icrosoft (R) Windows Debugger Version 10.0.25136.1001 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Dump completed successfully, progress percentage: 100
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22000 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22000.1.amd64fre.co_release.210604-1628
Machine Name:
Kernel base = 0xfffff805
Debug session time: Wed Sep 28 19:35:53.343 2022 (UTC - 5:00)
System Uptime: 0 days 3:54:04.972
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
..............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805
0: kd> !analyze -v
***
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffab83226e12d0, Virtual address for the attempted execute.
Arg2: 8a0000011c0009e3, PTE contents.
Arg3: fffff8057bba1e60, (reserved)
Arg4: 0000000000000003, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2062
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2163
Key : Analysis.Init.CPU.mSec
Value: 1140
Key : Analysis.Init.Elapsed.mSec
Value: 3581
Key : Analysis.Memory.CommitPeak.Mb
Value: 92
Key : Bugcheck.Code.DumpHeader
Value: 0xfc
Key : Bugcheck.Code.KiBugCheckData
Value: 0xfc
Key : Bugcheck.Code.Register
Value: 0xfc
Key : Dump.Attributes.AsUlong
Value: 1000
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
FILE_IN_CAB: MEMORY.DMP
DUMP_FILE_ATTRIBUTES: 0x1000
BUGCHECK_CODE: fc
BUGCHECK_P1: ffffab83226e12d0
BUGCHECK_P2: 8a0000011c0009e3
BUGCHECK_P3: fffff8057bba1e60
BUGCHECK_P4: 3
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
TRAP_FRAME: fffff8057bba1e60 -- (.trap 0xfffff8057bba1e60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000542
rdx=0000000000000025 rsi=0000000000000000 rdi=0000000000000000
rip=ffffab83226e12d0 rsp=fffff8057bba1ff0 rbp=0000000000000009
r8=ffffab83325b7058 r9=0000000000000003 r10=0000000000000172
r11=ffffab83325bb6f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ffffab83
Resetting default scope
STACK_TEXT:
fffff805
fffff805
fffff805
fffff805
fffff805
fffff805
fffff805
SYMBOL_NAME: nt!MiCheckSystemNxFault+16d9e8
MODULE_NAME: nt
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 16d9e8
FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}
Followup: MachineOwner
---------
0: kd> .trap 0xfffff8057bba1e60
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000542
rdx=0000000000000025 rsi=0000000000000000 rdi=0000000000000000
rip=ffffab83226e12d0 rsp=fffff8057bba1ff0 rbp=0000000000000009
r8=ffffab83325b7058 r9=0000000000000003 r10=0000000000000172
r11=ffffab83325bb6f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ffffab83
0: kd> lmvm nt
Browse full module list
start end module name
fffff805
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\B745976F1047000\ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: B745976F (This is a reproducible build file hash, not a timestamp)
CheckSum: 00B39E2B
ImageSize: 01047000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Dump completed successfully, progress percentage: 100
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 22000 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22000.1.amd64fre.co_release.210604-1628
Machine Name:
Kernel base = 0xfffff805
7f400000 PsLoadedModuleList = 0xfffff805
80029770Debug session time: Wed Sep 28 19:35:53.343 2022 (UTC - 5:00)
System Uptime: 0 days 3:54:04.972
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
..............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805
7f81ac90 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff805
7bba1c30=00000000000000fc0: kd> !analyze -v
***
- *
- Bugcheck Analysis *
- *
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffab83226e12d0, Virtual address for the attempted execute.
Arg2: 8a0000011c0009e3, PTE contents.
Arg3: fffff8057bba1e60, (reserved)
Arg4: 0000000000000003, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2062
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2163
Key : Analysis.Init.CPU.mSec
Value: 1140
Key : Analysis.Init.Elapsed.mSec
Value: 3581
Key : Analysis.Memory.CommitPeak.Mb
Value: 92
Key : Bugcheck.Code.DumpHeader
Value: 0xfc
Key : Bugcheck.Code.KiBugCheckData
Value: 0xfc
Key : Bugcheck.Code.Register
Value: 0xfc
Key : Dump.Attributes.AsUlong
Value: 1000
Key : WER.OS.Branch
Value: co_release
Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z
Key : WER.OS.Version
Value: 10.0.22000.1
FILE_IN_CAB: MEMORY.DMP
DUMP_FILE_ATTRIBUTES: 0x1000
BUGCHECK_CODE: fc
BUGCHECK_P1: ffffab83226e12d0
BUGCHECK_P2: 8a0000011c0009e3
BUGCHECK_P3: fffff8057bba1e60
BUGCHECK_P4: 3
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
TRAP_FRAME: fffff8057bba1e60 -- (.trap 0xfffff8057bba1e60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000542
rdx=0000000000000025 rsi=0000000000000000 rdi=0000000000000000
rip=ffffab83226e12d0 rsp=fffff8057bba1ff0 rbp=0000000000000009
r8=ffffab83325b7058 r9=0000000000000003 r10=0000000000000172
r11=ffffab83325bb6f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ffffab83
226e12d0 0100 add dword ptr [rax],eax ds:00000000
00000001=????????Resetting default scope
STACK_TEXT:
fffff805
7bba1c28 fffff805
7f8c9784 : 00000000000000fc ffffab83
226e12d0 8a0000011c0009e3 fffff805
7bba1e60 : nt!KeBugCheckExfffff805
7bba1c30 fffff805
7f744ba7 : 0000000000000011 00000000
00000003 0000000000000000 fffff805
7bba1d80 : nt!MiCheckSystemNxFault+0x16d9e8fffff805
7bba1c70 fffff805
7f66673c : ffffffffffffffff 00000000
00000011 fffff8057bba1dc0 00000000
00000000 : nt!MiRaisedIrqlFault+0x2b7fffff805
7bba1cc0 fffff805
7f8298f5 : 0000000001900030 ffffffff
ffffffff 0000000000000000 fffff805
7f669d7d : nt!MmAccessFault+0x3bcfffff805
7bba1e60 ffffab83
226e12d0 : ffffab831d8fa3b0 ffffab83
1d8fa3b0 ffffab83330bdcc8 00000000
00000000 : nt!KiPageFault+0x335fffff805
7bba1ff0 ffffab83
1d8fa3b0 : ffffab831d8fa3b0 ffffab83
330bdcc8 0000000000000000 00000000
00000009 : 0xffffab83226e12d0
fffff805
7bba1ff8 ffffab831d8fa3b0 : ffffab83
330bdcc8 0000000000000000 00000000
00000009 fffff8059963586d : 0xffffab83
1d8fa3b0fffff805
7bba2000 ffffab83
330bdcc8 : 0000000000000000 00000000
00000009 fffff8059963586d ffffab83
2270c1d0 : 0xffffab831d8fa3b0
fffff805
7bba2008 0000000000000000 : 00000000
00000009 fffff8059963586d ffffab83
2270c1d0 0000000000000009 : 0xffffab83
330bdcc8SYMBOL_NAME: nt!MiCheckSystemNxFault+16d9e8
MODULE_NAME: nt
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 16d9e8
FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
OS_VERSION: 10.0.22000.1
BUILDLAB_STR: co_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}
Followup: MachineOwner
---------
0: kd> .trap 0xfffff8057bba1e60
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000542
rdx=0000000000000025 rsi=0000000000000000 rdi=0000000000000000
rip=ffffab83226e12d0 rsp=fffff8057bba1ff0 rbp=0000000000000009
r8=ffffab83325b7058 r9=0000000000000003 r10=0000000000000172
r11=ffffab83325bb6f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ffffab83
226e12d0 0100 add dword ptr [rax],eax ds:00000000
00000001=????????0: kd> lmvm nt
Browse full module list
start end module name
fffff805
7f400000 fffff805
80447000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\FDCBA251C28BD5935DB2F7AEE341482A1\ntkrnlmp.pdbLoaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\B745976F1047000\ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: B745976F (This is a reproducible build file hash, not a timestamp)
CheckSum: 00B39E2B
ImageSize: 01047000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables: