Cheat Engine

Meiyoh · Posted: Mon Jan 06, 2020 2:54 pm Post subject: CE BSODs - No DBVM

Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 18362 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff804`6f000000 PsLoadedModuleList = 0xfffff804`6f448130
Debug session time: Mon Jan 6 22:00:41.452 2020 (UTC + 2:00)
System Uptime: 0 days 1:22:30.145
Loading Kernel Symbols
...............................................................
................................................................
...........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`003fb018). Type ".hh dbgerr001" for details
Loading unloaded module list
.............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff804`6f1c14e0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffef8c`01b875a0=0000000000000050
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffef8b8d00bb03, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: ffffcc2bf9e266c0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.Sec
Value: 4

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DATAHACKS

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 24

Key : Analysis.Memory.CommitPeak.Mb
Value: 67

Key : Analysis.System
Value: CreateObject

ADDITIONAL_XML: 1

BUGCHECK_CODE: 50

BUGCHECK_P1: ffffef8b8d00bb03

BUGCHECK_P2: 0

BUGCHECK_P3: ffffcc2bf9e266c0

BUGCHECK_P4: 2

READ_ADDRESS: ffffef8b8d00bb03

MM_INTERNAL_CODE: 2

IMAGE_NAME: win32kbase.sys

MODULE_NAME: win32kbase

FAULTING_MODULE: ffffcc2bf9e00000 win32kbase

PROCESS_NAME: cheatengine-x86_64.exe

TRAP_FRAME: ffffef8c01b87840 -- (.trap 0xffffef8c01b87840)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffcc08847c13f0 rbx=0000000000000000 rcx=ffffcc2bfa014710
rdx=00000000000004b2 rsi=0000000000000000 rdi=0000000000000000
rip=ffffcc2bf9e266c0 rsp=ffffef8c01b879d0 rbp=ffffef8c01b87b80
r8=0000000b869b0e01 r9=0000000000000000 r10=fffff8046f106020
r11=ffffef8c01b87a30 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
win32kbase!CHMRefHwndByHandle::CHMRefHwndByHandle+0x1e0:
ffffcc2b`f9e266c0 498b7340 mov rsi,qword ptr [r11+40h] ds:ffffef8c`01b87a70=0000000000000000
Resetting default scope

STACK_TEXT:
ffffef8c`01b87598 fffff804`6f1e35d6 : 00000000`00000050 ffffef8b`8d00bb03 00000000`00000000 ffffef8c`01b87840 : nt!KeBugCheckEx
ffffef8c`01b875a0 fffff804`6f072eef : 00000000`00000000 00000000`00000000 00000000`00000000 ffffef8b`8d00bb03 : nt!MiSystemFault+0x1d6866
ffffef8c`01b876a0 fffff804`6f1cf520 : ffffcc8c`8a470680 00000000`00000008 00000000`00000000 00000000`00000004 : nt!MmAccessFault+0x34f
ffffef8c`01b87840 ffffcc2b`f9e266c0 : ffffef8c`01b87a90 00000000`0000c0a2 ffffcc8c`7aca1d20 00000000`00001001 : nt!KiPageFault+0x360
ffffef8c`01b879d0 ffffcc2b`fa583db7 : ffffef8c`01b87b80 00000000`00000000 00000000`00000000 00000000`00000010 : win32kbase!CHMRefHwndByHandle::CHMRefHwndByHandle+0x1e0
ffffef8c`01b87a60 fffff804`6f1d2d18 : 00000000`021cf5a8 ffffef8c`01b87b80 ffffcc8c`7acc7b00 ffffcc8c`7c48d4c0 : win32kfull!NtUserGetProp+0x57
ffffef8c`01b87b00 00007ffd`d78b1264 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`021ced68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`d78b1264

SYMBOL_NAME: win32kbase!CHMRefHwndByHandle::CHMRefHwndByHandle+1e0

IMAGE_VERSION: 10.0.18362.535

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1e0

FAILURE_BUCKET_ID: AV_R_INVALID_win32kbase!CHMRefHwndByHandle::CHMRefHwndByHandle

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {1ddeb3a5-9801-5a83-cee4-b21588493d0d}

Followup: MachineOwner
---------

I run CE 7.0 BETA 4

I am getting BSODs ocassionally now.
I DONT use AV software.
Nothing in EXTRA is ticked.

Dark Byte · Posted: Mon Jan 06, 2020 3:10 pm Post subject:

Does it happen when pressing F1 or just randomly?

Try a different graphics card, new drivers, etc...

And try reporting to microsoft as while it is CE that triggers it, it is triggered from usermode address 7ffdd78b1264 which should never have that ability

Meiyoh · Posted: Mon Jan 06, 2020 3:21 pm Post subject:

Dark Byte · Posted: Mon Jan 06, 2020 4:31 pm Post subject:

CE version shouldn't matter unless you have an anti virus or anti cheat installed on your system, in which case when they tamper with CE they may accidentally screw things up if they follow a pointer that's not valid in that unofficial build

If your system is overclocked try putting it back to normal stock speeds, CE tends to stress out systems more than normal stress testers do

Meiyoh · Posted: Mon Jan 06, 2020 4:35 pm Post subject:

Dark Byte · Posted: Mon Jan 06, 2020 4:50 pm Post subject:

If something goes wrong, only the CE process would crash. This is a hardware issue, or you have a faulty driver somewhere