*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff880024aa7b0, Virtual address for the attempted write.
Arg2: 00000000050ae121, PTE contents.
Arg3: fffff88004147530, (reserved)
Arg4: 000000000000000b, (reserved)
Debugging Details:
------------------
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff88004147530 -- (.trap 0xfffff88004147530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880024aa090 rbx=0000000000000000 rcx=000000000000001d
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001d52e26 rsp=fffff880041476c0 rbp=fffff880041477f0
r8=fffffa800d75d1b8 r9=0000000000000000 r10=fffffa800fbf9010
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
fltmgr!FltpGetStartingCallbackNode+0x346:
fffff880`01d52e26 f0838020070000ff lock add dword ptr [rax+720h],0FFFFFFFFh ds:fffff880`024aa7b0=240c80f0
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000354d7c6 to fffff800034cfbc0
STACK_TEXT:
fffff880`041473c8 fffff800`0354d7c6 : 00000000`000000be fffff880`024aa7b0 00000000`050ae121 fffff880`04147530 : nt!KeBugCheckEx
fffff880`041473d0 fffff800`034cdcee : 00000000`00000001 fffff880`024aa7b0 00000000`00000000 fffffa80`0d75d010 : nt! ?? ::FNODOBFM::`string'+0x44cde
fffff880`04147530 fffff880`01d52e26 : fffffa80`0d75d010 fffff880`041477f0 fffffa80`1d6aae20 00000000`0f000001 : nt!KiPageFault+0x16e
fffff880`041476c0 fffff880`01d52107 : fffff880`041477f0 fffff880`00000002 00000000`00000000 00000000`00000000 : fltmgr!FltpGetStartingCallbackNode+0x346
fffff880`04147750 fffff880`01d506c7 : fffffa80`0d9268e0 fffffa80`1c84c480 fffffa80`0d762d00 fffffa80`1a6d9b80 : fltmgr!FltpPassThrough+0xb7
fffff880`041477d0 fffff880`081e7619 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`0365f588 : fltmgr!FltpDispatch+0xb7
fffff880`04147830 00000000`00000000 : 00000000`00000000 00000000`00000000 fffff800`0365f588 00000000`00000000 : DAMDrv64+0x2619
STACK_COMMAND: kb
FOLLOWUP_IP:
DAMDrv64+2619
fffff880`081e7619 ?? ???
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: DAMDrv64+2619
FOLLOWUP_NAME: MachineOwner
[COLOR="Red"]MODULE_NAME: DAMDrv64
IMAGE_NAME: DAMDrv64.sys[/COLOR]
DEBUG_FLR_IMAGE_TIMESTAMP: 51125a78
FAILURE_BUCKET_ID: X64_0xBE_DAMDrv64+2619
BUCKET_ID: X64_0xBE_DAMDrv64+2619
Followup: MachineOwner
---------