Hi everyone,
I'm trying to fix a Windows 10 desktop PC (Dell Inspiron 570, AMD Athlon II X2, 4 GB RAM, Samsung 250 GB SSD+ Seagate 750 GB HDD, DVD RW optic drive) that has a BSOD once or twice a week.
I finally got around to debugging the DMP file in C:\Windows\MiniDump with Microsoft's Windbg Preview. Microsoft told me that it's a memory issue- which is why I chose this category. But Windows 10's Memory Diagnostic Tool reported no errors. I also don't see any out of date drivers. Can someone here please translate the DMP to English, and maybe help pinpoint the issue? Thanks!
Here is the debugged DMP:
Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [K:\Users\User\Desktop\071821-12687-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802
Debug session time: Sun Jul 18 08:42:46.823 2021 (UTC - 4:00)
System Uptime: 9 days 18:54:49.205
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802
0: kd> !analyze -v
***
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff80200000018, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8021131c5b2, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 13515
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 142064
Key : Analysis.Init.CPU.mSec
Value: 9280
Key : Analysis.Init.Elapsed.mSec
Value: 149296
Key : Analysis.Memory.CommitPeak.Mb
Value: 81
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: fffff80200000018
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8021131c5b2
BUGCHECK_P4: 2
READ_ADDRESS: fffff8020fefb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
fffff80200000018
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffc307859f3b10 -- (.trap 0xffffc307859f3b10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000001880 rbx=0000000000000000 rcx=ffff8b07618ec490
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8021131c5b2 rsp=ffffc307859f3ca0 rbp=ffff8b075ccc4000
r8=00000000c00000bc r9=ffff9d0200703000 r10=fffff80200000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
mfehidk+0xc5b2:
fffff802
Resetting default scope
STACK_TEXT:
ffffc307
ffffc307
ffffc307
ffffc307
ffffc307
SYMBOL_NAME: mfehidk+c5b2
MODULE_NAME: mfehidk
IMAGE_NAME: mfehidk.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: c5b2
FAILURE_BUCKET_ID: AV_R_INVALID_mfehidk!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {46cfcca4-3630-5f70-fa70-214e3e3a47aa}
Followup: MachineOwner
---------
I'm trying to fix a Windows 10 desktop PC (Dell Inspiron 570, AMD Athlon II X2, 4 GB RAM, Samsung 250 GB SSD+ Seagate 750 GB HDD, DVD RW optic drive) that has a BSOD once or twice a week.
I finally got around to debugging the DMP file in C:\Windows\MiniDump with Microsoft's Windbg Preview. Microsoft told me that it's a memory issue- which is why I chose this category. But Windows 10's Memory Diagnostic Tool reported no errors. I also don't see any out of date drivers. Can someone here please translate the DMP to English, and maybe help pinpoint the issue? Thanks!
Here is the debugged DMP:
Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [K:\Users\User\Desktop\071821-12687-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff802
0f200000 PsLoadedModuleList = 0xfffff802
0fe2a2d0Debug session time: Sun Jul 18 08:42:46.823 2021 (UTC - 4:00)
System Uptime: 9 days 18:54:49.205
Loading Kernel Symbols
...............................................................
................................................................
...................................................
Loading User Symbols
Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff802
0f5f6b90 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffc307
859f3870=00000000000000500: kd> !analyze -v
***
- *
- Bugcheck Analysis *
- *
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff80200000018, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8021131c5b2, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 13515
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 142064
Key : Analysis.Init.CPU.mSec
Value: 9280
Key : Analysis.Init.Elapsed.mSec
Value: 149296
Key : Analysis.Memory.CommitPeak.Mb
Value: 81
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: fffff80200000018
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8021131c5b2
BUGCHECK_P4: 2
READ_ADDRESS: fffff8020fefb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
fffff80200000018
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffc307859f3b10 -- (.trap 0xffffc307859f3b10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000001880 rbx=0000000000000000 rcx=ffff8b07618ec490
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8021131c5b2 rsp=ffffc307859f3ca0 rbp=ffff8b075ccc4000
r8=00000000c00000bc r9=ffff9d0200703000 r10=fffff80200000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
mfehidk+0xc5b2:
fffff802
1131c5b2 41ff5218 call qword ptr [r10+18h] ds:fffff802
00000018=????????????????Resetting default scope
STACK_TEXT:
ffffc307
859f3868 fffff802
0f68dd7d : 0000000000000050 fffff802
00000018 0000000000000000 ffffc307
859f3b10 : nt!KeBugCheckExffffc307
859f3870 fffff802
0f5281a0 : 0000000000000000 00000000
00000000 ffffc307859f3b90 00000000
00000000 : nt!MiSystemFault+0x147d2dffffc307
859f3970 fffff802
0f604d5e : 0000000000000000 ffff8b07
00000000 0000000000000000 00000000
00000000 : nt!MmAccessFault+0x400ffffc307
859f3b10 fffff802
1131c5b2 : 0000000000000000 00000000
000002ae ffff8b075ccc4000 ffffb101
117ae000 : nt!KiPageFault+0x35effffc307
859f3ca0 00000000
00000000 : 00000000000002ae ffff8b07
5ccc4000 ffffb101117ae000 00000000
00001880 : mfehidk+0xc5b2SYMBOL_NAME: mfehidk+c5b2
MODULE_NAME: mfehidk
IMAGE_NAME: mfehidk.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: c5b2
FAILURE_BUCKET_ID: AV_R_INVALID_mfehidk!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {46cfcca4-3630-5f70-fa70-214e3e3a47aa}
Followup: MachineOwner
---------
Last edited: