Question Which driver is causing the BSOD?

[Countess_C]

I'm getting annoying bluescreens now and then, but I have no idea which driver is causing it. Here's the WindDbg analysis of the minidump:

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffdd846bc8e338, Virtual address for the attempted execute.
Arg2: 81000002a7f88963, PTE contents.
Arg3: ffffbe88d60945e0, (reserved)
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2686

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 5895

Key : Analysis.IO.Other.Mb
Value: 9

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 20

Key : Analysis.Init.CPU.mSec
Value: 1327

Key : Analysis.Init.Elapsed.mSec
Value: 59260

Key : Analysis.Memory.CommitPeak.Mb
Value: 86

Key : Bugcheck.Code.DumpHeader
Value: 0xfc

Key : Bugcheck.Code.KiBugCheckData
Value: 0xfc

Key : Bugcheck.Code.Register
Value: 0xfc

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


FILE_IN_CAB: MEMORY.DMP

BUGCHECK_CODE: fc

BUGCHECK_P1: ffffdd846bc8e338

BUGCHECK_P2: 81000002a7f88963

BUGCHECK_P3: ffffbe88d60945e0

BUGCHECK_P4: 2

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

PROCESS_NAME: firefox.exe

TRAP_FRAME: ffffbe88d60945e0 -- (.trap 0xffffbe88d60945e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa60516194528 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000000000f0 rsi=0000000000000000 rdi=0000000000000000
rip=ffffdd846bc8e338 rsp=ffffbe88d6094770 rbp=ffffca81a8258180
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=ffffba7a92400000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffffdd846bc8e338 1035741105a6 adc byte ptr [ffffdd8411cdf4b2],dh ds:ffffdd8411cdf4b2=?? Resetting default scope STACK_TEXT: ffffbe88d60942f8 fffff80045636db6 : 00000000000000fc ffffdd846bc8e338 81000002a7f88963 ffffbe88d60945e0 : nt!KeBugCheckEx ffffbe88d6094300 fffff800454c3466 : ffffdd846bc8e338 ffffbe88d6094500 0000000000000000 ffff800000000000 : nt!MiCheckSystemNxFault+0x1ec58e ffffbe88d6094340 fffff800454a4d70 : ffffbe8800000000 0000000000000011 ffffbe88d6094660 0000000000000000 : nt!MiSystemFault+0x6c6 ffffbe88d6094440 fffff80045609bd8 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!MmAccessFault+0x400 ffffbe88d60945e0 ffffdd846bc8e338 : ffffdd840000000f fffff80000000007 0000000000000000 ffffa60500000000 : nt!KiPageFault+0x358 ffffbe88d6094770 ffffdd840000000f : fffff80000000007 0000000000000000 ffffa60500000000 ffffdd8400000000 : 0xffffdd846bc8e338
ffffbe88d6094778 fffff80000000007 : 0000000000000000 ffffa60500000000 ffffdd8400000000 ffffa605126a5670 : 0xffffdd840000000f ffffbe88d6094780 0000000000000000 : ffffa60500000000 ffffdd8400000000 ffffa605126a5670 ffffa60500000000 : 0xfffff80000000007


SYMBOL_NAME: nt!MiCheckSystemNxFault+1ec58e

MODULE_NAME: nt

STACK_COMMAND: .cxr; .ecxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 1ec58e

FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}


System info:

Processor AMD Ryzen 7 3700X 8-Core Processor 3.59 GHz
Installerat RAM-minne 15,9 GB
Enhets-ID B863FEED-6968-4ABE-8B9B-67FD8368C4DA
Produkt-ID 00330-80127-49619-AA681
Systemtyp 64-bitars operativsystem, x64-baserad processor
Penna och pekskärm Penn- eller tryckinmatning är inte tillgängligt för den här bildskärmen

Utgåva Windows 10 Pro
Version 21H2
Installerad ‎2020-‎08-‎23
OS-version 19044.2604
Gränssnitt Windows Feature Experience Pack 120.2212.4190.0

 

[Ralston18]

Update your post to include full system hardware specs and OS information.

Any pattern to the BSODs?

What is the system typically doing when a BSOD occurs: Gaming, Video editing, downloads, etc..?

Look in Reliability History and Event Viewer for any error codes, warnings, or even informational events that are being captured just before or at the time of the BSODs.

Any given error or event can be clicked for more details. The details may or may not be helpful.

Try running the built in Windows troubleshooters. The troubleshooters may find and fix something.

Also try "sfc /scannow" and "dism".

FYI:

https://www.lifewire.com/how-to-use-sfc-scannow-to-repair-windows-system-files-2626161

How to use DISM command tool to repair Windows 10 image | Windows Central

 

[Countess_C]

Update your post to include full system hardware specs and OS information.

Any pattern to the BSODs?

What is the system typically doing when a BSOD occurs: Gaming, Video editing, downloads, etc..?

Ok, done. It usually happens randomly when I watch videos or reading on forums. It hasn't happened while gaming, image editing or things like that. Yet.

Look in Reliability History and Event Viewer for any error codes, warnings, or even informational events that are being captured just before or at the time of the BSODs.

Any given error or event can be clicked for more details. The details may or may not be helpful.

I often look in the Event Viewer after the BSODs but haven't found anything happening just before the bluescreens. Found nothing this time either.

Try running the built in Windows troubleshooters. The troubleshooters may find and fix something.

Also try "sfc /scannow" and "dism".

Thanks! I first tried sfc /scannow, and it repaired corrupt files. Looked in the log and it seems like it repaired a file called OneDrive.lnk and some stuff that was "owned twice", whatever that means.

Then I did the dism CheckHealth and ScanHealth and everything was fine.

 

[johnbl]

i might be able to find the driver name if you put the kernel dump
c:\windows\memory.dmp file on a cloud server, share the file for public access and post a link.

last one of these I looked at turned out to be a failed install of a device. you might look in windows control panel device manager for any failed installs. (yellow icon by the device)

 

[Colif]

STACK_TEXT: ffffbe88d60942f8 fffff80045636db6 : 00000000000000fc ffffdd846bc8e338 81000002a7f88963 ffffbe88d60945e0 : nt!KeBugCheckEx ffffbe88d6094300 fffff800454c3466 : ffffdd846bc8e338 ffffbe88d6094500 0000000000000000 ffff800000000000 : nt!MiCheckSystemNxFault+0x1ec58e ffffbe88d6094340 fffff800454a4d70 : ffffbe8800000000 0000000000000011 ffffbe88d6094660 0000000000000000 : nt!MiSystemFault+0x6c6 ffffbe88d6094440 fffff80045609bd8 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!MmAccessFault+0x400 ffffbe88d60945e0 ffffdd846bc8e338 : ffffdd840000000f fffff80000000007 0000000000000000 ffffa60500000000 : nt!KiPageFault+0x358 ffffbe88d6094770 ffffdd840000000f : fffff80000000007 0000000000000000 ffffa60500000000 ffffdd8400000000 : 0xffffdd846bc8e338
ffffbe88d6094778 fffff80000000007 : 0000000000000000 ffffa60500000000 ffffdd8400000000 ffffa605126a5670 : 0xffffdd840000000f ffffbe88d6094780 0000000000000000 : ffffa60500000000 ffffdd8400000000 ffffa605126a5670 ffffa60500000000 : 0xfffff80000000007

its in first in, last out order. IN other words, things at bottom happened before things above.
page faults happen when CPU has to access ram to get data
access faults happen when CPU tries to access ram it doesn't have permission to access.
Generally a driver to blame, as error description suggests.

as john just said, dumps would help

 

[Countess_C]

i might be able to find the driver name if you put the kernel dump
c:\windows\memory.dmp file on a cloud server, share the file for public access and post a link.

last one of these I looked at turned out to be a failed install of a device. you might look in windows control panel device manager for any failed installs. (yellow icon by the device)

I have looked in the device manager and all is ok.

Here's the minidump: https://www.mediafire.com/file/uyz1cicxvdgsvhl/031023-7312-01.rar/file

 

[johnbl]

I can not tell which driver caused the bugcheck from the minidump but I would expect it to be this drvier:
\SystemRoot\System32\drivers\PxHlpa64.sys Tue Apr 24 10:26:29 2012
you can download microsoft autoruns64, run it and find the driver and disable it and reboot and test to see if you bugcheck again
Autoruns for Windows - Sysinternals | Microsoft Learn

the driver is some 3rd party DVD support. (I would just remove it)

notes:
bios is 14 versions out of date (might want the fixes to prevent hacking)
X570 AORUS ELITE (rev. 1.0) Support | Motherboard - GIGABYTE Global
network drivers are pretty old, you should pick up the updates from the above link.(dated 2022/05/06 )
or directly from intel Intel® Driver & Support Assistant


machine info:
BIOS Version F4
BIOS Release Date 09/04/2019
Manufacturer Gigabyte Technology Co., Ltd.
Product Name X570 AORUS ELITE
Version -CF
Processor Version AMD Ryzen 7 3700X 8-Core Processor
Processor Voltage 8bh - 1.1V
External Clock 100MHz
Max Speed 4400MHz
Current Speed 3600MHz

 

[Countess_C]

I can not tell which driver caused the bugcheck from the minidump but I would expect it to be this drvier:
\SystemRoot\System32\drivers\PxHlpa64.sys Tue Apr 24 10:26:29 2012
you can download microsoft autoruns64, run it and find the driver and disable it and reboot and test to see if you bugcheck again
Autoruns for Windows - Sysinternals | Microsoft Learn

the driver is some 3rd party DVD support. (I would just remove it)

Hi, and thanks! If I disable or remove that driver, will the DVD-player still be able to work properly?

Edit: It doesn't seem easy to remove that driver: https://www.tenforums.com/drivers-hardware/184600-pxhlpa64-sys-preventing-core-isolation.html

notes:
bios is 14 versions out of date (might want the fixes to prevent hacking)
X570 AORUS ELITE (rev. 1.0) Support | Motherboard - GIGABYTE Global
network drivers are pretty old, you should pick up the updates from the above link.(dated 2022/05/06 )
or directly from intel Intel® Driver & Support Assistant

Thanks, I will think about it. Updating the BIOS is scary.

 

[johnbl]

Hi, and thanks! If I disable or remove that driver, will the DVD-player still be able to work properly?

Edit: It doesn't seem easy to remove that driver: https://www.tenforums.com/drivers-hardware/184600-pxhlpa64-sys-preventing-core-isolation.html



Thanks, I will think about it. Updating the BIOS is scary.

most modern machines have pretty easy bios updates now.

the dvd should still work UNLESS it was using some strange feature like running via USB.
most likely the driver was sold to many different vendors many apps could have installed it.
you can just use the autoruns and unclick the driver and it will not load, reboot and test your dvd to see if it still works. if it does not work you can run autoruns again and hit the checkmark to enable the driver and reboot.

if you want it gone for good, you delete the driver entry.

for this bugcheck, it would be common for older driers to not use the correct memory flags.
Now because of all of the malware these are getting locked down to prevent data from being executed as code.

 

[Countess_C]

most modern machines have pretty easy bios updates now.

the dvd should still work UNLESS it was using some strange feature like running via USB.
most likely the driver was sold to many different vendors many apps could have installed it.
you can just use the autoruns and unclick the driver and it will not load, reboot and test your dvd to see if it still works. if it does not work you can run autoruns again and hit the checkmark to enable the driver and reboot.

if you want it gone for good, you delete the driver entry.

for this bugcheck, it would be common for older driers to not use the correct memory flags.
Now because of all of the malware these are getting locked down to prevent data from being executed as code.

Thanks, I'll give it a try! It might take a while before I know if it stopped the BSODs from happening, since they are pretty random.

 

[Countess_C]

most modern machines have pretty easy bios updates now.

the dvd should still work UNLESS it was using some strange feature like running via USB.
most likely the driver was sold to many different vendors many apps could have installed it.
you can just use the autoruns and unclick the driver and it will not load, reboot and test your dvd to see if it still works. if it does not work you can run autoruns again and hit the checkmark to enable the driver and reboot.

if you want it gone for good, you delete the driver entry.

for this bugcheck, it would be common for older driers to not use the correct memory flags.
Now because of all of the malware these are getting locked down to prevent data from being executed as code.

I did the sfc /scannow thing earlier in March, as I said before, and it repaired some things, and I had to wait to see if it helped. Nope, I had more BSODs, one on 041423, one on 050423 and now one yesterday 050923. I have now disabled the PxHlpa64.sys driver, but now my optical drive is gone. I guess I can wait for a month or two to see if it helped, and only enable the driver again when I need to use the optical drive. But it's not fun to be without it.

I updated the BIOS today, like you recommended, from the old F4 to F37. Things seem to work as they should, so far. And the new BIOS allows me to upgrade the CPU to a 5900X if I want to.

 

[Countess_C]

I haven't had a bluescreen since I disabled PxHlpa64.sys, so I hope that was the culprit. I did this trick I read on tenforums to make the optical drive work again:

Go to C:\Windows\System32\drivers, rename PxHlpa64.sys to PxHlpa64.sys.old

Go to Registry Editor, find HKEY_LOCAL_MACHINE > System > CurrentControlSet > Control > Class

Find 4D36E965-E325-11CE-BFC1-08002BE10318
Delete LowerFilters and/or UpperFilters (I only had LowerFilters)

If you want to play safe, backup this registry key first.

 

[Colif]

i would suggest adding rest of the quote about core isolation and maybe a link to that thread on tenforum, just in case others need the extra steps.

 

[Countess_C]

i would suggest adding rest of the quote about core isolation and maybe a link to that thread on tenforum, just in case others need the extra steps.

The link is in post #8