PageFault analysis sample

Note: "--...--" replaces parts you can sanitize if you wish.




Microsoft (R) Windows Debugger Version 10.0.26100.1 AMD64
^^^^^^^^^^^^^ output of your windbg version, classic and "new" have their own sets of bugs

--...--

Windows 10 Kernel Version 26100 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0xfffff802`cdc00000 PsLoadedModuleList = 0xfffff802`ceaf4770

--...--

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffffffffffffa8b, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8026410aeb8, If non-zero, the instruction address which referenced the bad memory address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------

--...--

TRAP_FRAME:  fffff607c4792380 -- (.trap 0xfffff607c4792380)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffffffffffa88 rbx=0000000000000000 rcx=fffffffffffffa88
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8026410aeb8 rsp=fffff607c4792510 rbp=fffff607c47958c0
 r8=ffffe58b2efb5a50  r9=00000000000000c2 r10=ffffe58b2d100140
r11=ffff8481d4b83000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
blabla!blablabla:
fffff802`6410aeb8 8a4003          mov     al,byte ptr [rax+3] ds:ffffffff`fffffa8b=??
Resetting default scope


--...--

VVVVVVVVVVVVVVVVV exec the .trap command from above ^^^^


1: kd> .trap 0xfffff607c4792380
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffffffffffa88 rbx=0000000000000000 rcx=fffffffffffffa88
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8026410aeb8 rsp=fffff607c4792510 rbp=fffff607c47958c0
 r8=ffffe58b2efb5a50  r9=00000000000000c2 r10=ffffe58b2d100140
r11=ffff8481d4b83000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
blabla!blablabla:
fffff802`6410aeb8 8a4003          mov     al,byte ptr [rax+3] ds:ffffffff`fffffa8b=??

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ we can see valid volatile regs


1: kd> .cxr; k

 # Child-SP          RetAddr               Call Site
00 fffff607`c4792118 fffff802`cdf80bb5     nt!KeBugCheckEx
01 fffff607`c4792120 fffff802`cde2daaf     nt!MiSystemFault+0x735
02 fffff607`c4792210 fffff802`ce2821cb     nt!MmAccessFault+0x2ff
03 fffff607`c4792380 fffff802`6410aeb8     nt!KiPageFault+0x38b
04 fffff607`c4792510 fffff802`6410ab86     blabla!blablabla
<something-something-more>

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
in this case relevant frame number is **4**, (before the KiPageFault), so exec this:


1: kd> .frame /c /r 4
04 fffff607`c4792510 fffff802`6410ab86     blabla!blablabla
rax=fffffffffffffa88 rbx=ffffe58b33102000 rcx=fffffffffffffa88
rdx=0000000000000000 rsi=ffffe58b3aa59bad rdi=ffffe58b2efc3e20
rip=fffff8026410aeb8 rsp=fffff607c4792510 rbp=fffff607c47958c0
 r8=ffffe58b2efb5a50  r9=00000000000000c2 r10=ffffe58b2d100140
r11=ffff8481d4b83000 r12=0000000000000000 r13=ffffe58b3207ade0
r14=ffffe58b33102000 r15=ffffffff80002398
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00040246
blabla!blablabla:
fffff802`6410aeb8 8a4003          mov     al,byte ptr [rax+3] ds:002b:ffffffff`fffffa8b=??

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ we can see valid non-volatile regs


1: kd> ub . L10; u . L10
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ give some exec context
<something-something>


1: kd> uf .
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ more exec context so as not to request it back and forth
<something-something>


1: kd> dps @rsp L800
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ just dump stack data (optional, but can give more info)
<something-something>