Neler Yeni

minidump analizinden anlayan yardımcı olabilirmi

Katılım
16 Nisan 2020
Mesajlar
191
Dahası  
Reaksiyon skoru
82
İsim
mehmetcan bayır
selamlar .. işlemci değiştirdiğim için mavi ekran alıyorm ve minidump analizinden anlamıyorum bileniniz varsa bi ilgilenebilirmi .. Teşekkürler
 

Emre123a

80+ Gold
Katılım
23 Mart 2020
Mesajlar
9,376
En İyi Cevap
3
Dahası  
Reaksiyon skoru
10,315
İsim
Emre
kendimi recep gibi hissettim böyle :D
tmm bakıyorum
 

Emre123a

80+ Gold
Katılım
23 Mart 2020
Mesajlar
9,376
En İyi Cevap
3
Dahası  
Reaksiyon skoru
10,315
İsim
Emre
hocam sistemin ne
 

Toxpox

80+ Gold
Katılım
24 Mart 2020
Mesajlar
6,770
En İyi Cevap
32
Dahası  
Reaksiyon skoru
12,742
İsim
Toxpox
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for usbhub.sys
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
fffff80002a3c0e8: Unable to get Flags value from nt!KdVersionBlock
GetUlongPtrFromAddress: unable to read from fffff80002af7300

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 4671

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NFPVV9V

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 18438

Key : Analysis.Memory.CommitPeak.Mb
Value: 64

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: win7sp1_ldr_escrow

Key : WER.OS.Timestamp
Value: 2020-06-10T19:07:00Z

Key : WER.OS.Version
Value: 7.1.7601.24557


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 1e

BUGCHECK_P1: 0

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: svchost.exe

DPC_STACK_BASE: FFFFF880009CCFB0

TRAP_FRAME: fffff880009cc5a0 -- (.trap 0xfffff880009cc5a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000318 rbx=0000000000000000 rcx=fffffa8004cc42c0
rdx=000000004f444602 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003e1278f rsp=fffff880009cc730 rbp=0000000000000000
r8=0000000000000000 r9=fffffa80043ed430 r10=fffff88002fdcb80
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po nc
USBPORT!USBPORT_Core_AllocTransferEx+0x383:
fffff880`03e1278f ff ???
Resetting default scope

MISALIGNED_IP:
USBPORT!USBPORT_Core_AllocTransferEx+383
fffff880`03e1278f ff ???

STACK_TEXT:
fffff880`009cb5e8 fffff800`028f0e0e : 00000000`00000001 00000000`00000000 fffff880`009cbd60 fffff800`02878b00 : nt!KeBugCheck
fffff880`009cb5f0 fffff800`028f4efd : fffff800`02acf740 fffff800`02a2339c fffff800`02859000 fffff880`009cc4f8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`009cb620 fffff800`02879765 : fffff800`02a036a0 fffff880`009cb698 fffff880`009cc4f8 fffff800`02859000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`009cb650 fffff800`029d4bee : fffff880`009cc4f8 fffff880`009cbd60 fffff880`00000000 00000000`00000003 : nt!RtlDispatchException+0x415
fffff880`009cbd30 fffff800`028fc0c2 : fffff880`009cc4f8 fffffa80`043ed430 fffff880`009cc5a0 fffffa80`053a5870 : nt!KiDispatchException+0x17e
fffff880`009cc3c0 fffff800`028f838d : fffff880`009cc5a0 fffffa80`05c7b002 fffff880`009cc600 fffff880`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`009cc5a0 fffff880`03e1278f : fffffa80`043ed430 00000000`00000000 fffffa80`053a5870 fffffa80`05035168 : nt!KiInvalidOpcodeFault+0x30d
fffff880`009cc730 fffff880`03e2267c : fffffa80`05034050 fffffa80`00000380 fffffa80`04cc42c0 fffffa80`04cb2c60 : USBPORT!USBPORT_Core_AllocTransferEx+0x383
fffff880`009cc7c0 fffff880`03e2b1a8 : fffffa80`04cb2c60 fffffa80`050c0009 fffffa80`04cb2c60 fffffa80`053a5870 : USBPORT!USBPORT_ProcessURB+0x944
fffff880`009cc870 fffff880`03e04ae0 : 00000000`00000000 fffffa80`050cb050 fffffa80`0597ae40 fffffa80`04cb2c60 : USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x138
fffff880`009cc8b0 fffff880`04131566 : fffffa80`050cd050 fffffa80`04cd7440 fffffa80`04cb2c60 fffffa80`050cd1a0 : USBPORT!USBPORT_Dispatch+0x1dc
fffff880`009cc8f0 fffffa80`050cd050 : fffffa80`04cd7440 fffffa80`04cb2c60 fffffa80`050cd1a0 fffffa80`04cb2c60 : usbhub+0x3566
fffff880`009cc8f8 fffffa80`04cd7440 : fffffa80`04cb2c60 fffffa80`050cd1a0 fffffa80`04cb2c60 fffff880`041620e7 : 0xfffffa80`050cd050
fffff880`009cc900 fffffa80`04cb2c60 : fffffa80`050cd1a0 fffffa80`04cb2c60 fffff880`041620e7 00000000`00000000 : 0xfffffa80`04cd7440
fffff880`009cc908 fffffa80`050cd1a0 : fffffa80`04cb2c60 fffff880`041620e7 00000000`00000000 00000000`00000000 : 0xfffffa80`04cb2c60
fffff880`009cc910 fffffa80`04cb2c60 : fffff880`041620e7 00000000`00000000 00000000`00000000 fffffa80`04cd7440 : 0xfffffa80`050cd1a0
fffff880`009cc918 fffff880`041620e7 : 00000000`00000000 00000000`00000000 fffffa80`04cd7440 00000000`00000801 : 0xfffffa80`04cb2c60
fffff880`009cc920 00000000`00000000 : 00000000`00000000 fffffa80`04cd7440 00000000`00000801 fffffa80`04cb4a00 : usbhub+0x340e7


SYMBOL_NAME: USBPORT!USBPORT_Core_AllocTransferEx+383

IMAGE_NAME: hardware

IMAGE_VERSION: 6.1.7601.24138

STACK_COMMAND: .thread ; .cxr ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

OS_VERSION: 7.1.7601.24557

BUILDLAB_STR: win7sp1_ldr_escrow

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

FAILURE_ID_HASH: {201b0e5d-db2a-63d2-77be-8ce8ff234750}

Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff901c1b52280, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600019fa04, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name
fffff80002df40e8: Unable to get Flags value from nt!KdVersionBlock
GetUlongPtrFromAddress: unable to read from fffff80002eaf300

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2671

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NFPVV9V

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 18369

Key : Analysis.Memory.CommitPeak.Mb
Value: 65

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: win7sp1_ldr_escrow

Key : WER.OS.Timestamp
Value: 2020-06-10T19:07:00Z

Key : WER.OS.Version
Value: 7.1.7601.24557


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 50

BUGCHECK_P1: fffff901c1b52280

BUGCHECK_P2: 0

BUGCHECK_P3: fffff9600019fa04

BUGCHECK_P4: 5

READ_ADDRESS: fffff80002df40e8: Unable to get Flags value from nt!KdVersionBlock
fffff80002df40e8: Unable to get Flags value from nt!KdVersionBlock
fffff80002df40e8: Unable to get Flags value from nt!KdVersionBlock
Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff80002eaf2f0
GetUlongPtrFromAddress: unable to read from fffff80002eaf4a8
fffff901c1b52280

MM_INTERNAL_CODE: 5

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: chrome.exe

TRAP_FRAME: fffff880060c7770 -- (.trap 0xfffff880060c7770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c062c150 rbx=0000000000000000 rcx=000000000000030c
rdx=fffff900c1c03e01 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600019fa04 rsp=fffff880060c7900 rbp=fffff900c1c03eb8
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffff900c20b22f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
win32k!memset+0x7f84:
fffff960`0019fa04 7564 jne win32k!memset+0x7fea (fffff960`0019fa6a) [br=1]
Resetting default scope

STACK_TEXT:
fffff880`060c7618 fffff800`02d7dac6 : 00000000`00000050 fffff901`c1b52280 00000000`00000000 fffff880`060c7770 : nt!KeBugCheckEx
fffff880`060c7620 fffff800`02cb1cdc : 00000000`00000000 fffff901`c1b52280 fffffa80`040e3900 fffff900`c1b72270 : nt!MmAccessFault+0x736
fffff880`060c7770 fffff960`0019fa04 : fffff900`c1b72270 00000000`00000000 fffff880`060c7950 fffff800`02eea08d : nt!KiPageFault+0x35c
fffff880`060c7900 fffff960`0019fbc8 : fffff900`c1c03c10 fffff880`060c7c60 00000000`00000108 00000000`00000000 : win32k!memset+0x7f84
fffff880`060c7940 fffff960`0019d812 : fffff900`c1c03c10 fffff880`060c7b28 00000000`00000000 fffff800`00000000 : win32k!memset+0x8148
fffff880`060c79c0 fffff960`0019dce9 : 00000000`00000000 fffff800`000025ff 00000000`00000000 fffffa80`ffffffff : win32k!memset+0x5d92
fffff880`060c7aa0 fffff960`0019669b : 00000000`009aa0a8 00000000`008ed930 00000000`00000000 00000000`044ba0e0 : win32k!memset+0x6269
fffff880`060c7ae0 fffff800`02cb3c53 : fffffa80`060ea690 00000000`008eeed8 fffff880`060c7b88 00000000`0098b130 : win32k!EngRestoreFloatingPointState+0xcf7f
fffff880`060c7b70 00000000`77a78cba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`008eeeb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a78cba


SYMBOL_NAME: win32k!memset+7f84

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

IMAGE_VERSION: 6.1.7601.24555

STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0x50_win32k!memset+7f84

OS_VERSION: 7.1.7601.24557

BUILDLAB_STR: win7sp1_ldr_escrow

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

FAILURE_ID_HASH: {21044f41-c33f-7e4f-8bc7-28b3277bc40f}

Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000ebf0a073, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001546b8a, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for ataport.SYS
fffff80002e2c0e8: Unable to get Flags value from nt!KdVersionBlock
GetUlongPtrFromAddress: unable to read from fffff80002ee7300

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2937

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NFPVV9V

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 10269

Key : Analysis.Memory.CommitPeak.Mb
Value: 65

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: win7sp1_ldr_escrow

Key : WER.OS.Timestamp
Value: 2020-06-10T19:07:00Z

Key : WER.OS.Version
Value: 7.1.7601.24557


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: d1

BUGCHECK_P1: ebf0a073

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff88001546b8a

READ_ADDRESS: fffff80002e2c0e8: Unable to get Flags value from nt!KdVersionBlock
fffff80002e2c0e8: Unable to get Flags value from nt!KdVersionBlock
fffff80002e2c0e8: Unable to get Flags value from nt!KdVersionBlock
Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff80002ee72f0
GetUlongPtrFromAddress: unable to read from fffff80002ee74a8
00000000ebf0a073

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: TrustedInstaller.exe

DPC_STACK_BASE: FFFFF880009CCFB0

TRAP_FRAME: fffff880009cc6e0 -- (.trap 0xfffff880009cc6e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ebf0a048 rbx=0000000000000000 rcx=00000000000074f5
rdx=000000000572bfaa rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001546b8a rsp=fffff880009cc870 rbp=fffffa8004c65190
r8=fffffa80047dd404 r9=0000000000000000 r10=0000000000000004
r11=fffff880009cc918 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
volsnap!VspPerformanceCounters+0x24a:
fffff880`01546b8a 03482b add ecx,dword ptr [rax+2Bh] ds:00000000`ebf0a073=????????
Resetting default scope

MISALIGNED_IP:
volsnap!VspPerformanceCounters+24a
fffff880`01546b8a 03482b add ecx,dword ptr [rax+2Bh]

STACK_TEXT:
fffff880`009cc598 fffff800`02cebfe9 : 00000000`0000000a 00000000`ebf0a073 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`009cc5a0 fffff800`02ce9dce : 00000000`00000000 00000000`ebf0a073 fffffa80`04ffa000 00000000`00007500 : nt!KiBugCheckDispatch+0x69
fffff880`009cc6e0 fffff880`01546b8a : fffffa80`04c65040 00000000`00000000 fffffa80`04c65190 fffffa80`04ec2a30 : nt!KiPageFault+0x44e
fffff880`009cc870 fffff880`0155c511 : fffffa80`04affd02 fffffa80`04ec2a30 fffffa80`041b1368 fffffa80`04c65040 : volsnap!VspPerformanceCounters+0x24a
fffff880`009cc8c0 fffff800`02c90b21 : fffffa80`041b1323 00000000`00000000 fffffa80`04c65040 fffffa80`041b1010 : volsnap!VspWriteContextCompletionRoutine+0x51
fffff880`009cc920 fffff880`01449bce : 00000000`00000002 fffff880`03cc1501 fffffa80`04ffb6e0 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`009cca10 fffff800`02c90b21 : 00000000`00000000 fffff880`03fba7f6 00000000`00000050 00000000`00000004 : CLASSPNP!TransferPktComplete+0x1ce
fffff880`009cca90 fffff880`01179436 : 00000000`00000000 00000000`00000001 fffffa80`0638c780 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`009ccb80 00000000`00000000 : 00000000`00000001 fffffa80`0638c780 00000000`00000000 fffffa80`03e1e010 : ataport+0x9436


SYMBOL_NAME: volsnap!VspPerformanceCounters+24a

IMAGE_NAME: hardware

IMAGE_VERSION: 6.1.7601.23403

STACK_COMMAND: .thread ; .cxr ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED_volsnap.sys

OS_VERSION: 7.1.7601.24557

BUILDLAB_STR: win7sp1_ldr_escrow

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

FAILURE_ID_HASH: {5834731e-ec2f-e777-393f-b7f9d260e5c3}

Followup: MachineOwner
---------
Edit:
 

BMW_M4

80+ Bronze
Katılım
5 Haziran 2020
Mesajlar
1,684
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for usbhub.sys
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ExceptionRecord ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ContextRecord ***
*** ***
*************************************************************************
fffff80002a3c0e8: Unable to get Flags value from nt!KdVersionBlock
GetUlongPtrFromAddress: unable to read from fffff80002af7300

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 4671

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NFPVV9V

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 18438

Key : Analysis.Memory.CommitPeak.Mb
Value: 64

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: win7sp1_ldr_escrow

Key : WER.OS.Timestamp
Value: 2020-06-10T19:07:00Z

Key : WER.OS.Version
Value: 7.1.7601.24557


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 1e

BUGCHECK_P1: 0

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: svchost.exe

DPC_STACK_BASE: FFFFF880009CCFB0

TRAP_FRAME: fffff880009cc5a0 -- (.trap 0xfffff880009cc5a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000318 rbx=0000000000000000 rcx=fffffa8004cc42c0
rdx=000000004f444602 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003e1278f rsp=fffff880009cc730 rbp=0000000000000000
r8=0000000000000000 r9=fffffa80043ed430 r10=fffff88002fdcb80
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po nc
USBPORT!USBPORT_Core_AllocTransferEx+0x383:
fffff880`03e1278f ff ???
Resetting default scope

MISALIGNED_IP:
USBPORT!USBPORT_Core_AllocTransferEx+383
fffff880`03e1278f ff ???

STACK_TEXT:
fffff880`009cb5e8 fffff800`028f0e0e : 00000000`00000001 00000000`00000000 fffff880`009cbd60 fffff800`02878b00 : nt!KeBugCheck
fffff880`009cb5f0 fffff800`028f4efd : fffff800`02acf740 fffff800`02a2339c fffff800`02859000 fffff880`009cc4f8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`009cb620 fffff800`02879765 : fffff800`02a036a0 fffff880`009cb698 fffff880`009cc4f8 fffff800`02859000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`009cb650 fffff800`029d4bee : fffff880`009cc4f8 fffff880`009cbd60 fffff880`00000000 00000000`00000003 : nt!RtlDispatchException+0x415
fffff880`009cbd30 fffff800`028fc0c2 : fffff880`009cc4f8 fffffa80`043ed430 fffff880`009cc5a0 fffffa80`053a5870 : nt!KiDispatchException+0x17e
fffff880`009cc3c0 fffff800`028f838d : fffff880`009cc5a0 fffffa80`05c7b002 fffff880`009cc600 fffff880`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`009cc5a0 fffff880`03e1278f : fffffa80`043ed430 00000000`00000000 fffffa80`053a5870 fffffa80`05035168 : nt!KiInvalidOpcodeFault+0x30d
fffff880`009cc730 fffff880`03e2267c : fffffa80`05034050 fffffa80`00000380 fffffa80`04cc42c0 fffffa80`04cb2c60 : USBPORT!USBPORT_Core_AllocTransferEx+0x383
fffff880`009cc7c0 fffff880`03e2b1a8 : fffffa80`04cb2c60 fffffa80`050c0009 fffffa80`04cb2c60 fffffa80`053a5870 : USBPORT!USBPORT_ProcessURB+0x944
fffff880`009cc870 fffff880`03e04ae0 : 00000000`00000000 fffffa80`050cb050 fffffa80`0597ae40 fffffa80`04cb2c60 : USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x138
fffff880`009cc8b0 fffff880`04131566 : fffffa80`050cd050 fffffa80`04cd7440 fffffa80`04cb2c60 fffffa80`050cd1a0 : USBPORT!USBPORT_Dispatch+0x1dc
fffff880`009cc8f0 fffffa80`050cd050 : fffffa80`04cd7440 fffffa80`04cb2c60 fffffa80`050cd1a0 fffffa80`04cb2c60 : usbhub+0x3566
fffff880`009cc8f8 fffffa80`04cd7440 : fffffa80`04cb2c60 fffffa80`050cd1a0 fffffa80`04cb2c60 fffff880`041620e7 : 0xfffffa80`050cd050
fffff880`009cc900 fffffa80`04cb2c60 : fffffa80`050cd1a0 fffffa80`04cb2c60 fffff880`041620e7 00000000`00000000 : 0xfffffa80`04cd7440
fffff880`009cc908 fffffa80`050cd1a0 : fffffa80`04cb2c60 fffff880`041620e7 00000000`00000000 00000000`00000000 : 0xfffffa80`04cb2c60
fffff880`009cc910 fffffa80`04cb2c60 : fffff880`041620e7 00000000`00000000 00000000`00000000 fffffa80`04cd7440 : 0xfffffa80`050cd1a0
fffff880`009cc918 fffff880`041620e7 : 00000000`00000000 00000000`00000000 fffffa80`04cd7440 00000000`00000801 : 0xfffffa80`04cb2c60
fffff880`009cc920 00000000`00000000 : 00000000`00000000 fffffa80`04cd7440 00000000`00000801 fffffa80`04cb4a00 : usbhub+0x340e7


SYMBOL_NAME: USBPORT!USBPORT_Core_AllocTransferEx+383

IMAGE_NAME: hardware

IMAGE_VERSION: 6.1.7601.24138

STACK_COMMAND: .thread ; .cxr ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

OS_VERSION: 7.1.7601.24557

BUILDLAB_STR: win7sp1_ldr_escrow

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

FAILURE_ID_HASH: {201b0e5d-db2a-63d2-77be-8ce8ff234750}

Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff901c1b52280, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600019fa04, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name
fffff80002df40e8: Unable to get Flags value from nt!KdVersionBlock
GetUlongPtrFromAddress: unable to read from fffff80002eaf300

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2671

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NFPVV9V

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 18369

Key : Analysis.Memory.CommitPeak.Mb
Value: 65

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: win7sp1_ldr_escrow

Key : WER.OS.Timestamp
Value: 2020-06-10T19:07:00Z

Key : WER.OS.Version
Value: 7.1.7601.24557


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 50

BUGCHECK_P1: fffff901c1b52280

BUGCHECK_P2: 0

BUGCHECK_P3: fffff9600019fa04

BUGCHECK_P4: 5

READ_ADDRESS: fffff80002df40e8: Unable to get Flags value from nt!KdVersionBlock
fffff80002df40e8: Unable to get Flags value from nt!KdVersionBlock
fffff80002df40e8: Unable to get Flags value from nt!KdVersionBlock
Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff80002eaf2f0
GetUlongPtrFromAddress: unable to read from fffff80002eaf4a8
fffff901c1b52280

MM_INTERNAL_CODE: 5

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: chrome.exe

TRAP_FRAME: fffff880060c7770 -- (.trap 0xfffff880060c7770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c062c150 rbx=0000000000000000 rcx=000000000000030c
rdx=fffff900c1c03e01 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600019fa04 rsp=fffff880060c7900 rbp=fffff900c1c03eb8
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=fffff900c20b22f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
win32k!memset+0x7f84:
fffff960`0019fa04 7564 jne win32k!memset+0x7fea (fffff960`0019fa6a) [br=1]
Resetting default scope

STACK_TEXT:
fffff880`060c7618 fffff800`02d7dac6 : 00000000`00000050 fffff901`c1b52280 00000000`00000000 fffff880`060c7770 : nt!KeBugCheckEx
fffff880`060c7620 fffff800`02cb1cdc : 00000000`00000000 fffff901`c1b52280 fffffa80`040e3900 fffff900`c1b72270 : nt!MmAccessFault+0x736
fffff880`060c7770 fffff960`0019fa04 : fffff900`c1b72270 00000000`00000000 fffff880`060c7950 fffff800`02eea08d : nt!KiPageFault+0x35c
fffff880`060c7900 fffff960`0019fbc8 : fffff900`c1c03c10 fffff880`060c7c60 00000000`00000108 00000000`00000000 : win32k!memset+0x7f84
fffff880`060c7940 fffff960`0019d812 : fffff900`c1c03c10 fffff880`060c7b28 00000000`00000000 fffff800`00000000 : win32k!memset+0x8148
fffff880`060c79c0 fffff960`0019dce9 : 00000000`00000000 fffff800`000025ff 00000000`00000000 fffffa80`ffffffff : win32k!memset+0x5d92
fffff880`060c7aa0 fffff960`0019669b : 00000000`009aa0a8 00000000`008ed930 00000000`00000000 00000000`044ba0e0 : win32k!memset+0x6269
fffff880`060c7ae0 fffff800`02cb3c53 : fffffa80`060ea690 00000000`008eeed8 fffff880`060c7b88 00000000`0098b130 : win32k!EngRestoreFloatingPointState+0xcf7f
fffff880`060c7b70 00000000`77a78cba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`008eeeb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a78cba


SYMBOL_NAME: win32k!memset+7f84

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

IMAGE_VERSION: 6.1.7601.24555

STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0x50_win32k!memset+7f84

OS_VERSION: 7.1.7601.24557

BUILDLAB_STR: win7sp1_ldr_escrow

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

FAILURE_ID_HASH: {21044f41-c33f-7e4f-8bc7-28b3277bc40f}

Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000ebf0a073, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001546b8a, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for ataport.SYS
fffff80002e2c0e8: Unable to get Flags value from nt!KdVersionBlock
GetUlongPtrFromAddress: unable to read from fffff80002ee7300

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2937

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-NFPVV9V

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 10269

Key : Analysis.Memory.CommitPeak.Mb
Value: 65

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: win7sp1_ldr_escrow

Key : WER.OS.Timestamp
Value: 2020-06-10T19:07:00Z

Key : WER.OS.Version
Value: 7.1.7601.24557


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: d1

BUGCHECK_P1: ebf0a073

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff88001546b8a

READ_ADDRESS: fffff80002e2c0e8: Unable to get Flags value from nt!KdVersionBlock
fffff80002e2c0e8: Unable to get Flags value from nt!KdVersionBlock
fffff80002e2c0e8: Unable to get Flags value from nt!KdVersionBlock
Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff80002ee72f0
GetUlongPtrFromAddress: unable to read from fffff80002ee74a8
00000000ebf0a073

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: TrustedInstaller.exe

DPC_STACK_BASE: FFFFF880009CCFB0

TRAP_FRAME: fffff880009cc6e0 -- (.trap 0xfffff880009cc6e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ebf0a048 rbx=0000000000000000 rcx=00000000000074f5
rdx=000000000572bfaa rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001546b8a rsp=fffff880009cc870 rbp=fffffa8004c65190
r8=fffffa80047dd404 r9=0000000000000000 r10=0000000000000004
r11=fffff880009cc918 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
volsnap!VspPerformanceCounters+0x24a:
fffff880`01546b8a 03482b add ecx,dword ptr [rax+2Bh] ds:00000000`ebf0a073=????????
Resetting default scope

MISALIGNED_IP:
volsnap!VspPerformanceCounters+24a
fffff880`01546b8a 03482b add ecx,dword ptr [rax+2Bh]

STACK_TEXT:
fffff880`009cc598 fffff800`02cebfe9 : 00000000`0000000a 00000000`ebf0a073 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`009cc5a0 fffff800`02ce9dce : 00000000`00000000 00000000`ebf0a073 fffffa80`04ffa000 00000000`00007500 : nt!KiBugCheckDispatch+0x69
fffff880`009cc6e0 fffff880`01546b8a : fffffa80`04c65040 00000000`00000000 fffffa80`04c65190 fffffa80`04ec2a30 : nt!KiPageFault+0x44e
fffff880`009cc870 fffff880`0155c511 : fffffa80`04affd02 fffffa80`04ec2a30 fffffa80`041b1368 fffffa80`04c65040 : volsnap!VspPerformanceCounters+0x24a
fffff880`009cc8c0 fffff800`02c90b21 : fffffa80`041b1323 00000000`00000000 fffffa80`04c65040 fffffa80`041b1010 : volsnap!VspWriteContextCompletionRoutine+0x51
fffff880`009cc920 fffff880`01449bce : 00000000`00000002 fffff880`03cc1501 fffffa80`04ffb6e0 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`009cca10 fffff800`02c90b21 : 00000000`00000000 fffff880`03fba7f6 00000000`00000050 00000000`00000004 : CLASSPNP!TransferPktComplete+0x1ce
fffff880`009cca90 fffff880`01179436 : 00000000`00000000 00000000`00000001 fffffa80`0638c780 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`009ccb80 00000000`00000000 : 00000000`00000001 fffffa80`0638c780 00000000`00000000 fffffa80`03e1e010 : ataport+0x9436


SYMBOL_NAME: volsnap!VspPerformanceCounters+24a

IMAGE_NAME: hardware

IMAGE_VERSION: 6.1.7601.23403

STACK_COMMAND: .thread ; .cxr ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED_volsnap.sys

OS_VERSION: 7.1.7601.24557

BUILDLAB_STR: win7sp1_ldr_escrow

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

FAILURE_ID_HASH: {5834731e-ec2f-e777-393f-b7f9d260e5c3}

Followup: MachineOwner
---------
Edit:
Napıyon la penguen :p
 
Top Bottom