CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel
code or
data have been corrupted. There are generally three causes for a corruption:
- A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
- A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal
breakpoints,
“bp”, can only be set if the debugger is attached at boot time. Hardware
breakpoints, “ba”, can be set at any time.
- A hardware corruption occurred, e.g. failing RAM holding kernel code or
data.
Arguments:
Arg1: a3a00f58b53c88dd, Reserved
Arg2: b3b71bdf07bc6aa7, Reserved
Arg3: fffff80000bf6000, Failure type dependent information
Arg4: 0000000000000019, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x109
PROCESS_NAME: System
CURRENT_IRQL: 0
TAG_NOT_DEFINED_c000000f: FFFFD000208B8FB0
LAST_CONTROL_TRANSFER: from fffff80001d661f7 to fffff80001d67214
STACK_TEXT:
ffffd000208b1a28 fffff800
01d661f7 : 0000000000000000 ffffe000
024b9000
ffffd000208b1b60 ffffd000
20887180 : intelppm!MWaitIdle+0x18
ffffd000208b1a30 fffff803
c40c8ec3 : ffffd00020887180 ffffd000
208b1b00
000000012c464d4c ffffe000
021958c0 : intelppm!AcpiCStateIdleExecute+0x17
ffffd000208b1a60 fffff803
c40c8957 : ffffd00020887180 ffffd000
208b1c8c
ffffd000208b1c90 ffffd000
208b1c98 : nt!PpmIdleExecuteTransition+0x3d3
ffffd000208b1c50 fffff803
c415dabc : ffffd00020887180 ffffd000
20887180
ffffd00020893100 00000000
00000000 : nt!PoIdle+0x307
ffffd000208b1da0 00000000
00000000 : ffffd000208b2000 ffffd000
208ac000
0000000000000000 00000000
00000000 : nt!KiIdleLoop+0x2c
I don’t see any definition for region type 19.
I see there was a post earlier on NTDEV but not a public reply there.
Knowingly, we are not doing anything to manipulate any critical kernel
regions.
-Deepak
Generally Arg3 points to what is corrupted. Have you tried figuring out what
that is (u, ln, !pool, etc.)?
-scott
OSR
“Deepak Gupta” wrote in message news:xxxxx@ntdev…
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code
or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal
breakpoints,
“bp”, can only be set if the debugger is attached at boot time. Hardware
breakpoints, “ba”, can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or
data.
Arguments:
Arg1: a3a00f58b53c88dd, Reserved
Arg2: b3b71bdf07bc6aa7, Reserved
Arg3: fffff80000bf6000, Failure type dependent information
Arg4: 0000000000000019, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
------------------
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x109
PROCESS_NAME: System
CURRENT_IRQL: 0
TAG_NOT_DEFINED_c000000f: FFFFD000208B8FB0
LAST_CONTROL_TRANSFER: from fffff80001d661f7 to fffff80001d67214
STACK_TEXT:
ffffd000208b1a28 fffff800
01d661f7 : 0000000000000000 ffffe000
024b9000
ffffd000208b1b60 ffffd000
20887180 : intelppm!MWaitIdle+0x18
ffffd000208b1a30 fffff803
c40c8ec3 : ffffd00020887180 ffffd000
208b1b00
000000012c464d4c ffffe000
021958c0 : intelppm!AcpiCStateIdleExecute+0x17
ffffd000208b1a60 fffff803
c40c8957 : ffffd00020887180 ffffd000
208b1c8c
ffffd000208b1c90 ffffd000
208b1c98 : nt!PpmIdleExecuteTransition+0x3d3
ffffd000208b1c50 fffff803
c415dabc : ffffd00020887180 ffffd000
20887180
ffffd00020893100 00000000
00000000 : nt!PoIdle+0x307
ffffd000208b1da0 00000000
00000000 : ffffd000208b2000 ffffd000
208ac000
0000000000000000 00000000
00000000 : nt!KiIdleLoop+0x2c
I don’t see any definition for region type 19.
I see there was a post earlier on NTDEV but not a public reply there.
Knowingly, we are not doing anything to manipulate any critical kernel
regions.
-Deepak
Thanks Scott for Arg3
3: kd> ln fffff80000bf6000
(fffff80000bf7000) Beep!DriverEntry+0xffffffff
ffffffff |
(fffff800`00bf7154) Beep!BeepCancel
3: kd> lmvm beep
start end module name
fffff80000bf6000 fffff800
00bfe000 Beep (pdb symbols)
c:\symbols\beep.pdb\1DAB482E885243F1B8E2476E7D7047701\beep.pdb
Loaded symbol image file: Beep.SYS
Image path: \SystemRoot\System32\Drivers\Beep.SYS
Image name: Beep.SYS
Timestamp: Sat Jul 27 01:16:40 2013 (51F381E8)
CheckSum: 0000FDE4
ImageSize: 00008000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Looks like beep.sys is being corrupted.
So PG on Win 8.1 seems to be protected modules other NTOS as well.
Thanks again.
-Deepak
On Tue, Aug 20, 2013 at 11:40 AM, Scott Noone wrote:
> Generally Arg3 points to what is corrupted. Have you tried figuring out
> what that is (u, ln, !pool, etc.)?
>
> -scott
> OSR
>
> “Deepak Gupta” wrote in message news:xxxxx@ntdev.
> …
>
> CRITICAL_STRUCTURE_CORRUPTION (109)
> This bugcheck is generated when the kernel detects that critical kernel
> code or
> data have been corrupted. There are generally three causes for a
> corruption:
> 1) A driver has inadvertently or deliberately modified critical kernel code
> or data. See http://www.microsoft.com/whdc/**driver/kernel/64bitPatching.*
> *mspx http:
> 2) A developer attempted to set a normal kernel breakpoint using a kernel
> debugger that was not attached when the system was booted. Normal
> breakpoints,
> “bp”, can only be set if the debugger is attached at boot time. Hardware
> breakpoints, “ba”, can be set at any time.
> 3) A hardware corruption occurred, e.g. failing RAM holding kernel code or
> data.
> Arguments:
> Arg1: a3a00f58b53c88dd, Reserved
> Arg2: b3b71bdf07bc6aa7, Reserved
> Arg3: fffff80000bf6000, Failure type dependent information
> Arg4: 0000000000000019, Type of corrupted region, can be
> 0 : A generic data region
> 1 : Modification of a function or .pdata
> 2 : A processor IDT
> 3 : A processor GDT
> 4 : Type 1 process list corruption
> 5 : Type 2 process list corruption
> 6 : Debug routine modification
> 7 : Critical MSR modification
>
> Debugging Details:
> ------------------
>
>
> DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
>
> BUGCHECK_STR: 0x109
>
> PROCESS_NAME: System
>
> CURRENT_IRQL: 0
>
> TAG_NOT_DEFINED_c000000f: FFFFD000208B8FB0
>
> LAST_CONTROL_TRANSFER: from fffff80001d661f7 to fffff80001d67214
>
> STACK_TEXT:
> ffffd000208b1a28 fffff800
01d661f7 : 0000000000000000 ffffe000
024b9000
> ffffd000208b1b60 ffffd000
20887180 : intelppm!MWaitIdle+0x18
> ffffd000208b1a30 fffff803
c40c8ec3 : ffffd00020887180 ffffd000
208b1b00
> 000000012c464d4c ffffe000
021958c0 : intelppm!**
> AcpiCStateIdleExecute+0x17
> ffffd000208b1a60 fffff803
c40c8957 : ffffd00020887180 ffffd000
208b1c8c
> ffffd000208b1c90 ffffd000
208b1c98 : nt!PpmIdleExecuteTransition+ 0x3d3
> ffffd000208b1c50 fffff803
c415dabc : ffffd00020887180 ffffd000
20887180
> ffffd00020893100 00000000
00000000 : nt!PoIdle+0x307
> ffffd000208b1da0 00000000
00000000 : ffffd000208b2000 ffffd000
208ac000
> 0000000000000000 00000000
00000000 : nt!KiIdleLoop+0x2c
>
> I don’t see any definition for region type 19.
> I see there was a post earlier on NTDEV but not a public reply there.
>
> Knowingly, we are not doing anything to manipulate any critical kernel
> regions.
>
> -Deepak
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/ showlists.cfm?list=ntdevhttp:
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.**cfm?name=ListServerhttp:
></http:></http:></http:>