What caused the BSOD, would you help me to analyze it ? RRS feed

  • Question

  • Loading User Symbols
    Loading unloaded module list
    For analysis of this file, run !analyze -v
    fffff806`0adf5e40 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffffb00`2176ddf0=000000000000001a
    0: kd> !analyze -v
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
        # Any other values for parameter 1 must be individually examined.
    Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
    	the PTE. Parameters 3/4 contain the low/high parts of the PTE.
    Arg2: fffff97b04400ec8
    Arg3: 000000100c100000
    Arg4: 0000000000000000
    Debugging Details:
        Key  : Analysis.CPU.mSec
        Value: 3608
        Key  : Analysis.DebugAnalysisManager
        Value: Create
        Key  : Analysis.Elapsed.mSec
        Value: 27099
        Key  : Analysis.Init.CPU.mSec
        Value: 389
        Key  : Analysis.Init.Elapsed.mSec
        Value: 31313
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 75
        Key  : MemoryManagement.PFN
        Value: 100c100
      Kernel Generated Triage Dump
    BUGCHECK_P1: 41792
    BUGCHECK_P2: fffff97b04400ec8
    BUGCHECK_P3: 100c100000
    BUGCHECK_P4: 0
    BLACKBOXBSD: 1 (!blackboxbsd)
    BLACKBOXNTFS: 1 (!blackboxntfs)
    BLACKBOXPNP: 1 (!blackboxpnp)
    PROCESS_NAME:  SpatialAudioLi
    fffffb00`2176dde8 fffff806`0ac9d0fa     : 00000000`0000001a 00000000`00041792 fffff97b`04400ec8 00000010`0c100000 : nt!KeBugCheckEx
    fffffb00`2176ddf0 fffff806`0ac0b9e6     : 00000000`00000000 00000000`00000000 00000000`0000000a fffff97b`04400ec8 : nt!MiDeleteVa+0x153a
    fffffb00`2176def0 fffff806`0ac0bafb     : fffff97c`bd822000 ffff8985`0b187740 fffffb00`00000000 fffffb00`2176e360 : nt!MiWalkPageTablesRecursively+0x776
    fffffb00`2176df90 fffff806`0ac0bafb     : fffff97c`be5ec110 ffff8985`0b187740 fffffb00`00000001 fffffb00`2176e370 : nt!MiWalkPageTablesRecursively+0x88b
    fffffb00`2176e030 fffff806`0ac0bafb     : fffff97c`be5ec000 ffff8985`0b187740 fffffb00`00000002 fffffb00`2176e380 : nt!MiWalkPageTablesRecursively+0x88b
    fffffb00`2176e0d0 fffff806`0ac5de6b     : 00000000`00000000 ffff8985`0b187740 00000000`00000003 fffffb00`2176e390 : nt!MiWalkPageTablesRecursively+0x88b
    fffffb00`2176e170 fffff806`0ac9b991     : fffffb00`2176e310 ffff8985`00000001 00000000`00000002 fffff806`00000000 : nt!MiWalkPageTables+0x36b
    fffffb00`2176e270 fffff806`0b062b84     : 00000000`00040282 fffff806`0aca8b0e ffff998e`00000000 ffff8984`f98d5080 : nt!MiDeletePagablePteRange+0x4f1
    fffffb00`2176e580 fffff806`0acd5094     : ffff8985`0b1870c0 00000000`054f22e0 00000000`00000002 fffff806`00000000 : nt!MiDeleteVadBitmap+0x8c
    fffffb00`2176e610 fffff806`0b062a00     : ffff8985`0b1870c0 ffff8985`0b187800 ffff8985`0b187740 ffff8985`0e8a6080 : nt!MiDeleteFinalPageTables+0xc8
    fffffb00`2176e6d0 fffff806`0b05fe6f     : ffff8985`0b1870c0 fffffb00`2176e790 ffff8985`0e8a6080 ffff8985`0b187508 : nt!MmDeleteProcessAddressSpace+0x64
    fffffb00`2176e720 fffff806`0affb300     : ffff8985`0b187090 ffff8985`0b187090 00000000`00000000 ffff8984`f98f7900 : nt!PspProcessDelete+0x13f
    fffffb00`2176e7b0 fffff806`0ac61277     : 00000000`00000000 00000000`00000000 fffffb00`2176e939 ffff8985`0b1870c0 : nt!ObpRemoveObjectRoutine+0x80
    fffffb00`2176e810 fffff806`0b028d6e     : ffff8984`f98f7900 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObjectWithTag+0xc7
    fffffb00`2176e850 fffff806`0b02c9ec     : 00000000`00001240 ffff8985`0e8a6080 00000000`00000000 000000a8`5b95d480 : nt!ObCloseHandleTableEntry+0x29e
    fffffb00`2176e990 fffff806`0ae077b5     : ffff8985`00000000 00000000`00000001 fffffb00`2176ea80 fffffb00`2176ea80 : nt!NtClose+0xec
    fffffb00`2176ea00 00007ffd`9640cf04     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
    000000a8`5b95d1b8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`9640cf04
    SYMBOL_NAME:  nt!MiDeleteVa+153a
    IMAGE_VERSION:  10.0.19041.928
    STACK_COMMAND:  .thread ; .cxr ; kb
    IMAGE_NAME:  ntkrnlmp.exe
    FAILURE_BUCKET_ID:  0x1a_41792_nt!MiDeleteVa
    OSNAME:  Windows 10
    FAILURE_ID_HASH:  {ad6dfca3-101b-35a8-d6e1-12de9ecbc1f5}
    Followup:     MachineOwner

    Wednesday, May 12, 2021 2:35 AM

All replies

  • Cause this

    Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
    	the PTE. Parameters 3/4 contain the low/high parts of the PTE.

    IMAGE_NAME: ntkrnlmp.exe

    Also you can need trace that 0000000000041792

    • Edited by Peter2222 Thursday, May 20, 2021 7:58 AM
    Thursday, May 20, 2021 7:56 AM
  • reset your BSOD
    Tuesday, May 25, 2021 7:59 AM
  • Hi,

    Check the error log files and see what happened before the BSOD. This can help you figure out what caused the BSOD, whether it was a driver problem or a problem with a Windows update/piece of software. You can also Google search for the code/error that is showing on the bluescreen. But without your system specs, I can't be more specific than that.

    Thank you

    Friday, May 28, 2021 1:45 PM
  • The BSOD error can cause the system to crash suddenly after a shutdown error. It even becomes difficult to note the error code. 
    It indicates a possible corruption of the disk file system and is most likely caused by bad sectors on your hard disk. This problem is related to the NTFS file system. In order not to kill your PC, the automatic mechanism shuts down your computer.
    The problem is located 
    in the-- NTFS.SYS file. This is a driver file that allows to read and write to the NTFS-system. 
    >You can use Windows Defender and Security Essentials to recheck your PC for viruses/malware and clean them.
    >Check the hard drive for corruption using the CHKDSK /F command mentioned above, responding to the warning messages.
    >Check for outdated drivers using a driver update tool. These tools check all the drivers on your system & automatically update them with the latest ones.
    >Run a disk defragmentation tool available in Windows. You can also try to repair individual locations on your hard drive using this software.
    Wednesday, June 2, 2021 12:04 PM