[SOLVED] BSOD Critical process died after running CSGO frequently

[techjunkie007]

Hi,

So, from last few months, I have been facing this issue frequently where I get BSOD - Critical process died when I was playing CSGO
Here's the minidump:
https://www.mediafire.com/file/ex5v888cfqt6kwt/010923-6203-01.zip/file

my pc specs are
ryzen 9 5950X
32gb 3600mhz ram
500GB SSD + 2TB HDD + 1TB HDD
MSI MAG X570S Tomahawk Max WIFI Motherboard
GTX 970

Can someone help me with this?
Happy new year everyone!!

 

[johnbl]

bugcheck was due to a process that died, it was in the 32bit subsystem
the process name was
svchost.exe
this is a generic name of a service. It will have to be updated but you wiil not know which one it is.
when I attempt to read the command line I get this in the debugger:
CommandLine: '< Name not readable >'



svchost.exe is a shell used to run a .exe as a service. to determine which copy caused the problem you have to see the command line parameters as to how it was called. This would require a kernel memory dump or full memory dump to see it in the debugger.

the system was running for only 15 minutes.
the call was made from user mode, I would update any razer drivers and maybe your audio drivers as a guess as the source of the problem. (update firmware of razer device if you can)

best guess would be to update or remove this driver:
\SystemRoot\System32\drivers\RzDev_0f1f.sys Mon Aug 17 20:59:56 2020

second guess would be that this file has been modified:
Aug 22 04:46:42 2018 C:\Windows\System32\KERNELBA祳_献役
it was called just before the bugcheck.
it could just be a debugger bug but is should be kernbase.dll

 

[techjunkie007]

bugcheck was due to a process that died, it was in the 32bit subsystem
the process name was
svchost.exe
this is a generic name of a service. It will have to be updated but you wiil not know which one it is.
when I attempt to read the command line I get this in the debugger:
CommandLine: '< Name not readable >'



svchost.exe is a shell used to run a .exe as a service. to determine which copy caused the problem you have to see the command line parameters as to how it was called. This would require a kernel memory dump or full memory dump to see it in the debugger.

the system was running for only 15 minutes.
the call was made from user mode, I would update any razer drivers and maybe your audio drivers as a guess as the source of the problem. (update firmware of razer device if you can)

best guess would be to update or remove this driver:
\SystemRoot\System32\drivers\RzDev_0f1f.sys Mon Aug 17 20:59:56 2020

Thanks @johnbl, I just updated the Razer firmware completely and will try to run my game again.
In the meanwhile, Is there anything I can do to elaborate the debugging process or get even more detailed logs?

 

[johnbl]

Thanks @johnbl, I just updated the Razer firmware completely and will try to run my game again.
In the meanwhile, Is there anything I can do to elaborate the debugginggam process or get even more detailed logs?

you could change the memory dump type to kernel and I could read the command line for the service host to see who made the call.
since this is a 32 bit subsystem games and programs might modify the sub system files and that might account for the modified kernbase.dll.
Not sure how to fix that for the sub system.

kernel memory dumps are much larger than minidumps. they show info running on all cpu rather than just the one that crashed. It also contains the internal logs. it generally doe not include much more for the subsystems. for that you have to get a full memory dump and the file will be the size of the amount of RAM for your system.

start with a kernel dump if you continue to crash.

you might run:

1. Open command prompt with administrator access
2. Type each command below and wait until scan is completed.

sfc /scannow
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
DISM /online /cleanup-image /startcomponentcleanup /resetbase

DISM /online /cleanup-image /startcomponentcleanup

edit: added the last two dism commands


I am not sure it will repair the file that looked modified but it will not hurt.
-------------
edit:
looked up how to fix kernbase.dll

Can you perform the commands below by running command prompt as an admin.

regsvr32 /u KernelBase.dll. This will unregister the file.

regsvr32 /i KernelBase.dll. This will register the file.

 

[johnbl]

here is another thing you can try:
download microsoft rammap64 from here:
RAMMap - Sysinternals | Microsoft Learn
run it as an admin then find the empty menu item and select each one in turn.
the main thing is to empty the standby list.
this is for the case where the dism.exe command did not find any corrupted files in storage. Windows may be running the program from a RAM memory image that has been modified. This is were windows load a program into standby memory before you event try to run it. Then it only has to mark the memory as active and not load everything when you try to run the program. The memory image might be modified. Deleting the standby list will remove it and force a full load of the program from disk. It also has the side effect of making your memory dumps a lot smaller for a full memory dump.

 

[techjunkie007]

bugcheck was due to a process that died, it was in the 32bit subsystem
the process name was
svchost.exe
this is a generic name of a service. It will have to be updated but you wiil not know which one it is.
when I attempt to read the command line I get this in the debugger:
CommandLine: '< Name not readable >'



svchost.exe is a shell used to run a .exe as a service. to determine which copy caused the problem you have to see the command line parameters as to how it was called. This would require a kernel memory dump or full memory dump to see it in the debugger.

the system was running for only 15 minutes.
the call was made from user mode, I would update any razer drivers and maybe your audio drivers as a guess as the source of the problem. (update firmware of razer device if you can)

best guess would be to update or remove this driver:
\SystemRoot\System32\drivers\RzDev_0f1f.sys Mon Aug 17 20:59:56 2020

second guess would be that this file has been modified:
Aug 22 04:46:42 2018 C:\Windows\System32\KERNELBA祳_献役
it was called just before the bugcheck.
it could just be a debugger bug but is should be kernbase.dll

Indeed the solution was to update Razer Synapze after all. I haven't faced the issue in last 2 hours of gaming which was never possible in last 4 months!!
All thanks to you! For all these months, I thought I was mistaken to go for Ryzen but it was just a software issue. Thanks very much!

 

[techjunkie007]

you could change the memory dump type to kernel and I could read the command line for the service host to see who made the call.
since this is a 32 bit subsystem games and programs might modify the sub system files and that might account for the modified kernbase.dll.
Not sure how to fix that for the sub system.

kernel memory dumps are much larger than minidumps. they show info running on all cpu rather than just the one that crashed. It also contains the internal logs. it generally doe not include much more for the subsystems. for that you have to get a full memory dump and the file will be the size of the amount of RAM for your system.

start with a kernel dump if you continue to crash.

you might run:

1. Open command prompt with administrator access
2. Type each command below and wait until scan is completed.

sfc /scannow
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
DISM /online /cleanup-image /startcomponentcleanup /resetbase

DISM /online /cleanup-image /startcomponentcleanup

edit: added the last two dism commands


I am not sure it will repair the file that looked modified but it will not hurt.
-------------
edit:
looked up how to fix kernbase.dll

Can you perform the commands below by running command prompt as an admin.

regsvr32 /u KernelBase.dll. This will unregister the file.

regsvr32 /i KernelBase.dll. This will register the file.

Thanks for the detailed analysis and help here! I will perform this as well to clean up!