Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Microsoft (R) Windows Debugger Version 10.0.22621.755 AMD64
- Copyright (c) Microsoft Corporation. All rights reserved.
- Using NET for debugging
- Opened WinSock 2.0
- Waiting to reconnect...
- You can get the target MAC address by running .kdtargetmac command.
- Connected to Windows 10 22621 x64 target at (Mon Apr 10 03:17:16.844 2023 (UTC + 2:00)), ptr64 TRUE
- Kernel Debugger connection established.
- Symbol search path is: srv*
- Executable search path is:
- Windows 10 Kernel Version 22621 MP (1 procs) Free x64
- Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
- Machine Name:
- Kernel base = 0xfffff805`06600000 PsLoadedModuleList = 0xfffff805`07213430
- System Uptime: 0 days 0:00:00.908
- KDTARGET: Refreshing KD connection
- Access violation - code c0000005 (!!! second chance !!!)
- nt!ExpInterlockedPushEntrySList+0xd:
- fffff805`06a334ad 498b02 mov rax,qword ptr [r10]
- 1: kd> !analyze -v
- Connected to Windows 10 22621 x64 target at (Mon Apr 10 03:19:57.923 2023 (UTC + 2:00)), ptr64 TRUE
- Loading Kernel Symbols
- ...............................................................
- ................................................................
- .........................................................
- Loading User Symbols
- Loading unloaded module list
- .......
- *******************************************************************************
- * *
- * Bugcheck Analysis *
- * *
- *******************************************************************************
- Unknown bugcheck code (0)
- Unknown bugcheck description
- Arguments:
- Arg1: 0000000000000000
- Arg2: 0000000000000000
- Arg3: 0000000000000000
- Arg4: 0000000000000000
- Debugging Details:
- ------------------
- KEY_VALUES_STRING: 1
- Key : AV.Dereference
- Value: NullPtr
- Key : AV.Fault
- Value: Read
- Key : Analysis.CPU.mSec
- Value: 2718
- Key : Analysis.DebugAnalysisManager
- Value: Create
- Key : Analysis.Elapsed.mSec
- Value: 63841
- Key : Analysis.Init.CPU.mSec
- Value: 1999
- Key : Analysis.Init.Elapsed.mSec
- Value: 167540
- Key : Analysis.Memory.CommitPeak.Mb
- Value: 83
- Key : WER.OS.Branch
- Value: ni_release
- Key : WER.OS.Timestamp
- Value: 2022-05-06T12:50:00Z
- Key : WER.OS.Version
- Value: 10.0.22621.1
- BUGCHECK_CODE: 0
- BUGCHECK_P1: 0
- BUGCHECK_P2: 0
- BUGCHECK_P3: 0
- BUGCHECK_P4: 0
- PROCESS_NAME: System
- READ_ADDRESS: 0000000000000000
- ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
- EXCEPTION_CODE_STR: c0000005
- EXCEPTION_PARAMETER1: 0000000000000000
- EXCEPTION_PARAMETER2: 0000000000000000
- STACK_TEXT:
- ffffa70a`22087638 fffff805`068f51b9 : fffff805`278c105f fffff805`06600000 00000000`01047000 fffff805`278c1a20 : nt!ExpInterlockedPushEntrySList+0xd
- ffffa70a`22087648 00000000`00000000 : ffffe301`786ff000 fffff805`068f519c 00000000`01047000 fffff805`06600000 : nt!KeAllocateInterrupt+0x89
- SYMBOL_NAME: nt!ExpInterlockedPushEntrySList+d
- MODULE_NAME: nt
- IMAGE_NAME: ntkrnlmp.exe
- STACK_COMMAND: .cxr; .ecxr ; kb
- BUCKET_ID_FUNC_OFFSET: d
- FAILURE_BUCKET_ID: ACCESS_VIOLATION_nt!ExpInterlockedPushEntrySList
- OS_VERSION: 10.0.22621.1
- BUILDLAB_STR: ni_release
- OSPLATFORM_TYPE: x64
- OSNAME: Windows 10
- FAILURE_ID_HASH: {bf933696-8d93-97e5-92d7-700b9d51efd0}
- Followup: MachineOwner
- ---------
Advertisement
Add Comment
Please, Sign In to add comment