Sysnative Windows Update
Inactive
- Oct 9, 2014
- 741
Have you removed ESET?
[7SP1 x64] Random BSODs when waking from sleep and other
- Thread starter johnymrazko
- Start date
bwv848
BSOD Kernel Dump Senior Analyst
Hi,
Not to interrupt you guys here, but it appears to be that your disk may be the real culprit here. Here are a few excerpts of disk errors I've found in the Event Log.
Do you know whether if this is your SSD or HDD? Disk Management should be able to tell you that. If it's the SSD (which I believe it is), update the firmware and see whether if the system improves. If it's the HDD, I counsel you to back up all your data on it and possibly replace it, or physically remove it from the system. It's most likely failing — remember software tests are never 100% accurate. You may consider running CHKDSK, but (in my experience) it may make things worse.
Not to interrupt you guys here, but it appears to be that your disk may be the real culprit here. Here are a few excerpts of disk errors I've found in the Event Log.
Code:
Event[50040]:
Log Name: System
Source: Ntfs
Date: 2017-11-19T21:10:00.251
Event ID: 55
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: Pali-PC
Description:
[COLOR=#ff0000]The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume2.[/COLOR]
Code:
Event[54523]:
Log Name: System
Source: Disk
Date: 2017-12-02T22:33:45.637
Event ID: 51
Task: N/A
Level: Warning
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: Pali-PC
Description:
[COLOR=#ff0000]An error was detected on device \Device\Harddisk2\DR2 during a paging operation.[/COLOR]
Code:
Event[49999]:
Log Name: System
Source: Disk
Date: 2017-11-19T13:25:55.716
Event ID: 11
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: Pali-PC
Description:
[COLOR=#ff0000]The driver detected a controller error on \Device\Harddisk2\DR2.[/COLOR]
Disk 2 looks to be the SSD, or the C: partition.
Checking the attributes of the SSD and running chkdsk might be worth it.
To check the attributes, you could use Samsung Magician or CrystalDiskInfo and see if there are any problems or marked attributes.
Code:
Description Disk driveManufacturer (Standard disk drives)
Model KINGSTON SV300S37A240G SCSI Disk Device
Bytes/Sector 512
Media Loaded Yes
Media Type Fixed hard disk
Partitions 1
SCSI Bus 4
SCSI Logical Unit 0
SCSI Port 0
SCSI Target ID 0
Sectors/Track 63
Size 223,57 GB (240 054 796 800 bytes)
Total Cylinders 29 185
Total Sectors 468 857 025
Total Tracks 7 442 175
Tracks/Cylinder 255
[COLOR=#ff0000]Partition Disk #1, Partition #0[/COLOR]
Partition Size 223,37 GB (239 843 934 208 bytes)
Partition Starting Offset 210 763 776 bytesChecking the attributes of the SSD and running chkdsk might be worth it.
To check the attributes, you could use Samsung Magician or CrystalDiskInfo and see if there are any problems or marked attributes.
johnymrazko
Member
- Dec 3, 2017
- 15
Here is chkdsk result on ssd
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
347392 file records processed. File verification completed.
961 large file records processed. 0 bad file records processed. 2 EA records processed. 54 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
435156 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
347392 file SDs/SIDs processed. Cleaning up 85 unused index entries from index $SII of file 0x9.
Cleaning up 85 unused index entries from index $SDH of file 0x9.
Cleaning up 85 unused security descriptors.
Security descriptor verification completed.
43883 data files processed. CHKDSK is verifying Usn Journal...
34962240 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
347376 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
23881810 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
234222591 KB total disk space.
138050776 KB in 280259 files.
188184 KB in 43884 indexes.
0 KB in bad sectors.
456391 KB in use by the system.
65536 KB occupied by the log file.
95527240 KB available on disk.
4096 bytes in each allocation unit.
58555647 total allocation units on disk.
23881810 allocation units available on disk.
Internal Info:
00 4d 05 00 3a f2 04 00 04 56 09 00 00 00 00 00 .M..:....V......
ce 01 00 00 36 00 00 00 00 00 00 00 00 00 00 00 ....6...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
347392 file records processed. File verification completed.
961 large file records processed. 0 bad file records processed. 2 EA records processed. 54 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
435156 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
347392 file SDs/SIDs processed. Cleaning up 85 unused index entries from index $SII of file 0x9.
Cleaning up 85 unused index entries from index $SDH of file 0x9.
Cleaning up 85 unused security descriptors.
Security descriptor verification completed.
43883 data files processed. CHKDSK is verifying Usn Journal...
34962240 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
347376 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
23881810 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.
234222591 KB total disk space.
138050776 KB in 280259 files.
188184 KB in 43884 indexes.
0 KB in bad sectors.
456391 KB in use by the system.
65536 KB occupied by the log file.
95527240 KB available on disk.
4096 bytes in each allocation unit.
58555647 total allocation units on disk.
23881810 allocation units available on disk.
Internal Info:
00 4d 05 00 3a f2 04 00 04 56 09 00 00 00 00 00 .M..:....V......
ce 01 00 00 36 00 00 00 00 00 00 00 00 00 00 00 ....6...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
johnymrazko
Member
- Dec 3, 2017
- 15
Here is dump even after ssd firmware update
Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`0321a000 PsLoadedModuleList = 0xfffff800`0345c750
Debug session time: Fri Jan 5 16:37:12.053 2018 (UTC + 1:00)
System Uptime: 0 days 0:32:16.036
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`fffdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {3, fffff8a005b186a0, fffff8a005b186a0, fffff8a0059186a0}
*** ERROR: Module load completed but symbols could not be loaded for avgMonFlt.sys
Probably caused by : Pool_Corruption ( nt!ExFreePool+76b )
Followup: Pool_corruption
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8a005b186a0, the pool entry being checked.
Arg3: fffff8a005b186a0, the read back flink freelist value (should be the same as 2).
Arg4: fffff8a0059186a0, the read back blink freelist value (should be the same as 2).
Debugging Details:
------------------
BUGCHECK_STR: 0x19_3
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: AVGSvc.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff800033c071f to fffff8000328ae00
STACK_TEXT:
fffff880`0d3b84a8 fffff800`033c071f : 00000000`00000019 00000000`00000003 fffff8a0`05b186a0 fffff8a0`05b186a0 : nt!KeBugCheckEx
fffff880`0d3b84b0 fffff800`033c21b1 : 00000000`00000000 fffff8a0`067f7650 fffff8a0`019a9100 fffff800`032b8e6d : nt!ExFreePool+0x76b
fffff880`0d3b8540 fffff800`03267392 : 00000000`0207aac0 fffffa80`16ead870 fffffa80`68507641 fffff880`0144e444 : nt!ExFreePoolWithTag+0x411
fffff880`0d3b85f0 fffff880`05cb221a : 00000000`00000000 00000000`00000000 fffff8a0`067f7660 fffff8a0`019a9010 : nt!RtlDeleteElementGenericTableAvl+0x4e
fffff880`0d3b8620 fffff880`05cc3ca6 : fffff880`0d3b8778 fffffa80`1317f180 fffffa80`16e7e370 00000000`00000009 : avgMonFlt+0xd21a
fffff880`0d3b8650 fffff880`0134a987 : 00000000`00004968 fffffa80`133ab300 fffffa80`180bb110 fffffa80`15c1d170 : avgMonFlt+0x1eca6
fffff880`0d3b86c0 fffff880`0137089c : fffff880`0d3b87c0 00000000`0207aa01 fffffa80`18ffcd90 00000000`00004968 : fltmgr!FltpFilterMessage+0xc7
fffff880`0d3b8710 fffff880`01374ca2 : fffffa80`18ffcd90 00000000`0207aac0 00000000`0207aac0 fffff8a0`019a9010 : fltmgr!FltpMsgDeviceControl+0xdc
fffff880`0d3b8770 fffff880`0134999f : fffffa80`12f04310 00000000`00000000 fffffa80`16ead870 fffffa80`17d0bc30 : fltmgr!FltpMsgDispatch+0xd2
fffff880`0d3b87f0 fffff800`03599e4a : 00000000`00000002 00000000`00000000 fffffa80`16ead870 fffffa80`18ffcd90 : fltmgr! ?? ::FNODOBFM::`string'+0x2e80
fffff880`0d3b8850 fffff800`035ae35c : fffffa80`16ead870 fffffa80`16ead870 fffffa80`16ead870 fffff880`03502180 : nt!IopSynchronousServiceTail+0xfa
fffff880`0d3b88c0 fffff800`035ae3f6 : fffffa80`133ab2d0 00000000`00000000 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0xc49
fffff880`0d3b8a00 fffff800`0328a093 : fffffa80`141126a0 00000000`00000001 fffffa80`15d86600 fffff800`03587b14 : nt!NtDeviceIoControlFile+0x56
fffff880`0d3b8a70 00000000`75502e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01a7e998 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75502e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePool+76b
fffff800`033c071f cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExFreePool+76b
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 6.1.7601.23915
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: X64_0x19_3_nt!ExFreePool+76b
BUCKET_ID: X64_0x19_3_nt!ExFreePool+76b
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x19_3_nt!exfreepool+76b
FAILURE_ID_HASH: {ab733f4b-3d44-7e7f-b6aa-ca74429c9e0d}
Followup: Pool_corruption
---------
Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`0321a000 PsLoadedModuleList = 0xfffff800`0345c750
Debug session time: Fri Jan 5 16:37:12.053 2018 (UTC + 1:00)
System Uptime: 0 days 0:32:16.036
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`fffdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {3, fffff8a005b186a0, fffff8a005b186a0, fffff8a0059186a0}
*** ERROR: Module load completed but symbols could not be loaded for avgMonFlt.sys
Probably caused by : Pool_Corruption ( nt!ExFreePool+76b )
Followup: Pool_corruption
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8a005b186a0, the pool entry being checked.
Arg3: fffff8a005b186a0, the read back flink freelist value (should be the same as 2).
Arg4: fffff8a0059186a0, the read back blink freelist value (should be the same as 2).
Debugging Details:
------------------
BUGCHECK_STR: 0x19_3
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: AVGSvc.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff800033c071f to fffff8000328ae00
STACK_TEXT:
fffff880`0d3b84a8 fffff800`033c071f : 00000000`00000019 00000000`00000003 fffff8a0`05b186a0 fffff8a0`05b186a0 : nt!KeBugCheckEx
fffff880`0d3b84b0 fffff800`033c21b1 : 00000000`00000000 fffff8a0`067f7650 fffff8a0`019a9100 fffff800`032b8e6d : nt!ExFreePool+0x76b
fffff880`0d3b8540 fffff800`03267392 : 00000000`0207aac0 fffffa80`16ead870 fffffa80`68507641 fffff880`0144e444 : nt!ExFreePoolWithTag+0x411
fffff880`0d3b85f0 fffff880`05cb221a : 00000000`00000000 00000000`00000000 fffff8a0`067f7660 fffff8a0`019a9010 : nt!RtlDeleteElementGenericTableAvl+0x4e
fffff880`0d3b8620 fffff880`05cc3ca6 : fffff880`0d3b8778 fffffa80`1317f180 fffffa80`16e7e370 00000000`00000009 : avgMonFlt+0xd21a
fffff880`0d3b8650 fffff880`0134a987 : 00000000`00004968 fffffa80`133ab300 fffffa80`180bb110 fffffa80`15c1d170 : avgMonFlt+0x1eca6
fffff880`0d3b86c0 fffff880`0137089c : fffff880`0d3b87c0 00000000`0207aa01 fffffa80`18ffcd90 00000000`00004968 : fltmgr!FltpFilterMessage+0xc7
fffff880`0d3b8710 fffff880`01374ca2 : fffffa80`18ffcd90 00000000`0207aac0 00000000`0207aac0 fffff8a0`019a9010 : fltmgr!FltpMsgDeviceControl+0xdc
fffff880`0d3b8770 fffff880`0134999f : fffffa80`12f04310 00000000`00000000 fffffa80`16ead870 fffffa80`17d0bc30 : fltmgr!FltpMsgDispatch+0xd2
fffff880`0d3b87f0 fffff800`03599e4a : 00000000`00000002 00000000`00000000 fffffa80`16ead870 fffffa80`18ffcd90 : fltmgr! ?? ::FNODOBFM::`string'+0x2e80
fffff880`0d3b8850 fffff800`035ae35c : fffffa80`16ead870 fffffa80`16ead870 fffffa80`16ead870 fffff880`03502180 : nt!IopSynchronousServiceTail+0xfa
fffff880`0d3b88c0 fffff800`035ae3f6 : fffffa80`133ab2d0 00000000`00000000 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0xc49
fffff880`0d3b8a00 fffff800`0328a093 : fffffa80`141126a0 00000000`00000001 fffffa80`15d86600 fffff800`03587b14 : nt!NtDeviceIoControlFile+0x56
fffff880`0d3b8a70 00000000`75502e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01a7e998 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75502e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePool+76b
fffff800`033c071f cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExFreePool+76b
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 6.1.7601.23915
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: X64_0x19_3_nt!ExFreePool+76b
BUCKET_ID: X64_0x19_3_nt!ExFreePool+76b
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x19_3_nt!exfreepool+76b
FAILURE_ID_HASH: {ab733f4b-3d44-7e7f-b6aa-ca74429c9e0d}
Followup: Pool_corruption
---------
bwv848
BSOD Kernel Dump Senior Analyst
It's obvious that the dump appeared to flag AVG. I suggest you remove AVG at once and run their removal tool, AVG Remover. Was AVG the replacement of ESET? For now use Microsoft Security Essentials for protection.
I am still of the strong belief that your SSD is to blame for the crashes though it passed all diagnostics.
I am still of the strong belief that your SSD is to blame for the crashes though it passed all diagnostics.
johnymrazko
Member
- Dec 3, 2017
- 15
Here is the new dump . Should i buy new ssd?
Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*Symbol information
Symbol search path is: SRV*C:\Windows\symbol_cache*Symbol information
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24000.amd64fre.win7sp1_ldr.171231-1547
Machine Name:
Kernel base = 0xfffff800`0324c000 PsLoadedModuleList = 0xfffff800`0348ba90
Debug session time: Sat Feb 10 19:35:47.104 2018 (UTC + 1:00)
System Uptime: 0 days 9:17:58.088
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffda018). Type ".hh dbgerr001" for details
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a066f13554, 0, fffff88001457fd0, 5}
*** ERROR: Symbol file could not be found. Defaulted to export symbols for em006_64.dll -
*** ERROR: Module load completed but symbols could not be loaded for ehdrv.sys
Probably caused by : em006_64.dll ( em006_64!module_init_entry+ac7e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
READ_ADDRESS: fffff8a066f13554 Paged pool
FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]
MM_INTERNAL_CODE: 5
IMAGE_NAME: em006_64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660
FAULTING_MODULE: fffff88001449000 Ntfs
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0
STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a
STACK_COMMAND: kb
FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)
SYMBOL_STACK_INDEX: 14
SYMBOL_NAME: em006_64!module_init_entry+ac7e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: em006_64
IMAGE_VERSION: 0.0.1175.0
FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e
FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
READ_ADDRESS: fffff8a066f13554 Paged pool
FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]
MM_INTERNAL_CODE: 5
IMAGE_NAME: em006_64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660
FAULTING_MODULE: fffff88001449000 Ntfs
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0
STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a
STACK_COMMAND: kb
FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)
SYMBOL_STACK_INDEX: 14
SYMBOL_NAME: em006_64!module_init_entry+ac7e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: em006_64
IMAGE_VERSION: 0.0.1175.0
FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e
FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
READ_ADDRESS: fffff8a066f13554 Paged pool
FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]
MM_INTERNAL_CODE: 5
IMAGE_NAME: em006_64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660
FAULTING_MODULE: fffff88001449000 Ntfs
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0
STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a
STACK_COMMAND: kb
FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)
SYMBOL_STACK_INDEX: 14
SYMBOL_NAME: em006_64!module_init_entry+ac7e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: em006_64
IMAGE_VERSION: 0.0.1175.0
FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e
FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}
Followup: MachineOwner
Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*Symbol information
Symbol search path is: SRV*C:\Windows\symbol_cache*Symbol information
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24000.amd64fre.win7sp1_ldr.171231-1547
Machine Name:
Kernel base = 0xfffff800`0324c000 PsLoadedModuleList = 0xfffff800`0348ba90
Debug session time: Sat Feb 10 19:35:47.104 2018 (UTC + 1:00)
System Uptime: 0 days 9:17:58.088
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffda018). Type ".hh dbgerr001" for details
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a066f13554, 0, fffff88001457fd0, 5}
*** ERROR: Symbol file could not be found. Defaulted to export symbols for em006_64.dll -
*** ERROR: Module load completed but symbols could not be loaded for ehdrv.sys
Probably caused by : em006_64.dll ( em006_64!module_init_entry+ac7e )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
READ_ADDRESS: fffff8a066f13554 Paged pool
FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]
MM_INTERNAL_CODE: 5
IMAGE_NAME: em006_64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660
FAULTING_MODULE: fffff88001449000 Ntfs
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0
STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a
STACK_COMMAND: kb
FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)
SYMBOL_STACK_INDEX: 14
SYMBOL_NAME: em006_64!module_init_entry+ac7e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: em006_64
IMAGE_VERSION: 0.0.1175.0
FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e
FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
READ_ADDRESS: fffff8a066f13554 Paged pool
FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]
MM_INTERNAL_CODE: 5
IMAGE_NAME: em006_64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660
FAULTING_MODULE: fffff88001449000 Ntfs
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0
STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a
STACK_COMMAND: kb
FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)
SYMBOL_STACK_INDEX: 14
SYMBOL_NAME: em006_64!module_init_entry+ac7e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: em006_64
IMAGE_VERSION: 0.0.1175.0
FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e
FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
READ_ADDRESS: fffff8a066f13554 Paged pool
FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]
MM_INTERNAL_CODE: 5
IMAGE_NAME: em006_64.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660
FAULTING_MODULE: fffff88001449000 Ntfs
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0
STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a
STACK_COMMAND: kb
FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)
SYMBOL_STACK_INDEX: 14
SYMBOL_NAME: em006_64!module_init_entry+ac7e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: em006_64
IMAGE_VERSION: 0.0.1175.0
FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e
FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}
Followup: MachineOwner
Sysnative Windows Update
Inactive
- Oct 9, 2014
- 741
Looks like ESET has caused it. Are you using it?
johnymrazko
Member
- Dec 3, 2017
- 15
No I am not using it
Sysnative Windows Update
Inactive
- Oct 9, 2014
- 741
What does Samsung Magician say about drive's health?
HyperHenry
Active member
I would still run Chrystal Disk Info as suggested in post #23. Looking at the SMART values is better than guessing. I'd also recommend disabling sleep as on a PC it's not needed and can cause needless problems.
- May 7, 2013
- 10,400
For any subsequent crashes, could you please attach the log files using the Sysnative file collection tool?
Has Sysnative Forums helped you? Please consider donating to help us support the site!