NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800d8b14f8
Arg3: fffff8800d8b0d60
Arg4: fffff80002ea4025
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800d8b14f8 -- (.exr 0xfffff8800d8b14f8)
ExceptionAddress: fffff80002ea4025 (nt!MmMapViewInSystemCache+0x0000000000000275)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800d8b0d60 -- (.cxr 0xfffff8800d8b0d60)
rax=ffeffa80043aef80 rbx=fffff6fcc00d6600 rcx=000000000000000f
rdx=fffffa80043aef80 rsi=fffff8a00c3f5ff8 rdi=fffff8a00c3f5a70
rip=fffff80002ea4025 rsp=fffff8800d8b1730 rbp=fffff6fcc00d6800
r8=fffffa8000000020 r9=fffff8800d8b17a0 r10=0000000000000000
r11=0000000000000000 r12=fffffa80043aef10 r13=fffffa8004512088
r14=fffffa8004281b60 r15=fffffa80043aef90
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!MmMapViewInSystemCache+0x275:
fffff800`02ea4025 4c896808 mov qword ptr [rax+8],r13 ds:002b:ffeffa80`043aef88=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: 360tray.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b20e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsCachedRead+180
fffff880`01432fc0 84c0 test al,al
FAULTING_IP:
nt!MmMapViewInSystemCache+275
fffff800`02ea4025 4c896808 mov qword ptr [rax+8],r13
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff80002ea3407 to fffff80002ea4025
STACK_TEXT:
fffff880`0d8b1730 fffff800`02ea3407 : fffff8a0`0cfaccc0 fffff880`02f63830 fffff880`0d8b18d8 fffff8a0`0c7ccc50 : nt!MmMapViewInSystemCache+0x275
fffff880`0d8b18a0 fffff800`02e992a0 : fffff8a0`00000000 00000000`00000000 fffffa80`04253f00 fffff8a0`00000000 : nt!CcGetVacbMiss+0x177
fffff880`0d8b1960 fffff800`03195762 : 00000000`00000000 00000000`00000000 fffff880`0d8b1a30 fffff880`0d8b1ac0 : nt!CcGetVirtualAddress+0x1b0
fffff880`0d8b19f0 fffff880`01432fc0 : fffff8a0`00000000 fffff8a0`00000005 fffffa80`04008a00 fffff880`01486001 : nt!CcCopyRead+0x132
fffff880`0d8b1ab0 fffff880`01437303 : 00000000`00000000 fffff8a0`0c83a140 fffff880`0d8b1ce0 00000000`00000000 : Ntfs!NtfsCachedRead+0x180
fffff880`0d8b1b10 fffff880`01439f78 : fffffa80`04008a00 fffffa80`043d4880 fffff880`0d8b1c01 fffffa80`044e9600 : Ntfs!NtfsCommonRead+0x583
fffff880`0d8b1cb0 fffff880`0135323f : fffffa80`043d4bd8 fffffa80`043d4880 fffffa80`044e96c0 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0d8b1d60 fffff880`0135594a : 00000000`00000000 00000000`00000000 fffffa80`04fbc000 fffffa80`044e96c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0d8b1df0 fffff880`01362204 : fffffa80`03d54020 00000000`00000019 fffffa80`04c98010 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`0d8b1e90 fffff880`0413911b : fffffa80`04fbc018 fffff880`01355953 fffffa80`043d4880 fffff800`02e89b7c : fltmgr!FltReadFile+0x334
fffff880`0d8b1f70 fffffa80`04fbc018 : fffff880`01355953 fffffa80`043d4880 fffff800`02e89b7c fffff8a0`0d1a1010 : SRTSP64+0x2b11b
fffff880`0d8b1f78 fffff880`01355953 : fffffa80`043d4880 fffff800`02e89b7c fffff8a0`0d1a1010 fffffa80`00000004 : 0xfffffa80`04fbc018
fffff880`0d8b1f80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2d3
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: Ntfs!NtfsCachedRead+180
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff8800d8b0d60 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCachedRead+180
BUCKET_ID: X64_0x24_Ntfs!NtfsCachedRead+180
Followup: MachineOwner
---------