Question KMODE_EXCEPTION_NOT_HANDLED

Oct 11, 2021
1
0
10
0
I experienced this issue "KMODE_EXCEPTION_NOT_HANDLED" used WinDbg and got the following
"
Microsoft (R) Windows Debugger Version 10.0.22415.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\101021-28500-01.dmp]
Could not open dump file [C:\Windows\Minidump\101021-28500-01.dmp], NTSTATUS 0xC000011E
"An attempt was made to map a file of size zero with the maximum size specified as zero."

Microsoft (R) Windows Debugger Version 10.0.22415.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\100921-24765-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff80327800000 PsLoadedModuleList = 0xfffff8032842a230
Debug session time: Sat Oct 9 17:05:19.882 2021 (UTC + 3:00)
System Uptime: 0 days 9:34:01.969
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff80327bf71c0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff8032ba820b0=000000000000001e
0: kd> !analyze -v
***
  • *
  • Bugcheck Analysis *
  • *
***

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80333e56c8a, The address that the exception occurred at
Arg3: ffffde86e1ed6f48, Parameter 0 of the exception
Arg4: fffff8032ba82920, Parameter 1 of the exception

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 5499

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 81049

Key : Analysis.Init.CPU.mSec
Value: 1124

Key : Analysis.Init.Elapsed.mSec
Value: 141820

Key : Analysis.Memory.CommitPeak.Mb
Value: 82

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 1e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff80333e56c8a

BUGCHECK_P3: ffffde86e1ed6f48

BUGCHECK_P4: fffff8032ba82920

WRITE_ADDRESS: fffff803284fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
fffff8032ba82920

EXCEPTION_PARAMETER1: ffffde86e1ed6f48

EXCEPTION_PARAMETER2: fffff8032ba82920

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: ffffde86e1ed6ff0 -- (.trap 0xffffde86e1ed6ff0)
Unable to read trap frame at ffffde86e1ed6ff0

STACK_TEXT:
fffff803
2ba820a8 fffff80327d0f82f : 000000000000001e ffffffffc0000005 fffff80333e56c8a ffffde86e1ed6f48 : nt!KeBugCheckEx
fffff803
2ba820b0 fffff80327c10aa6 : fffff8032ba82920 fffff80327b40595 ffffde86e1ed7180 fffff80333e56c8a : nt!KiFatalFilter+0x1f
fffff803
2ba820f0 fffff80327bccdd2 : fffff80300000002 fffff803278d3ce0 ffffde86e1ed3000 ffffde86e1ed9000 : nt!KeExpandKernelStackAndCalloutInternal$filt$0+0x16
fffff803
2ba82130 fffff80327c00082 : fffff803278d3ce0 fffff8032ba82710 fffff80327bccd30 0000000000000000 : nt!_C_specific_handler+0xa2
fffff803
2ba821a0 fffff80327ae6dd7 : fffff8032ba82710 0000000000000000 ffffde86e1ed81e0 fffff80327af8458 : nt!RtlpExecuteHandlerForException+0x12
fffff803
2ba821d0 fffff80327ae59d6 : ffffde86e1ed6f48 fffff8032ba82e20 ffffde86e1ed6f48 0000000000000001 : nt!RtlDispatchException+0x297
fffff803
2ba828f0 fffff80327bf8052 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiDispatchException+0x186
fffff803
2ba82fb0 fffff80327bf8020 : fffff80327c092a5 ffffe4031ce30e00 ffffde86e1ed6f10 ffffe4040afc9510 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffffde86
e1ed6e08 fffff80327c092a5 : ffffe4031ce30e00 ffffde86e1ed6f10 ffffe4040afc9510 ffffe4040afc9510 : nt!KiExceptionDispatchOnExceptionStackContinue
ffffde86
e1ed6e10 fffff80327c05443 : 0000000000000000 0000000000000000 ffffe40415110400 ffffe4040f541a00 : nt!KiExceptionDispatch+0x125
ffffde86
e1ed6ff0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : nt!KiPageFault+0x443


SYMBOL_NAME: Ndu!NduInboundTransportClassify+1ba

MODULE_NAME: Ndu

IMAGE_NAME: Ndu.sys

IMAGE_VERSION: 10.0.19041.1030

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1ba

FAILURE_BUCKET_ID: 0x1E_c0000005_Ndu!NduInboundTransportClassify

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {20bb08ac-a1f1-8497-9e04-32de84a8ca09}

Followup: MachineOwner
---------"
Someone please interpret the above information for me.
 

ASK THE COMMUNITY

TRENDING THREADS