Windows 10: Help interpreting minidump analysis from WinDbg

Hi,

I have been investigating a Driver Power State Failure BSOD and came across several pointers on how to identify the cause. Checking BluescreenViewer showed it was an 'ntoskrnl.exe' issue. Upon further checking, I found that kernel issues could be a wide range of things and resorted to WinDbg to further narrow it down. Could anyone help me interpret the following? So far, I believe it is a PnP issue but I'm not super sure. Please help me check the following:

.................................................. For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff800`5a9c2390 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff800`5f0ce7b0=000000000000009f 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_POWER_STATE_FAILURE (9f) A driver has failed to complete a power IRP within a specific time. Arguments: Arg1: 0000000000000004, The power transition timed out waiting to synchronize with the Pnp subsystem. Arg2: 000000000000012c, Timeout in seconds. Arg3: ffff898e7c2aa040, The thread currently holding on to the Pnp lock. Arg4: fffff8005f0ce7e0, nt!TRIAGE_9F_PNP on Win7 and higher Debugging Details: ------------------ Implicit thread is now ffff898e`7c2aa040 *** WARNING: Unable to verify checksum for win32k.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.Sec Value: 3 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on DESKTOP-FB5I7SJ Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.Sec Value: 79 Key : Analysis.Memory.CommitPeak.Mb Value: 69 Key : Analysis.System Value: CreateObject ADDITIONAL_XML: 1 BUGCHECK_CODE: 9f BUGCHECK_P1: 4 BUGCHECK_P2: 12c BUGCHECK_P3: ffff898e7c2aa040 BUGCHECK_P4: fffff8005f0ce7e0 DRVPOWERSTATE_SUBCODE: 4 FAULTING_THREAD: ffff898e7c2aa040 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System BAD_STACK_POINTER: fffff8005f0ce7a8 STACK_TEXT: ffff9984`eea77420 fffff800`5a91507d : ffff9c81`80ca5180 00000001`fffffffe ffff9c81`ffffffff 00000000`00000001 : nt!KiSwapContext+0x76 ffff9984`eea77560 fffff800`5a913f04 : ffff898e`7c2aa040 00000000`00000000 00630038`00000000 00380033`00000000 : nt!KiSwapThread+0xbfd ffff9984`eea77600 fffff800`5a9136a5 : fffff800`5ab83490 fffff800`00000000 00000000`00000300 00000000`00000000 : nt!KiCommitThreadWait+0x144 ffff9984`eea776a0 fffff800`5a945766 : ffff898e`7fd844d0 00000000`00000000 ffff898e`7fd65500 fffff800`5af31300 : nt!KeWaitForSingleObject+0x255 ffff9984`eea77780 fffff800`5a945636 : ffffaf8a`30ca2410 ffff898e`7fd65520 00000000`00000000 00000000`00000000 : nt!PopFxActivateDevice+0x122 ffff9984`eea777d0 fffff800`5af31077 : ffff898e`7c1277f0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PoFxActivateDevice+0xe ffff9984`eea77800 fffff800`5af30d5a : ffff898e`7fd65520 ffff9984`eea77880 00000000`00000000 fffff800`5af30a81 : nt!PnpDeleteLockedDeviceNode+0x43 ffff9984`eea77840 fffff800`5af2f557 : ffff898e`7e2ec750 00000003`00000002 00000000`00000003 00000000`00000000 : nt!PnpDeleteLockedDeviceNodes+0x76 ffff9984`eea778c0 fffff800`5af08b4e : ffff9984`eea77a10 ffff898e`7bc69b00 ffff9984`eea77a00 ffffaf8a`00000003 : nt!PnpProcessQueryRemoveAndEject+0x1ef ffff9984`eea779b0 fffff800`5add69b8 : ffffaf8a`3aa202d0 ffffaf8a`2deb7ed0 ffffaf8a`2deb7ed0 00000000`00000000 : nt!PnpProcessTargetDeviceEvent+0xea ffff9984`eea779e0 fffff800`5a8f43b5 : ffff898e`74495880 ffff898e`7c2aa040 ffff898e`74495880 ffff9984`00002000 : nt!PnpDeviceEventWorker+0x2d8 ffff9984`eea77a70 fffff800`5a86bcd5 : ffff898e`7c2aa040 00000000`00000080 ffff898e`74497340 00000000`00000000 : nt!ExpWorkerThread+0x105 ffff9984`eea77b10 fffff800`5a9c9998 : ffff9c81`80a53180 ffff898e`7c2aa040 fffff800`5a86bc80 00000000`00000000 : nt!PspSystemThreadStartup+0x55 ffff9984`eea77b60 00000000`00000000 : ffff9984`eea78000 ffff9984`eea71000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28 STACK_COMMAND: .thread 0xffff898e7c2aa040 ; kb SYMBOL_NAME: nt!KiSwapContext+76 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe IMAGE_VERSION: 10.0.18362.836 BUCKET_ID_FUNC_OFFSET: 76 FAILURE_BUCKET_ID: 0x9F_4_STACKPTR_ERROR_nt!KiSwapContext OS_VERSION: 10.0.18362.1 BUILDLAB_STR: 19h1_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {93f68f63-ba05-dc3b-36fd-9cbce8228665} Followup: MachineOwner --------- 0: kd> lmvm nt Browse full module list start end module name fffff800`5a800000 fffff800`5b2b7000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\DCA4AD4BEEB4746D48F84C0125019E431\ntkrnlmp.pdb Loaded symbol image file: ntkrnlmp.exe Mapped memory image file: C:\ProgramData\Dbg\sym\ntoskrnl.exe\B785E389ab7000\ntoskrnl.exe Image path: ntkrnlmp.exe Image name: ntkrnlmp.exe Browse all global symbols functions data Image was built with /Brepro flag. Timestamp: B785E389 (This is a reproducible build file hash, not a timestamp) CheckSum: 0097940F ImageSize: 00AB7000 File version: 10.0.18362.836 Product version: 10.0.18362.836 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 1.0 App File date: 00000000.00000000 Translations: 0409.04b0 Information from resource tables: CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: ntkrnlmp.exe OriginalFilename: ntkrnlmp.exe ProductVersion: 10.0.18362.836 FileVersion: 10.0.18362.836 (WinBuild.160101.0800) FileDescription: NT Kernel & System LegalCopyright: © Microsoft Corporation. All rights reserved.
submitted by /u/wagmainis
[link] [comments]

:)

 

windbg cannot analyze minidump file

Did you install and configure WinDBG using this:

Install and Configure WinDBG for BSOD Analysis Windows 10 BSOD Tutorials

If so, then the .dmp file is corrupted.

 

WinDBG-all apps


Hi, very good your post and thank you for such information, i followed all the steps but i got this message when trying to set the path for the symbols.

please help, thanks!!

 

Bsod with Vista64

Well i finally found a site where it tells the average computer user , step by step how to open a minidump through windbg . I was shocked to see the first one had at the Image name Ntfs.sys can this really be making problems?, the second was with video driver and the third is with tcpip.sys *Frown .