Hello tried this code and works ok on windows 8 vmware but on windows 10 vmware had to modify it a bit to work because of bsod. But on real windows 10 got bsod - page fault in non paged area. Tested it on vmware is ok but on real host this bsod do you have an idea why it is very hard to debug on real pc.
!analyze -v
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffff80002c70, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8041c9d23d5, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
*** WARNING: Unable to verify timestamp for gethwid.sys
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 5
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-9IDCT4T
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 38
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : Analysis.System
Value: CreateObject
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffffff80002c70
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8041c9d23d5
BUGCHECK_P4: 2
READ_ADDRESS: fffff8041d2fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8041d20f380: Unable to get Flags value from nt!KdVersionBlock
fffff8041d20f380: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffff80002c70
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 2
PROCESS_NAME: System
TRAP_FRAME: ffff858082d8d8c0 – (.trap 0xffff858082d8d8c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff858082d8dac0 rbx=0000000000000000 rcx=ffff858082d8dcc0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8041c9d23d5 rsp=ffff858082d8da50 rbp=ffff858082d8db50
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=ffff858082d8df38 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!output_l+0x89:
fffff8041c9d23d5 458a0c24 mov r9b,byte ptr [r12] ds:00000000
00000000=??
Resetting default scope
STACK_TEXT:
ffff858082d8d618 fffff804
1ca4e27f : 0000000000000050 ffffffff
80002c70 0000000000000000 ffff8580
82d8d8c0 : nt!KeBugCheckEx
ffff858082d8d620 fffff804
1c8a6960 : 0000000000000000 00000000
00000000 ffff858082d8d940 00000000
00000000 : nt!MiSystemFault+0x1898cf
ffff858082d8d720 fffff804
1ca05f5e : 0000000000000000 ffff8580
00000000 ffffb70917a9b1c0 ffff8807
0d1dcae0 : nt!MmAccessFault+0x400
ffff858082d8d8c0 fffff804
1c9d23d5 : 0000000000000000 00000000
00000000 0000000000000000 00000000
00000000 : nt!KiPageFault+0x35e
ffff858082d8da50 fffff804
1c9ce19a : 0000000000000020 00000000
00000000 ffff858082d8de10 fffff804
1ca097b8 : nt!output_l+0x89
ffff858082d8dd10 fffff804
1c9ce121 : 000000000000007f ffff8580
82d8de10 ffff37403f844682 fffff804
1ca09620 : nt!vsnprintf_l+0x6a
ffff858082d8dd80 fffff804
1c96f46b : ffff858082d8e470 ffff8807
00bd3500 ffff858082d8de40 fffff804
1c9ce08c : nt!vsnprintf+0x11
ffff858082d8ddc0 fffff804
1c962c64 : 0000000000000000 00000000
00000080 0000000000000003 ffffb709
254925e0 : nt!RtlStringCbVPrintfA+0x3f
ffff858082d8ddf0 fffff804
1c962b3c : ffff8807002d0000 ffff8807
00bd3510 ffff858082d8e470 fffff804
1c9fbc30 : nt!vDbgPrintExWithPrefixInternal+0xe4
ffff858082d8def0 fffff804
1d904c70 : ffffffff80002c70 00000000
00000000 ffff88070d1dcae0 ffffb709
0e652880 : nt!DbgPrint+0x3c
ffff858082d8df40 ffffffff
80002c70 : 0000000000000000 ffff8807
0d1dcae0 ffffb7090e652880 00000000
00000000 : gethwid+0x4c70
ffff858082d8df48 00000000
00000000 : ffff88070d1dcae0 ffffb709
0e652880 0000000000000000 ffff8580
00000080 : 0xffffffff`80002c70
SYMBOL_NAME: gethwid+4c70
MODULE_NAME: gethwid
IMAGE_NAME: gethwid.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 4c70
FAILURE_BUCKET_ID: AV_R_INVALID_gethwid!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5c1ae45c-6bee-516e-d466-f1bd94725f76}
Followup: MachineOwner