Ecco il debug. Chi mi sa aiutare?
Codice:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff800020d7a36, fffffa6007d5e2b0, 0}
Probably caused by : ntkrnlmp.exe ( nt!NtClearEvent+37 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020d7a36, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6007d5e2b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.
FAULTING_IP:
nt!ObReferenceObjectByHandle+206
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9]
CONTEXT: fffffa6007d5e2b0 -- (.cxr 0xfffffa6007d5e2b0)
rax=0000000000000001 rbx=fffffa6007d5ec28 rcx=00000000000002f4
rdx=0000000000000002 rsi=0000000000715500 rdi=fffffa800423a060
rip=fffff800020d7a36 rsp=fffffa6007d5eb10 rbp=0000000000000000
r8=fffff880106a7000 r9=0000100000000000 r10=fffff800020d0e00
r11=000000000026f100 r12=fffff8800d411110 r13=00000000000002f4
r14=0000000000000001 r15=fffffa800512b830
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObReferenceObjectByHandle+0x206:
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9] ds:002b:00000880`106a7000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CoDWaW.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800020d0e37 to fffff800020d7a36
STACK_TEXT:
fffffa60`07d5eb10 fffff800`020d0e37 : 00000000`000bfa00 fffff800`00000002 fffffa80`039aedc0 00000000`00000001 : nt!ObReferenceObjectByHandle+0x206
fffffa60`07d5ebe0 fffff800`01e5ddf3 : fffffa80`0423a060 00000000`00000000 00000000`00da7a64 fffffa80`047000f0 : nt!NtClearEvent+0x37
fffffa60`07d5ec20 00000000`75c23d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c23d09
FOLLOWUP_IP:
nt!NtClearEvent+37
fffff800`020d0e37 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtClearEvent+37
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35
STACK_COMMAND: .cxr 0xfffffa6007d5e2b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020d7a36, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6007d5e2b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.
FAULTING_IP:
nt!ObReferenceObjectByHandle+206
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9]
CONTEXT: fffffa6007d5e2b0 -- (.cxr 0xfffffa6007d5e2b0)
rax=0000000000000001 rbx=fffffa6007d5ec28 rcx=00000000000002f4
rdx=0000000000000002 rsi=0000000000715500 rdi=fffffa800423a060
rip=fffff800020d7a36 rsp=fffffa6007d5eb10 rbp=0000000000000000
r8=fffff880106a7000 r9=0000100000000000 r10=fffff800020d0e00
r11=000000000026f100 r12=fffff8800d411110 r13=00000000000002f4
r14=0000000000000001 r15=fffffa800512b830
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObReferenceObjectByHandle+0x206:
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9] ds:002b:00000880`106a7000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CoDWaW.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800020d0e37 to fffff800020d7a36
STACK_TEXT:
fffffa60`07d5eb10 fffff800`020d0e37 : 00000000`000bfa00 fffff800`00000002 fffffa80`039aedc0 00000000`00000001 : nt!ObReferenceObjectByHandle+0x206
fffffa60`07d5ebe0 fffff800`01e5ddf3 : fffffa80`0423a060 00000000`00000000 00000000`00da7a64 fffffa80`047000f0 : nt!NtClearEvent+0x37
fffffa60`07d5ec20 00000000`75c23d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c23d09
FOLLOWUP_IP:
nt!NtClearEvent+37
fffff800`020d0e37 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtClearEvent+37
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35
STACK_COMMAND: .cxr 0xfffffa6007d5e2b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020d7a36, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6007d5e2b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.
FAULTING_IP:
nt!ObReferenceObjectByHandle+206
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9]
CONTEXT: fffffa6007d5e2b0 -- (.cxr 0xfffffa6007d5e2b0)
rax=0000000000000001 rbx=fffffa6007d5ec28 rcx=00000000000002f4
rdx=0000000000000002 rsi=0000000000715500 rdi=fffffa800423a060
rip=fffff800020d7a36 rsp=fffffa6007d5eb10 rbp=0000000000000000
r8=fffff880106a7000 r9=0000100000000000 r10=fffff800020d0e00
r11=000000000026f100 r12=fffff8800d411110 r13=00000000000002f4
r14=0000000000000001 r15=fffffa800512b830
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObReferenceObjectByHandle+0x206:
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9] ds:002b:00000880`106a7000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CoDWaW.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800020d0e37 to fffff800020d7a36
STACK_TEXT:
fffffa60`07d5eb10 fffff800`020d0e37 : 00000000`000bfa00 fffff800`00000002 fffffa80`039aedc0 00000000`00000001 : nt!ObReferenceObjectByHandle+0x206
fffffa60`07d5ebe0 fffff800`01e5ddf3 : fffffa80`0423a060 00000000`00000000 00000000`00da7a64 fffffa80`047000f0 : nt!NtClearEvent+0x37
fffffa60`07d5ec20 00000000`75c23d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c23d09
FOLLOWUP_IP:
nt!NtClearEvent+37
fffff800`020d0e37 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtClearEvent+37
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35
STACK_COMMAND: .cxr 0xfffffa6007d5e2b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020d7a36, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6007d5e2b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.
FAULTING_IP:
nt!ObReferenceObjectByHandle+206
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9]
CONTEXT: fffffa6007d5e2b0 -- (.cxr 0xfffffa6007d5e2b0)
rax=0000000000000001 rbx=fffffa6007d5ec28 rcx=00000000000002f4
rdx=0000000000000002 rsi=0000000000715500 rdi=fffffa800423a060
rip=fffff800020d7a36 rsp=fffffa6007d5eb10 rbp=0000000000000000
r8=fffff880106a7000 r9=0000100000000000 r10=fffff800020d0e00
r11=000000000026f100 r12=fffff8800d411110 r13=00000000000002f4
r14=0000000000000001 r15=fffffa800512b830
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObReferenceObjectByHandle+0x206:
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9] ds:002b:00000880`106a7000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CoDWaW.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800020d0e37 to fffff800020d7a36
STACK_TEXT:
fffffa60`07d5eb10 fffff800`020d0e37 : 00000000`000bfa00 fffff800`00000002 fffffa80`039aedc0 00000000`00000001 : nt!ObReferenceObjectByHandle+0x206
fffffa60`07d5ebe0 fffff800`01e5ddf3 : fffffa80`0423a060 00000000`00000000 00000000`00da7a64 fffffa80`047000f0 : nt!NtClearEvent+0x37
fffffa60`07d5ec20 00000000`75c23d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c23d09
FOLLOWUP_IP:
nt!NtClearEvent+37
fffff800`020d0e37 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtClearEvent+37
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35
STACK_COMMAND: .cxr 0xfffffa6007d5e2b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020d7a36, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6007d5e2b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.
FAULTING_IP:
nt!ObReferenceObjectByHandle+206
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9]
CONTEXT: fffffa6007d5e2b0 -- (.cxr 0xfffffa6007d5e2b0)
rax=0000000000000001 rbx=fffffa6007d5ec28 rcx=00000000000002f4
rdx=0000000000000002 rsi=0000000000715500 rdi=fffffa800423a060
rip=fffff800020d7a36 rsp=fffffa6007d5eb10 rbp=0000000000000000
r8=fffff880106a7000 r9=0000100000000000 r10=fffff800020d0e00
r11=000000000026f100 r12=fffff8800d411110 r13=00000000000002f4
r14=0000000000000001 r15=fffffa800512b830
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObReferenceObjectByHandle+0x206:
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9] ds:002b:00000880`106a7000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CoDWaW.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800020d0e37 to fffff800020d7a36
STACK_TEXT:
fffffa60`07d5eb10 fffff800`020d0e37 : 00000000`000bfa00 fffff800`00000002 fffffa80`039aedc0 00000000`00000001 : nt!ObReferenceObjectByHandle+0x206
fffffa60`07d5ebe0 fffff800`01e5ddf3 : fffffa80`0423a060 00000000`00000000 00000000`00da7a64 fffffa80`047000f0 : nt!NtClearEvent+0x37
fffffa60`07d5ec20 00000000`75c23d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c23d09
FOLLOWUP_IP:
nt!NtClearEvent+37
fffff800`020d0e37 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtClearEvent+37
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35
STACK_COMMAND: .cxr 0xfffffa6007d5e2b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020d7a36, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6007d5e2b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.
FAULTING_IP:
nt!ObReferenceObjectByHandle+206
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9]
CONTEXT: fffffa6007d5e2b0 -- (.cxr 0xfffffa6007d5e2b0)
rax=0000000000000001 rbx=fffffa6007d5ec28 rcx=00000000000002f4
rdx=0000000000000002 rsi=0000000000715500 rdi=fffffa800423a060
rip=fffff800020d7a36 rsp=fffffa6007d5eb10 rbp=0000000000000000
r8=fffff880106a7000 r9=0000100000000000 r10=fffff800020d0e00
r11=000000000026f100 r12=fffff8800d411110 r13=00000000000002f4
r14=0000000000000001 r15=fffffa800512b830
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObReferenceObjectByHandle+0x206:
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9] ds:002b:00000880`106a7000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CoDWaW.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800020d0e37 to fffff800020d7a36
STACK_TEXT:
fffffa60`07d5eb10 fffff800`020d0e37 : 00000000`000bfa00 fffff800`00000002 fffffa80`039aedc0 00000000`00000001 : nt!ObReferenceObjectByHandle+0x206
fffffa60`07d5ebe0 fffff800`01e5ddf3 : fffffa80`0423a060 00000000`00000000 00000000`00da7a64 fffffa80`047000f0 : nt!NtClearEvent+0x37
fffffa60`07d5ec20 00000000`75c23d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c23d09
FOLLOWUP_IP:
nt!NtClearEvent+37
fffff800`020d0e37 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtClearEvent+37
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35
STACK_COMMAND: .cxr 0xfffffa6007d5e2b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020d7a36, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6007d5e2b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.
FAULTING_IP:
nt!ObReferenceObjectByHandle+206
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9]
CONTEXT: fffffa6007d5e2b0 -- (.cxr 0xfffffa6007d5e2b0)
rax=0000000000000001 rbx=fffffa6007d5ec28 rcx=00000000000002f4
rdx=0000000000000002 rsi=0000000000715500 rdi=fffffa800423a060
rip=fffff800020d7a36 rsp=fffffa6007d5eb10 rbp=0000000000000000
r8=fffff880106a7000 r9=0000100000000000 r10=fffff800020d0e00
r11=000000000026f100 r12=fffff8800d411110 r13=00000000000002f4
r14=0000000000000001 r15=fffffa800512b830
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObReferenceObjectByHandle+0x206:
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9] ds:002b:00000880`106a7000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CoDWaW.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800020d0e37 to fffff800020d7a36
STACK_TEXT:
fffffa60`07d5eb10 fffff800`020d0e37 : 00000000`000bfa00 fffff800`00000002 fffffa80`039aedc0 00000000`00000001 : nt!ObReferenceObjectByHandle+0x206
fffffa60`07d5ebe0 fffff800`01e5ddf3 : fffffa80`0423a060 00000000`00000000 00000000`00da7a64 fffffa80`047000f0 : nt!NtClearEvent+0x37
fffffa60`07d5ec20 00000000`75c23d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c23d09
FOLLOWUP_IP:
nt!NtClearEvent+37
fffff800`020d0e37 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtClearEvent+37
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35
STACK_COMMAND: .cxr 0xfffffa6007d5e2b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800020d7a36, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffa6007d5e2b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.
FAULTING_IP:
nt!ObReferenceObjectByHandle+206
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9]
CONTEXT: fffffa6007d5e2b0 -- (.cxr 0xfffffa6007d5e2b0)
rax=0000000000000001 rbx=fffffa6007d5ec28 rcx=00000000000002f4
rdx=0000000000000002 rsi=0000000000715500 rdi=fffffa800423a060
rip=fffff800020d7a36 rsp=fffffa6007d5eb10 rbp=0000000000000000
r8=fffff880106a7000 r9=0000100000000000 r10=fffff800020d0e00
r11=000000000026f100 r12=fffff8800d411110 r13=00000000000002f4
r14=0000000000000001 r15=fffffa800512b830
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!ObReferenceObjectByHandle+0x206:
fffff800`020d7a36 4b8b0408 mov rax,qword ptr [r8+r9] ds:002b:00000880`106a7000=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: CoDWaW.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800020d0e37 to fffff800020d7a36
STACK_TEXT:
fffffa60`07d5eb10 fffff800`020d0e37 : 00000000`000bfa00 fffff800`00000002 fffffa80`039aedc0 00000000`00000001 : nt!ObReferenceObjectByHandle+0x206
fffffa60`07d5ebe0 fffff800`01e5ddf3 : fffffa80`0423a060 00000000`00000000 00000000`00da7a64 fffffa80`047000f0 : nt!NtClearEvent+0x37
fffffa60`07d5ec20 00000000`75c23d09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0007ee68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c23d09
FOLLOWUP_IP:
nt!NtClearEvent+37
fffff800`020d0e37 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!NtClearEvent+37
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48d1ba35
STACK_COMMAND: .cxr 0xfffffa6007d5e2b0 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
BUCKET_ID: X64_0x3B_nt!NtClearEvent+37
Followup: MachineOwner
---------