API tools faq
paste
Guest User

mini dump when just logging into windows and leaving it idle

a guest
Oct 15th, 2019
132
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.71 KB | None | 0 0
raw download clone embed print report
  1. Microsoft (R) Windows Debugger Version 10.0.19494.1001 AMD64
  2.  
  3. Copyright (c) Microsoft Corporation. All rights reserved.
  4.  
  5.  
  6. Loading Dump File [C:\Windows\Minidump\101519-7203-01.dmp]
  7. Mini Kernel Dump File: Only registers and stack trace are available
  8.  
  9.  
  10. ************* Path validation summary **************
  11. Response Time (ms) Location
  12. Deferred srv*
  13. Symbol search path is: srv*
  14. Executable search path is:
  15. Windows 10 Kernel Version 18362 MP (12 procs) Free x64
  16. Product: WinNt, suite: TerminalServer SingleUserTS
  17. Machine Name:
  18. Kernel base = 0xfffff800`48800000 PsLoadedModuleList = 0xfffff800`48c48210
  19. Debug session time: Tue Oct 15 16:21:35.565 2019 (UTC - 6:00)
  20. System Uptime: 0 days 0:47:18.310
  21. Loading Kernel Symbols
  22. ..
  23.  
  24. Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
  25. Run !sym noisy before .reload to track down problems loading symbols.
  26.  
  27. .............................................................
  28. ................................................................
  29. ................................................................
  30. .................
  31. Loading User Symbols
  32. Loading unloaded module list
  33. ..........
  34. For analysis of this file, run !analyze -v
  35.  
  36. nt!KeBugCheckEx:
  37.  
  38. fffff800`489c1220 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff848e`49415df0=000000000000003b
  39. 8: kd> !analyze -v
  40. *******************************************************************************
  41. * *
  42. * Bugcheck Analysis *
  43. * *
  44. *******************************************************************************
  45.  
  46. SYSTEM_SERVICE_EXCEPTION (3b)
  47. An exception happened while executing a system service routine.
  48. Arguments:
  49. Arg1: 00000000c0000005, Exception code that caused the bugcheck
  50. Arg2: fffff8005de5baa6, Address of the instruction which caused the bugcheck
  51. Arg3: ffff848e49416720, Address of the context record for the exception that caused the bugcheck
  52. Arg4: 0000000000000000, zero.
  53.  
  54. Debugging Details:
  55. ------------------
  56.  
  57.  
  58. KEY_VALUES_STRING: 1
  59.  
  60. Key : Analysis.CPU.Sec
  61. Value: 2
  62.  
  63. Key : Analysis.DebugAnalysisProvider.CPP
  64. Value: Create: 8007007e on DESKTOP-1CBU1CD
  65.  
  66. Key : Analysis.DebugData
  67. Value: CreateObject
  68.  
  69. Key : Analysis.DebugModel
  70. Value: CreateObject
  71.  
  72. Key : Analysis.Elapsed.Sec
  73. Value: 4
  74.  
  75. Key : Analysis.Memory.CommitPeak.Mb
  76. Value: 78
  77.  
  78. Key : Analysis.System
  79. Value: CreateObject
  80.  
  81.  
  82. DUMP_FILE_ATTRIBUTES: 0x8
  83. Kernel Generated Triage Dump
  84.  
  85. BUGCHECK_CODE: 3b
  86.  
  87. BUGCHECK_P1: c0000005
  88.  
  89. BUGCHECK_P2: fffff8005de5baa6
  90.  
  91. BUGCHECK_P3: ffff848e49416720
  92.  
  93. BUGCHECK_P4: 0
  94.  
  95. CONTEXT: ffff848e49416720 -- (.cxr 0xffff848e49416720)
  96.  
  97. rax=0000000000000000 rbx=ffff9e88961f5080 rcx=e925b84a64500000
  98.  
  99. rdx=ffffdc0bde5eb3a8 rsi=000001b6950a6740 rdi=0000000000000001
  100. rip=fffff8005de5baa6 rsp=ffff848e49417110 rbp=ffff848e49417a80
  101. r8=ffff848e494170e8 r9=00000000ffffffff r10=fffff80048838fa0
  102. r11=ffff848e494179e0 r12=0000000000002cd0 r13=000001b694f97220
  103. r14=ffffdc0bde5eb370 r15=00000000c000007b
  104. iopl=0 nv up ei pl zr na po nc
  105. cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
  106. dxgkrnl!NtNotifyPresentToCompositionSurface+0x2e6:
  107. fffff800`5de5baa6 38498b cmp byte ptr [rcx-75h],cl ds:002b:e925b84a`644fff8b=??
  108. Resetting default scope
  109.  
  110. CUSTOMER_CRASH_COUNT: 1
  111.  
  112. PROCESS_NAME: Wow.exe
  113.  
  114. STACK_TEXT:
  115. ffff848e`49417110 fffff800`489d2b15 : ffff9e88`961f5080 ffff9e88`961f5080 000001b6`950a6740 00000000`00000020 : dxgkrnl!NtNotifyPresentToCompositionSurface+0x2e6
  116. ffff848e`49417a00 00007ffd`b3e877c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
  117. 0000000e`b9f9d958 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`b3e877c4
  118.  
  119.  
  120. CHKIMG_EXTENSION: !chkimg -lo 50 -db !dxgkrnl
  121. 10 errors : !dxgkrnl (fffff8005de5b9a4-fffff8005de5bafc)
  122. fffff8005de5b9a0 00 c0 4c 8b *de 24 38 48 8b 7c 24 50 *25 8b 64 24 ..L..$8H.|$P%.d$
  123. fffff8005de5b9b0 40 eb 06 41 *fe 0d 00 00 c0 4c 8b 15 14 16 06 00 @..A.....L......
  124. ...
  125. fffff8005de5baa0 8b 73 30 49 *b7 7b 38 49 8b e3 41 5f *8f 5e 41 5c .s0I.{8I..A_.^A\
  126. fffff8005de5bab0 c3 cc cc cc *f8 cc cc cc cc cc cc cc fc cc cc cc ................
  127. ...
  128. fffff8005de5bae0 5c 24 20 49 *7c 5b b0 33 f6 49 89 73 *02 49 21 5b \$ I|[.3.I.s.I![
  129. fffff8005de5baf0 c0 33 c0 49 *aa 43 d0 49 89 43 d8 49 *92 43 e0 48 .3.I.C.I.C.I.C.H
  130.  
  131. MODULE_NAME: memory_corruption
  132.  
  133.  
  134. IMAGE_NAME: memory_corruption
  135.  
  136.  
  137. MEMORY_CORRUPTOR: STRIDE
  138.  
  139. STACK_COMMAND: .cxr 0xffff848e49416720 ; kb
  140.  
  141. FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE
  142.  
  143. OSPLATFORM_TYPE: x64
  144.  
  145. OSNAME: Windows 10
  146.  
  147. FAILURE_ID_HASH: {574dbc1b-92cb-fb09-cb7a-cacc1bb2c511}
  148.  
  149. Followup: memory_corruption
  150. ---------
  151.  
  152. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis'
  153. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis'
  154. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis'
  155. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis'
  156. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis'
  157. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis'
  158. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis'
  159. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis'
  160. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis'
  161. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis'
  162. NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1910.3003.0_neutral__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis'
  163.  
  164. Microsoft (R) Windows Debugger Version 10.0.19494.1001 AMD64
  165. Copyright (c) Microsoft Corporation. All rights reserved.
  166.  
  167.  
  168. Loading Dump File [C:\Windows\Minidump\090919-8046-01.dmp]
  169. Could not open dump file [C:\Windows\Minidump\090919-8046-01.dmp], Win32 error 0n2
  170. "The system cannot find the file specified."
  171.  
  172. Microsoft (R) Windows Debugger Version 10.0.19494.1001 AMD64
  173. Copyright (c) Microsoft Corporation. All rights reserved.
  174.  
  175.  
  176. Loading Dump File [C:\Windows\Minidump\101419-11156-01.dmp]
  177. Mini Kernel Dump File: Only registers and stack trace are available
  178.  
  179.  
  180. ************* Path validation summary **************
  181. Response Time (ms) Location
  182. Deferred srv*
  183. Symbol search path is: srv*
  184. Executable search path is:
  185. Windows 10 Kernel Version 18362 MP (12 procs) Free x64
  186. Product: WinNt, suite: TerminalServer SingleUserTS
  187. Machine Name:
  188. Kernel base = 0xfffff807`0e600000 PsLoadedModuleList = 0xfffff807`0ea48210
  189. Debug session time: Mon Oct 14 15:38:36.820 2019 (UTC - 6:00)
  190. System Uptime: 0 days 0:12:21.564
  191. Loading Kernel Symbols
  192. ...............................................................
  193. ................................................................
  194. ................................................................
  195. .................
  196. Loading User Symbols
  197. Loading unloaded module list
  198. .........
  199. For analysis of this file, run !analyze -v
  200.  
  201. nt!KeBugCheckEx:
  202.  
  203. fffff807`0e7c1220 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffcd87`0b337420=0000000000000050
  204. 3: kd> !analyze -v
  205. *******************************************************************************
  206. * *
  207. * Bugcheck Analysis *
  208. * *
  209. *******************************************************************************
  210.  
  211. PAGE_FAULT_IN_NONPAGED_AREA (50)
  212. Invalid system memory was referenced. This cannot be protected by try-except.
  213. Typically the address is just plain bad or it is pointing at freed memory.
  214. Arguments:
  215. Arg1: fffff8c325e44d60, memory referenced.
  216. Arg2: 0000000000000010, value 0 = read operation, 1 = write operation.
  217. Arg3: fffff8c325e44d60, If non-zero, the instruction address which referenced the bad memory
  218. address.
  219. Arg4: 0000000000000002, (reserved)
  220.  
  221. Debugging Details:
  222. ------------------
  223.  
  224.  
  225. Could not read faulting driver name
  226.  
  227. KEY_VALUES_STRING: 1
  228.  
  229. Key : Analysis.CPU.Sec
  230. Value: 1
  231.  
  232. Key : Analysis.DebugAnalysisProvider.CPP
  233. Value: Create: 8007007e on DESKTOP-1CBU1CD
  234.  
  235. Key : Analysis.DebugData
  236. Value: CreateObject
  237.  
  238. Key : Analysis.DebugModel
  239. Value: CreateObject
  240.  
  241. Key : Analysis.Elapsed.Sec
  242. Value: 1
  243.  
  244. Key : Analysis.Memory.CommitPeak.Mb
  245. Value: 78
  246.  
  247. Key : Analysis.System
  248. Value: CreateObject
  249.  
  250.  
  251. DUMP_FILE_ATTRIBUTES: 0x8
  252. Kernel Generated Triage Dump
  253.  
  254. BUGCHECK_CODE: 50
  255.  
  256. BUGCHECK_P1: fffff8c325e44d60
  257.  
  258. BUGCHECK_P2: 10
  259.  
  260. BUGCHECK_P3: fffff8c325e44d60
  261.  
  262. BUGCHECK_P4: 2
  263.  
  264. READ_ADDRESS: fffff8070eb733b8: Unable to get MiVisibleState
  265. Unable to get NonPagedPoolStart
  266. Unable to get NonPagedPoolEnd
  267. Unable to get PagedPoolStart
  268. Unable to get PagedPoolEnd
  269. fffff8070ea2a3c8: Unable to get Flags value from nt!KdVersionBlock
  270. fffff8070ea2a3c8: Unable to get Flags value from nt!KdVersionBlock
  271. unable to get nt!MmSpecialPagesInUse
  272. fffff8c325e44d60
  273.  
  274. MM_INTERNAL_CODE: 2
  275.  
  276. CUSTOMER_CRASH_COUNT: 1
  277.  
  278. PROCESS_NAME: dwm.exe
  279.  
  280. TRAP_FRAME: ffffcd870b3376c0 -- (.trap 0xffffcd870b3376c0)
  281.  
  282. NOTE: The trap frame does not contain all registers.
  283.  
  284. Some register values may be zeroed or incorrect.
  285.  
  286. rax=fffff8c325e44d60 rbx=0000000000000000 rcx=ffffe081d22f6a40
  287.  
  288. rdx=ffffe081c81ea8a8 rsi=0000000000000000 rdi=0000000000000000
  289. rip=fffff8c325e44d60 rsp=ffffcd870b337858 rbp=ffffcd870b3378d8
  290. r8=ffffcd870b337838 r9=00000000ffffffff r10=7ffffffffffffffc
  291. r11=ffffd002aa26a080 r12=0000000000000000 r13=0000000000000000
  292. r14=0000000000000000 r15=0000000000000000
  293. iopl=0 nv up ei pl zr na po nc
  294. fffff8c3`25e44d60 ?? ???
  295. Resetting default scope
  296.  
  297. FAILED_INSTRUCTION_ADDRESS:
  298. +0
  299. fffff8c3`25e44d60 ?? ???
  300.  
  301. STACK_TEXT:
  302. ffffcd87`0b337418 fffff807`0e7e33d6 : 00000000`00000050 fffff8c3`25e44d60 00000000`00000010 ffffcd87`0b3376c0 : nt!KeBugCheckEx
  303. ffffcd87`0b337420 fffff807`0e672edf : ffffe081`d22ed000 00000000`00000010 00000000`00000000 fffff8c3`25e44d60 : nt!MiSystemFault+0x1d66a6
  304. ffffcd87`0b337520 fffff807`0e7cf320 : 00000000`0000057b 00000000`000000d0 ffffcd87`0b3379a8 00000000`00000064 : nt!MmAccessFault+0x34f
  305. ffffcd87`0b3376c0 fffff8c3`25e44d60 : ffff893c`eadf84cb 00000000`00000000 ffff8956`c0608ed0 00000000`00000001 : nt!KiPageFault+0x360
  306. ffffcd87`0b337858 ffff893c`eadf84cb : 00000000`00000000 ffff8956`c0608ed0 00000000`00000001 00000000`00000000 : 0xfffff8c3`25e44d60
  307. ffffcd87`0b337860 ffff893c`eadf8226 : ffffcd87`0b337a80 ffffcd87`0b3379a8 ffffcd87`0b337958 ffffe081`d22f6a40 : win32kbase!DirectComposition::CConnection::BeginFrame+0x1fb
  308. ffffcd87`0b337920 fffff807`0e7d2b15 : 00000000`000001fc ffffd002`aa26a080 00000000`000003e8 000001fe`83a9d420 : win32kbase!NtDCompositionBeginFrame+0x196
  309. ffffcd87`0b337a00 00007ffe`82f13404 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
  310. 000000e1`44a9f538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`82f13404
  311.  
  312.  
  313. SYMBOL_NAME: win32kbase!DirectComposition::CConnection::BeginFrame+1fb
  314.  
  315. MODULE_NAME: win32kbase
  316.  
  317.  
  318. IMAGE_NAME: win32kbase.sys
  319.  
  320.  
  321. IMAGE_VERSION: 10.0.18362.418
  322.  
  323. STACK_COMMAND: .thread ; .cxr ; kb
  324.  
  325. BUCKET_ID_FUNC_OFFSET: 1fb
  326.  
  327. FAILURE_BUCKET_ID: AV_INVALID_BAD_IP_win32kbase!DirectComposition::CConnection::BeginFrame
  328.  
  329. OSPLATFORM_TYPE: x64
  330.  
  331. OSNAME: Windows 10
  332.  
  333. FAILURE_ID_HASH: {c40542bf-cb23-3a7f-7278-fff0840dfa4d}
  334.  
  335. Followup: MachineOwner
  336. ---------
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!