*** Fatal System Error: 0x000000fc
|
(0x97EBF6A4,0x11DD2963,0x97EBF56C,0x00000002)
|
|
Break instruction exception - code 80000003 (first chance)
|
|
A fatal system error has occurred.
|
Debugger entered on first try; Bugcheck callbacks have not been invoked.
|
|
A fatal system error has occurred.
|
|
Connected to Windows 8 9600 x86 compatible target at (Thu Nov 20 11:02:38.043 2014 (UTC + 1:00)), ptr64 FALSE
|
Loading Kernel Symbols
|
...............................................................
|
................................................................
|
..........................
|
Loading User Symbols
|
..............
|
Loading unloaded module list
|
........
|
*******************************************************************************
|
* *
|
* Bugcheck Analysis *
|
* *
|
*******************************************************************************
|
|
Use !analyze -v to get detailed debugging information.
|
|
BugCheck FC, {97ebf6a4, 11dd2963, 97ebf56c, 2}
|
|
Probably caused by : ATMFD.DLL ( ATMFD+30358 )
|
|
Followup: MachineOwner
|
---------
|
|
nt!RtlpBreakWithStatusInstruction:
|
81912ef4 cc int 3
|
0: kd> !analyze -v
|
*******************************************************************************
|
* *
|
* Bugcheck Analysis *
|
* *
|
*******************************************************************************
|
|
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
|
An attempt was made to execute non-executable memory. The guilty driver
|
is on the stack trace (and is typically the current instruction pointer).
|
When possible, the guilty driver's name (Unicode string) is printed on
|
the bugcheck screen and saved in KiBugCheckDriver.
|
Arguments:
|
Arg1: 97ebf6a4, Virtual address for the attempted execute.
|
Arg2: 11dd2963, PTE contents.
|
Arg3: 97ebf56c, (reserved)
|
Arg4: 00000002, (reserved)
|
|
Debugging Details:
|
------------------
|
|
|
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
|
|
BUGCHECK_STR: 0xFC
|
|
PROCESS_NAME: csrss.exe
|
|
CURRENT_IRQL: 0
|
|
TRAP_FRAME: 97ebf56c -- (.trap 0xffffffff97ebf56c)
|
ErrCode = 00000011
|
eax=992eda71 ebx=00000000 ecx=00000000 edx=86992d24 esi=97ebf6e8 edi=97ebf628
|
eip=97ebf6a4 esp=97ebf5e0 ebp=9937637c iopl=0 nv up ei pl zr na pe nc
|
cs=0008 ss=0010 ds=0001 es=0023 fs=0030 gs=0023 efl=00010246
|
97ebf6a4 b0f7 mov al,0F7h
|
Resetting default scope
|
|
LAST_CONTROL_TRANSFER: from 81993cbe to 81912ef4
|
|
STACK_TEXT:
|
97ebef7c 81993cbe 00000003 1535b09a 00000065 nt!RtlpBreakWithStatusInstruction
|
97ebefd0 819937d8 81a23138 97ebf3cc 97ebf440 nt!KiBugCheckDebugBreak+0x1f
|
97ebf3a0 81911ab6 000000fc 97ebf6a4 11dd2963 nt!KeBugCheck2+0x676
|
97ebf3c4 819119ed 000000fc 97ebf6a4 11dd2963 nt!KiBugCheck2+0xc6
|
97ebf3e4 8193050a 000000fc 97ebf6a4 11dd2963 nt!KeBugCheckEx+0x19
|
97ebf440 8185afa5 97ebf56c 11dd2963 80000000 nt! ?? ::FNODOBFM::`string'+0x5148
|
97ebf4c8 81925ff5 00000008 97ebf6a4 00000000 nt!MmAccessFault+0x735
|
97ebf4c8 97ebf6a4 00000008 97ebf6a4 00000000 nt!KiTrap0E+0xf1
|
WARNING: Frame IP not in any known module. Following frames may be wrong.
|
97ebf65c 99376358 97ebf934 00000000 56433230 0x97ebf6a4
|
97ebf69c 92feb84d 97ebf7b0 9936564b 97ebf818 ATMFD+0x30358
|
97ebf75c 9936557b 97ebf934 00000000 56433230 win32k!NSInstrumentation::CLeakTrackingAllocator::AllocateCommon<<lambda_fe07375a717cc73f98fc191ce18da5ff>,<lambda_b5a93bfe6359a6d610535e22a6514191> >+0x2e
|
97ebf790 99351277 99351193 8889751a ffffffff ATMFD+0x1f57b
|
97ebf794 99351193 8889751a ffffffff 993511cd ATMFD+0xb277
|
97ebf7a0 993511cd 1172dacc 1172da94 97ebf7d4 ATMFD+0xb193
|
97ebf7b0 993656fe 97ebf85c 00000000 97ebf83c ATMFD+0xb1cd
|
97ebf7d4 99358e2e 888e5380 9938a268 97ebf818 ATMFD+0x1f6fe
|
97ebf944 99358b52 ffffffff 97ebfac0 888918c8 ATMFD+0x12e2e
|
97ebf994 99349f11 ffffffff 97ebfac0 00000000 ATMFD+0x12b52
|
97ebf9e8 92f6af3a 9027e010 888d8400 00000001 ATMFD+0x3f11
|
97ebfa44 92f6b83d 9027e010 888d8400 00000001 win32k!PDEVOBJ::QueryFontData+0x5c
|
97ebfa7c 92f6b6f1 888d8400 00000042 97ebfac0 win32k!ulCallAndConvertFontOutput+0x2a
|
97ebfb0c 92f6b908 00000061 00000001 97ebfc9c win32k!xInsertMetricsPlusRFONTOBJ+0x185
|
97ebfb20 92ec6294 888b7c7c 00000061 00000000 win32k!RFONTOBJ::bInsertMetricsPlus+0x25
|
97ebfb50 92ec5fe9 0000001a 00000104 888b7aa0 win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x149
|
97ebfba0 92fa9259 97ebfc80 97ebfc9c 00000008 win32k!ESTROBJ::vCharPos_H3+0xa1
|
97ebfc1c 92ec679b 90241068 0000001a 97ebfc80 win32k!ESTROBJ::vInit+0x889
|
97ebfe50 92ec69e8 0000001a ffffffff 97ebfe94 win32k!GreGetTextExtentExW+0x17d
|
97ebff2c 81922b27 9001075e 000e1d80 0000001a win32k!NtGdiGetTextExtentExW+0x16b
|
97ebff2c 777c6ce4 9001075e 000e1d80 0000001a nt!KiSystemServicePostCall
|
0009e8d0 00000000 00000000 00000000 00000000 ntdll!KiFastSystemCallRet
|
|
|
STACK_COMMAND: kb
|
|
FOLLOWUP_IP:
|
ATMFD+30358
|
99376358 59 pop ecx
|
|
SYMBOL_STACK_INDEX: 9
|
|
SYMBOL_NAME: ATMFD+30358
|
|
FOLLOWUP_NAME: MachineOwner
|
|
MODULE_NAME: ATMFD
|
|
IMAGE_NAME: ATMFD.DLL
|
|
DEBUG_FLR_IMAGE_TIMESTAMP: 52158fac
|
|
FAILURE_BUCKET_ID: 0xFC_ATMFD+30358
|
|
BUCKET_ID: 0xFC_ATMFD+30358
|
|
Followup: MachineOwner
|
---------
|
|
|