Instant Online Crash Analysis, brought to you by OSR Open Systems Resources, Inc.
Show DivPrimary Analysis

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 8 Kernel Version 16299 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff803`c5a03000 PsLoadedModuleList = 0xfffff803`c5d64fb0
Debug session time: Fri Nov 24 08:14:20.984 2017 (UTC - 5:00)
System Uptime: 0 days 0:04:24.636
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffe107e057ace2, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff803c5ca949d, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 ffffe107e057ace2

FAULTING_IP:
nt!ExFreePoolWithTag+3d
fffff803`c5ca949d 410fb747f2      movzx   eax,word ptr [r15-0Eh]

MM_INTERNAL_CODE:  2

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  ffff8f015bf8a5e0 -- (.trap 0xffff8f015bf8a5e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffe107e057acf0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803c5ca949d rsp=ffff8f015bf8a770 rbp=fffff80ff439c050
 r8=0000000000000001  r9=7fffbe0412317638 r10=7ffffffffffffffc
r11=ffff8f015bf8a810 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!ExFreePoolWithTag+0x3d:
fffff803`c5ca949d 410fb747f2      movzx   eax,word ptr [r15-0Eh] ds:ffffffff`fffffff2=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff803c5ba6640 to fffff803c5b670e0

STACK_TEXT:
ffff8f01`5bf8a358 fffff803`c5ba6640 : 00000000`00000050 ffffe107`e057ace2 00000000`00000000 ffff8f01`5bf8a5e0 : nt!KeBugCheckEx
ffff8f01`5bf8a360 fffff803`c5a72777 : 00000000`00000000 ffffe107`e057ace2 ffff8f01`5bf8a5e0 ffff8f01`5bf8a500 : nt!MiSystemFault+0x116a20
ffff8f01`5bf8a400 fffff803`c5b70c72 : ffffbe04`11264000 ffffbe04`0f1b24f0 ffffa107`dee7d120 fffff80f`f426e001 : nt!MmAccessFault+0xae7
ffff8f01`5bf8a5e0 fffff803`c5ca949d : 00000000`00000000 ffffbe04`123176d0 ffffbe04`00000000 ffffbe04`00000001 : nt!KiPageFault+0x132
ffff8f01`5bf8a770 fffff80f`f435d31d : 00000000`00000000 ffffa107`00000000 ffffa107`00000000 ffffbe04`0cf4b338 : nt!ExFreePoolWithTag+0x3d
ffff8f01`5bf8a840 fffff80f`f439c235 : ffffbe04`0cf4b338 ffffa107`e0b94bf0 ffffa107`e0b94ab0 ffffbe04`0ae76180 : NTFS!NtfsCommonClose+0x59d
ffff8f01`5bf8a910 fffff80f`f439c05f : 00000000`00000200 ffffbe04`0b13f580 ffffbe04`0aef5a70 fffff803`c5f4d590 : NTFS!NtfsFspCloseInternal+0x1c9
ffff8f01`5bf8aa50 fffff803`c5a3fe05 : ffffbe04`0aef5a70 fffff803`c5f4d500 ffffbe04`0aef5a00 ffffbe04`0aef5a70 : NTFS!NtfsFspClose+0xf
ffff8f01`5bf8aa80 fffff803`c5a2bf87 : 00000000`00000000 00000000`00000080 ffffbe04`0aee9040 ffffbe04`0b13f580 : nt!ExpWorkerThread+0xf5
ffff8f01`5bf8ab10 fffff803`c5b6c676 : ffffcf81`280a0180 ffffbe04`0b13f580 fffff803`c5a2bf40 00000000`00000000 : nt!PspSystemThreadStartup+0x47
ffff8f01`5bf8ab60 00000000`00000000 : ffff8f01`5bf8b000 ffff8f01`5bf84000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+3d
fffff803`c5ca949d 410fb747f2      movzx   eax,word ptr [r15-0Eh]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!ExFreePoolWithTag+3d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  59efff9b

FAILURE_BUCKET_ID:  X64_AV_nt!ExFreePoolWithTag+3d

BUCKET_ID:  X64_AV_nt!ExFreePoolWithTag+3d

Followup: MachineOwner
---------


This free analysis is provided by OSR Open Systems Resources, Inc.
Want a deeper understanding of crash dump analysis? Check out our Windows Kernel Debugging and Crash Dump Analysis Seminar (opens in new tab/window)
Show DivCrash Code Links
Show DivInformation About Address 0xffffe107e057ace2
Show DivLoaded Module List
Show DivRaw Stack Contents
Show DivDump Header Information
Show DivStrings