A
ArjunAnilkumar
Guest
Heres the mini dump analysis
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`7e9f5a80 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff9f05`c77dae40=000000000000001a
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
contains the address of the PFN for the corrupted page table page.
On a 32 bit OS, parameter 2 contains a pointer to the number of used
PTEs, and parameter 3 contains the number of used PTEs.
Arg2: ffff820006545e20
Arg3: 000000000000007c
Arg4: 000000000000007d
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2484
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on ONEPLUS7
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 9084
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41790
BUGCHECK_P2: ffff820006545e20
BUGCHECK_P3: 7c
BUGCHECK_P4: 7d
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: LogonUI.exe
STACK_TEXT:
ffff9f05`c77dae38 fffff803`7e89a5da : 00000000`0000001a 00000000`00041790 ffff8200`06545e20 00000000`0000007c : nt!KeBugCheckEx
ffff9f05`c77dae40 fffff803`7e89ad6e : 00000000`00000000 ffff9f05`c77db550 ffff9bbf`fa848000 ffff9f05`c77db4a0 : nt!MiDeletePteRun+0x17da
ffff9f05`c77db050 fffff803`7e80bedd : 00000000`00000000 ffffb503`ca385700 ffff9f05`c77db4a0 ffff9bbf`fa847ec8 : nt!MiDeleteVaTail+0x6e
ffff9f05`c77db080 fffff803`7e80bafb : ffff9bcd`00000000 ffffb503`ca385700 ffff9f05`00000000 ffff9f05`c77db4f0 : nt!MiWalkPageTablesRecursively+0xc6d
ffff9f05`c77db120 fffff803`7e80bafb : ffff9bcd`00000000 ffffb503`ca385700 ffff9f05`00000001 ffff9f05`c77db500 : nt!MiWalkPageTablesRecursively+0x88b
ffff9f05`c77db1c0 fffff803`7e80bafb : ffff9bcd`00000000 ffffb503`ca385700 ffff9f05`00000002 ffff9f05`c77db510 : nt!MiWalkPageTablesRecursively+0x88b
ffff9f05`c77db260 fffff803`7e85de6b : 00000000`00000000 ffffb503`ca385700 00000000`00000003 ffff9f05`c77db520 : nt!MiWalkPageTablesRecursively+0x88b
ffff9f05`c77db300 fffff803`7e89b991 : ffff9f05`c77db4a0 ffffb503`00000000 ffff9bbe`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b
ffff9f05`c77db400 fffff803`7e86baf0 : 00000000`00000001 ffff9f05`00000000 ffffb503`ca385550 ffffb503`c8ff7080 : nt!MiDeletePagablePteRange+0x4f1
ffff9f05`c77db710 fffff803`7ec360d9 : ffffb503`cb8b93c0 00000000`00000000 ffffb503`00000000 ffffb503`00000000 : nt!MiDeleteVad+0x360
ffff9f05`c77db820 fffff803`7ec35770 : ffffb503`cb8b93c0 ffffb503`cbfcfcb0 ffffb503`c8ff7080 00000000`00000000 : nt!MiUnmapVad+0x49
ffff9f05`c77db850 fffff803`7ec33a3f : ffffb503`c62a2f10 ffffb503`c62a2f10 ffffb503`cb8b93c0 ffffb503`ca385080 : nt!MiCleanVad+0x30
ffff9f05`c77db880 fffff803`7ec5db24 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffb503`ca385080 : nt!MmCleanProcessAddressSpace+0x137
ffff9f05`c77db900 fffff803`7ed06b16 : ffffb503`ca385080 ffffa306`d730a7b0 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffff9f05`c77db990 fffff803`7ed0a00e : ffffb503`00000000 00000000`00000001 0000024b`4bf31250 000000e9`c6628000 : nt!PspExitThread+0x5f6
ffff9f05`c77dba90 fffff803`7ea074b8 : ffffb503`ca385080 ffffb503`c8ff7080 ffff9f05`c77dbb80 ffffb503`ca385080 : nt!NtTerminateProcess+0xde
ffff9f05`c77dbb00 00007fff`f48acba4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000e9`c65bfb28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`f48acba4
SYMBOL_NAME: nt!MiDeletePteRun+17da
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 17da
FAILURE_BUCKET_ID: 0x1a_41790_nt!MiDeletePteRun
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {27ce5d5a-97b1-faf0-183f-c86809269d56}
Followup: MachineOwner
---------
Continue reading...
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`7e9f5a80 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff9f05`c77dae40=000000000000001a
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
contains the address of the PFN for the corrupted page table page.
On a 32 bit OS, parameter 2 contains a pointer to the number of used
PTEs, and parameter 3 contains the number of used PTEs.
Arg2: ffff820006545e20
Arg3: 000000000000007c
Arg4: 000000000000007d
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2484
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on ONEPLUS7
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 9084
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41790
BUGCHECK_P2: ffff820006545e20
BUGCHECK_P3: 7c
BUGCHECK_P4: 7d
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: LogonUI.exe
STACK_TEXT:
ffff9f05`c77dae38 fffff803`7e89a5da : 00000000`0000001a 00000000`00041790 ffff8200`06545e20 00000000`0000007c : nt!KeBugCheckEx
ffff9f05`c77dae40 fffff803`7e89ad6e : 00000000`00000000 ffff9f05`c77db550 ffff9bbf`fa848000 ffff9f05`c77db4a0 : nt!MiDeletePteRun+0x17da
ffff9f05`c77db050 fffff803`7e80bedd : 00000000`00000000 ffffb503`ca385700 ffff9f05`c77db4a0 ffff9bbf`fa847ec8 : nt!MiDeleteVaTail+0x6e
ffff9f05`c77db080 fffff803`7e80bafb : ffff9bcd`00000000 ffffb503`ca385700 ffff9f05`00000000 ffff9f05`c77db4f0 : nt!MiWalkPageTablesRecursively+0xc6d
ffff9f05`c77db120 fffff803`7e80bafb : ffff9bcd`00000000 ffffb503`ca385700 ffff9f05`00000001 ffff9f05`c77db500 : nt!MiWalkPageTablesRecursively+0x88b
ffff9f05`c77db1c0 fffff803`7e80bafb : ffff9bcd`00000000 ffffb503`ca385700 ffff9f05`00000002 ffff9f05`c77db510 : nt!MiWalkPageTablesRecursively+0x88b
ffff9f05`c77db260 fffff803`7e85de6b : 00000000`00000000 ffffb503`ca385700 00000000`00000003 ffff9f05`c77db520 : nt!MiWalkPageTablesRecursively+0x88b
ffff9f05`c77db300 fffff803`7e89b991 : ffff9f05`c77db4a0 ffffb503`00000000 ffff9bbe`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b
ffff9f05`c77db400 fffff803`7e86baf0 : 00000000`00000001 ffff9f05`00000000 ffffb503`ca385550 ffffb503`c8ff7080 : nt!MiDeletePagablePteRange+0x4f1
ffff9f05`c77db710 fffff803`7ec360d9 : ffffb503`cb8b93c0 00000000`00000000 ffffb503`00000000 ffffb503`00000000 : nt!MiDeleteVad+0x360
ffff9f05`c77db820 fffff803`7ec35770 : ffffb503`cb8b93c0 ffffb503`cbfcfcb0 ffffb503`c8ff7080 00000000`00000000 : nt!MiUnmapVad+0x49
ffff9f05`c77db850 fffff803`7ec33a3f : ffffb503`c62a2f10 ffffb503`c62a2f10 ffffb503`cb8b93c0 ffffb503`ca385080 : nt!MiCleanVad+0x30
ffff9f05`c77db880 fffff803`7ec5db24 : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffb503`ca385080 : nt!MmCleanProcessAddressSpace+0x137
ffff9f05`c77db900 fffff803`7ed06b16 : ffffb503`ca385080 ffffa306`d730a7b0 00000000`00000000 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffff9f05`c77db990 fffff803`7ed0a00e : ffffb503`00000000 00000000`00000001 0000024b`4bf31250 000000e9`c6628000 : nt!PspExitThread+0x5f6
ffff9f05`c77dba90 fffff803`7ea074b8 : ffffb503`ca385080 ffffb503`c8ff7080 ffff9f05`c77dbb80 ffffb503`ca385080 : nt!NtTerminateProcess+0xde
ffff9f05`c77dbb00 00007fff`f48acba4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000e9`c65bfb28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`f48acba4
SYMBOL_NAME: nt!MiDeletePteRun+17da
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 17da
FAILURE_BUCKET_ID: 0x1a_41790_nt!MiDeletePteRun
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {27ce5d5a-97b1-faf0-183f-c86809269d56}
Followup: MachineOwner
---------
Continue reading...