Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Minidump\081715-6500-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Symbol Path validation summary ************** Response Time (ms) Location Deferred SRV*C:\Minidump\SYMBOLS*http://msdl.microsoft.com/download/symbols Symbol search path is: SRV*C:\Minidump\SYMBOLS*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 8 Kernel Version 9600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 9600.17936.amd64fre.winblue_ltsb.150715-0840 Machine Name: Kernel base = 0xfffff802`c1079000 PsLoadedModuleList = 0xfffff802`c134e7b0 Debug session time: Mon Aug 17 13:11:53.698 2015 (UTC + 2:00) System Uptime: 0 days 2:10:14.174 Loading Kernel Symbols ............................................................... ................................................................ ................................. Loading User Symbols Loading unloaded module list ........... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {b500190645, ffffd00022b05fe8, ffffd00022b057f0, fffff8016246a940} Probably caused by : Ntfs.sys ( Ntfs!memcpy+1c0 ) Followup: MachineOwner --------- 7: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 000000b500190645 Arg2: ffffd00022b05fe8 Arg3: ffffd00022b057f0 Arg4: fffff8016246a940 Debugging Details: ------------------ EXCEPTION_RECORD: ffffd00022b05fe8 -- (.exr 0xffffd00022b05fe8) ExceptionAddress: fffff8016246a940 (Ntfs!memcpy+0x00000000000001c0) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000078 Attempt to read from address 0000000000000078 CONTEXT: ffffd00022b057f0 -- (.cxr 0xffffd00022b057f0;r) rax=ffffc001fc0c41f0 rbx=0000000000000000 rcx=ffffe00026bf0778 rdx=00001fffd940f908 rsi=00000000522e1e28 rdi=0000000052526612 rip=fffff8016246a940 rsp=ffffd00022b06228 rbp=ffffd00022b062c0 r8=0000000000000040 r9=0000000000000008 r10=00000000200aa000 r11=ffffe00026bf0738 r12=0000000000000001 r13=ffffe00026bf0734 r14=ffffe000200abf80 r15=ffffe0001f818180 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 Ntfs!memcpy+0x1c0: fffff801`6246a940 488b440af8 mov rax,qword ptr [rdx+rcx-8] ds:002b:00000000`00000078=???????????????? Last set context: rax=ffffc001fc0c41f0 rbx=0000000000000000 rcx=ffffe00026bf0778 rdx=00001fffd940f908 rsi=00000000522e1e28 rdi=0000000052526612 rip=fffff8016246a940 rsp=ffffd00022b06228 rbp=ffffd00022b062c0 r8=0000000000000040 r9=0000000000000008 r10=00000000200aa000 r11=ffffe00026bf0738 r12=0000000000000001 r13=ffffe00026bf0734 r14=ffffe000200abf80 r15=ffffe0001f818180 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 Ntfs!memcpy+0x1c0: fffff801`6246a940 488b440af8 mov rax,qword ptr [rdx+rcx-8] ds:002b:00000000`00000078=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000078 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff802c13d8138 unable to get nt!MmNonPagedPoolStart unable to get nt!MmSizeOfNonPagedPoolInBytes 0000000000000078 FOLLOWUP_IP: Ntfs!memcpy+1c0 fffff801`6246a940 488b440af8 mov rax,qword ptr [rdx+rcx-8] FAULTING_IP: Ntfs!memcpy+1c0 fffff801`6246a940 488b440af8 mov rax,qword ptr [rdx+rcx-8] BUGCHECK_STR: 0x24 DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre LAST_CONTROL_TRANSFER: from fffff80162501fb8 to fffff8016246a940 STACK_TEXT: ffffd000`22b06228 fffff801`62501fb8 : 00000000`4c46744e ffffd000`22b06900 ffffd000`22b063a8 ffffd000`00000000 : Ntfs!memcpy+0x1c0 ffffd000`22b06230 fffff801`625040de : ffffd000`22b06900 ffffe000`1f818180 01d0d8dd`85beaa00 ffffd000`22b06900 : Ntfs!NtfsCheckpointVolume+0x988 ffffd000`22b06790 fffff801`62503f15 : ffffd000`22b06900 ffffd000`22b06900 ffffe000`1f818188 00000000`00000000 : Ntfs!NtfsCheckpointAllVolumesWorker+0x5e ffffd000`22b067e0 fffff801`62504270 : ffffd000`22b06900 00000000`00000000 fffff801`62504080 ffffd000`22b068b0 : Ntfs!NtfsForEachVcb+0x1ad ffffd000`22b06880 fffff802`c10fe1cf : fffff802`c144af50 fffff801`62504144 fffff801`624b6de0 fffff801`624b6de0 : Ntfs!NtfsCheckpointAllVolumes+0x12c ffffd000`22b06b50 fffff802`c11770a8 : ffffe000`25597850 ffffe000`1ff2a880 00000000`00000080 ffffe000`1ff2a880 : nt!ExpWorkerThread+0x69f ffffd000`22b06c00 fffff802`c11cefc6 : fffff802`c1378180 ffffe000`1ff2a880 fffff802`c13d1a00 00000000`00000108 : nt!PspSystemThreadStartup+0x58 ffffd000`22b06c60 00000000`00000000 : ffffd000`22b07000 ffffd000`22b01000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!memcpy+1c0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 54387b6b IMAGE_VERSION: 6.3.9600.17399 STACK_COMMAND: .cxr 0xffffd00022b057f0 ; kb BUCKET_ID_FUNC_OFFSET: 1c0 FAILURE_BUCKET_ID: 0x24_Ntfs!memcpy BUCKET_ID: 0x24_Ntfs!memcpy ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x24_ntfs!memcpy FAILURE_ID_HASH: {a6371206-df46-3d19-0535-573a32f19408} Followup: MachineOwner --------- 7: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 000000b500190645 Arg2: ffffd00022b05fe8 Arg3: ffffd00022b057f0 Arg4: fffff8016246a940 Debugging Details: ------------------ EXCEPTION_RECORD: ffffd00022b05fe8 -- (.exr 0xffffd00022b05fe8) ExceptionAddress: fffff8016246a940 (Ntfs!memcpy+0x00000000000001c0) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000078 Attempt to read from address 0000000000000078 CONTEXT: ffffd00022b057f0 -- (.cxr 0xffffd00022b057f0;r) rax=ffffc001fc0c41f0 rbx=0000000000000000 rcx=ffffe00026bf0778 rdx=00001fffd940f908 rsi=00000000522e1e28 rdi=0000000052526612 rip=fffff8016246a940 rsp=ffffd00022b06228 rbp=ffffd00022b062c0 r8=0000000000000040 r9=0000000000000008 r10=00000000200aa000 r11=ffffe00026bf0738 r12=0000000000000001 r13=ffffe00026bf0734 r14=ffffe000200abf80 r15=ffffe0001f818180 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 Ntfs!memcpy+0x1c0: fffff801`6246a940 488b440af8 mov rax,qword ptr [rdx+rcx-8] ds:002b:00000000`00000078=???????????????? Last set context: rax=ffffc001fc0c41f0 rbx=0000000000000000 rcx=ffffe00026bf0778 rdx=00001fffd940f908 rsi=00000000522e1e28 rdi=0000000052526612 rip=fffff8016246a940 rsp=ffffd00022b06228 rbp=ffffd00022b062c0 r8=0000000000000040 r9=0000000000000008 r10=00000000200aa000 r11=ffffe00026bf0738 r12=0000000000000001 r13=ffffe00026bf0734 r14=ffffe000200abf80 r15=ffffe0001f818180 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 Ntfs!memcpy+0x1c0: fffff801`6246a940 488b440af8 mov rax,qword ptr [rdx+rcx-8] ds:002b:00000000`00000078=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000078 READ_ADDRESS: 0000000000000078 FOLLOWUP_IP: Ntfs!memcpy+1c0 fffff801`6246a940 488b440af8 mov rax,qword ptr [rdx+rcx-8] FAULTING_IP: Ntfs!memcpy+1c0 fffff801`6246a940 488b440af8 mov rax,qword ptr [rdx+rcx-8] BUGCHECK_STR: 0x24 DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre LAST_CONTROL_TRANSFER: from fffff80162501fb8 to fffff8016246a940 STACK_TEXT: ffffd000`22b06228 fffff801`62501fb8 : 00000000`4c46744e ffffd000`22b06900 ffffd000`22b063a8 ffffd000`00000000 : Ntfs!memcpy+0x1c0 ffffd000`22b06230 fffff801`625040de : ffffd000`22b06900 ffffe000`1f818180 01d0d8dd`85beaa00 ffffd000`22b06900 : Ntfs!NtfsCheckpointVolume+0x988 ffffd000`22b06790 fffff801`62503f15 : ffffd000`22b06900 ffffd000`22b06900 ffffe000`1f818188 00000000`00000000 : Ntfs!NtfsCheckpointAllVolumesWorker+0x5e ffffd000`22b067e0 fffff801`62504270 : ffffd000`22b06900 00000000`00000000 fffff801`62504080 ffffd000`22b068b0 : Ntfs!NtfsForEachVcb+0x1ad ffffd000`22b06880 fffff802`c10fe1cf : fffff802`c144af50 fffff801`62504144 fffff801`624b6de0 fffff801`624b6de0 : Ntfs!NtfsCheckpointAllVolumes+0x12c ffffd000`22b06b50 fffff802`c11770a8 : ffffe000`25597850 ffffe000`1ff2a880 00000000`00000080 ffffe000`1ff2a880 : nt!ExpWorkerThread+0x69f ffffd000`22b06c00 fffff802`c11cefc6 : fffff802`c1378180 ffffe000`1ff2a880 fffff802`c13d1a00 00000000`00000108 : nt!PspSystemThreadStartup+0x58 ffffd000`22b06c60 00000000`00000000 : ffffd000`22b07000 ffffd000`22b01000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!memcpy+1c0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 54387b6b IMAGE_VERSION: 6.3.9600.17399 STACK_COMMAND: .cxr 0xffffd00022b057f0 ; kb BUCKET_ID_FUNC_OFFSET: 1c0 FAILURE_BUCKET_ID: 0x24_Ntfs!memcpy BUCKET_ID: 0x24_Ntfs!memcpy ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x24_ntfs!memcpy FAILURE_ID_HASH: {a6371206-df46-3d19-0535-573a32f19408} Followup: MachineOwner ---------