Hi,
Lately I've been getting these bluescreens and suddent restarts. The bluescreens said something about "page_fault_in_nonpaged_area", so I checked the crash dump in WinDbg. Here's what it said:
"PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d928a08d, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 8054adef, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 426c9fbc
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
d928a08d
FAULTING_IP:
nt+73def
8054adef 00833d802956 add byte ptr [ebx+5629803Dh],al
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from 804ea856 to 8054adef
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b9f7eca4 804ea856 00000001 00000000 58434c41 nt+0x73def
b9f7ecc0 f85ef133 00000001 00000808 58434c41 nt+0x13856
b9f7ecfc f85fbb65 e184efb8 0006ebc8 00f7ed14 Vaxx347b+0x1133
b9f7ed1c f85fbbfc 0006ec28 0006e948 00000000 Vaxx347b+0xdb65
b9f7ed64 7c90eb94 badb0d00 0006e930 828cbda8 Vaxx347b+0xdbfc
b9f7ed68 badb0d00 0006e930 828cbda8 00000000 0x7c90eb94
b9f7ed6c 0006e930 828cbda8 00000000 00000090 0xbadb0d00
b9f7ed70 828cbda8 00000000 00000090 000000a4 0x6e930
b9f7ed74 00000000 00000090 000000a4 000000ff 0x828cbda8
STACK_COMMAND: kb
FOLLOWUP_IP:
Vaxx347b+1133
f85ef133 ?? ???
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Vaxx347b+1133
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Vaxx347b
IMAGE_NAME: Vaxx347b.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------"
I am by no means an expert, but if I understand correctly, there is something wrong with ntoskrnl.exe. How can I fix this?
Lately I've been getting these bluescreens and suddent restarts. The bluescreens said something about "page_fault_in_nonpaged_area", so I checked the crash dump in WinDbg. Here's what it said:
"PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d928a08d, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 8054adef, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 426c9fbc
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
d928a08d
FAULTING_IP:
nt+73def
8054adef 00833d802956 add byte ptr [ebx+5629803Dh],al
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from 804ea856 to 8054adef
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b9f7eca4 804ea856 00000001 00000000 58434c41 nt+0x73def
b9f7ecc0 f85ef133 00000001 00000808 58434c41 nt+0x13856
b9f7ecfc f85fbb65 e184efb8 0006ebc8 00f7ed14 Vaxx347b+0x1133
b9f7ed1c f85fbbfc 0006ec28 0006e948 00000000 Vaxx347b+0xdb65
b9f7ed64 7c90eb94 badb0d00 0006e930 828cbda8 Vaxx347b+0xdbfc
b9f7ed68 badb0d00 0006e930 828cbda8 00000000 0x7c90eb94
b9f7ed6c 0006e930 828cbda8 00000000 00000090 0xbadb0d00
b9f7ed70 828cbda8 00000000 00000090 000000a4 0x6e930
b9f7ed74 00000000 00000090 000000a4 000000ff 0x828cbda8
STACK_COMMAND: kb
FOLLOWUP_IP:
Vaxx347b+1133
f85ef133 ?? ???
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Vaxx347b+1133
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Vaxx347b
IMAGE_NAME: Vaxx347b.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------"
I am by no means an expert, but if I understand correctly, there is something wrong with ntoskrnl.exe. How can I fix this?
