!analyze -v interpretation

NTDEV
1

Could somebody give me a hand understanding this?

0: kd> !analyze -v
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffffa80030e6990, address which referenced memory

Debugging Details:

WRITE_ADDRESS: 0000000000000000

CURRENT_IRQL: 2

FAULTING_IP:
+0
fffffa80`030e6990 0000 add byte ptr [rax],al

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: fffff88002fce6a0 – (.trap 0xfffff88002fce6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80018b4040
rdx=0000000000000013 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa80030e6990 rsp=fffff88002fce838 rbp=0000000000000000
r8=fffff880064cf17c r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
fffffa80030e6990 0000 add byte ptr [rax],al ds:0000000000000000=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002db7cc2 to fffff80002cbdcf0

STACK_TEXT:
fffff88002fcdde8 fffff80002db7cc2 : 0000000000000000 fffffa80018b4040 0000000000000065 fffff80002d017e8 : nt!RtlpBreakWithStatusInstruction
fffff88002fcddf0 fffff80002db8aae : 0000000000000003 0000000000000000 fffff80002d02040 00000000000000d1 : nt!KiBugCheckDebugBreak+0x12
fffff88002fcde50 fffff80002cc5fc4 : 0000000000000000 0000000000000000 0000000000000000 fffff80002d43394 : nt!KeBugCheck2+0x71e
fffff88002fce520 fffff80002cc5469 : 000000000000000a 0000000000000000 0000000000000002 0000000000000001 : nt!KeBugCheckEx+0x104
fffff88002fce560 fffff80002cc40e0 : fffff8800168c110 fffff80002e42e80 fffffa8002b451a0 fffffa80030e68f0 : nt!KiBugCheckDispatch+0x69
fffff88002fce6a0 fffffa80030e6990 : fffffa80030e68f0 fffffa80030e6a10 fffffa80030e68f0 0000000000000000 : nt!KiPageFault+0x260
fffff88002fce838 fffffa80030e68f0 : fffffa80030e6a10 fffffa80030e68f0 0000000000000000 0000000000000000 : 0xfffffa80030e6990 fffff88002fce840 fffffa80030e6a10 : fffffa80030e68f0 0000000000000000 0000000000000000 fffff88002fce8a0 : 0xfffffa80030e68f0
fffff88002fce848 fffffa80030e68f0 : 0000000000000000 0000000000000000 fffff88002fce8a0 00000000000e0082 : 0xfffffa80030e6a10 fffff88002fce850 0000000000000000 : 0000000000000000 fffff88002fce8a0 00000000000e0082 fffffa8003358c80 : 0xfffffa80030e68f0

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiPageFault+260
fffff800`02cc40e0 440f20c0 mov rax,cr8

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: nt!KiPageFault+260

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 54d0317d

FAILURE_BUCKET_ID: X64_0xD1_nt!KiPageFault+260

BUCKET_ID: X64_0xD1_nt!KiPageFault+260

Followup: MachineOwner

2

A driver, the symbols for which you didn’t load, attempted to write to a NULL pointer.

Is that all you’re asking?

Peter
OSR
@OSRDrivers

3

Note the faulting instruction:

fffffa80`030e6990 0000 add byte ptr [rax],al

While this is valid assembly, it’s also the instruction you get when you execute to a memory location containing zeroes (the byte code here is 0000). So your instruction pointer has likely gone bad, either because someone accidentally zeroed out some memory or because you’ve jumped to nowhere.

-scott
OSR
@OSRDrivers