BugCheck 3B, {c0000005, fffff960001a4283, fffff880045e7060, 0}
Probably caused by : win32k.sys ( win32k!HmgLockEx+a3 )
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960001a4283, Address of the instruction which caused the bugcheck
Arg3: fffff880045e7060, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
В дампе указан Desktop Window Manager, который отвечает за обработку графики и отрисовку окон.
PROCESS_NAME: dwm.exe
<-- В этом процессе произошел сбой
Посмотрим окончание работы системы
fffff880`045e5ff0 ????????`????????
fffff880`045e5ff8 ????????`????????
fffff880`045e6000 30303043`30303030
fffff880`045e6008 00000040`0000000a
fffff880`045e6010 fffff800`02a80860 nt!IopTriageDumpDataBlocks
fffff880`045e6018 fffff800`02a7cb20 nt!KeBugCheckAddPagesCallbackListHead
fffff880`045e6020 fffff800`02a7cb20 nt!KeBugCheckAddPagesCallbackListHead
fffff880`045e6028 00000000`00000000
fffff880`045e6030 00000000`00000000
fffff880`045e6038 00000000`00000000
fffff880`045e6040 00000000`00000000
fffff880`045e6048 fffffa80`07c4a000
fffff880`045e6050 fffff800`02930610 nt!IoSetDumpRange
fffff880`045e6058 fffff800`02930560 nt!IoFreeDumpRange
fffff880`045e6060 fffff800`02ab4900 nt!KiProcessorBlock
fffff880`045e6068 00000000`40000082
fffff880`045e6070 00000000`00000001
fffff880`045e6078 00000000`0000003b
fffff880`045e6080 fffff800`0280c000 nt!MmIsSessionAddress <PERF> (nt+0x0)
fffff880`045e6088 fffff800`02974866 nt!KeBugCheck2+0xac6
fffff880`045e6090 fffff800`
0000003b <-- код ошибки
fffff880`045e6098 00000000`
c0000005 <-- 1 аргумент, других аргументов не видно
fffff880`045e60a0 00000000`000004d0
fffff880`045e60a8 fffffa80`0915c060
fffff880`045e60b0 00000000`00000000
fffff880`045e60b8 fffff880`045e61c0
fffff880`045e60c0 fffffa80`0915c060
fffff880`045e60c8 fffff880`349aa15eUnable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
nvlddmkm+0x1a815e
fffff880`045e60d0 00000000`00000000
fffff880`045e60d8 fffffa80`0915c060
fffff880`045e60e0 00000000`08918001
Давайте посмотрим аргумент 2:
fffff960001a4283
win32k!HmgLockEx+0x86:
fffff960`001a4266 6639770c cmp word ptr [rdi+0Ch],si
fffff960`001a426a 753d jne win32k!HmgLockEx+0xc9 ()
fffff960`001a426c 413bed cmp ebp,r13d
fffff960`001a426f 7406 je win32k!HmgLockEx+0x97 (fffff960`001a4277)
fffff960`001a4271 f6470f20 test byte ptr [rdi+0Fh],20h
fffff960`001a4275 7432 je win32k!HmgLockEx+0xc9 (fffff960`001a42a9)
fffff960`001a4277 65488b0c2588010000 mov rcx,qword ptr gs:[188h]
fffff960`001a4280 488b1f mov rbx,qword ptr [rdi]
Тут видим блокировку win32k
Посмотрим регистры аргумента 3: fffff880045e7060
rax=fffff900c0200000 rbx=0000000000000000 rcx=fffffa800915c060
rdx=fffff900c0200000 rsi=0000000000000000 rdi=fffff900c0200000
rip=fffff960001a4283 rsp=fffff880045e7a40 rbp=0000000000000000
в регистре ip указан адрес аргумента 2:
r8=0000000000000001 r9=0000000000000000 r10=0000000000000000
r11=fffff880045e7aa8 r12=0000000003af4800 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
win32k!HmgLockEx+0xa3:
fffff960`001a4283 0fb7430c movzx eax,word ptr [rbx+0Ch] ds:002b:00000000`0000000c=????
Здесь тоже заблокрован win32k
