BSOD ATTEMPTED_WRITE_TO_READONLY_MEMORY

Question

Hey, guys. Help me solve the problem. I am getting an error and blue screen. I have a memory dump. Here is the basic information from the dump:

************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : false AllowNugetExeUpdate : false AllowNugetMSCredentialProviderInstall : false AllowParallelInitializationOfLocalRepositories : true

-- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.062 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 36

Microsoft (R) Windows Debugger Version 10.0.25877.1004 AMD64 Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\lu4ic\OneDrive\Рабочий стол\MEMORY.DMP] Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv* Executable search path is: Missing image name, possible paged-out or corrupt data. Unable to load image Unknown_Module_8f8983ff4a3f35ff, Win32 error 0n2 \*\*\* WARNING: Unable to verify timestamp for Unknown\_Module\_8f8983ff4a3f35ff WARNING: Mismatch between nt!KdDebuggerDataBlock and nt!KdVersionBlock - KernBase (Kernel Base Address) Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Windows 10 Kernel Version 19041 MP (32 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Edition build lab: 19041.1.amd64fre.vb\_release.191206-1406 Kernel base = 0xfffff80563400000 PsLoadedModuleList = 0xfffff8056402a770 Debug session time: Fri Dec 15 19:31:08.190 2023 (UTC + 2:00) System Uptime: 0 days 1:07:42.987 Page 1a1ff657d9 too large to be in the dump file. Page 9fa089f09f too large to be in the dump file. Page f6a86aa001 too large to be in the dump file. Page 118001a566 too large to be in the dump file. Page a4a678b003 too large to be in the dump file. Missing image name, possible paged-out or corrupt data. Unable to load image Unknown\_Module\_8f8983ff4a3f35ff, Win32 error 0n2 *** WARNING: Unable to verify timestamp for Unknown_Module_8f8983ff4a3f35ff Missing image name, possible paged-out or corrupt data. Unable to read KLDR\_DATA\_TABLE\_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Loading Kernel Symbols Missing image name, possible paged-out or corrupt data. .Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff`231204ff - NTSTATUS 0xC0000141

Page 67a61623a0 too large to be in the dump file. Loading unloaded module list .Page 98bff8e8f9 too large to be in the dump file. ......... WARNING: .reload failed, module list may be incomplete For analysis of this file, run !analyze -v fffff805637fd6f0 48894c2408 mov qword ptr [rsp+8],rcx ss:ffff9d00a2aff3c0=???????????????? 12: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) An attempt was made to write to readonly memory. The guilty driver is on the stack trace (and is typically the current instruction pointer). When possible, the guilty driver's name (Unicode string) is printed on the BugCheck screen and saved in KiBugCheckDriver. Arguments: Arg1: ffffb35980001ff8, Virtual address for the attempted write. Arg2: 1a0000034739b025, PTE contents. Arg3: ffff9d00a2aff5b0, (reserved) Arg4: 000000000000000a, (reserved)

Debugging Details:

***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR\_DATA\_TABLE\_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR\_DATA\_TABLE\_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR\_DATA\_TABLE\_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR\_DATA\_TABLE\_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR\_DATA\_TABLE\_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR\_DATA\_TABLE\_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Page ffc6c4b too large to be in the dump file. Page 57eff5200b too large to be in the dump file. Page 9ff5f7ca30 too large to be in the dump file. Page d85168840 too large to be in the dump file. Page baff6b8fb too large to be in the dump file. Page 50789e009 too large to be in the dump file. Page 2035abac3d too large to be in the dump file. Page f011f00990 too large to be in the dump file. Page 585ff4c628 too large to be in the dump file. Page 204790498d too large to be in the dump file. Page a0db89b0e1 too large to be in the dump file. Page 86d8606f80 too large to be in the dump file. Page affa8b8cdf too large to be in the dump file. Page 9b0ff6c8ab too large to be in the dump file. Page 19ff779 too large to be in the dump file. Missing image name, possible paged-out or corrupt data. Unable to read KLDR\_DATA\_TABLE\_ENTRY at 221305ff231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete Missing image name, possible paged-out or corrupt data. Unable to read KLDR_DATA_TABLE_ENTRY at 221305ff`231204ff - NTSTATUS 0xC0000141 WARNING: .reload failed, module list may be incomplete

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 61

Key  : Analysis.Elapsed.mSec
Value: 58

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 0

Key  : Analysis.IO.Write.Mb
Value: 0

Key  : Analysis.Init.CPU.mSec
Value: 296

Key  : Analysis.Init.Elapsed.mSec
Value: 7874

Key  : Analysis.Memory.CommitPeak.Mb
Value: 54

Key  : Bugcheck.Code.LegacyAPI
Value: 0xbe

Key  : Failure.Bucket
Value: CORRUPT\_MODULELIST\_AV

Key  : Failure.Hash
Value: {fc259191-ef0c-6215-476f-d32e5dcaf1b7}

Key  : WER.CorruptModuleList
Value: 1

Key  : WER.OS.Branch
Value: vb\_release

Key  : WER.OS.Version
Value: 10.0.19041.1

BUGCHECK_CODE: be

BUGCHECK_P1: ffffb35980001ff8

BUGCHECK_P2: 1a0000034739b025

BUGCHECK_P3: ffff9d00a2aff5b0

BUGCHECK_P4: a

FILE_IN_CAB: MEMORY.DMP

STACK_TEXT:
ffff9d00a2aff3b8 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0xfffff805`637fd6f0

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

STACK_COMMAND: .cxr; .ecxr ; kb

FAILURE_BUCKET_ID: CORRUPT_MODULELIST_AV

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {fc259191-ef0c-6215-476f-d32e5dcaf1b7}

Followup: MachineOwner

Answer 1

Hi Оксана,

My name is Igor, it's a pleasure for me to help others and I'll try to help you.

Please run Windows memory diagnostic tool and switch it to extended mode when it starts (F1 key). Note, test hang at ~21% for more than 2-3 hours means memory error too.

Turn off XMP mode in BIOS if it is turned on.

And if your PC is home assembled, please check your RAM modes (voltage, frequency, timings) are in compliance with numbers in the motherboard compatibility list for your RAM model.

If no errors will be found, use driver verifier to gather additional information.

https://support.microsoft.com/en-us/help/244617...

Run

verifier /standard /all /bootmode resetonbootfail

command, reboot PC and use it as usual (it will be slower). If blue screen happens please share memory dumps to OneDrive for analysis.

Answer 2

Likely this means you did not wait test end. Please try driver verifier.

Answer 3

You may test memory modules one by one.

I tested each card separately. All the cards hung at 21%. Does this mean that all four cards are defective?

Answer 4

You may test memory modules one by one.

Answer 5

Hello Igor. Thank you for your reply. Today, I try run extended test and in 21% it stoped. I think that some memory card do not work. How can I check it?