Blue Screen of Death Problem

Emil Ikonic 1 Reputation point
2022-02-13T02:49:03.763+00:00

Hello I got this two BSOD Bugs that occured in half an hour, please tell me what caused them. I have BlueStacks 5 emulator, which wasn't running when this happened and my virtualization is enabled:

First one

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffff808611ed5258, Virtual address for the attempted execute.
Arg2: 810000002f4c0963, PTE contents.
Arg3: ffff9284cdc675e0, (reserved)
Arg4: 0000000000000002, (reserved)

Debugging Details:

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 2828

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 15415

Key  : Analysis.Init.CPU.mSec
Value: 733

Key  : Analysis.Init.Elapsed.mSec
Value: 28508

Key  : Analysis.Memory.CommitPeak.Mb
Value: 74

Key  : WER.OS.Branch
Value: vb_release

Key  : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key  : WER.OS.Version
Value: 10.0.19041.1

BUGCHECK_CODE: fc

BUGCHECK_P1: ffff808611ed5258

BUGCHECK_P2: 810000002f4c0963

BUGCHECK_P3: ffff9284cdc675e0

BUGCHECK_P4: 2

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: firefox.exe

TRAP_FRAME: ffff9284cdc675e0 -- (.trap 0xffff9284cdc675e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffbb8ea9c835c8 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000000000a4 rsi=0000000000000000 rdi=0000000000000000
rip=ffff808611ed5258 rsp=ffff9284cdc67770 rbp=ffffd1814eecf180
r8=0000000100000254 r9=ffffd1814eecf180 r10=ffffbb8eaab18080
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffff8086`11ed5258 58 pop rax
Resetting default scope

STACK_TEXT:
ffff9284cdc672f8 fffff8074b084028 : 00000000000000fc ffff808611ed5258 810000002f4c0963 ffff9284cdc675e0 : nt!KeBugCheckEx
ffff9284cdc67300 fffff8074aebdbb6 : ffff808611ed5258 ffff9284cdc67500 ffff928400000000 ffff800000000000 : nt!MiCheckSystemNxFault+0x12dec0
ffff9284cdc67340 fffff8074ae9f4d0 : ffff9284cdc674a0 0000000000000011 ffff9284cdc67660 0000000000000000 : nt!MiSystemFault+0x6c6
ffff9284cdc67440 fffff8074b00545e : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!MmAccessFault+0x400
ffff9284cdc675e0 ffff808611ed5258 : ffff808600000004 fffff80700000000 0000000000000000 ffffbb8e00000000 : nt!KiPageFault+0x35e
ffff9284cdc67770 ffff808600000004 : fffff80700000000 0000000000000000 ffffbb8e00000000 ffff808600000000 : 0xffff808611ed5258 ffff9284cdc67778 fffff80700000000 : 0000000000000000 ffffbb8e00000000 ffff808600000000 ffffbb8ead229dd0 : 0xffff808600000004
ffff9284cdc67780 0000000000000000 : ffffbb8e00000000 ffff808600000000 ffffbb8ead229dd0 ffffbb8e00000000 : 0xfffff807`00000000

SYMBOL_NAME: nt!MiCheckSystemNxFault+12dec0

MODULE_NAME: nt

IMAGE_VERSION: 10.0.19041.1466

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 12dec0

FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}

Followup: MachineOwner

Second

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000129, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8011b6a2e65, address which referenced memory

Debugging Details:

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 2312

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 2293

Key  : Analysis.Init.CPU.mSec
Value: 5936

Key  : Analysis.Init.Elapsed.mSec
Value: 94059

Key  : Analysis.Memory.CommitPeak.Mb
Value: 78

Key  : WER.OS.Branch
Value: vb_release

Key  : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key  : WER.OS.Version
Value: 10.0.19041.1

BUGCHECK_CODE: a

BUGCHECK_P1: 129

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8011b6a2e65

READ_ADDRESS: Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000129

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: firefox.exe

TRAP_FRAME: fffffc83b5ba1330 -- (.trap 0xfffffc83b5ba1330)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd068341a0000 rbx=0000000000000000 rcx=0000000000000000
rdx=8000000000000867 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8011b6a2e65 rsp=fffffc83b5ba14c0 rbp=ffffd000eb24bd68
r8=0000000000000000 r9=fffffff000000000 r10=ffffd068341a07f8
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!MiCompletePrivateZeroFault+0x565:
fffff8011b6a2e65 498b4518 mov rax,qword ptr [r13+18h] ds:0000000000000018=????????????????
Resetting default scope

STACK_TEXT:
fffffc83b5ba11e8 fffff8011b809369 : 000000000000000a 0000000000000129 0000000000000002 0000000000000000 : nt!KeBugCheckEx
fffffc83b5ba11f0 fffff8011b805669 : 0000000000000000 ffffd3097c88cac0 0000000000000000 1a00000034963867 : nt!KiBugCheckDispatch+0x69
fffffc83b5ba1330 fffff8011b6a2e65 : ffffd3097c88c9c0 ffffd000eb24bd68 ffffcb80057ee320 ffffd3097c88c340 : nt!KiPageFault+0x469
fffffc83b5ba14c0 fffff8011b6a28d7 : fffffc83b5ba1790 0000000000000000 0000000000000001 0000000000000000 : nt!MiCompletePrivateZeroFault+0x565
fffffc83b5ba1600 fffff8011b6a1e08 : fffffc83b5ba1790 fffffc83b5ba19e0 ffffd30900000000 0000000000000000 : nt!MiResolvePrivateZeroFault+0x707
fffffc83b5ba1730 fffff8011b6a11dd : 00000000c0000016 0000000000000002 0000000000000000 0000000000000002 : nt!MiResolveDemandZeroFault+0x208
fffffc83b5ba1820 fffff8011b69f2c9 : 0000000000000111 0000000000000004 00000000c0000016 0000000000000000 : nt!MiDispatchFault+0x22d
fffffc83b5ba1960 fffff8011b80555e : ffffd3097c1ed080 0000000000000000 0000000000000000 ffffd30900000000 : nt!MmAccessFault+0x189
fffffc83b5ba1b00 00007ff94619bad9 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x35e
0000007eb4d7e930 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x00007ff9`4619bad9

SYMBOL_NAME: nt!MiCompletePrivateZeroFault+565

MODULE_NAME: nt

IMAGE_VERSION: 10.0.19041.1526

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET: 565

FAILURE_BUCKET_ID: AV_nt!MiCompletePrivateZeroFault

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {da77f906-0950-e1c7-5aba-d57356ac6e7e}

Followup: MachineOwner

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
10,617 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Docs 15,141 Reputation points
    2022-02-13T03:28:44.667+00:00

    Run the V2 log collector and post a share link into this thread:

    https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html
    https://www.elevenforum.com/t/bsod-posting-instructions.103/

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.

    On the bottom of each post there is:

    Propose as answer = answered the question

    On the left side of each post there is /\ with a number: click = a helpful post
    .
    .
    .
    .
    .

    0 comments
  2. Limitless Technology 39,351 Reputation points
    2022-02-21T02:59:17.437+00:00

    Hello @Emil Ikonic

    As per log The ntkrnlmp.exe BSOD could be caused by missing, corrupt or damaged system files on your computer. To see if this is the case, you should run a Windows repair.

    1. Disable any Antivirus program or Windows firewall you may have for temporary purpose.
    2. Cleanup below Temp folders
      C:\Windows\Temp
      %USERPROFILE%\AppData\Local\Temp
    3. Run Disk Cleanup from Select C:\ Drive from Properties- > General -> Disk Cleanup - >Cleanup system files
    4. Run sfc /scannow
    5. Run below DISM command from elevated prompt.

    DISM /Online /Cleanup-Image /CheckHealth
    DISM /Online /Cleanup-Image /ScanHealth
    DISM /Online /Cleanup-Image /RestoreHealth

    1. Driver Verifier monitors Windows kernel-mode drivers and graphics drivers to detect illegal function calls or actions that might corrupt the system. Verify all drivers using below command

    verifier.exe /all

    1. Uninstall and Install Latest version of Video drivers.
    2. Run Windows Memory Diagnostics Tool from windows to check Memory related errors.

    ------
    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments