BSOD: PAGE_FAULT and MEMORY_MANAGEMENT (X64)

swedan said:

Hi,

I keep getting BSOD and I cannot pinpoint what's the problem. I have ran memtest86+ without any reported errors, and I've re-installed Windows 7 X64 several time. At first it seems to work but after a while BSOD's starts coming. The BSOD's are
PAGE_FAULT_IN_NON_PAGED_AREA and
MEMORY_MANAGEMENT

My setup is as follows:

• 8GB (4x CORSAIR 2GB DDR3 XMS3 INTEL I5/I7 PC12800 1600MHZ CL9)

• ASUS P7P55D P55 S-1156 ATX

• INTEL CORE I7 860 2.80GHZ 8MB S-1156

• XFX RADEON HD5770 XT 1GB GDDR5 PCI-E 2DVI/HDMI/DP

I've got five crashes this morning, and here's one of the dumps:

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Simon Johansson\Downloads\060210-21138-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a18000 PsLoadedModuleList = 0xfffff800`02c55e50
Debug session time: Wed Jun  2 09:19:43.298 2010 (UTC + 2:00)
System Uptime: 0 days 0:05:13.616
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffac00ad1e7e0, 1, fffff80002a8d70c, 5}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+40ecb )

Followup: MachineOwner
---------

4: kd> !anaylyze -v
No export anaylyze found
4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffac00ad1e7e0, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002a8d70c, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc00e0
 fffffac00ad1e7e0 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
fffff800`02a8d70c f0480fc11f      lock xadd qword ptr [rdi],rbx

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800990f9c0 -- (.trap 0xfffff8800990f9c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffac00ad1e810
rdx=0000000000000004 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a8d70c rsp=fffff8800990fb50 rbp=fffff8800990fca0
 r8=fffff80002a18000  r9=0000000000000000 r10=ffffffffffffffef
r11=fffffa800a4d1820 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!ObfDereferenceObject+0x2c:
fffff800`02a8d70c f0480fc11f      lock xadd qword ptr [rdi],rbx ds:e810:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b07801 to fffff80002a88600

STACK_TEXT:  
fffff880`0990f858 fffff800`02b07801 : 00000000`00000050 fffffac0`0ad1e7e0 00000000`00000001 fffff880`0990f9c0 : nt!KeBugCheckEx
fffff880`0990f860 fffff800`02a866ee : 00000000`00000001 ffffffff`ffffffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x40ecb
fffff880`0990f9c0 fffff800`02a8d70c : fffffa80`0b840920 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0990fb50 fffff800`02d83dcc : fffff880`0990fca0 fffffac0`0ad1e810 fffff880`0990fbf8 00000000`00000001 : nt!ObfDereferenceObject+0x2c
fffff880`0990fbb0 fffff800`02a87853 : fffffa80`0b26e060 00000000`00007530 fffff880`0990fbf8 fffffa80`0ad1e810 : nt!NtWaitForSingleObject+0xcc
fffff880`0990fc20 00000000`773ffefa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`073bfa08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773ffefa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+40ecb
fffff800`02b07801 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+40ecb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+40ecb

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+40ecb

Followup: MachineOwner
---------

Any suggestions what it could be?

We really do need the actual DMP file. There are things that we can do that you probably dont know how to do yet. Use these to find and upload them to us. https://www.sevenforums.com/crash-loc...d-problem.html



Thanks

Ken

I have attached the dumps as a ZIP file now, if anyone could look at them and help me that would be highly appreciated!

swedan said:

I have attached the dumps as a ZIP file now, if anyone could look at them and help me that would be highly appreciated!

The DMP's point to a win 7 file which is almost impossible. In the mean time I would run a system file check to verify and repair your system files
(type cmd in search>right click and run as admin>sfc /scannow)

Let us know the results

Ken

Just ran the sfc /scannow and it stops at 7 percent saying

Code:

Windows Resource Protection could not perform the requested operation.

Tried it twice with a reboot in between. Any solutions to that problem?

swedan said:

Just ran the sfc /scannow and it stops at 7 percent saying

Code:

Windows Resource Protection could not perform the requested operation.

Tried it twice with a reboot in between. Any solutions to that problem?

Yes a repair install. For that you should have a backup, restore point, and win 7 dvd



Ken

zigzag3143 said:

Yes a repair install. For that you should have a backup, restore point, and win 7 dvd
Ken

I did a startup repair wich found nothing. Then I tried SFC again with success up to 56 %, where it BSODed again...

I'm quite stuck here. What did you say about an "almost impossible file" in the dumps, I didn't get that?

Thanks for all the help so far!

And now the SFC worked. After trying several times (with reboots in between):

Code:

Verification 100% complete.
Windows Resource Protection did not find any integrity violations.