Solved BSOD with several Chrome windows, error 3B (C0000005, ...

[Haakon]

I've been getting this error for a couple of months, over 20 times in all. The two common situations in which it usually happens are:
1) Browsing in Chrome, particularly when there are many windows and tabs open.
2) While computer is idle.
Except for the very first time this happened, it points to file aswSnx.sys, address FFFFF8800????AD1, where the ???? can vary

I attach the SFdebug file.

Haakon

 

[peebee]

All of the crashes I saw point to Avast as the culprit. Looking at the module in particular, it's up to date, but it's still the cause nonetheless.

fffff880`03e87000 fffff880`03f88000 aswSnx
Loaded symbol image file: aswSnx.sys
Image path: \??\C:\Windows\system32\drivers\aswSnx.sys
Image name: aswSnx.sys
Timestamp: Tue Jan 21 11:11:09 2014 (52DEAA2D)
CheckSum: 000FECA1
ImageSize: 00101000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

Personally, I wouldn't use Avast. If you have to run antivirus (I don't run any) then use something that has hundreds of millions of engineering dollars behind it. Such as McAfee or Symantec. I know these comments will likely get me a lot of heat, but they're just my opinion.

If you want to post links to some full memory dumps I'd be happy to look further to see if another driver might be stepping on top of the Avast driver. As it is right now, some action in user mode invokes a call to aswSnx.sys (likely through services.exe) which results in an unrecoverable exception.

It's this instruction here that causes the bugcheck:

aswSnx+0x2cad1:
fffff880`040f7ad1 f30f6f01 movdqu xmm0,xmmword ptr [rcx] ds:00000000`17de0000=????????????????????????????????

Unfortunately the code referenced is paged out.

 

[Haakon]

Thanks so much peebee for looking into this.

Having had various problems with viruses (and other critters) over the years, I don't feel that no antivirus is an option. I certainly am not wedded to Avast, but it seems that there has to be more to the story, or lots of people with a similar setup (whatever that consists of) would be getting the same problem.

I'll set up the computer for a full dump. In the meantime fwiw here's a kernel dump:
https://www.dropbox.com/s/p8cxql7tmvt7mi7/MEMORY.DMP

 

[Haakon]

Actually, I can't set it up for a full dump. Apparently I have too much memory (6 GB).

 

[peebee]

I understand not wanting to part from your AV. Many people share the same feelings. I'm just rather old school in that I don't feel AV is necessary if you take reasonable steps to prevent getting infected. Such as not using JRE, Flash, Acrobat, etc. and not downloading questionable material. And personally, I absolutely hate the performance penalty of running AV as well. Most people need it though.

As for the full memory dump, let's look at the kernel dump first.

 

[peebee]

I looked at your kernel dump and saw very similar results. I was able to look at a few additional areas but they didn't appear to have any signs of concern. The instruction that's causing the crash is consistent and is within a function of the aswsnx.sys driver. The function is being invoked by something in user mode though so a full dump is going to be required to further analyze this problem. Here's a little of what I'm looking at:

aswSnx+0x2c9cc:
fffff880`03e989cc 4c8bdc          mov     r11,rsp
fffff880`03e989cf 49895b08        mov     qword ptr [r11+8],rbx
fffff880`03e989d3 49897310        mov     qword ptr [r11+10h],rsi
fffff880`03e989d7 49897b20        mov     qword ptr [r11+20h],rdi
fffff880`03e989db 4d894318        mov     qword ptr [r11+18h],r8
fffff880`03e989df 4154            push    r12
fffff880`03e989e1 4883ec60        sub     rsp,60h
fffff880`03e989e5 498bf8          mov     rdi,r8
fffff880`03e989e8 8bda            mov     ebx,edx
fffff880`03e989ea 488bf1          mov     rsi,rcx
fffff880`03e989ed 488b842490000000 mov     rax,qword ptr [rsp+90h]
fffff880`03e989f5 498943b8        mov     qword ptr [r11-48h],rax
fffff880`03e989f9 ff1581330b00    call    qword ptr [aswSnx+0xdfd80 (fffff880`03f4bd80)]
fffff880`03e989ff 448be0          mov     r12d,eax
fffff880`03e98a02 89442430        mov     dword ptr [rsp+30h],eax
fffff880`03e98a06 85c0            test    eax,eax
fffff880`03e98a08 0f88fc010000    js      aswSnx+0x2cc0a (fffff880`03e98c0a)
aswSnx+0x2ca0e:
fffff880`03e98a0e ff159caf0600    call    qword ptr [aswSnx+0x979b0 (fffff880`03f039b0)]
fffff880`03e98a14 3c01            cmp     al,1
fffff880`03e98a16 0f85ee010000    jne     aswSnx+0x2cc0a (fffff880`03e98c0a)
aswSnx+0x2ca1c:
fffff880`03e98a1c 83fb01          cmp     ebx,1
fffff880`03e98a1f 0f85e5010000    jne     aswSnx+0x2cc0a (fffff880`03e98c0a)
aswSnx+0x2ca25:
fffff880`03e98a25 48c744244070020000 mov   qword ptr [rsp+40h],270h
fffff880`03e98a2e 488364243800    and     qword ptr [rsp+38h],0
fffff880`03e98a34 ff1576af0600    call    qword ptr [aswSnx+0x979b0 (fffff880`03f039b0)]
fffff880`03e98a3a 84c0            test    al,al
fffff880`03e98a3c 751a            jne     aswSnx+0x2ca58 (fffff880`03e98a58)
aswSnx+0x2ca3e:
fffff880`03e98a3e 41b8536e7820    mov     r8d,20786E53h
fffff880`03e98a44 488b542440      mov     rdx,qword ptr [rsp+40h]
fffff880`03e98a49 8bcb            mov     ecx,ebx
fffff880`03e98a4b ff15ffaf0600    call    qword ptr [aswSnx+0x97a50 (fffff880`03f03a50)]
fffff880`03e98a51 4889442438      mov     qword ptr [rsp+38h],rax
fffff880`03e98a56 eb2c            jmp     aswSnx+0x2ca84 (fffff880`03e98a84)
aswSnx+0x2ca58:
fffff880`03e98a58 c744242804000000 mov     dword ptr [rsp+28h],4
fffff880`03e98a60 c744242000100000 mov     dword ptr [rsp+20h],1000h
fffff880`03e98a68 4c8d4c2440      lea     r9,[rsp+40h]
fffff880`03e98a6d 4533c0          xor     r8d,r8d
fffff880`03e98a70 488d542438      lea     rdx,[rsp+38h]
fffff880`03e98a75 4883c9ff        or      rcx,0FFFFFFFFFFFFFFFFh
fffff880`03e98a79 ff15f9aa0600    call    qword ptr [aswSnx+0x97578 (fffff880`03f03578)]
fffff880`03e98a7f 488b442438      mov     rax,qword ptr [rsp+38h]
aswSnx+0x2ca84:
fffff880`03e98a84 4885c0          test    rax,rax
fffff880`03e98a87 0f847d010000    je      aswSnx+0x2cc0a (fffff880`03e98c0a)
aswSnx+0x2ca8d:
fffff880`03e98a8d 488364242000    and     qword ptr [rsp+20h],0
fffff880`03e98a93 448b4c2440      mov     r9d,dword ptr [rsp+40h]
fffff880`03e98a98 4c8bc0          mov     r8,rax
fffff880`03e98a9b ba02000000      mov     edx,2
fffff880`03e98aa0 488bce          mov     rcx,rsi
fffff880`03e98aa3 ff15d7320b00    call    qword ptr [aswSnx+0xdfd80 (fffff880`03f4bd80)]
fffff880`03e98aa9 8bf0            mov     esi,eax
fffff880`03e98aab 85c0            test    eax,eax
fffff880`03e98aad 0f881b010000    js      aswSnx+0x2cbce (fffff880`03e98bce)
aswSnx+0x2cab3:
fffff880`03e98ab3 488d15464b0b00  lea     rdx,[aswSnx+0xe1600 (fffff880`03f4d600)]
fffff880`03e98aba 488d4c2448      lea     rcx,[rsp+48h]
fffff880`03e98abf e850670c00      call    aswSnx+0xf3214 (fffff880`03f5f214)
fffff880`03e98ac4 85c0            test    eax,eax
fffff880`03e98ac6 0f8802010000    js      aswSnx+0x2cbce (fffff880`03e98bce)
[COLOR=red]aswSnx[/COLOR]+0x2cacc:
fffff880`03e98acc 488b4c2438      mov     rcx,qword ptr [rsp+38h]
[COLOR=red]fffff880`03e98ad1 f30f6f01        movdqu  xmm0,xmmword ptr [rcx][/COLOR][COLOR=red] <---- crash[/COLOR]
fffff880`03e98ad5 f30f7f442450    movdqu  xmmword ptr [rsp+50h],xmm0
fffff880`03e98adb ff15cfae0600    call    qword ptr [aswSnx+0x979b0 (fffff880`03f039b0)]
fffff880`03e98ae1 3c01            cmp     al,1
fffff880`03e98ae3 7426            je      aswSnx+0x2cb0b (fffff880`03e98b0b)
aswSnx+0x2cae5:
fffff880`03e98ae5 488b4c2458      mov     rcx,qword ptr [rsp+58h]
fffff880`03e98aea 488b05b7a90600  mov     rax,qword ptr [aswSnx+0x974a8 (fffff880`03f034a8)]
fffff880`03e98af1 483b08          cmp     rcx,qword ptr [rax]
fffff880`03e98af4 761a            jbe     aswSnx+0x2cb10 (fffff880`03e98b10)
aswSnx+0x2caf6:
fffff880`03e98af6 488d542450      lea     rdx,[rsp+50h]
fffff880`03e98afb 488b5c2448      mov     rbx,qword ptr [rsp+48h]
fffff880`03e98b00 488bcb          mov     rcx,rbx
fffff880`03e98b03 ff157fad0600    call    qword ptr [aswSnx+0x97888 (fffff880`03f03888)]
fffff880`03e98b09 eb47            jmp     aswSnx+0x2cb52 (fffff880`03e98b52)
aswSnx+0x2cb0b:
fffff880`03e98b0b 488b4c2458      mov     rcx,qword ptr [rsp+58h]
aswSnx+0x2cb10:
fffff880`03e98b10 0fb7442450      movzx   eax,word ptr [rsp+50h]
fffff880`03e98b15 6685c0          test    ax,ax
fffff880`03e98b18 740f            je      aswSnx+0x2cb29 (fffff880`03e98b29)
aswSnx+0x2cb1a:
fffff880`03e98b1a 0fb7d0          movzx   edx,ax
fffff880`03e98b1d 41b801000000    mov     r8d,1
fffff880`03e98b23 ff1547a70600    call    qword ptr [aswSnx+0x97270 (fffff880`03f03270)]
aswSnx+0x2cb29:
fffff880`03e98b29 488d542450      lea     rdx,[rsp+50h]
fffff880`03e98b2e 488b5c2448      mov     rbx,qword ptr [rsp+48h]
fffff880`03e98b33 488bcb          mov     rcx,rbx
fffff880`03e98b36 ff154cad0600    call    qword ptr [aswSnx+0x97888 (fffff880`03f03888)]
fffff880`03e98b3c eb14            jmp     aswSnx+0x2cb52 (fffff880`03e98b52)
aswSnx+0x2cb52:
fffff880`03e98b52 85f6            test    esi,esi
fffff880`03e98b54 7869            js      aswSnx+0x2cbbf (fffff880`03e98bbf)
aswSnx+0x2cb56:
fffff880`03e98b56 41b001          mov     r8b,1
fffff880`03e98b59 488d15d0110b00  lea     rdx,[aswSnx+0xddd30 (fffff880`03f49d30)]
fffff880`03e98b60 488bcb          mov     rcx,rbx
fffff880`03e98b63 ff1557ad0600    call    qword ptr [aswSnx+0x978c0 (fffff880`03f038c0)]
fffff880`03e98b69 85c0            test    eax,eax
fffff880`03e98b6b 751e            jne     aswSnx+0x2cb8b (fffff880`03e98b8b)
aswSnx+0x2cb6d:
fffff880`03e98b6d 488bcf          mov     rcx,rdi
fffff880`03e98b70 e89fe1fdff      call    aswSnx+0xad14 (fffff880`03e76d14)
fffff880`03e98b75 84c0            test    al,al
fffff880`03e98b77 7446            je      aswSnx+0x2cbbf (fffff880`03e98bbf)
aswSnx+0x2cb79:
fffff880`03e98b79 4c8bc7          mov     r8,rdi
fffff880`03e98b7c 488bd7          mov     rdx,rdi
fffff880`03e98b7f b902000000      mov     ecx,2
fffff880`03e98b84 e88b2cfeff      call    aswSnx+0xf814 (fffff880`03e7b814)
fffff880`03e98b89 eb34            jmp     aswSnx+0x2cbbf (fffff880`03e98bbf)
aswSnx+0x2cb8b:
fffff880`03e98b8b 41b001          mov     r8b,1
fffff880`03e98b8e 488d158b110b00  lea     rdx,[aswSnx+0xddd20 (fffff880`03f49d20)]
fffff880`03e98b95 488bcb          mov     rcx,rbx
fffff880`03e98b98 ff1522ad0600    call    qword ptr [aswSnx+0x978c0 (fffff880`03f038c0)]
fffff880`03e98b9e 85c0            test    eax,eax
fffff880`03e98ba0 751d            jne     aswSnx+0x2cbbf (fffff880`03e98bbf)
aswSnx+0x2cba2:
fffff880`03e98ba2 66833f4e        cmp     word ptr [rdi],4Eh
fffff880`03e98ba6 7217            jb      aswSnx+0x2cbbf (fffff880`03e98bbf)
aswSnx+0x2cba8:
fffff880`03e98ba8 488bcf          mov     rcx,rdi
fffff880`03e98bab e850960300      call    aswSnx+0x66200 (fffff880`03ed2200)
fffff880`03e98bb0 84c0            test    al,al
fffff880`03e98bb2 740b            je      aswSnx+0x2cbbf (fffff880`03e98bbf)
aswSnx+0x2cbb4:
fffff880`03e98bb4 488bd7          mov     rdx,rdi
fffff880`03e98bb7 488bcf          mov     rcx,rdi
fffff880`03e98bba e88d960300      call    aswSnx+0x6624c (fffff880`03ed224c)
aswSnx+0x2cbbf:
fffff880`03e98bbf 488d153a4a0b00  lea     rdx,[aswSnx+0xe1600 (fffff880`03f4d600)]
fffff880`03e98bc6 488bcb          mov     rcx,rbx
fffff880`03e98bc9 e89ec20400      call    aswSnx+0x78e6c (fffff880`03ee4e6c)
aswSnx+0x2cbce:
fffff880`03e98bce ff15dcad0600    call    qword ptr [aswSnx+0x979b0 (fffff880`03f039b0)]
fffff880`03e98bd4 84c0            test    al,al
fffff880`03e98bd6 7512            jne     aswSnx+0x2cbea (fffff880`03e98bea)
aswSnx+0x2cbd8:
fffff880`03e98bd8 ba536e7820      mov     edx,20786E53h
fffff880`03e98bdd 488b4c2438      mov     rcx,qword ptr [rsp+38h]
fffff880`03e98be2 ff1538ae0600    call    qword ptr [aswSnx+0x97a20 (fffff880`03f03a20)]
fffff880`03e98be8 eb20            jmp     aswSnx+0x2cc0a (fffff880`03e98c0a)
aswSnx+0x2cbea:
fffff880`03e98bea 488364244000    and     qword ptr [rsp+40h],0
fffff880`03e98bf0 41b900800000    mov     r9d,8000h
fffff880`03e98bf6 4c8d442440      lea     r8,[rsp+40h]
fffff880`03e98bfb 488d542438      lea     rdx,[rsp+38h]
fffff880`03e98c00 4883c9ff        or      rcx,0FFFFFFFFFFFFFFFFh
fffff880`03e98c04 ff15eea80600    call    qword ptr [aswSnx+0x974f8 (fffff880`03f034f8)]
aswSnx+0x2cc0a:
fffff880`03e98c0a 418bc4          mov     eax,r12d
fffff880`03e98c0d 4c8d5c2460      lea     r11,[rsp+60h]
fffff880`03e98c12 498b5b10        mov     rbx,qword ptr [r11+10h]
fffff880`03e98c16 498b7318        mov     rsi,qword ptr [r11+18h]
fffff880`03e98c1a 498b7b28        mov     rdi,qword ptr [r11+28h]
fffff880`03e98c1e 498be3          mov     rsp,r11
fffff880`03e98c21 415c            pop     r12
fffff880`03e98c23 c3              ret
 
2: kd> dd [COLOR=red]@rcx <--- register being moved... usermode addresses (can't see what the data is without a full dump)[/COLOR]
00000000`072c0000  ???????? ???????? ???????? ????????
00000000`072c0010  ???????? ???????? ???????? ????????
00000000`072c0020  ???????? ???????? ???????? ????????
00000000`072c0030  ???????? ???????? ???????? ????????
00000000`072c0040  ???????? ???????? ???????? ????????
00000000`072c0050  ???????? ???????? ???????? ????????
00000000`072c0060  ???????? ???????? ???????? ????????
00000000`072c0070  ???????? ???????? ???????? ????????

As for getting a full memory dump, you might need to increase your pagefile size so that it's able to capture the entire contents of physical memory? I believe there are a number of causes of why a full dump can't be captured but this is probably a good start.

 

[Haakon]

Thanks for pointing out the code. I actually did some x86 assembly programming eons ago, so it's not totally foreign to me.

I figured out how to do a full dump--just waitin' for the next crash. I'll let you know when it happens.

 

[peebee]

No problem. I'll check back periodically to see if you post a full crash dump.

 

[Haakon]

I had the BSOD last night when I got home. This must be the first time I've actually looked forward to it, in hopes that you could do some further diagnosis. I started uploading it to the cloud, but this morning I got another one. Hopefully the upload completed--it appears it did from the size.

Here's the link:
https://drive.google.com/file/d/0ByvuKoL3sk0OUW9yRG4zbE9qaFk/edit?usp=sharing

 

[Haakon]

Since I had that second crash, I could upload that second full dump too, if it makes any difference. I think there's enough room. Let me know.

 

[peebee]

Not going to be necessary. I looked at this a little yesterday and this morning. Unfortunately I don't have anything conclusive, but I do have a very strong hunch. Keep in mind that I'm still relatively new to debugging (have been diving in head first last month or two) so maybe a veteran might be able to dig a little deep than I have.

I believe what's happening is the Rapport software that is installed is corrupting Avast's page table. Likely in a buffer overflow, but I've not confirmed that and have no evidence of it (yet). The fact that the two processes and their stack frames are consistent with the crashes makes me believe they're tripping over one another. The "trip" always appears to happen during a usermode interaction that makes a kernel call. I'll provide some of the code I went through to hopefully paint a thorough picture for you.

With all that said, I would start by uninstalling the Rapport software and monitoring the situation. My bet is that the problem goes away.

[COLOR=#000000][FONT=Courier New]2: kd> !running[/FONT][/COLOR]
 
[COLOR=#000000][FONT=Courier New]System Processors:  (000000000000000f)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Idle Processors:  (0000000000000003) (0000000000000000) (0000000000000000) (0000000000000000)[/FONT][/COLOR]
 
[COLOR=#000000][FONT=Courier New]     Prcbs             Current         (pri) Next            (pri) Idle[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]2    fffff88002f63180  fffffa8007419b50 (11)                       fffff88002f6dfc0  ................[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]3    fffff88002fd3180  fffffa8006106060 ( 8)                       fffff88002fddfc0  ................[/FONT][/COLOR]
 
[COLOR=#000000][FONT=Courier New]2: kd> !thread fffffa8007419b50[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]THREAD fffffa8007419b50  Cid 0fa0.0aac  Teb: 00000000fffdb000 Win32Thread: fffff900c3fd5c20 RUNNING on processor 2[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]IRP List:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]  fffffa80072f1c60: (0006,0118) Flags: 00060000  Mdl: 00000000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Not impersonating[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]DeviceMap                 fffff8a0065a8910[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]Owning Process            fffffa8007317b30       Image:         [/COLOR][COLOR=red]chrome.exe[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]Attached Process          N/A            Image:         N/A[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Wait Start TickCount      10452135       Ticks: 0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Context Switch Count      20632429       IdealProcessor: 2                 LargeStack[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]UserTime                  00:07:58.704[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]KernelTime                00:01:54.551[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Win32 Start Address chrome!SetCrashKeyValueImpl (0x00000000001b7ef2)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Stack Init fffff8800a6ca640 Current fffff8800a6ca530[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Base fffff8800a6cb000 Limit fffff8800a6c2000 Call fffff8800a6ca690[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Child-SP          RetAddr           : Args to Child                                                           : Call Site[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6c9128 fffff800`03292169 : 00000000`0000003b 00000000`c0000005 fffff880`03efcad1 fffff880`0a6c99f0 : nt!KeBugCheckEx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6c9130 fffff800`03291abc : fffff880`0a6ca198 fffff880`0a6c99f0 00000000`00000000 fffff880`03f569d0 : nt!KiBugCheckDispatch+0x69[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6c9270 fffff800`032bd75d : fffff880`03fb3f6c 00000000`00000000 fffff880`03ed0000 fffff880`0a6ca198 : nt!KiSystemServiceHandler+0x7c[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6c92b0 fffff800`032bc535 : fffff800`033e26c4 fffff880`0a6c9328 fffff880`0a6ca198 fffff800`0321d000 : nt!RtlpExecuteHandlerForException+0xd[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6c92e0 fffff800`032cd4c1 : fffff880`0a6ca198 fffff880`0a6c99f0 fffff880`00000000 00000000`062b00d0 : nt!RtlDispatchException+0x415[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6c99c0 fffff800`03292242 : fffff880`0a6ca198 00000000`00000001 fffff880`0a6ca240 00000000`00000000 : nt!KiDispatchException+0x135[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca060 fffff800`03290dba : 00000000`00000000 00000000`0b5a0000 fffff8a0`13a74300 00000000`00000001 : nt!KiExceptionDispatch+0xc2[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]fffff880`0a6ca240 fffff880`03efcad1 : 00000000`00000001 00000000`00003302 00000000`062b00d0 00000000`00000000 : nt![/COLOR][COLOR=red]KiPageFault[/COLOR][COLOR=#000000]+0x23a (TrapFrame @ fffff880`0a6ca240) [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- Page fault caused by aswsnx.sys[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca3d0 fffff800`03291e53 : fffffa80`07419b50 00000000`000fc6d8 00000000`062b00d0 fffff880`0a6ca458 : aswSnx+0x2cad1[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]fffff880`0a6ca440 00000000`776f13ba : 00000000`7529d148 00000000`00000002 00000000`00000000 00000000`75c09b28 : [/COLOR][COLOR=red]nt!KiSystemServiceCopyEnd+0x13[/COLOR][COLOR=#000000] (TrapFrame @ fffff880`0a6ca4b0) [/COLOR][/FONT][COLOR=#000000][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][FONT=Courier New]- Call to kernel[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]00000000`000fc6b8 00000000`7529d148 : 00000000`00000002 00000000`00000000 00000000`75c09b28 00000000`00000164 : [/COLOR][COLOR=red]ntdll!NtQueryObject+0xa [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- User function that invokes kernel call[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]00000000`000fc6c0 00000000`7529d282 : 00000000`02000000 00000000`00000001 00000000`00d5ba30 00000000`00000004 : wow64!ConstructKernelKeyPath+0x1d4[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fc740 00000000`75293203 : 00000000`0039e6fc 00000000`02000000 00000000`0039e130 00000000`0039e3a4 : wow64!Wow64NtOpenKey+0x5a[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fc7e0 00000000`7527d03b : 00000000`00000000 00000000`00000000 00000000`000fd0a0 00000000`0039e134 : wow64!whNtOpenKeyEx+0x73[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fc840 00000000`75202776 : 00000000`00000246 00000000`13f2e5a0 00000000`00000246 00000000`75202776 : wow64!Wow64SystemServiceEx+0xd7[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fd100 00000000`7527d132 : 00000000`00000246 00000000`75201904 00000000`00000246 00000000`7520198b : wow64cpu!ServiceNoTurbo+0x2d[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fd1c0 00000000`75278a50 : 00000000`00000000 00000000`000fdef0 00000018`0039eef0 00000000`778900dc : wow64!RunCpuSimulation+0xa[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fd210 00000000`75242c4e : 00000000`000fd590 00000000`00000002 00000000`000fdef0 00000000`00000020 : wow64!Wow64KiUserCallbackDispatcher+0x204[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fd560 00000000`776f11f5 : 00000000`00110624 00000000`00000000 00000000`00000000 778ee5fc`778b2612 : wow64win!whcbfnDWORD+0xe2[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fdf50 00000000`7524fe4a : 00000000`7522aefe 00000000`000fe018 0000005e`00000068 00000000`7525287a : ntdll!KiUserCallbackDispatcherContinue (TrapFrame @ 00000000`000fde18)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fdfd8 00000000`7522aefe : 00000000`000fe018 0000005e`00000068 00000000`7525287a 00000000`00000001 : wow64win!ZwUserMessageCall+0xa[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fdfe0 00000000`7524281b : 00000000`00000040 00000000`752254b0 00000000`00000000 00000000`0000003d : wow64win!whNT32NtUserMessageCallCB+0x32[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fe030 00000000`7522b00a : 00000000`000002b3 00000000`0039ee40 00000000`0000003d 00000000`0039ee30 : wow64win!Wow64DoMessageThunk+0x8b[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fe070 00000000`7527d03b : 00000000`0039ee0c 00000000`fffdb000 00000000`fffdd000 00000000`7522af0c : wow64win!whNtUserMessageCall+0xfe[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fe110 00000000`75202776 : 00000000`77380b75 00000000`75270023 00000000`00000246 00000000`0039ef58 : wow64!Wow64SystemServiceEx+0xd7[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fe9d0 00000000`7527d132 : 00000000`00000000 00000000`75201920 00000000`777b5430 00000000`776cecf1 : wow64cpu!ServiceNoTurbo+0x2d[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000fea90 00000000`7527c54b : 00000000`00000000 00000000`00000000 00000000`75274ad8 00000000`7ffe0030 : wow64!RunCpuSimulation+0xa[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000feae0 00000000`776e4966 : 00000000`004b3140 00000000`00000000 00000000`777d2670 00000000`777a5978 : wow64!Wow64LdrpInitialize+0x42b[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000ff030 00000000`776e1937 : 00000000`00000000 00000000`776e4071 00000000`000ff5e0 00000000`00000000 : ntdll!LdrpInitializeProcess+0x17e3[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000ff520 00000000`776cc34e : 00000000`000ff5e0 00000000`00000000 00000000`fffdf000 00000000`00000000 : ntdll! ?? ::FNODOBFM::`string'+0x28ff0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`000ff590 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe[/FONT][/COLOR]
 
[COLOR=#000000][FONT=Courier New]2: kd> !thread fffffa8006106060[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]THREAD fffffa8006106060  Cid 0078.14b4  Teb: 000000007efa7000 Win32Thread: fffff900c1afbc20 RUNNING on processor 3[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Not impersonating[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]DeviceMap                 fffff8a000006090[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]Owning Process            fffffa8007d495e0       Image:         [/COLOR][COLOR=red]RapportMgmtService.exe[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]Attached Process          N/A            Image:         N/A[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Wait Start TickCount      10452135       Ticks: 0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Context Switch Count      2648           IdealProcessor: 0                 LargeStack[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]UserTime                  00:00:01.716[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]KernelTime                00:00:03.712[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Win32 Start Address 0x00000000003b8df0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Stack Init fffff88012488db0 Current fffff880124881c0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Base fffff88012489000 Limit fffff88012480000 Call 0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Child-SP          RetAddr           : Args to Child                                                           : Call Site[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`12488640 fffff800`0359b590 : fffffa80`00000000 fffffa80`0553b801 fffffa80`00000060 fffff880`124886e8 : nt!ObpAllocateObject+0x217[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`124886b0 fffff800`03591ef9 : 00000000`00000025 fffffa80`088a17b8 fffffa80`08465610 fffffa80`08465610 : nt!IopAllocRealFileObject+0xf0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`12488760 fffff800`0358ddb8 : fffffa80`08465610 fffff800`00000000 fffffa80`088a1600 fffffa80`00000001 : nt!IopParseDevice+0xf90[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`124888c0 fffff800`0358efd6 : 00000000`00000000 fffffa80`088a1600 00000000`026bef00 fffffa80`05550400 : nt!ObpLookupObjectName+0x588[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`124889b0 fffff800`035908dc : 00000000`00000400 00000000`00000000 fffffa80`08a58301 fffff880`12488a98 : nt!ObOpenObjectByName+0x306[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`12488a80 fffff800`0359bed4 : 00000000`026be5a8 fffff8a0`c0100080 00000000`026bee70 00000000`026be5c0 : nt!IopCreateFile+0x2bc[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`12488b20 fffff800`03291e53 : fffffa80`07d495e0 00000000`00000001 fffffa80`06106060 fffff800`03589ce4 : nt!NtCreateFile+0x78[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`12488bb0 00000000`776f180a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`12488c20)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`026be538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!ZwCreateFile+0xa[/FONT][/COLOR]
 
[COLOR=#000000][FONT=Courier New]2: kd> .trap fffff880`0a6ca240[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]NOTE: The trap frame does not contain all registers.[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Some register values may be zeroed or incorrect.[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]rax=0000000000000000 rbx=0000000000000000 rcx=000000000b5a0000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]rdx=fffff8a011d619c1 rsi=0000000000000000 rdi=0000000000000000[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]rip=[/COLOR][COLOR=red]fffff88003efcad1[/COLOR][COLOR=#000000] rsp=fffff8800a6ca3d0 rbp=fffff8800a6ca530[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]r8=fffff8a011d619c0  r9=fffff8800a6ca318 r10=fffff88003fb1600[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]r11=fffff8a011d619c0 r12=0000000000000000 r13=0000000000000000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]r14=0000000000000000 r15=0000000000000000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]iopl=0         nv up ei pl zr na po nc[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cad1:[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]fffff880`03efcad1 f30f6f01        movdqu  xmm0,xmmword ptr [rcx] ds:00000000`0b5a0000=????????????????????????????????[/COLOR][/FONT]

 

[peebee]

[COLOR=#000000][FONT=Courier New]2: kd> uf fffff88003efcad1-10[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2c9cc:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9cc 4c8bdc          mov     r11,rsp[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9cf 49895b08        mov     qword ptr [r11+8],rbx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9d3 49897310        mov     qword ptr [r11+10h],rsi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9d7 49897b20        mov     qword ptr [r11+20h],rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9db 4d894318        mov     qword ptr [r11+18h],r8[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9df 4154            push    r12[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9e1 4883ec60        sub     rsp,60h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9e5 498bf8          mov     rdi,r8[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9e8 8bda            mov     ebx,edx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9ea 488bf1          mov     rsi,rcx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9ed 488b842490000000 mov     rax,qword ptr [rsp+90h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9f5 498943b8        mov     qword ptr [r11-48h],rax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9f9 ff1581330b00    call    qword ptr [aswSnx+0xdfd80 (fffff880`03fafd80)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efc9ff 448be0          mov     r12d,eax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca02 89442430        mov     dword ptr [rsp+30h],eax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca06 85c0            test    eax,eax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca08 0f88fc010000    js      aswSnx+0x2cc0a (fffff880`03efcc0a)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2ca0e:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca0e ff159caf0600    call    qword ptr [aswSnx+0x979b0 (fffff880`03f679b0)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca14 3c01            cmp     al,1[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca16 0f85ee010000    jne     aswSnx+0x2cc0a (fffff880`03efcc0a)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2ca1c:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca1c 83fb01          cmp     ebx,1[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca1f 0f85e5010000    jne     aswSnx+0x2cc0a (fffff880`03efcc0a)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2ca25:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca25 48c744244070020000 mov   qword ptr [rsp+40h],270h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca2e 488364243800    and     qword ptr [rsp+38h],0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca34 ff1576af0600    call    qword ptr [aswSnx+0x979b0 (fffff880`03f679b0)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca3a 84c0            test    al,al[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca3c 751a            jne     aswSnx+0x2ca58 (fffff880`03efca58)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2ca3e:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca3e 41b8536e7820    mov     r8d,20786E53h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca44 488b542440      mov     rdx,qword ptr [rsp+40h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca49 8bcb            mov     ecx,ebx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca4b ff15ffaf0600    call    qword ptr [aswSnx+0x97a50 (fffff880`03f67a50)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca51 4889442438      mov     qword ptr [rsp+38h],rax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca56 eb2c            jmp     aswSnx+0x2ca84 (fffff880`03efca84)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2ca58:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca58 c744242804000000 mov     dword ptr [rsp+28h],4[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca60 c744242000100000 mov     dword ptr [rsp+20h],1000h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca68 4c8d4c2440      lea     r9,[rsp+40h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca6d 4533c0          xor     r8d,r8d[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca70 488d542438      lea     rdx,[rsp+38h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca75 4883c9ff        or      rcx,0FFFFFFFFFFFFFFFFh[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca79 ff15f9aa0600    call    qword ptr [aswSnx+0x97578 (fffff880`03f67578)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca7f 488b442438      mov     rax,qword ptr [rsp+38h][/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2ca84:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca84 4885c0          test    rax,rax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca87 0f847d010000    je      aswSnx+0x2cc0a (fffff880`03efcc0a)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2ca8d:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca8d 488364242000    and     qword ptr [rsp+20h],0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca93 448b4c2440      mov     r9d,dword ptr [rsp+40h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca98 4c8bc0          mov     r8,rax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efca9b ba02000000      mov     edx,2[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaa0 488bce          mov     rcx,rsi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaa3 ff15d7320b00    call    qword ptr [aswSnx+0xdfd80 (fffff880`03fafd80)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaa9 8bf0            mov     esi,eax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaab 85c0            test    eax,eax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaad 0f881b010000    js      aswSnx+0x2cbce (fffff880`03efcbce)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cab3:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcab3 488d15464b0b00  lea     rdx,[aswSnx+0xe1600 (fffff880`03fb1600)][/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]fffff880`03efcaba 488d4c2448      lea     rcx,[[/COLOR][COLOR=red]rsp+48h[/COLOR][COLOR=#000000]] [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- rcx came from this address (on the stack)[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]fffff880`03efcabf e850670c00      call    aswSnx+0xf3214 (fffff880`03fc3214)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcac4 85c0            test    eax,eax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcac6 0f8802010000    js      aswSnx+0x2cbce (fffff880`03efcbce)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[FONT=Courier New][COLOR=red]aswSnx[/COLOR][COLOR=#000000]+0x2cacc:[/COLOR][/FONT]
[FONT=Courier New][COLOR=#000000]fffff880`03efcacc 488b4c2438      mov     [/COLOR][COLOR=red]rcx[/COLOR][COLOR=#000000],qword ptr [rsp+38h] [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- We crashed moving the contents of this register[/COLOR][/FONT]
[FONT=Courier New][COLOR=#000000]fffff880`03efcad1 f30f6f01        [/COLOR][COLOR=red]movdqu  xmm0,xmmword ptr [rcx] [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- Crash[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]fffff880`03efcad5 f30f7f442450    movdqu  xmmword ptr [rsp+50h],xmm0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcadb ff15cfae0600    call    qword ptr [aswSnx+0x979b0 (fffff880`03f679b0)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcae1 3c01            cmp     al,1[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcae3 7426            je      aswSnx+0x2cb0b (fffff880`03efcb0b)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cae5:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcae5 488b4c2458      mov     rcx,qword ptr [rsp+58h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaea 488b05b7a90600  mov     rax,qword ptr [aswSnx+0x974a8 (fffff880`03f674a8)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaf1 483b08          cmp     rcx,qword ptr [rax][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaf4 761a            jbe     aswSnx+0x2cb10 (fffff880`03efcb10)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2caf6:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcaf6 488d542450      lea     rdx,[rsp+50h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcafb 488b5c2448      mov     rbx,qword ptr [rsp+48h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb00 488bcb          mov     rcx,rbx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb03 ff157fad0600    call    qword ptr [aswSnx+0x97888 (fffff880`03f67888)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb09 eb47            jmp     aswSnx+0x2cb52 (fffff880`03efcb52)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb0b:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb0b 488b4c2458      mov     rcx,qword ptr [rsp+58h][/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb10:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb10 0fb7442450      movzx   eax,word ptr [rsp+50h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb15 6685c0          test    ax,ax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb18 740f            je      aswSnx+0x2cb29 (fffff880`03efcb29)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb1a:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb1a 0fb7d0          movzx   edx,ax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb1d 41b801000000    mov     r8d,1[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb23 ff1547a70600    call    qword ptr [aswSnx+0x97270 (fffff880`03f67270)][/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb29:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb29 488d542450      lea     rdx,[rsp+50h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb2e 488b5c2448      mov     rbx,qword ptr [rsp+48h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb33 488bcb          mov     rcx,rbx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb36 ff154cad0600    call    qword ptr [aswSnx+0x97888 (fffff880`03f67888)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb3c eb14            jmp     aswSnx+0x2cb52 (fffff880`03efcb52)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb52:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb52 85f6            test    esi,esi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb54 7869            js      aswSnx+0x2cbbf (fffff880`03efcbbf)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb56:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb56 41b001          mov     r8b,1[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb59 488d15d0110b00  lea     rdx,[aswSnx+0xddd30 (fffff880`03fadd30)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb60 488bcb          mov     rcx,rbx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb63 ff1557ad0600    call    qword ptr [aswSnx+0x978c0 (fffff880`03f678c0)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb69 85c0            test    eax,eax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb6b 751e            jne     aswSnx+0x2cb8b (fffff880`03efcb8b)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb6d:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb6d 488bcf          mov     rcx,rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb70 e89fe1fdff      call    aswSnx+0xad14 (fffff880`03edad14)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb75 84c0            test    al,al[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb77 7446            je      aswSnx+0x2cbbf (fffff880`03efcbbf)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb79:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb79 4c8bc7          mov     r8,rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb7c 488bd7          mov     rdx,rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb7f b902000000      mov     ecx,2[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb84 e88b2cfeff      call    aswSnx+0xf814 (fffff880`03edf814)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb89 eb34            jmp     aswSnx+0x2cbbf (fffff880`03efcbbf)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cb8b:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb8b 41b001          mov     r8b,1[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb8e 488d158b110b00  lea     rdx,[aswSnx+0xddd20 (fffff880`03fadd20)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb95 488bcb          mov     rcx,rbx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb98 ff1522ad0600    call    qword ptr [aswSnx+0x978c0 (fffff880`03f678c0)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcb9e 85c0            test    eax,eax[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcba0 751d            jne     aswSnx+0x2cbbf (fffff880`03efcbbf)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cba2:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcba2 66833f4e        cmp     word ptr [rdi],4Eh[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcba6 7217            jb      aswSnx+0x2cbbf (fffff880`03efcbbf)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cba8:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcba8 488bcf          mov     rcx,rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbab e850960300      call    aswSnx+0x66200 (fffff880`03f36200)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbb0 84c0            test    al,al[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbb2 740b            je      aswSnx+0x2cbbf (fffff880`03efcbbf)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cbb4:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbb4 488bd7          mov     rdx,rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbb7 488bcf          mov     rcx,rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbba e88d960300      call    aswSnx+0x6624c (fffff880`03f3624c)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cbbf:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbbf 488d153a4a0b00  lea     rdx,[aswSnx+0xe1600 (fffff880`03fb1600)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbc6 488bcb          mov     rcx,rbx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbc9 e89ec20400      call    aswSnx+0x78e6c (fffff880`03f48e6c)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cbce:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbce ff15dcad0600    call    qword ptr [aswSnx+0x979b0 (fffff880`03f679b0)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbd4 84c0            test    al,al[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbd6 7512            jne     aswSnx+0x2cbea (fffff880`03efcbea)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cbd8:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbd8 ba536e7820      mov     edx,20786E53h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbdd 488b4c2438      mov     rcx,qword ptr [rsp+38h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbe2 ff1538ae0600    call    qword ptr [aswSnx+0x97a20 (fffff880`03f67a20)][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbe8 eb20            jmp     aswSnx+0x2cc0a (fffff880`03efcc0a)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cbea:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbea 488364244000    and     qword ptr [rsp+40h],0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbf0 41b900800000    mov     r9d,8000h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbf6 4c8d442440      lea     r8,[rsp+40h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcbfb 488d542438      lea     rdx,[rsp+38h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc00 4883c9ff        or      rcx,0FFFFFFFFFFFFFFFFh[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc04 ff15eea80600    call    qword ptr [aswSnx+0x974f8 (fffff880`03f674f8)][/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cc0a:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc0a 418bc4          mov     eax,r12d[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc0d 4c8d5c2460      lea     r11,[rsp+60h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc12 498b5b10        mov     rbx,qword ptr [r11+10h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc16 498b7318        mov     rsi,qword ptr [r11+18h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc1a 498b7b28        mov     rdi,qword ptr [r11+28h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc1e 498be3          mov     rsp,r11[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`03efcc21 415c            pop     r12[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]fffff880`03efcc23 c3              ret[/COLOR][/FONT]

 

[peebee]

[FONT=Courier New][COLOR=#000000]2: kd> dp [/COLOR][COLOR=red]@rsp+48h [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- Location on the stack where rcx came from. Looks good[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca418  fffff8a0`11d619c0 00000000`000fc770[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca428  00000000`000fc798 00000000`000fc798[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca438  fffff800`03291e53 fffffa80`07419b50[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca448  00000000`000fc6d8 00000000`062b00d0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca458  fffff880`0a6ca458 00000000`00000000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca468  fffffa80`07317b30 fffff8a0`124a41c0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca478  00000000`000030cc 00000000`75202401[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff880`0a6ca488  00000000`000fd100 00000000`000ffd20[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]2: kd> dd @rcx[/FONT][/COLOR]
[COLOR=red][FONT=Courier New]00000000`0b5a0000  ???????? ???????? ???????? ???????? [/FONT][/COLOR][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][COLOR=red][FONT=Courier New]- No data?[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`0b5a0010  ???????? ???????? ???????? ????????[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`0b5a0020  ???????? ???????? ???????? ????????[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`0b5a0030  ???????? ???????? ???????? ????????[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`0b5a0040  ???????? ???????? ???????? ????????[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`0b5a0050  ???????? ???????? ???????? ????????[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`0b5a0060  ???????? ???????? ???????? ????????[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]00000000`0b5a0070  ???????? ???????? ???????? ????????[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]2: kd> r[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]Last set context:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]rax=0000000000000000 rbx=0000000000000000 rcx=000000000b5a0000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]rdx=fffff8a011d619c1 rsi=0000000000000000 rdi=0000000000000000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]rip=fffff88003efcad1 rsp=fffff8800a6ca3d0 rbp=fffff8800a6ca530[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New] r8=fffff8a011d619c0  r9=fffff8800a6ca318 r10=fffff88003fb1600[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]r11=fffff8a011d619c0 r12=0000000000000000 r13=0000000000000000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]r14=0000000000000000 r15=0000000000000000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]iopl=0         nv up ei pl zr na po nc[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]cs=0010  ss=0018  ds=0000  es=0000  fs=0000  gs=0000             efl=00010246[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]aswSnx+0x2cad1:[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]fffff880`03efcad1 f30f6f01        movdqu  xmm0,xmmword ptr [rcx] ds:[/COLOR][COLOR=red]00000000`0b5a0000[/COLOR][COLOR=#000000]=???????????????????????????????? [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- Address being referenced. Shouldn’t be ?’s in a full dump.[/COLOR][/FONT]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]2: kd> !pte 00000000`0b5a0000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]                                           VA 000000000b5a0000[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00000    PDE at FFFFF6FB400002D0    PTE at FFFFF6800005AD00[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]contains 65700001A9C95867  contains 174000000CC99867  contains 6AA000003CC7C867  contains [/COLOR][COLOR=red]0000000000000000 [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- Invalid page table entry[/COLOR][/FONT]
[FONT=Courier New][COLOR=#000000]pfn 1a9c95    ---DA--UWEV  pfn cc99      ---DA--UWEV  pfn 3cc7c     ---DA--UWEV  [/COLOR][COLOR=red]not valid[/COLOR][/FONT]

 

[Haakon]

Thanks for looking into this!

It makes sense that it could be Rapport. The one situation that I reproduced that caused the crash was logging into a site. Some of the sites use Rapport, I can't remember which at this point, and I neglected to write down which site it was, but it might have been one that used it. The problem is pretty intermittent--it can come up several times in a day and then not for a week, so it could take a while before I know for sure.

 

[Haakon]

I hadn't mentioned this before, but it is something else that has been coming up for about the same period, and just happened again: Windows Explorer crashes intermittently. Most of the time it just restarts itself, but occasionally I have to restart the machine. Do you think this could be related???

 

[peebee]

I hadn't mentioned this before, but it is something else that has been coming up for about the same period, and just happened again: Windows Explorer crashes intermittently. Most of the time it just restarts itself, but occasionally I have to restart the machine. Do you think this could be related???

It's probably unrelated because the explorer crashes are happening in usermode. Aside from looking at event logs (eventvwr.msc) and any other various logs explorer.exe keeps track of, the only other method of debugging this would be to attach a live debugger and wait until the process terminates.

 

[Haakon]

OK, it's been a week and no BSODs. I am marking this solved. The only thing I changed is to remove Trusteer Rapport, which is apparently used by some 50 banks on the server end as well as recommended for their users. I told Trusteer about it, and with luck it will be fixed in a future version. Meanwhile I am considering a dual boot or Live CD/USB Drive.

It seems the antivirus and other protective software like Trusteer, as well as the OSs themselves are in a sort of core wars to get to deeper levels of your system in order to attack or protect the system. It's not surprising that they end up stepping on each other in the kernel--it's more surprising that often the systems keep working.