Reputation: 509
Everything I see online says that the best way to diagnose a driver that's causing BSODs is to open the crash dump in windbg and run !analyze -v and it'll tell me what driver is the issue. Maybe I'm missing something, but I can't figure out what's supposed to tell me that.
Here's my !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffcb02f821d200, Virtual address for the attempted execute.
Arg2: 8a000001f4c009e3, PTE contents.
Arg3: fffffd87af0973d0, (reserved)
Arg4: 0000000000000003, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 140
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 1196
Key : Analysis.Init.CPU.mSec
Value: 828
Key : Analysis.Init.Elapsed.mSec
Value: 628505
Key : Analysis.Memory.CommitPeak.Mb
Value: 100
Key : WER.OS.Branch
Value: ni_release
Key : WER.OS.Timestamp
Value: 2022-05-06T12:50:00Z
Key : WER.OS.Version
Value: 10.0.22621.1
FILE_IN_CAB: 011525-14328-01.dmp
BUGCHECK_CODE: fc
BUGCHECK_P1: ffffcb02f821d200
BUGCHECK_P2: 8a000001f4c009e3
BUGCHECK_P3: fffffd87af0973d0
BUGCHECK_P4: 3
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MsMpEng.exe
TRAP_FRAME: fffffd87af0973d0 -- (.trap 0xfffffd87af0973d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000111 rbx=0000000000000000 rcx=fffff880e0417290
rdx=fffff8017006af81 rsi=0000000000000000 rdi=0000000000000000
rip=ffffcb02f821d200 rsp=fffffd87af097560 rbp=fffff880e0417290
r8=fffff8fc407020b8 r9=0000000000000000 r10=fffff88000000000
r11=fffff8fc7e3f1000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ffffcb02`f821d200 0000 add byte ptr [rax],al ds:00000000`00000111=??
Resetting default scope
STACK_TEXT:
fffffd87`af097218 fffff801`6f8c95aa : 00000000`000000fc ffffcb02`f821d200 8a000001`f4c009e3 fffffd87`af0973d0 : nt!KeBugCheckEx
fffffd87`af097220 fffff801`6f8c41ee : 00000000`00000011 00000000`00000003 00000000`00000000 fffffd87`af0972f0 : nt!MiCheckSystemNxFault+0x17efa2
fffffd87`af097260 fffff801`6f66a603 : 00000000`00000000 00000000`00000011 fffffd87`af097369 00000000`00000000 : nt!MiRaisedIrqlFault+0x18a0ee
fffffd87`af0972b0 fffff801`6f82617e : fffffd87`af097460 fffff801`6f66f9ed ffffcb02`dbbb5000 fffff801`6f6709f9 : nt!MmAccessFault+0x363
fffffd87`af0973d0 ffffcb02`f821d200 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x37e
fffffd87`af097560 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffcb02`f821d200
SYMBOL_NAME: nt!MiCheckSystemNxFault+17efa2
MODULE_NAME: nt
IMAGE_VERSION: 10.0.22621.4601
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 17efa2
FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
OS_VERSION: 10.0.22621.1
BUILDLAB_STR: ni_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}
Followup: MachineOwner
Also, I don't know if it's relevant, but I get different BSOD error codes when it crashes.
Edit: Also, I don't have any errors shown in Device Manager, and I ran a memory test that didn't find any issues.
Upvotes: 0
Views: 57