Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`ff286018). Type “.hh dbgerr001” for details
Loading unloaded module list
…
-
*
-
Bugcheck Analysis *
-
*
Use !analyze -v to get detailed debugging information.
BugCheck 24, {b500190645, ffffd000ccae02f8, ffffd000ccadfb00, fffff801676ebc5d}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDecodeFileObject+49 )
Followup: MachineOwner
9: kd> !analyze -v
-
*
-
Bugcheck Analysis *
-
*
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 000000b500190645
Arg2: ffffd000ccae02f8
Arg3: ffffd000ccadfb00
Arg4: fffff801676ebc5d
Debugging Details:
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: VMware, Inc.
VIRTUAL_MACHINE: VMware
SYSTEM_PRODUCT_NAME: VMware Virtual Platform
SYSTEM_VERSION: None
BIOS_VENDOR: Phoenix Technologies LTD
BIOS_VERSION: 6.00
BIOS_DATE: 09/30/2014
BASEBOARD_MANUFACTURER: Intel Corporation
BASEBOARD_PRODUCT: 440BX Desktop Reference Platform
BASEBOARD_VERSION: None
DUMP_TYPE: 1
BUGCHECK_P1: b500190645
BUGCHECK_P2: ffffd000ccae02f8
BUGCHECK_P3: ffffd000ccadfb00
BUGCHECK_P4: fffff801676ebc5d
EXCEPTION_RECORD: ffffd000ccae02f8 – (.exr 0xffffd000ccae02f8)
ExceptionAddress: fffff801676ebc5d (Ntfs!NtfsDecodeFileObject+0x0000000000000049)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 000013c04243465e
Attempt to read from address 000013c04243465e
CONTEXT: ffffd000ccadfb00 – (.cxr 0xffffd000ccadfb00)
rax=000013c04243465a rbx=ffffe4018e4a3830 rcx=0000000000000000
rdx=ffffd000ccae0610 rsi=0000000000000000 rdi=ffffe4018e4a3ab0
rip=fffff801676ebc5d rsp=ffffd000ccae0530 rbp=ffffd000ccae0a00
r8=ffffd000ccae05f8 r9=ffffd000ccae0628 r10=ffffd000ccae0618
r11=ffffd000ccae0780 r12=ffffd000ccae0a70 r13=ffffe4018e4a3830
r14=0000000000000001 r15=ffffd000ccae0780
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
Ntfs!NtfsDecodeFileObject+0x49:
fffff801676ebc5d 8b4804 mov ecx,dword ptr [rax+4] ds:002b:000013c0
4243465e=???
Resetting default scope
CPU_COUNT: 20
CPU_MHZ: 6a2
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: f
CPU_STEPPING: 1
CPU_MICROCODE: 6,f,1,0 (F,M,S,R) SIG: 38’00000000 (cache) 38’00000000 (init)
DEFAULT_BUCKET_ID: STRING_DEREFERENCE
PROCESS_NAME: ArcMap.exe
CURRENT_IRQL: 0
FOLLOWUP_IP:
Ntfs!NtfsDecodeFileObject+49
fffff801`676ebc5d 8b4804 mov ecx,dword ptr [rax+4]
FAULTING_IP:
Ntfs!NtfsDecodeFileObject+49
fffff801`676ebc5d 8b4804 mov ecx,dword ptr [rax+4]
BUGCHECK_STR: 0x24
READ_ADDRESS: 000013c04243465e
ERROR_CODE: (NTSTATUS) 0xc0000005 -
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 -
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 000013c04243465e
ANALYSIS_SESSION_HOST: ZHOUGS-PC1
ANALYSIS_SESSION_TIME: 09-10-2020 09:56:53.0376
ANALYSIS_VERSION: 10.0.17763.132 amd64fre
DEVICE_OBJECT: 0000000000000004
LAST_CONTROL_TRANSFER: from fffff80167752744 to fffff801676ebc5d
STACK_TEXT:
ffffd000ccae0530 fffff801
67752744 : 0000000050000018 fffff802
d8cc7d25 000000008e4a3830 fffff802
00000000 : Ntfs!NtfsDecodeFileObject+0x49
ffffd000ccae0570 fffff801
677c2fee : ffffd000ccae0780 ffffe401
8e4a3830 0000000000000000 ffffd000
ccae0a00 : Ntfs!NtfsCommonSetEa+0x94
ffffd000ccae06e0 fffff801
677c318a : ffffd000ccae0780 ffffe401
8e4a3830 ffffe4018e4a3830 fffff801
67db54fc : Ntfs!NtfsFsdDispatchSwitch+0x13e
ffffd000ccae0760 fffff801
6750db1e : ffffe4018e4a3af8 00000000
00000000 fffff6e000919e18 ffffec00
4c76ddd8 : Ntfs!NtfsFsdDispatchWait+0x47
ffffd000ccae09b0 fffff801
6750c0c2 : ffffd000ccae0a70 ffffe001
1ae49490 ffffec004c38c070 ffffe401
8e4a3830 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2ce
ffffd000ccae0a50 fffff802
d8a60788 : 0000000000000001 ffffd000
ccae0b31 ffffec004c38c070 0000001e
00100090 : fltmgr!FltpDispatch+0xb2
ffffd000ccae0ab0 fffff802
d8c59b3a : 0000000000000004 00000000
00000000 0000000000000000 ffffe401
8e4a3830 : nt!IopSynchronousServiceTail+0x170
ffffd000ccae0b80 fffff802
d87d61b3 : ffffe4018e633880 00000000
fe894000 0000000000000000 00000000
fe892000 : nt!NtSetEaFile+0x4ca
ffffd000ccae0c40 00007ffe
a401233a : 0000000000000000 00000000
00000000 0000000000000000 00000000
00000000 : nt!KiSystemServiceCopyEnd+0x13
000000001a8be838 00000000
00000000 : 0000000000000000 00000000
00000000 0000000000000000 00000000
00000000 : 0x00007ffe`a401233a
THREAD_SHA1_HASH_MOD_FUNC: 27c3d0634b372cb90f8f7c7c2427b9e8a4b855ca
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 66cdf10b49fdb5426c310d5f89b709d3d1497d07
THREAD_SHA1_HASH_MOD: 9a2ca6154debbb461080755929258901b6e34132
FAULT_INSTR_CODE: f604488b
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsDecodeFileObject+49
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 54387b6b
IMAGE_VERSION: 6.3.9600.17399
STACK_COMMAND: .cxr 0xffffd000ccadfb00 ; kb
BUCKET_ID_FUNC_OFFSET: 49
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsDecodeFileObject
BUCKET_ID: 0x24_Ntfs!NtfsDecodeFileObject
PRIMARY_PROBLEM_CLASS: 0x24_Ntfs!NtfsDecodeFileObject
TARGET_TIME: 2020-09-09T07:51:35.000Z
OSBUILD: 9600
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 Server TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 08:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: 46c
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x24_ntfs!ntfsdecodefileobject
FAILURE_ID_HASH: {088c6a02-fb95-5b4c-6631-2f37b3c12a38}
Followup: MachineOwner
9: kd> k
Child-SP RetAddr Call Site
00 ffffd000ccadf158 fffff801
676f7eec nt!KeBugCheckEx
01 ffffd000ccadf160 fffff801
67818f9b Ntfs!NtfsExceptionFilter+0x1e8c0
02 ffffd000ccadf320 fffff802
d87b9a96 Ntfs!NtfsFsdDispatchSwitch$filt$0+0x18
03 ffffd000ccadf360 fffff802
d87d1eed nt!_C_specific_handler+0x86
04 ffffd000ccadf3d0 fffff802
d8754125 nt!RtlpExecuteHandlerForException+0xd
05 ffffd000ccadf400 fffff802
d87584de nt!RtlDispatchException+0x1a5
06 ffffd000ccadfad0 fffff802
d87d65c2 nt!KiDispatchException+0x646
07 ffffd000ccae01c0 fffff802
d87d4d14 nt!KiExceptionDispatch+0xc2
08 ffffd000ccae03a0 fffff801
676ebc5d nt!KiPageFault+0x214
09 ffffd000ccae0530 fffff801
67752744 Ntfs!NtfsDecodeFileObject+0x49
0a ffffd000ccae0570 fffff801
677c2fee Ntfs!NtfsCommonSetEa+0x94
0b ffffd000ccae06e0 fffff801
677c318a Ntfs!NtfsFsdDispatchSwitch+0x13e
0c ffffd000ccae0760 fffff801
6750db1e Ntfs!NtfsFsdDispatchWait+0x47
0d ffffd000ccae09b0 fffff801
6750c0c2 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2ce
0e ffffd000ccae0a50 fffff802
d8a60788 fltmgr!FltpDispatch+0xb2
0f ffffd000ccae0ab0 fffff802
d8c59b3a nt!IopSynchronousServiceTail+0x170
10 ffffd000ccae0b80 fffff802
d87d61b3 nt!NtSetEaFile+0x4ca
11 ffffd000ccae0c40 00007ffe
a401233a nt!KiSystemServiceCopyEnd+0x13
12 000000001a8be838 00000000
00000000 0x00007ffe`a401233a