Reference by pointer windows 10 что такое
Добрый день! Уважаемые читатели и гости одного из крупнейших IT порталов России Pyatilistnik.org. В прошлый раз мы с вами рассмотрели ситуацию по настройке роутера Mikrotik для малого офиса. Офис работает и в его жизненном цикле могут возникать разного рода проблемы, одной из такой ситуаций, было появление синего экрана reference_by_pointer с кодом 0x00000018. Давайте разбираться в чем дело и как, это исправить.
Описание ситуации
И так у меня есть RDS ферма построенная на Windows Server 2012 R2, в какой-то момент система мониторинга прислала уведомление, о том что один из узлов не доступен. Так как у меня, это виртуальная машина) на ESXI 6.5 и крутящейся на сервере Dell R740, то я подключился к консоли и увидел синий экран с такой вот формулировкой:
Анализ синего экрана reference_by_pointer 0x00000018
Когда моя виртуальная машина загрузилась, то я увидел сообщение, что с компьютером возникла проблема, был создан файл минидампа и полного дампа MEMORY.DMP. Я не поленился и отправил сведения компании Microsoft.
Перед тем, как производить анализ дампов, я всегда просматриваю события в логах Windows. В журнале «Система» я обнаружил ошибку с кодом ID 1001:
Как видно из события ID 1001 с кодом 0x00000018, вся информация была записана в дамп по пути C:\Windows\MEMORY.DMP. Ранее я вам рассказывал, как производить анализ дампа и находить причины синего экрана, советую почитать. Там мы использовали утилиту Microsoft Kernel Debugger. Открываем Microsoft Kernel Debugger и скармливаем по очереди ваши файлы дампов, для начала я посмотрю мини дамп.
GetUlongPtrFromAddress: unable to read from fffff8011c3c8308
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.19377.amd64fre.winblue_ltsb_escrow.190524-1500
SYSTEM_MANUFACTURER: VMware, Inc.
VIRTUAL_MACHINE: VMware
SYSTEM_PRODUCT_NAME: VMware Virtual Platform
SYSTEM_VERSION: None
BIOS_VENDOR: Phoenix Technologies LTD
BIOS_VERSION: 6.00
BIOS_DATE: 12/12/2018
BASEBOARD_MANUFACTURER: Intel Corporation
BASEBOARD_PRODUCT: 440BX Desktop Reference Platform
BASEBOARD_VERSION: None
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffffe80208a4e700
BUGCHECK_P3: 10
BUGCHECK_P4: ffffc0024a26e1f1
CPU_COUNT: 10
CPU_MHZ: bb1
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 55
CPU_STEPPING: 4
CPU_MICROCODE: 6,55,4,0 (F,M,S,R) SIG: 200005E’00000000 (cache) 200005E’00000000 (init)
ANALYSIS_SESSION_TIME: 11-05-2019 16:25:03.0325
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff8011c1dd91d to fffff8011c1ba3a0
STACK_TEXT:
ffffd000`311b7788 fffff801`1c1dd91d : 00000000`00000018 00000000`00000000 ffffe802`08a4e700 00000000`00000010 : nt!KeBugCheckEx
ffffd000`311b7790 fffff801`1c0c3042 : 00000000`00000002 00000000`00000004 ffffe802`08a4e700 fffff800`557020dd : nt! ?? ::FNODOBFM::`string’+0xe82d
ffffd000`311b77d0 fffff801`1c0c291a : 00000000`0000eb01 00000000`00010224 00000000`00000001 ffffe802`0a7c8080 : nt!ExpApplyPriorityBoost+0x16a
ffffd000`311b7840 fffff801`1c0d03ea : ffffe802`07b51b70 ffffe801`ff4ee230 ffffe802`00000000 fffff801`00000000 : nt!ExpWaitForResource+0xea
ffffd000`311b78f0 fffff800`55732a67 : 00000000`00000002 00000000`00000000 ffffd000`311b7b30 00000000`c0000055 : nt!ExAcquireResourceExclusiveLite+0x1da
ffffd000`311b7960 fffff800`55740b5e : ffffc002`51d7c010 ffffe000`d13cd601 ffffe000`d67fab00 ffffe000`d67fa790 : rdbss!__RxAcquireFcb+0xe7
ffffd000`311b79e0 fffff800`563a6a17 : ffffe000`d67fa790 ffffe000`d67f9010 00000000`00000001 fffff800`56382c01 : rdbss!RxFinalizeConnection+0x21e
ffffd000`311b7aa0 fffff800`563a07e1 : ffffe802`09084010 ffffe802`0a799580 ffffe000`d13cd410 ffffe802`0a799580 : rdpdr!DrDeleteConnection+0xbf
ffffd000`311b7ae0 fffff800`5574b474 : ffffe802`09084010 ffffe802`09084010 ffffe802`0a799580 ffffe000`d13cd410 : rdpdr! ?? ::NNGAKEGL::`string’+0x4961
ffffd000`311b7b60 fffff800`557332f0 : ffffe802`0a7996e0 ffffe802`0a799580 ffffe802`0a799580 ffffe801`f5cc51c0 : rdbss!RxXXXControlFileCallthru+0xe4
ffffd000`311b7ba0 fffff800`55700cea : ffffe802`0a799580 fffff800`55725c80 01d593c6`037ea5e1 00007ff7`f3f6a000 : rdbss!RxCommonDevFCBFsCtl+0xb0
ffffd000`311b7c00 fffff800`5573128d : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`54d66ab9 : rdbss!RxFsdCommonDispatch+0x4fa
ffffd000`311b7d80 fffff800`56390175 : ffffc002`19f1e050 00000000`00000000 fffff800`5638c010 ffffd000`311b7ea8 : rdbss!RxFsdDispatch+0xed
ffffd000`311b7df0 fffff800`54e5a4c5 : ffffe802`0a0facb0 00000000`00000000 ffffe802`0a799580 ffffe801`f5cc51c0 : rdpdr!DrPeekDispatch+0x175
ffffd000`311b7ea0 fffff800`54e5a6a2 : ffffc001`cb6fe1c0 fffff800`54e51000 ffffe000`d191db80 00000000`00000000 : mup!MupiCallUncProvider+0x1b5
ffffd000`311b7f10 fffff800`54e5aa32 : ffffe802`0a799580 ffffd000`311b7fe0 00000000`00000000 ffffd000`311b7f98 : mup!MupStateMachine+0xd2
ffffd000`311b7f50 fffff800`541a30da : ffffe802`0a893250 ffffe802`0a0facb0 00000000`00000800 ffffd000`311b7fa8 : mup!MupFsControl+0xf6
ffffd000`311b7f90 fffff800`541cb821 : ffffd000`311b8050 ffffe000`d1c410a0 ffffe802`0a799728 ffffe802`0a799580 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x25a
ffffd000`311b8030 fffff801`1c4ff0af : 00000000`00000002 ffffd000`311b8111 ffffe802`0a7e72b0 0000001e`00100001 : fltmgr!FltpFsControl+0x111
ffffd000`311b8090 fffff801`1c500018 : ffffe802`0a7e7204 ffffe802`0a7e72b0 ffffc002`3d76d218 ffffe802`0a7e72b0 : nt!IopSynchronousServiceTail+0x32b
ffffd000`311b8160 fffff801`1c4b660a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0xdb8
ffffd000`311b82a0 fffff801`1c1ca2a3 : 00000000`00000102 ffffd000`311b8358 00000000`00000000 ffffe000`00000001 : nt!NtFsControlFile+0x56
ffffd000`311b8310 00007ffd`5c670aea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000e8`227fe478 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`5c670aea
Далее я наблюдаю имя сбойного модуля MODULE_NAME: rdbss
FOLLOWUP_IP:
rdbss!__RxAcquireFcb+e7
fffff800`55732a67 440fb6f0 movzx r14d,al
Устранение ошибки 0x00000018
REFERENCE_BY_POINTER
Причин, по которым ваш ПК выдает критические ошибки, и отказывается работать очень много. В большинстве случаев система заранее находит поврежденные файлы или вредоносные программы и сообщает вам об этом, посредством «синего экрана смерти». Само название, ничем смертельным не грозит вашему компьютеру, оно прижилось из-за английской расшифровки аббревиатуры — BSoD.
Чтобы быстрее определить место и причину неисправности, на экране выводиться специальная строка и в ней указан код ошибки. Ошибка 0x00000018 означает неисправности с вашей оперативной памятью. Именно модули памяти чаще всего являются причиной критической ошибки.
Сегодня на современных ПК можно устанавливать большие объемы памяти, чтобы обеспечит работоспособность и большую производительность. Но есть определенные правила, которых необходимо придерживаться при выборе оперативки. Для того чтобы не выбивало ошибку 0x00000018 следует подбирать планки памяти, с одинаковой рабочей частотой, для большей уверенности также рекомендуется брать планки от одного производителя.
Решение ошибки 0x00000018
Если, после апгрейда компьютера вы столкнулись с ошибкой stop 0x00000018, значить необходимо, выключить питание ПК и открыть системный блок. Далее выньте планки оперативной памяти и сверьте их частоту. Если все совпадает, то возможно одна из планок не работает. Чтобы определить нерабочую планку, придется поочередно вставлять каждый модуль и включать компьютер, тот модуль, при работе которого будет сообщение 0x00000018 для windows 7 и других версий ОС и является нерабочим. Отдайте его в сервисный центр или же верните по гарантии.
Профилактические меры
Для профилактики и предотвращения ошибки 0x00000018 рекомендуется выполнять следующие условия:
- пользуйтесь антивирусом;
- устанавливайте лицензионную операционную систему;
- следите, чтобы на жестком диске всегда было достаточно свободного места;
- при апгрейде компьютера учитывайте требования и совместимость со всеми модулями.
Error Reference by pointer in Windows 10 Pro
Hi TechSupport people,
I’ve had this problem in the last few months very often, in normal computer use sometimes by closing explorer or by moving and copying files.
In recent days I did a new installation of windows 8 OEM and upgrade to windows 10, but the problem reappeared.
Here are the basic details of my comp:
OS: Winow 10 Professional — x64-bit
Age of OS installation: 3 days
CPU: Intel Core i7-3630QM CPU 2.40GHz
RAM: 8.00GB
Video card: Intel HD Graphics 4000
System manufacturer: ASUS
Minidump file using BlueScreenview:
Thanks in advance and greetings
Replies (10)
Hi TechSupport people,
I’ve had this problem in the last few months very often, in normal computer use sometimes by closing explorer or by moving and copying files.
In recent days I did a new installation of windows 8 OEM and upgrade to windows 10, but the problem reappeared.
Here are the basic details of my comp:
OS: Winow 10 Professional — x64-bit
Age of OS installation: 3 days
CPU: Intel Core i7-3630QM CPU 2.40GHz
RAM: 8.00GB
Video card: Intel HD Graphics 4000
System manufacturer: ASUS
Minidump file using BlueScreenview:
==================================================
Dump File : 081017-40765-01.dmp
Crash Time : 10/08/2017 14.14.19
Bug Check String : REFERENCE_BY_POINTER
Bug Check Code : 0x00000018
Parameter 1 : 00000000`00000000
Parameter 2 : ffffd90c`3ad1f080
Parameter 3 : 00000000`00000006
Parameter 4 : ffffffff`ffffffff
Caused By Driver : FLTMGR.SYS
Caused By Address : FLTMGR.SYS+34d6
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+16c560
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\081017-40765-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 15063
Dump File Size : 630.876
==================================================
Thanks in advance and greetings
6 people found this reply helpful
Was this reply helpful?
Sorry this didn’t help.
Great! Thanks for your feedback.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.
How satisfied are you with this reply?
Thanks for your feedback.
It’s possible that your computer is crashing due to outdated drivers. Just to confirm, are you still experiencing this concern?
We’ll wait for your response.
11 people found this reply helpful
Was this reply helpful?
Sorry this didn’t help.
Great! Thanks for your feedback.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.
How satisfied are you with this reply?
Thanks for your feedback.
the problem is still present, the driver hypothesis has been taken into account but it is not easy for me to identify which driver causes the problem.
Do you have tips on how to find which driver?
Thanks in advance and greetings
Was this reply helpful?
Sorry this didn’t help.
Great! Thanks for your feedback.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.
How satisfied are you with this reply?
Thanks for your feedback.
Let’s start with the common drivers used which most commonly be the reason of the error message you’re receiving.
Let’s reinstall your graphic driver first, then let’s reinstall the network adapter next. Here’s how to reinstall a driver:
- Right-click Start, then select Device Manager.
- Right-click the driver, then select Uninstall.
- Restart your laptop to automatically reinstall the drivers. Make sure that you update the driver after re-installation.
To make sure that no application is causing the issue, let’s perform a Clean Boot. Clean Boot helps eliminate software conflicts that occur when running or installing a program in Windows 10.
Note: Please go through the section: How to reset the computer to start as usual after troubleshooting with clean boot of the Kb article to boot the computer in normal startup after fixing the issue.
We’ll be waiting for the result.
3 people found this reply helpful
Was this reply helpful?
Sorry this didn’t help.
Great! Thanks for your feedback.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.
How satisfied are you with this reply?
Thanks for your feedback.
Can you zip up the minidump files in the C:\Windows\Minidump folder and make available (provide link) via a public folder on OneDrive or similar site.
Here’s a link on using OneDrive:
If you have problems zipping the minidump files copy the minidump files to another location such as a folder on the Desktop
Also, you do not necessarily have to zip up the minidump files, you can upload them one at a time.
Was this reply helpful?
Sorry this didn’t help.
Great! Thanks for your feedback.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.
How satisfied are you with this reply?
Thanks for your feedback.
Also, it may help to look at the minidump files from the blue screen crashes.
Can you zip up the minidump files in the C:\Windows\Minidump folder and make available (provide link) via a public folder on OneDrive or similar site.
Here’s a link on using OneDrive:
If you have problems zipping the minidump files copy the minidump files to another location such as a folder on the Desktop
Also, you do not necessarily have to zip up the minidump files, you can upload them one at a time.
Hello,
the minidump files from the blue screen crashes are available for viewing at » https://1drv.ms/f/s!AlQDhFSd7pySh1gZbQsGtWLeFlOk»
Thank you in advance for your help
Was this reply helpful?
Sorry this didn’t help.
Great! Thanks for your feedback.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.
How satisfied are you with this reply?
Thanks for your feedback.
The minidump files were inconclusive but seemed to indicate a potential issue with the file system.
explorer.exe was the process that consistently crashed.
Can you provide the following file which has more information on the crash:
The memory.dmp file will be quite large, you could zip and compress the memory.dmp file with a third party application such as 7-Zip.
3 people found this reply helpful
Was this reply helpful?
Sorry this didn’t help.
Great! Thanks for your feedback.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.
How satisfied are you with this reply?
Thanks for your feedback.
Actually, the truecrypt-x64.sys appears to be the issue (you do not have to provide the memory.dmp file):
2: kd> !devobj ffffd486dde48080
Device object (ffffd486dde48080) is for:
Cannot read info offset from nt!ObpInfoMaskToOffset
Unable to load image \??\D:\PROGRAMMI PORTABLE\SW — TrueCrypt — Portable\truecrypt-x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for truecrypt-x64.sys
*** ERROR: Module load completed but symbols could not be loaded for truecrypt-x64.sys
\Driver\truecrypt DriverObject ffffd486d59d2060
Current Irp 00000000 RefCount -1 Type 00000007 Flags 00000050
Vpb ffffd486dc5f4f70 SecurityDescriptor ffffe78c45464370 DevExt ffffd486dde481d0 DevObjExt ffffd486dde487b8
ExtensionFlags (0x00000002) DOE_DELETE_PENDING
Characteristics (0x00000101) FILE_REMOVABLE_MEDIA, FILE_DEVICE_SECURE_OPEN
Device queue is not busy.
So try uninstalling TrueCrypt and see if the error resolves.
In the following link with a similar error the user installed VeraCrypt to replace TrueCrypt to solve the error:
1 person found this reply helpful
Was this reply helpful?
Sorry this didn’t help.
Great! Thanks for your feedback.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.
How satisfied are you with this reply?
Thanks for your feedback.
Actually, the truecrypt-x64.sys appears to be the issue (you do not have to provide the memory.dmp file):
2: kd> !devobj ffffd486dde48080
Device object (ffffd486dde48080) is for:
Cannot read info offset from nt!ObpInfoMaskToOffset
Unable to load image \??\D:\PROGRAMMI PORTABLE\SW — TrueCrypt — Portable\truecrypt-x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for truecrypt-x64.sys
*** ERROR: Module load completed but symbols could not be loaded for truecrypt-x64.sys
\Driver\truecrypt DriverObject ffffd486d59d2060
Current Irp 00000000 RefCount -1 Type 00000007 Flags 00000050
Vpb ffffd486dc5f4f70 SecurityDescriptor ffffe78c45464370 DevExt ffffd486dde481d0 DevObjExt ffffd486dde487b8
ExtensionFlags (0x00000002) DOE_DELETE_PENDING
Characteristics (0x00000101) FILE_REMOVABLE_MEDIA, FILE_DEVICE_SECURE_OPEN
Device queue is not busy.
So try uninstalling TrueCrypt and see if the error resolves.
In the following link with a similar error the user installed VeraCrypt to replace TrueCrypt to solve the error:
Thanks a lot for the help, not using more TrueCrypt the problem is solved.
