here some stuff i have found
Bug Check 0x1A: MEMORY_MANAGEMENT
The MEMORY_MANAGEMENT bug check has a value of 0x0000001A. This indicates that a severe memory management error occurred.
Parameters
The following parameters are displayed on the blue screen. Parameter 1 is the only parameter of interest; this identifies the exact violation.
Parameter 1 Cause of Error
0x1 The fork clone block reference count is corrupt. (This only occurs on checked builds of Windows.)
0x777 The caller is unlocking a system cache address that is not currently locked. (This address was either never mapped or is being unlocked twice.)
0x778 The system is using the very last system cache view address, instead of preserving it.
0x780
0x781 The PTEs mapping the argument system cache view have been corrupted.
0x1000 A caller of MmGetSystemAddressForMdl* tried to map a fully-cached physical page as non-cached. This action would cause a conflicting hardware translation buffer entry, and so it was refused by the operating system. Since the caller specified "bugcheck on failure" in the requesting MDL, the system had no choice but to bugcheck in this instance.
0x1010 The caller is unlocking a pageable section that is not currently locked. (This section was either never locked or is being unlocked twice.)
0x1234 The caller is trying lock a nonexistent pageable section.
0x1235 The caller is trying to protect an MDL with an invalid mapping.
0x3451 The PTEs of an outswapped kernel thread stack are corrupt.
0x8888
0x8889 Internal memory management structures are corrupt.
0x41283 The working set index encoded in the PTE is corrupt.
0x41284 A PTE or the working set list is corrupt.
0x41286 The caller is trying to free an invalid pool address.
0x41785 The working set list is corrupt.
0x61940 A PDE has been unexpectedly invalidated.
Other An unknown memory management error occurred.
Bug Check 0x9C: MACHINE_CHECK_EXCEPTION
The MACHINE_CHECK_EXCEPTION bug check has a value of 0x0000009C. This indicates that a fatal machine check exception has occurred.
Parameters
The four parameters listed in the message have different meanings, depending on the processor type.
If the processor is based on x86 architecture, and has the MCE feature but not the MCA feature — for example, the Intel Pentium processor— the parameters have the following meaning.
Parameter Description
1 The low 32 bits of P5_MC_TYPE MSR
2 Reserved
3 The high 32 bits of P5_MC_ADDR MSR
4 The low 32 bits of P5_MC_ADDR MSR
If the processor is based on x86 architecture, and has the MCA feature in addition to the MCE feature — for example, the Intel Pentium Pro processor— the parameters have the following meaning.
Parameter Description
1 The bank number
2 The address field of MCi_ADDR MSR for the MCA bank that had the error
3 The high 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 The low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
On an Itanium processor the parameters have the following meaning. Parameter 1 indicates the type of violation.
Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x1 Address of the log Size of the log 0
0x2 Address of the log Size of the log Error code SAL returned an error for SAL_GET_STATEINFO while processing MCA.
0x3 Address of the log Size of the log Error code SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
0x4 Address of the log Size of the log 0 FW reported a fatal MCA.
0x5 Address of the log Size of the log 0 Two possible causes:
SAL reported a recoverable MCA, but this recovery is not currently supported;
SAL generated an MCA but was unable to produce an error record.
0xB Address of the log Size of the log 0
0xC Address of the log Size of the log Error code SAL returned an error for SAL_GET_STATEINFO while processing an INIT event.
0xD Address of the log Size of the log Error code SAL returned an error for SAL_CLEAR_STATEINFO while processing an INIT event.
0xE Address of the log Size of the log 0
Bug Check 0x4E: PFN_LIST_CORRUPT
The PFN_LIST_CORRUPT bug check has a value of 0x0000004E. This indicates that the page frame number (PFN) list is corrupt.
Parameters
The following parameters are displayed on the blue screen. Parameter 1 indicates the type of violation. The meaning of the other parameters depends on the value of Parameter 1.
Parameter 1 Parameter 2 Parameter 3 Parameter 4 Cause of Error
0x01 The ListHead value which was corrupt The number of pages available 0 The list head was corrupt
0x02 The entry in the list being removed The highest physical page number The reference count of the entry being removed A list entry was corrupt
0x07 The page frame number The current share count 0 A driver has unlocked a page more times than it locked it
0x8F New page number Old page number 0 The free or zeroed page listhead is corrupt
0x99 Page frame number Current page state 0 A PTE or PFN is corrupt
Cause
This error is typically caused by drivers passing bad memory descriptor lists. For example, a driver might have called MmUnlockPages twice with the same list.
If a kernel debugger is available, examine the stack trace.
The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.
If you encounter bug check 0xA while upgrading to a later version of Microsoft® Windows®, this error might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version.
Resolving the Problem
If a kernel debugger is available, obtain a stack trace.
To resolve an error caused by a faulty device driver, system service, or BIOS
Restart your computer.
Press F8 at the character-based menu that displays the operating system choices.
Select the Last Known Good Configuration option from the Windows Advanced Options menu. This option is most effective when only one driver or service is added at a time.
To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool
Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.
Try disabling memory caching of the BIOS.
Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the ownerÂ’s manual for your computer.
Make sure the latest Service Pack is installed.
If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers. Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination.
For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only. Also, check each IDE device for the proper master/slave/stand-alone setting. Try removing all IDE devices except for hard disks.
If the message appears during an installation of Windows, make sure that the computer and all installed peripherals are listed on the Microsoft Windows Hardware Compatibility List (HCL).
Here is a debugging example:
kd> .bugcheck [Lists bugcheck data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000
kd> kb [Lists the stack trace.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194
kd> kv [Lists the trap frames.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194
kd> .trap 8013eee8 [Gets the registers for the trap frame at the time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
ErrCode = 00000000
00000000 ??????????????? [The current instruction pointer is NULL.]
kd> kb [Gives the stack trace before the fault.]
ChildEBP RetAddr Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0
Comments
Before upgrading to a new version of Windows, remove all third-party device drivers and system services, and disable any virus scanners. Contact the software manufacturers to obtain updates of these third-party tools.
Bug Check 0x50: PAGE_FAULT_IN_NONPAGED_AREA
The PAGE_FAULT_IN_NONPAGED_AREA bug check has a value of 0x00000050. This indicates that invalid system memory has been referenced.
Parameters
The following parameters are displayed on the blue screen.
Parameter Description
1 Memory address referenced
2 0: Read operation
1: Write operation
3 Address that referenced memory (if known)
4 Reserved
If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.
Cause
Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service.
Antivirus software can also trigger this error, as can a corrupted NTFS volume.
Resolving the Problem
Resolving a faulty hardware problem: If hardware has been added to the system recently, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. You should run hardware diagnostics supplied by the system manufacturer. For details on these procedures, see the ownerÂ’s manual for your computer.
Resolving a faulty system service problem: Disable the service and confirm that this resolves the error. If so, contact the manufacturer of the system service about a possible update. If the error occurs during system startup, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.
Resolving an antivirus software problem: Disable the program and confirm that this resolves the error. If it does, contact the manufacturer of the program about a possible update.
Resolving a corrupted NTFS volume problem: Run Chkdsk /f /r to detect and repair disk errors. You must restart the system before the disk scan begins on a system partition. If the hard disk is SCSI, check for problems between the SCSI controller and the disk.
Finally, check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it.
Comments
Typically, this address is in freed memory or is simply invalid.
This cannot be protected by a try - except handler — it can only be protected by a probe
i hope this helped
