Hi,
I need help with a BSOD issue. I was able to isolate that the BSOD I am experiencing is caused by the fact that a system critical process is being terminated by another process. From the analysis, we know that RightFax.Conversion.Processor.exe is terminating CSRSS.exe as we see the call to NtTerminateProcess on the 64 bit stack. Is there a way to prevent other processes from terminating this system critical process CRSS.exe
The bug code is 0xF4 and here is the screenshot of the minidump: .
| Dump File | Crash Time | Bug Check String | Bug Check Code | Parameter 1 | Parameter 2 | Parameter 3 | Parameter 4 | Caused By Driver | Caused By Address | File Description | Product Name | Company | File Version | Processor | Crash Address | Stack Address 1 | Stack Address 2 | Stack Address 3 | Computer Name | Full Path | Processors Count | Major Version | Minor Version | Dump File Size | Dump File Time |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 111015-19484-01.dmp | 11/11/2015 1:11:33 AM | CRITICAL_OBJECT_TERMINATION | 0x000000f4 | 00000000`00000003 | fffffa80`9489f940 | fffffa80`9489fc20 | fffff800`023d4e70 | ntoskrnl.exe | ntoskrnl.exe+735c0 | NT Kernel & System | Microsoft® Windows® Operating System | Microsoft Corporation | 6.1.7601.19045 (win7sp1_gdr.151019-1254) | x64 | ntoskrnl.exe+735c0 | C:\Windows\Minidump\111015-19484-01.dmp | 2 | 15 | 7601 | 289,936 | 11/12/2015 10:07:08 PM |
More details:
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8098d384c0, Terminating object
Arg3: fffffa8098d387a0, Process image file name
Arg4: fffff800023e1f80, Explanatory message (ascii)
STACK_TEXT:
fffff880`07612b08 fffff800`02471202 : 00000000`000000f4 00000000`00000003 fffffa80`98d384c0 fffffa80`98d387a0 : nt!KeBugCheckEx
fffff880`07612b10 fffff800`02396c3b : ffffffff`ffffffff fffffa80`933ea060 fffffa80`98d384c0 fffffa80`931b6600 : nt!PspCatchCriticalBreak+0x92
fffff880`07612b50 fffff800`023937e4 : ffffffff`ffffffff 00000000`00000001 fffffa80`98d384c0 00000000`00000008 : nt!PspTerminateAllThreads+0x3d57
fffff880`07612ba0 fffff800`020da493 : fffffa80`98d384c0 00000000`ffffffff fffffa80`933ea060 00000000`00000000 : nt!NtTerminateProcess+0xf4
fffff880`07612c20 00000000`7714dc7a : 00000000`74c96222 00000000`00001000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`010de518 00000000`74c96222 : 00000000`00001000 00000000`00000000 00000000`00000000 00000000`74c9050c : ntdll!ZwTerminateProcess+0xa
00000000`010de520 00000000`74c8d18f : 00000000`0452f0a8 00000000`0452e7d8 00000000`7ef9b000 00000000`7ef9d000 : wow64!whNtTerminateProcess+0x46
00000000`010de550 00000000`74ad2776 : 00000000`743b2762 00000000`00000023 00000000`00000246 00000000`0452e824 : wow64!Wow64SystemServiceEx+0xd7
00000000`010dee10 00000000`74c8d286 : 00000000`00000000 00000000`74ad1920 00000000`00000000 00000000`00000000 : wow64cpu!ServiceNoTurbo+0x2d
00000000`010deed0 00000000`74c8c69e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : wow64!RunCpuSimulation+0xa
00000000`010def20 00000000`77175284 : 00000000`00000000 00000000`7efdf000 00000000`7ef9b000 00000000`00000000 : wow64!Wow64LdrpInitialize+0x42a
00000000`010df470 00000000`7712b63e : 00000000`010df530 00000000`00000000 00000000`7efdf000 00000000`00000000 : ntdll!_LdrpInitialize+0x49be4
00000000`010df4e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe
STACK_COMMAND: kb
RETRACER_ANALYSIS_TAG_STATUS: DEBUG_FLR_FAULTING_IP is not found
FOLLOWUP_NAME: wintriag
IMAGE_VERSION:
FAILURE_BUCKET_ID: X64_0xF4_csrss.exe_BUGCHECK_CRITICAL_PROCESS_TERMINATED_BY_RightFax.Conve_ffffffff
BUCKET_ID: X64_0xF4_csrss.exe_BUGCHECK_CRITICAL_PROCESS_TERMINATED_BY_RightFax.Conve_ffffffff
PRIMARY_PROBLEM_CLASS: X64_0xF4_csrss.exe_BUGCHECK_CRITICAL_PROCESS_TERMINATED_BY_RightFax.Conve_ffffffff
1: kd> !thread fffffa80`933ea060
THREAD fffffa80933ea060 Cid 0f40.1144 Teb: 000000007ef9b000 Win32Thread: fffff900c1d9c810 RUNNING on processor 1
Not impersonating
DeviceMap fffff8a004935e20
Owning Process fffffa80931b6600 Image: RightFax.Conversion.Processor.exe
Attached Process N/A Image: N/A
Wait Start TickCount 37603154 Ticks: 0
Context Switch Count 1777964 IdealProcessor: 1 LargeStack
UserTime 00:03:18.901
KernelTime 00:01:14.443
Win32 Start Address clr!Thread::intermediateThreadProc (0x0000000074490623)
Stack Init fffff88007612db0 Current fffff88007612aa0
Base fffff88007613000 Limit fffff8800760a000 Call 0
Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
00 0452f0b0 72c1aea7 ntdll_772e0000!ZwTerminateProcess+0x12
01 0452f110 72ce2f28 System_ni+0x5caea7
02 0452f144 003fed77 System_ni+0x692f28
03 0452f190 003fdfe3 0x3fed77
04 0452f1c4 003fe3ec 0x3fdfe3
05 0452f200 003fd7a9 0x3fe3ec
06 0452f254 003fd601 0x3fd7a9
07 0452f25c 7364af8d 0x3fd601
08 0452f268 7364aef6 mscorlib_ni+0x34af8d
09 0452f28c 7364aeb9 mscorlib_ni+0x34aef6
0a 0452f2f4 73602316 mscorlib_ni+0x34aeb9
0b 0452f308 7364ad62 mscorlib_ni+0x302316
0c 0452f354 7364ac87 mscorlib_ni+0x34ad62
0d 0452f364 7364f3e1 mscorlib_ni+0x34ac87
0e 0452f370 003f4047 mscorlib_ni+0x34f3e1
0f 0452f3a0 7360cacf 0x3f4047
10 0452f3ac 736023d7 mscorlib_ni+0x30cacf
11 0452f410 73602316 mscorlib_ni+0x3023d7
12 0452f424 736022d1 mscorlib_ni+0x302316
13 0452f440 7360cb4c mscorlib_ni+0x3022d1
14 0452f458 743b2952 mscorlib_ni+0x30cb4c
15 0452f464 743d318f clr!CallDescrWorkerInternal+0x34
16 0452f4b8 743d39d5 clr!CallDescrWorkerWithHandler+0x6b
17 0452f530 7448d8e6 clr!MethodDescCallSite::CallTargetWorker+0x152
18 (Inline) -------- clr!MethodDescCallSite::Call+0xe
19 0452f6a4 744900ad clr!ThreadNative::KickOffThread_Worker+0x19d
1a 0452f6b8 7449011b clr!ManagedThreadBase_DispatchInner+0x67
1b 0452f760 744901e8 clr!ManagedThreadBase_DispatchMiddle+0x82
1c 0452f7bc 743bc6ff clr!ManagedThreadBase_DispatchOuter+0x5b
1d 0452f7e0 7448d7a2 clr!ManagedThreadBase_FullTransitionWithAD+0x2f
1e (Inline) -------- clr!ManagedThreadBase::KickOff+0x15
1f 0452f864 7449066c clr!ThreadNative::KickOffThread+0x1d2
20 0452f980 75a0337a clr!Thread::intermediateThreadProc+0x4d
21 0452f98c 77319882 KERNEL32!BaseThreadInitThunk+0x12
22 0452f9cc 77319855 ntdll_772e0000!RtlInitializeExceptionChain+0x63
23 0452f9e4 00000000 ntdll_772e0000!RtlInitializeExceptionChain+0x36
