- Jun 20, 2008
- 3
- 0
- 18,510
My Windows 10 install has been rock solid up until this point. I got my first BSOD today, returning the error CRITICAL_PROCESS_DIED. Before this, I have been struggling with memory errors with Chrome and other programs opened, resulting in black program screens and crashes.
The usual error was "The instruction at 0x00000000000xxxxx referenced memory at at 0x0000000xxxx. The memory could not be read."
I believe the triggering event was when I attempted to update my AMD graphics card. The update continued to fail because it could not update the .NET framework. In my infinite wisdom, I removed the particular framework install and ran the AMD update successfully. I have a feeling that this has been the source of my errors.
sfc and dism commands have not detected anything when ran through Powershell.
Hardware:
AMD Ryzen 5 2600X
Windows 10 Home 10.0.18363 Build 18363
16GB RAM
AMD Radeon RX 570
***
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffffd68aeb1333c0, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4874
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-KHU034U
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 7163
Key : Analysis.Memory.CommitPeak.Mb
Value: 89
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: ef
BUGCHECK_P1: ffffd68aeb1333c0
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
PROCESS_NAME: csrss.exe
CRITICAL_PROCESS: csrss.exe
ERROR_CODE: (NTSTATUS) 0x100 - STATUS_KERNEL_APC
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CONTEXT: 00000211f2d6ffa0 -- (.cxr 0x211f2d6ffa0)
Unable to read context, Win32 error 0n30
EXCEPTION_CODE_STR: 100
EXCEPTION_PARAMETER1: 32726a6770013276
EXCEPTION_PARAMETER2: 7c016b657267a401
EXCEPTION_PARAMETER3: 6568b00132727567
EXCEPTION_PARAMETER4: 0
EXCEPTION_RECORD: 00000211f3564cc8 -- (.exr 0x211f3564cc8)
ExceptionAddress: 3c0132676e628000
ExceptionCode: 00000100
ExceptionFlags: bc020a00
NumberParameters: 1819441507
Parameter[0]: 32726a6770013276
Parameter[1]: 7c016b657267a401
Parameter[2]: 6568b00132727567
Parameter[3]: 726d686bbc017262
Parameter[4]: cc0132646e6bd801
Parameter[5]: 616ce401206f616c
Parameter[6]: 326d6c6df0016e74
Parameter[7]: 5202676e6f6d4602
Parameter[8]: 726f5e02726d796d
Parameter[9]: 756c617476023279
Parameter[10]: 8e02326c65746a02
Parameter[11]: 69749a0269616874
Parameter[12]: 326c6d74a6027462
Parameter[13]: 524105003c008202
Parameter[14]: 20594c4d22002041
STACK_TEXT:
fffffc8e
fffffc8e
fffffc8e
fffffc8e
fffffc8e
fffffc8e
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
0000001b
STACK_COMMAND: .cxr 0x211f2d6ffa0 ; kb
SYMBOL_NAME: ntdll!NtTerminateProcess+14
MODULE_NAME: ntdll
IMAGE_NAME: ntdll.dll
IMAGE_VERSION: 10.0.18362.1316
BUCKET_ID_FUNC_OFFSET: 14
FAILURE_BUCKET_ID: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_f1573080_ntdll!NtTerminateProcess
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e7d45d85-1849-5b27-e2d5-4d02f62a3cec}
Followup: MachineOwner
---------
6: kd> lmvm ntdll
Browse full module list
start end module name
00007ffa
Loaded symbol image file: ntdll.dll
Mapped memory image file: C:\ProgramData\Dbg\sym\ntdll.dll\45A49E531f0000\ntdll.dll
Image path: C:\WINDOWS\SYSTEM32\ntdll.dll
Image name: ntdll.dll
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 45A49E53 (This is a reproducible build file hash, not a timestamp)
CheckSum: 001ED1B7
ImageSize: 001F0000
File version: 10.0.18362.1316
Product version: 10.0.18362.1316
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntdll.dll
OriginalFilename: ntdll.dll
ProductVersion: 10.0.18362.1316
FileVersion: 10.0.18362.1316 (WinBuild.160101.0800)
FileDescription: NT Layer DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
The usual error was "The instruction at 0x00000000000xxxxx referenced memory at at 0x0000000xxxx. The memory could not be read."
I believe the triggering event was when I attempted to update my AMD graphics card. The update continued to fail because it could not update the .NET framework. In my infinite wisdom, I removed the particular framework install and ran the AMD update successfully. I have a feeling that this has been the source of my errors.
sfc and dism commands have not detected anything when ran through Powershell.
Hardware:
AMD Ryzen 5 2600X
Windows 10 Home 10.0.18363 Build 18363
16GB RAM
AMD Radeon RX 570
***
- *
- Bugcheck Analysis *
- *
CRITICAL_PROCESS_DIED (ef)
A critical system process died
Arguments:
Arg1: ffffd68aeb1333c0, Process object or thread object
Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4874
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-KHU034U
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 7163
Key : Analysis.Memory.CommitPeak.Mb
Value: 89
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: ef
BUGCHECK_P1: ffffd68aeb1333c0
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
PROCESS_NAME: csrss.exe
CRITICAL_PROCESS: csrss.exe
ERROR_CODE: (NTSTATUS) 0x100 - STATUS_KERNEL_APC
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CONTEXT: 00000211f2d6ffa0 -- (.cxr 0x211f2d6ffa0)
Unable to read context, Win32 error 0n30
EXCEPTION_CODE_STR: 100
EXCEPTION_PARAMETER1: 32726a6770013276
EXCEPTION_PARAMETER2: 7c016b657267a401
EXCEPTION_PARAMETER3: 6568b00132727567
EXCEPTION_PARAMETER4: 0
EXCEPTION_RECORD: 00000211f3564cc8 -- (.exr 0x211f3564cc8)
ExceptionAddress: 3c0132676e628000
ExceptionCode: 00000100
ExceptionFlags: bc020a00
NumberParameters: 1819441507
Parameter[0]: 32726a6770013276
Parameter[1]: 7c016b657267a401
Parameter[2]: 6568b00132727567
Parameter[3]: 726d686bbc017262
Parameter[4]: cc0132646e6bd801
Parameter[5]: 616ce401206f616c
Parameter[6]: 326d6c6df0016e74
Parameter[7]: 5202676e6f6d4602
Parameter[8]: 726f5e02726d796d
Parameter[9]: 756c617476023279
Parameter[10]: 8e02326c65746a02
Parameter[11]: 69749a0269616874
Parameter[12]: 326c6d74a6027462
Parameter[13]: 524105003c008202
Parameter[14]: 20594c4d22002041
STACK_TEXT:
fffffc8e
bc9d4c78 fffff8010ccc9a69 : 00000000000000ef ffffd68aeb1333c0 0000000000000000 0000000000000000 : nt!KeBugCheckExfffffc8e
bc9d4c80 fffff8010cbda521 : ffffd68aeb1333c0 fffff8010c520d35 ffffd68aeb1333c0 fffff8010c4e9438 : nt!PspCatchCriticalBreak+0x115fffffc8e
bc9d4d20 fffff8010ca72898 : ffffd68a00000000 0000000000000000 ffffd68aeb1333c0 ffffd68aeb1333c0 : nt!PspTerminateAllThreads+0x165a55fffffc8e
bc9d4d90 fffff8010cad6dc9 : ffffffffffffffff fffffc8ebc9d4ec0 ffffd68aeb1333c0 fffffc8ebc9d4e01 : nt!PspTerminateProcess+0xe0fffffc8e
bc9d4dd0 fffff8010c5d5358 : ffffd68a00000304 ffffd68af1573080 ffffd68aeb1333c0 0000001b730be280 : nt!NtTerminateProcess+0xa9fffffc8e
bc9d4e40 00007ffa11a7cc74 : 00007ffa0e878301 00000211f3564cc8 00000211f33da92e ffffffffee1e5d00 : nt!KiSystemServiceCopyEnd+0x280000001b
730bd928 00007ffa0e878301 : 00000211f3564cc8 00000211f33da92e ffffffffee1e5d00 0000000000000c28 : ntdll!NtTerminateProcess+0x140000001b
730bd930 00007ffa11aafc78 : 0000001b730be1e0 00007ffa0e8781d0 0000001b730be020 00007ffa0f56c045 : CSRSRV!CsrUnhandledExceptionFilter+0x1310000001b
730bd9c0 00007ffa11a803d0 : 0000001b730be770 0000001b730be0b0 0000000000000000 00007ffa119fe2d9 : ntdll!LdrpLogFatalUserCallbackException+0x980000001b
730bdb00 00007ffa11a8184f : 00007ffa11b52770 0000000000000000 0000000000000000 0000001b730be770 : ntdll!KiUserCallbackDispatcherHandler+0x200000001b
730bdb40 00007ffa11a4a889 : 0000001b00000001 00007ffa119e0000 0000000000000000 00007ffa11b52770 : ntdll!RtlpExecuteHandlerForException+0xf0000001b
730bdb70 00007ffa11a804be : 00000211f3564cc8 00000211f2d6ffa0 0000000000000000 0000000000000000 : ntdll!RtlDispatchException+0x2190000001b
730be280 00007ffa0fcd7726 : 0000000000000000 00007ffa0fccc004 0000000000000000 00007ffa11a04f93 : ntdll!KiUserExceptionDispatch+0x2e0000001b
730be990 00007ffa0fcd769f : 0000021100000000 0000000000000000 0000001b730bea50 0000000000000000 : USER32!DefDlgProcWorker+0x660000001b
730bea50 00007ffa0fcd5c1d : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : USER32!DefDlgProcW+0x4f0000001b
730bea90 00007ffa0fcd57ec : 0000000000000008 00007ffa11a7c480 00000000000c04f2 0000000080000000 : USER32!UserCallWinProcCheckWow+0x2bd0000001b
730bec20 00007ffa0fce5c08 : 0000001b730bed38 0000000000000000 0000000000000000 00007ffa0fd67130 : USER32!DispatchClientMessage+0x9c0000001b
730bec80 00007ffa11a80464 : 0000000000000000 0000000000008040 0000480800000050 00007ffa11a7c480 : USER32!_fnNCDESTROY+0x380000001b
730bece0 00007ffa0fa61f24 : 00007ffa0fcc7dc1 ffffffff00000000 0000000000000000 0000000000000000 : ntdll!KiUserCallbackDispatcherContinue0000001b
730bed68 00007ffa0fcc7dc1 : ffffffff00000000 0000000000000000 0000000000000000 0000000000000000 : win32u!NtUserCreateWindowEx+0x140000001b
730bed70 00007ffa0fcc6623 : 00000000000002fc 0000001b00000001 0000000000010101 00000000000002fc : USER32!VerNtUserCreateWindowEx+0x2110000001b
730bf100 00007ffa0fcebcf5 : 00000397fb615332 000000000000004b 0000000000010009 0000000000000002 : USER32!InternalCreateDialog+0x6130000001b
730bf2e0 00007ffa0fd33009 : 0000000000010009 0000001b730bf440 0000001b730bf660 00000211eca861c0 : USER32!InternalDialogBox+0x1010000001b
730bf340 00007ffa0fd31a45 : 0000000000000000 0000000000000095 00000000000002f8 0000000000000032 : USER32!SoftModalMessageBox+0x7e90000001b
730bf490 00007ffa0fd32782 : 0000000000000000 0000000000000010 000000000000000e 0000000000000800 : USER32!MessageBoxWorker+0x3190000001b
730bf640 00007ffa0e8098a9 : 0000ff0000000000 00007ffa11a1aec6 0000000000000001 00007ffa0e81ca40 : USER32!MessageBoxTimeoutW+0x1920000001b
730bf740 00007ffa0e809d8d : 0000000000000000 00007ffa0e81ca40 0000000000000000 00007ffa0e81ca40 : winsrvext!HardErrorHandler+0x32d0000001b
730bf900 00007ffa0e80a27e : 00000211eca62980 00000211eca62980 0000000000000000 0000000000000001 : winsrvext!ProcessHardErrorRequest+0xe90000001b
730bf970 00007ffa0e87868d : 0000001b730bfc90 00007ffa11a4edae 0000000000000000 00000211eca52110 : winsrvext!UserHardErrorEx+0x4be0000001b
730bfa30 00007ffa0e877c7a : 00007ffa0e870000 0000000000000000 0000000000000000 00000211eca52530 : CSRSRV!QueueHardError+0x1a50000001b
730bfa70 00007ffa11a4d4df : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : CSRSRV!CsrApiRequestThread+0x260a0000001b
730bff00 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!RtlUserThreadStart+0x2fSTACK_COMMAND: .cxr 0x211f2d6ffa0 ; kb
SYMBOL_NAME: ntdll!NtTerminateProcess+14
MODULE_NAME: ntdll
IMAGE_NAME: ntdll.dll
IMAGE_VERSION: 10.0.18362.1316
BUCKET_ID_FUNC_OFFSET: 14
FAILURE_BUCKET_ID: 0xEF_csrss.exe_BUGCHECK_CRITICAL_PROCESS_f1573080_ntdll!NtTerminateProcess
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e7d45d85-1849-5b27-e2d5-4d02f62a3cec}
Followup: MachineOwner
---------
6: kd> lmvm ntdll
Browse full module list
start end module name
00007ffa
119e0000 00007ffa11bd0000 ntdll (pdb symbols) C:\ProgramData\Dbg\sym\ntdll.pdb\7EE935EEAE220FF810D5D4F0B5AD0E4C1\ntdll.pdbLoaded symbol image file: ntdll.dll
Mapped memory image file: C:\ProgramData\Dbg\sym\ntdll.dll\45A49E531f0000\ntdll.dll
Image path: C:\WINDOWS\SYSTEM32\ntdll.dll
Image name: ntdll.dll
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 45A49E53 (This is a reproducible build file hash, not a timestamp)
CheckSum: 001ED1B7
ImageSize: 001F0000
File version: 10.0.18362.1316
Product version: 10.0.18362.1316
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntdll.dll
OriginalFilename: ntdll.dll
ProductVersion: 10.0.18362.1316
FileVersion: 10.0.18362.1316 (WinBuild.160101.0800)
FileDescription: NT Layer DLL
LegalCopyright: © Microsoft Corporation. All rights reserved.
Facebook
Twitter
Instagram