Windows 8 and 8.1 Forums


wakeup from S3, windows 8 enter BSOD

  1. #1


    Posts : 1
    windows 8

    wakeup from S3, windows 8 enter BSOD


    Like the title say, windows 8 BSOD after wake up from S3. The following is the dumpfile ( Sorry, I did not have dump file now.) I just Wonder the meaning of the "AV"
    BUGCHECK_STR: AV
    PROCESS_NAME: System

    The dump file show the possible root cause is HIDCLASS.sys. Could someone explain the detail of fail reason? How to solve the problem?

    Microsoft (R) Windows Debugger Version 6.2.9200.16384 X86
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [E:\MEMORY.DMP]
    Kernel Bitmap Dump File: Full address space is available
    Symbol search path is: SRV*D:\WinDebug\SRV*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 8 Kernel Version 9200 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 9200.16461.amd64fre.win8_gdr.121119-1606
    Machine Name:
    Kernel base = 0xfffff803`86c14000 PsLoadedModuleList = 0xfffff803`86edea80
    Debug session time: Wed Apr 24 08:17:28.072 2013 (UTC + 8:00)
    System Uptime: 0 days 21:31:04.173
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .....................................................
    Loading User Symbols
    Loading unloaded module list
    ............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck 50, {fffffffffffffff7, 0, fffff80386cedcfb, 0}
    Probably caused by : HIDCLASS.SYS ( HIDCLASS!HidpIdleTimeWorker+6d )
    Followup: MachineOwner
    ---------
    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffffffffffff7, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80386cedcfb, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)
    Debugging Details:
    ------------------

    READ_ADDRESS: fffffffffffffff7
    FAULTING_IP:
    nt!IoReuseIrp+2b
    fffff803`86cedcfb 0fb67147 movzx esi,byte ptr [rcx+47h]
    MM_INTERNAL_CODE: 0
    DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
    BUGCHECK_STR: AV
    PROCESS_NAME: System
    CURRENT_IRQL: 0
    TRAP_FRAME: fffff8801aa37880 -- (.trap 0xfffff8801aa37880)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=ffff6c9a15d4b110 rbx=0000000000000000 rcx=ffffffffffffffb0
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80386cedcfb rsp=fffff8801aa37a10 rbp=fffffa800bc80440
    r8=0000000000000000 r9=0000000000000000 r10=0000000000000062
    r11=fffff8801aa37aa8 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na pe nc
    nt!IoReuseIrp+0x2b:
    fffff803`86cedcfb 0fb67147 movzx esi,byte ptr [rcx+47h] ds:ffffffff`fffffff7=??
    Resetting default scope
    LAST_CONTROL_TRANSFER: from fffff80386dfcbe1 to fffff80386c8f340
    STACK_TEXT:
    fffff880`1aa37698 fffff803`86dfcbe1 : 00000000`00000050 ffffffff`fffffff7 00000000`00000000 fffff880`1aa37880 : nt!KeBugCheckEx
    fffff880`1aa376a0 fffff803`86cc9cef : 00000000`00000000 ffffffff`fffffff7 fffffa80`0e895040 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x32321
    fffff880`1aa37740 fffff803`86c8cdee : 00000000`00000000 fffff880`05666440 00000000`00000000 fffff880`1aa37880 : nt!MmAccessFault+0x54f
    fffff880`1aa37880 fffff803`86cedcfb : 45ad6cbf`00000001 00000000`00000000 00000000`00000003 fffff803`86cba1bb : nt!KiPageFault+0x16e
    fffff880`1aa37a10 fffff880`05664e69 : 00000000`00000000 fffff880`05666440 fffffa80`0bc80440 ffffffff`ffffffb0 : nt!IoReuseIrp+0x2b
    fffff880`1aa37ab0 fffff803`86c7a413 : fffffa80`0bd35930 00000000`00000000 fffff880`05664dfc fffffa80`0bc80440 : HIDCLASS!HidpIdleTimeWorker+0x6d
    fffff880`1aa37b10 fffff803`86cc7511 : fffff803`86e98110 fffffa80`0e895040 fffff803`86c7a3b4 fffff803`86eabd00 : nt!IopProcessWorkItem+0x5f
    fffff880`1aa37b80 fffff803`86c36551 : fffffa80`06712810 00000000`00000080 fffff803`86cc73d0 fffffa80`0e895040 : nt!ExpWorkerThread+0x142
    fffff880`1aa37c10 fffff803`86c74dd6 : fffff803`86f0a180 fffffa80`0e895040 fffffa80`071efb00 fffffa80`0671b940 : nt!PspSystemThreadStartup+0x59
    fffff880`1aa37c60 00000000`00000000 : fffff880`1aa38000 fffff880`1aa32000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    HIDCLASS!HidpIdleTimeWorker+6d
    fffff880`05664e69 4885f6 test rsi,rsi
    SYMBOL_STACK_INDEX: 5
    SYMBOL_NAME: HIDCLASS!HidpIdleTimeWorker+6d
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: HIDCLASS
    IMAGE_NAME: HIDCLASS.SYS
    DEBUG_FLR_IMAGE_TIMESTAMP: 50ab0d6a
    BUCKET_ID_FUNC_OFFSET: 6d
    FAILURE_BUCKET_ID: AV_HIDCLASS!HidpIdleTimeWorker
    BUCKET_ID: AV_HIDCLASS!HidpIdleTimeWorker
    Followup: MachineOwner
    ---------
    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffffffffffff7, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80386cedcfb, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)
    Debugging Details:
    ------------------

    READ_ADDRESS: fffffffffffffff7
    FAULTING_IP:
    nt!IoReuseIrp+2b
    fffff803`86cedcfb 0fb67147 movzx esi,byte ptr [rcx+47h]
    MM_INTERNAL_CODE: 0
    DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
    BUGCHECK_STR: AV
    PROCESS_NAME: System
    CURRENT_IRQL: 0
    TRAP_FRAME: fffff8801aa37880 -- (.trap 0xfffff8801aa37880)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=ffff6c9a15d4b110 rbx=0000000000000000 rcx=ffffffffffffffb0
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80386cedcfb rsp=fffff8801aa37a10 rbp=fffffa800bc80440
    r8=0000000000000000 r9=0000000000000000 r10=0000000000000062
    r11=fffff8801aa37aa8 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei ng nz na pe nc
    nt!IoReuseIrp+0x2b:
    fffff803`86cedcfb 0fb67147 movzx esi,byte ptr [rcx+47h] ds:ffffffff`fffffff7=??
    Resetting default scope
    LAST_CONTROL_TRANSFER: from fffff80386dfcbe1 to fffff80386c8f340
    STACK_TEXT:
    fffff880`1aa37698 fffff803`86dfcbe1 : 00000000`00000050 ffffffff`fffffff7 00000000`00000000 fffff880`1aa37880 : nt!KeBugCheckEx
    fffff880`1aa376a0 fffff803`86cc9cef : 00000000`00000000 ffffffff`fffffff7 fffffa80`0e895040 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x32321
    fffff880`1aa37740 fffff803`86c8cdee : 00000000`00000000 fffff880`05666440 00000000`00000000 fffff880`1aa37880 : nt!MmAccessFault+0x54f
    fffff880`1aa37880 fffff803`86cedcfb : 45ad6cbf`00000001 00000000`00000000 00000000`00000003 fffff803`86cba1bb : nt!KiPageFault+0x16e
    fffff880`1aa37a10 fffff880`05664e69 : 00000000`00000000 fffff880`05666440 fffffa80`0bc80440 ffffffff`ffffffb0 : nt!IoReuseIrp+0x2b
    fffff880`1aa37ab0 fffff803`86c7a413 : fffffa80`0bd35930 00000000`00000000 fffff880`05664dfc fffffa80`0bc80440 : HIDCLASS!HidpIdleTimeWorker+0x6d
    fffff880`1aa37b10 fffff803`86cc7511 : fffff803`86e98110 fffffa80`0e895040 fffff803`86c7a3b4 fffff803`86eabd00 : nt!IopProcessWorkItem+0x5f
    fffff880`1aa37b80 fffff803`86c36551 : fffffa80`06712810 00000000`00000080 fffff803`86cc73d0 fffffa80`0e895040 : nt!ExpWorkerThread+0x142
    fffff880`1aa37c10 fffff803`86c74dd6 : fffff803`86f0a180 fffffa80`0e895040 fffffa80`071efb00 fffffa80`0671b940 : nt!PspSystemThreadStartup+0x59
    fffff880`1aa37c60 00000000`00000000 : fffff880`1aa38000 fffff880`1aa32000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    HIDCLASS!HidpIdleTimeWorker+6d
    fffff880`05664e69 4885f6 test rsi,rsi
    SYMBOL_STACK_INDEX: 5
    SYMBOL_NAME: HIDCLASS!HidpIdleTimeWorker+6d
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: HIDCLASS
    IMAGE_NAME: HIDCLASS.SYS
    DEBUG_FLR_IMAGE_TIMESTAMP: 50ab0d6a
    BUCKET_ID_FUNC_OFFSET: 6d
    FAILURE_BUCKET_ID: AV_HIDCLASS!HidpIdleTimeWorker
    BUCKET_ID: AV_HIDCLASS!HidpIdleTimeWorker
    Followup: MachineOwner
    ---------
    1: kd> lmvm HIDCLASS
    start end module name
    fffff880`05658000 fffff880`05673000 HIDCLASS (pdb symbols) d:\windebug\srv\hidclass.pdb\CEC5F9DA80B2429B8D741A9437FAED8A2\hidclass.pdb
    Loaded symbol image file: HIDCLASS.SYS
    Image path: \SystemRoot\System32\drivers\HIDCLASS.SYS
    Image name: HIDCLASS.SYS
    Timestamp: Tue Nov 20 12:56:10 2012 (50AB0D6A)
    CheckSum: 00016912
    ImageSize: 0001B000
    File version: 6.2.9200.16461
    Product version: 6.2.9200.16461
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 2.0 Dll
    File date: 00000000.00000000
    Translations: 0409.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft? Windows? Operating System
    InternalName: hidclass.sys
    OriginalFilename: hidclass.sys
    ProductVersion: 6.2.9200.16461
    FileVersion: 6.2.9200.16461 (win8_gdr.121119-1606)
    FileDescription: Hid Class Library
    LegalCopyright: ? Microsoft Corporation. All rights reserved.



    Thanks first.

      My System SpecsSystem Spec

  2. #2


    Posts : 5,139
    Win8.1Pro - Finally!!!


    I'm uncertain what the BUGCHECK_STR: AV means. I'd guess that it stands for "Access Violation" - but that's not applicable (AFAIK) in a STOP 0x133 error

    The PROCESS_NAME: System is merely the process that the thread was executing in when the crash occurred. Most references will say that this doesn't matter in debugging a crash - but I find that if it's repeatedly the same process (and not a Windows process), then it might be significant.

    As for the analysis, it's not simply a matter of what's listed as the cause. The cause occurs where the crash occurs - but take this for example:

    A driver (call it xyz.sys) writes to memory space owned by the HIDCLASS.sys driver
    Then the xyz.sys driver exits - and no trace of it remains on the system
    Then HIDCLASS.sys attempts to access that memory space - and finds the wrong info there.
    At that point it "panics" and crashes the system.
    So, the cause is listed as HIDCLASS.sys - but the real culprit is xyz.sys (which is nowhere to be found).

    Then comes the detective work!
    First, we assume that 90+% of BSOD's are caused by 3rd party (non-Windows) drivers
    Then, we assume that the majority of the remainder are due to hardware issues/failures
    Finally, we assume that a small percentage (less than 1% IME) are due to Windows problems.

    In many BSOD's we find that Windows drivers are blamed (like HIDCLASS.sys is blamed here). The thought process we use here is that Windows has protection mechanisms built into it to protect the drivers, so they're (Windows drivers) are the least likely to be corrupted/damaged/problematic. Also, if the are damaged, you're more likely to see other problems in addition to the occasional BSOD. So we conclude that a Windows driver blamed in the memory dumps isn't the real reason.

    Luckily (IMO) this is a BugCheck 50 - PAGE_FAULT_IN_NONPAGED_AREA - which is usually amenable to manipulation using Driver Verifier. This will help us (we hope) to isolate the name of the actual offending driver. Follow the instructions here to stress the 3rd party drivers: Driver Verifier Settings

    There are other things that we do, but we need the actual memory dumps and other reports to see what's going on inside the system. Please provide this information so we can provide a complete analysis: Blue Screen of Death (BSOD) Posting Instructions
      My System SpecsSystem Spec

wakeup from S3, windows 8 enter BSOD
Related Threads
Solved BSOD after wakeup from sleep in BSOD Crashes and Debugging
Hi, few months ago i had issues with wakeup and BSOD. After that i've changed platform to new one (with few old parts). Few days ago I had one more BSOD too (after wakeup). No bsods occurs till today. All dumps are in the attachement. Platform have old HDDs, graphic card,...
Hi, I built a new desktop computer about a 3 weeks ago and have encountered 3 critical errors since then. Two of them kicked me to the BSOD (the first two) and the third I think did (since it generated an error log in BlueScreenView) but the monitor didn't display it. Before continuing, my...
How to Enable or Disable Password Protection on Wakeup in Windows 8 and 8.1 This tutorial will show you how to enable or disable to require a password on wakeup from sleep for all users in Windows 8 and Windows 8.1. You must be signed in as an administrator to be able to do the steps in this...
BSOD after wakeup from hibernation in BSOD Crashes and Debugging
dump file attached
This has been happening for a while but it only ever happens after wake-up from sleep and it's back up again in 5 seconds flat so it's never bothered me too much. If I catch the error I believe it's PFN_LIST_CORRUPT. Running Windbg on the minidumps gives a range of causes,...
Cant enter windows in User Accounts and Family Safety
I have problem and i dont have a clue how to fix it. Recently i upgraded to windows 8.1. Everything was ok. Till today. I was signed in from microsoft account i have (live.com). But my brother wanted to switch to local account. And he did today. But account became guest account and lost all...
Windows 8 dll error on wakeup in General Support
Whenever windows 8 RP comes up from hibernation, I get three error boxes on top of each other, all being the same error. EAccess violation for SHCORE.dll. I googled with no luck so far, anybody have any ideas on what is causing it?
Eight Forums Android App Eight Forums IOS App Follow us on Facebook