae0 fffff800`3344aeea : 00000000`00000001 00000000`00000002 ffffe100`0dc7e800 00000000`00000000 : nt!PopPolicyWorkerAction+0x6d
ffff8b0d`73f9cb50 fffff800`33460835 : ffffe100`0f5e6040 fffff800`3344ae70 ffffe100`0dc7e860 fffff800`33762688 : nt!PopPolicyWorkerThread+0x7a
ffff8b0d`73f9cb80 fffff800`334e94e7 : ffffa700`2f4e4bc0 00000000`00000080 ffffe100`0dc98480 ffffe100`0f5e6040 : nt!ExpWorkerThread+0xf5
ffff8b0d`73f9cc10 fffff800`3356eef6 : ffffa700`2f4d8180 ffffe100`0f5e6040 fffff800`334e94a0 00000000`00000000 : nt!PspSystemThreadStartup+0x47
ffff8b0d`73f9cc60 00000000`00000000 : ffff8b0d`73f9d000 ffff8b0d`73f97000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: 419b7cf41d42b3c6186404588cb590dfcdbb030a
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: bda932f4b5fb8bebbb7eaf768616ed23a76c8925
THREAD_SHA1_HASH_MOD: b28610981796779b4ac02f58898fde25728a775c
FOLLOWUP_IP:
nt!NtSetSystemPowerState+b90
fffff800`33834bd0 cc int 3
FAULT_INSTR_CODE: 44fb8bcc
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!NtSetSystemPowerState+b90
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 59dc593b
IMAGE_VERSION: 10.0.16299.19
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: b90
FAILURE_BUCKET_ID: 0xc0000145_nt!NtSetSystemPowerState
BUCKET_ID: 0xc0000145_nt!NtSetSystemPowerState
PRIMARY_PROBLEM_CLASS: 0xc0000145_nt!NtSetSystemPowerState
TARGET_TIME: 2017-10-20T12:49:35.000Z
OSBUILD: 16299
OSSERVICEPACK: 19
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2017-10-09 22:23:07
BUILDDATESTAMP_STR: 160101.0800
BUILDLAB_STR: WinBuild
BUILDOSVER_STR: 10.0.16299.19
ANALYSIS_SESSION_ELAPSED_TIME: 4fb
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xc0000145_nt!ntsetsystempowerstate
FAILURE_ID_HASH: {fd0f7920-78c3-6aab-7dc0-d7ab18763a0b}
Followup: MachineOwner
---------
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment