Jump to content

Unknown caused an Access Violation (0xc0000005)


Recommended Posts

Windbg says:

Spoiler

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Downloads\crash.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available


************* Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*c:\symbols*https://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*https://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 10 Version 18362 MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS Personal
18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Debug session time: Sat Sep 14 21:39:35.000 2019 (UTC + 2:00)
System Uptime: not available
Process Uptime: 0 days 0:01:36.000
................................................................
....................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2b0c.2e40): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtGetContextThread+0x14:
00007ffd`9dcbde64 c3              ret
0:006> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify timestamp for KSP_x64.exe
*** WARNING: Unable to verify timestamp for mono.dll
*** WARNING: Unable to verify timestamp for nvd3dumx.dll
*** WARNING: Unable to verify timestamp for DiscordHook64.dll

KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Execute

    Key  : Timeline.Process.Start.DeltaSec
    Value: 96


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1

Timeline: !analyze.Start
    Name: <blank>
    Time: 2019-09-16T18:51:12.503Z
    Diff: 169897503 mSec

Timeline: Dump.Current
    Name: <blank>
    Time: 2019-09-14T19:39:35.0Z
    Diff: 0 mSec

Timeline: Process.Start
    Name: <blank>
    Time: 2019-09-14T19:37:59.0Z
    Diff: 96000 mSec


DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT:  (.ecxr)
rax=0000000006e267c0 rbx=0000000006e267c0 rcx=0000000006e267c8
rdx=0000000131354e60 rsi=0000000000000100 rdi=0000000131354e60
rip=0000000006e267c0 rsp=000000000d42e450 rbp=000000000d42e4e9
 r8=0000000193a25c18  r9=0000000000000001 r10=0000000000008000
r11=000000000d42e4c0 r12=0000000000000100 r13=0000000000000000
r14=0000000006e267c0 r15=0000000000000100
iopl=0         ov up ei pl nz na po cy
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010a07
00000000`06e267c0 60              ???
Resetting default scope

FAULTING_IP: 
+0
00000000`06e267c0 60              ???

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 0000000006e267c0
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000008
   Parameter[1]: 0000000006e267c0
Attempt to execute non-executable address 0000000006e267c0

DEFAULT_BUCKET_ID:  SOFTWARE_NX_FAULT

PROCESS_NAME:  KSP_x64.exe

FOLLOWUP_IP: 
d3d9!CBaseDevice::CreateOffscreenPlainSurfaceInternal+13b
00007ffd`6496ad4f 8bd8            mov     ebx,eax

EXECUTE_ADDRESS: 6e267c0

FAILED_INSTRUCTION_ADDRESS: 
+0
00000000`06e267c0 60              ???

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000008

EXCEPTION_PARAMETER2:  0000000006e267c0

WATSON_BKT_PROCSTAMP:  4614489d

WATSON_BKT_PROCVER:  9.18.944.0

PROCESS_VER_PRODUCT:  Microsoft® DirectX for Windows®

WATSON_BKT_MODULE:  unknown

WATSON_BKT_MODVER:  0.0.0.0

WATSON_BKT_MODOFFSET:  6e267c0

WATSON_BKT_MODSTAMP:  bbbbbbb4

BUILD_VERSION_STRING:  18362.1.amd64fre.19h1_release.190318-1202

MODLIST_WITH_TSCHKSUM_HASH:  cd79fb351f5735fbf15e1a9e8c17f0e5df9dfcd9

MODLIST_SHA1_HASH:  da8fb2381a68fb715fc09f784f1a49404eb77e56

DUMP_FLAGS:  0

DUMP_TYPE:  2

ANALYSIS_SESSION_TIME:  09-16-2019 20:51:12.0503

ANALYSIS_VERSION: 10.0.18362.1 amd64fre

THREAD_ATTRIBUTES: 
BUGCHECK_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

PROBLEM_CLASSES: 

    ID:     [0n313]
    Type:   [@ACCESS_VIOLATION]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Omit
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x2e40]
    Frame:  [0] : unknown!unknown

    ID:     [0n287]
    Type:   [INVALID_POINTER_EXECUTE]
    Class:  Primary
    Scope:  BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x2e40]
    Frame:  [0] : unknown!unknown

    ID:     [0n295]
    Type:   [SOFTWARE_NX_FAULT]
    Class:  Primary
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x2b0c]
    TID:    [0x2e40]
    Frame:  [0] : unknown!unknown

IP_ON_HEAP:  0000000006e267c0
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

LAST_CONTROL_TRANSFER:  from 0000000000000100 to 0000000006e267c0

STACK_TEXT:  
00000000`0d42e450 00000000`00000100 : 00007ffd`6496ad4f 00000000`00000000 00007ffd`00000000 00000000`00000002 : 0x6e267c0
00000000`0d42e458 00007ffd`6496ad4f : 00000000`00000000 00007ffd`00000000 00000000`00000002 00000001`313563e0 : 0x100
00000000`0d42e460 00007ffd`6496ab41 : 00000000`06e267c0 00000000`00000100 00000000`00000100 00000000`00000000 : d3d9!CBaseDevice::CreateOffscreenPlainSurfaceInternal+0x13b
00000000`0d42e4f0 00007ff6`6668a0ee : 00000000`06e267c0 00000000`0d42e629 00000000`00000001 00000000`00000000 : d3d9!CBaseDevice::CreateOffscreenPlainSurface+0x91
00000000`0d42e550 00000000`06e267c0 : 00000000`0d42e629 00000000`00000001 00000000`00000000 00000000`00000002 : KSP_x64+0x33a0ee
00000000`0d42e558 00000000`0d42e629 : 00000000`00000001 00000000`00000000 00000000`00000002 00000000`0d42e5b0 : 0x6e267c0
00000000`0d42e560 00000000`00000001 : 00000000`00000000 00000000`00000002 00000000`0d42e5b0 00000000`00000000 : 0xd42e629
00000000`0d42e568 00000000`00000000 : 00000000`00000002 00000000`0d42e5b0 00000000`00000000 00000000`0d42e780 : 0x1


THREAD_SHA1_HASH_MOD_FUNC:  0bfd132089fe4d3a53e60efd804e97d1594b4ecd

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  4d8a4b6c7f550ba53e19cadb8572c184f2419b8f

THREAD_SHA1_HASH_MOD:  1fb35f7f42905dad5ad8d8723d8d62fbd74cbc74

FAULT_INSTR_CODE:  c085d88b

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  d3d9!CBaseDevice::CreateOffscreenPlainSurfaceInternal+13b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: d3d9

IMAGE_NAME:  d3d9.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  1ac9a115

STACK_COMMAND:  ~6s ; .ecxr ; kb

FAILURE_BUCKET_ID:  SOFTWARE_NX_FAULT_c0000005_d3d9.dll!CBaseDevice::CreateOffscreenPlainSurfaceInternal

BUCKET_ID:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE_BAD_IP_d3d9!CBaseDevice::CreateOffscreenPlainSurfaceInternal+13b

FAILURE_EXCEPTION_CODE:  c0000005

FAILURE_IMAGE_NAME:  d3d9.dll

BUCKET_ID_IMAGE_STR:  d3d9.dll

FAILURE_MODULE_NAME:  d3d9

BUCKET_ID_MODULE_STR:  d3d9

FAILURE_FUNCTION_NAME:  CBaseDevice::CreateOffscreenPlainSurfaceInternal

BUCKET_ID_FUNCTION_STR:  CBaseDevice::CreateOffscreenPlainSurfaceInternal

BUCKET_ID_OFFSET:  13b

BUCKET_ID_MODTIMEDATESTAMP:  1ac9a115

BUCKET_ID_MODCHECKSUM:  1c5021

BUCKET_ID_MODVER_STR:  10.0.18362.329

BUCKET_ID_PREFIX_STR:  APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE_BAD_IP_

FAILURE_PROBLEM_CLASS:  APPLICATION_FAULT

FAILURE_SYMBOL_NAME:  d3d9.dll!CBaseDevice::CreateOffscreenPlainSurfaceInternal

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/KSP_x64.exe/9.18.944.0/4614489d/unknown/0.0.0.0/bbbbbbb4/c0000005/06e267c0.htm?Retriage=1

TARGET_TIME:  2019-09-14T19:39:35.000Z

OSBUILD:  18362

OSSERVICEPACK:  329

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  768

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt SingleUserTS Personal

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

BUILDDATESTAMP_STR:  190318-1202

BUILDLAB_STR:  19h1_release

BUILDOSVER_STR:  10.0.18362.1.amd64fre.19h1_release.190318-1202

ANALYSIS_SESSION_ELAPSED_TIME:  1e4b5

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:software_nx_fault_c0000005_d3d9.dll!cbasedevice::createoffscreenplainsurfaceinternal

FAILURE_ID_HASH:  {31c8e682-bffd-17e9-4b5b-775e46c06a66}
 

A "classic" 0xc0000005 or Access Violation then, "someone" tried to access memory at an address that couldn't be accessed. Excluding Windows files, in the dump file these files are mentioned in particular:

*** WARNING: Unable to verify timestamp for KSP_x64.exe
*** WARNING: Unable to verify timestamp for mono.dll
*** WARNING: Unable to verify timestamp for nvd3dumx.dll
*** WARNING: Unable to verify timestamp for DiscordHook64.dll

The first two files belong to KSP itself, which leaves the two possible culprits nvd3dumx.dll and DiscordHook64.dll.

Then we also have:

FAILURE_IMAGE_NAME:  d3d9.dll

This file belongs to DirectX9, so the crash has to do with graphics routines.

nvd3dumx.dll is part of your Nvidia graphics driver, while DiscordHook64.dll obviously belongs to your installed Discord App.

My take: the crash has probably been caused by the graphics driver, I'd update that. Could also be Discord, but I don't think so.

Edited by VoidSquid
Link to comment
Share on other sites

This thread is quite old. Please consider starting a new thread rather than reviving this one.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...