unexpected kernel mode trap - Blue screen crash

[Party]

Does anyone have a fix for this? I've tried everything that I can think of, and the game only launches if I turn Anticheat off and play offline....

so far I've tried the following, and NOTHING works.

-updated bios
-turned off Kernel Mode in windows security
-reinstalled anti cheat by deleting files & verifying through steam
-re-installed game twice
-updated drivers
-updated windows
-ran game as admin
-deleted all traces of anticheat in Red editor & reinstalled anticheat
-turned off internet & launched (works but I want to play online....)
-turned off NVDIA overlay

I don't understand why it's bricking my whole computer everytime I try to launch the game with Anticheat Enabled.

I had no issues launching the game until the DLC.
My computer is as powerful as it can get so I know it's not a performance issue.

has anyone tried anything else? I know others are struggling with same issue.
Thanks

[Sleepy Kilik]

Αναρτήθηκε αρχικά από dark-breed:

Αναρτήθηκε αρχικά από Sleepy Kilik:

This is what comes up when I try to play offline mode. Thanks in advance.

ProductId: 839533616 (32bit)
Windows Version: 10.0 (Build 19045)
Error Code: 30005
Process Exit Code: 0h
UUID: da059660-394d-dc9d-f7a1-ee09bef8a174
Process list:
aac3572dramhal_x86.exe
aac3572mbhal_x86.exe
aackingstondramhal_x86.exe
acpowernotification.exe
adpclientservice.exe
adskaccessservicehost.exe
adsklicensingservice.exe
aggregatorhost.exe
armourycrate.service.exe
armourycrate.usersessionhelper.exe
armouryhtmldebugserver.exe
armourysocketserver.exe
armouryswagent.exe
armsvc.exe
asus_framework.exe
asuscertservice.exe
atkexcomsvc.exe
audbserver.exe
aura.app.exe
aura.service.exe
auwatchdogservice.exe
backgroundtaskhost.exe
conhost.exe
crashpad_handler.exe
csrss.exe
ctfmon.exe
dashost.exe
dllhost.exe
dshttpapiservice.exe
dwm.exe
ergonomickbnotificationservice.exe
explorer.exe
extensioncardhal_x86.exe
fnplicensingservice64.exe
fontdrvhost.exe
gamebar.exe
gamebarftserver.exe
gamesdk.exe
googledrivefs.exe
ijplmsvc.exe
jhi_service.exe
lightingservice.exe
lsass.exe
memory compression
microsoft.sharepoint.exe
neatstartupservice.exe
nvcontainer.exe
nvdisplay.container.exe
nvidia share.exe
nvidia web helper.exe
nvsphelper64.exe
officeclicktorun.exe
onedrive.exe
phoneexperiencehost.exe
powertoys.advancedpaste.exe
powertoys.colorpickerui.exe
powertoys.exe
powertoys.fancyzones.exe
powertoys.mousejumpui.exe
printisolationhost.exe
registry
rogliveservice.exe
rstmwservice.exe
runtimebroker.exe
searchapp.exe
searchfilterhost.exe
searchindexer.exe
searchprotocolhost.exe
securityhealthservice.exe
securityhealthsystray.exe
services.exe
sihost.exe
smss.exe
spoolsv.exe
start_protected_game.exe
startmenuexperiencehost.exe
steam.exe
steamservice.exe
steamwebhelper.exe
svchost.exe
taskhostw.exe
textinputhost.exe
vds.exe
vpdagent_x64.exe
wininit.exe
winlogon.exe
wmiprvse.exe
wmiregistrationservice.exe
wudfhost.exe
yourphoneappproxy.exe

In your System is Software running with virtual device drivers, this drivers are incompatible with EAC, you have to remove this Software.

It is also to check if the vds.exe is the real one or a malware.

Thank you. after 4 hours of trying to start the game, Disableing VDS worked.

I went to:
Services.msc/ and disabled Virtual Disk Service.

I'll update you on what happens next. if it happens. Thank You!

[SotiCoto]

FromSoft trying to trick people into believing that EAC isn't malware when it does this sort of crap.

[dark-breed]

Αναρτήθηκε αρχικά από SotiCoto:

FromSoft trying to trick people into believing that EAC isn't malware when it does this sort of crap.

You have no idea why it happens.

[Ganola]

Edit: I just noticed you find culprit in VDS service, but I'll keep message bellow.

I can see you have plenty of apps running maybe unnecessary in background. Tried to disable this Asus Armoury Crate and Asus software? Exit from OneDrive and Google Drive (by right clicking on icon in system tray - next to clock). Disable Game Bar in windows settings if features not used. Exit sharepoint client. Is PowerToys needed during game? Also, do you really need GeForce Experience running? Try to minimize running as much as possible apps in background especially the ones working with network or displaying info in overlay (like hw/fps/temps information). Try reinstalling/repairing EAC and existing C++ runtimes. I also recognize AutoDesk licensing service running, maybe temporary stopping that service also helps (don't disable it if you use Autodesk software!).

[dark-breed]

Αναρτήθηκε αρχικά από Ganola:

Edit: I just noticed you find culprit in VDS service, but I'll keep message bellow.

I can see you have plenty of apps running maybe unnecessary in background. Tried to disable this Asus Armoury Crate and Asus software? Exit from OneDrive and Google Drive (by right clicking on icon in system tray - next to clock). Disable Game Bar in windows settings if features not used. Exit sharepoint client. Is PowerToys needed during game? Also, do you really need GeForce Experience running? Try to minimize running as much as possible apps in background especially the ones working with network or displaying info in overlay (like hw/fps/temps information). Try reinstalling/repairing EAC and existing C++ runtimes. I also recognize AutoDesk licensing service running, maybe temporary stopping that service also helps (don't disable it if you use Autodesk software!).

Since the last EAC update a lot of virtual device drivers (specific software that contain only runtime virtual devices) are incompatible.
EAC send a ident call and for what ever reason this trigger a kernel mode trap.

I think it is related to a missing exception list in the EAC Implementation and this implementation simply ask any running device what it is, this also explain why logitech background app cause malfunctions, it also contain a only runtime virtual device.

[Ganola]

Αναρτήθηκε αρχικά από dark-breed:

Since the last EAC update a lot of virtual device drivers (specific software that contain only runtime virtual devices) are incompatible.
EAC send a ident call and for what ever reason this trigger a kernel mode trap.

I think it is related to a missing exception list in the EAC Implementation and this implementation simply ask any running device what it is, this also explain why logitech background app cause malfunctions, it also contain a only runtime virtual device.

Thanks for explanation - as a coding dev in free time (with platform independent asm level of understanding/knowledge) and after seeing legit Virtual Disk service was causing EAC kernel trap errors for OP, absolutely agree with your suspicion about EAC. TBH, I never had great opinion about quality of any anti-cheat software, but unfortunately it is necessary evil for online play ...

[Sleepy Kilik]

Αναρτήθηκε αρχικά από dark-breed:

Αναρτήθηκε αρχικά από Ganola:

Edit: I just noticed you find culprit in VDS service, but I'll keep message bellow.

I can see you have plenty of apps running maybe unnecessary in background. Tried to disable this Asus Armoury Crate and Asus software? Exit from OneDrive and Google Drive (by right clicking on icon in system tray - next to clock). Disable Game Bar in windows settings if features not used. Exit sharepoint client. Is PowerToys needed during game? Also, do you really need GeForce Experience running? Try to minimize running as much as possible apps in background especially the ones working with network or displaying info in overlay (like hw/fps/temps information). Try reinstalling/repairing EAC and existing C++ runtimes. I also recognize AutoDesk licensing service running, maybe temporary stopping that service also helps (don't disable it if you use Autodesk software!).

Since the last EAC update a lot of virtual device drivers (specific software that contain only runtime virtual devices) are incompatible.
EAC send a ident call and for what ever reason this trigger a kernel mode trap.

I think it is related to a missing exception list in the EAC Implementation and this implementation simply ask any running device what it is, this also explain why logitech background app cause malfunctions, it also contain a only runtime virtual device.

After Reformatting, removing 2 broken m.2 Drives, Replacing ram with brand new ram....
BSOD Unexpected Kernel MODE Trap strikes again...

I am posting the minidump file


************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : true
AllowNugetExeUpdate : true
NonInteractiveNuget : true
AllowNugetMSCredentialProviderInstall : true
AllowParallelInitializationOfLocalRepositories : true
EnableRedirectToChakraJsProvider : false

-- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 42

Microsoft (R) Windows Debugger Version 10.0.27668.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Dr. Light\Desktop\081324-8171-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Kernel base = 0xfffff802`27800000 PsLoadedModuleList = 0xfffff802`2842a8c0
Debug session time: Tue Aug 13 17:36:29.203 2024 (UTC - 7:00)
System Uptime: 0 days 0:13:46.059
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000a4`8db5b018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:

Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
BugCheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffff8881feb9de50
Arg3: ffff9984b9590fa0
Arg4: fffff80227a3fe1f

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2406

Key : Analysis.Elapsed.mSec
Value: 3350

Key : Analysis.IO.Other.Mb
Value: 7

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 20

Key : Analysis.Init.CPU.mSec
Value: 859

Key : Analysis.Init.Elapsed.mSec
Value: 70379

Key : Analysis.Memory.CommitPeak.Mb
Value: 84

Key : Bugcheck.Code.LegacyAPI
Value: 0x7f

Key : Bugcheck.Code.TargetModel
Value: 0x7f

Key : Failure.Bucket
Value: 0x7f_8_EasyAntiCheat_EOS!unknown_function

Key : Failure.Hash
Value: {9d5b0e91-8976-ce0a-e55f-fa940c7a1997}

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 7f

BUGCHECK_P1: 8

BUGCHECK_P2: ffff8881feb9de50

BUGCHECK_P3: ffff9984b9590fa0

BUGCHECK_P4: fffff80227a3fe1f

FILE_IN_CAB: 081324-8171-01.dmp

FAULTING_THREAD: ffffcd08fdbe5080

TRAP_FRAME: ffff9984b95917c0 -- (.trap 0xffff9984b95917c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000011 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80227a4bd4b rsp=ffff9984b9591950 rbp=ffff9984b9591a31
r8=ffff9984b9591810 r9=7fffe20353796018 r10=000000006d4e6f49
r11=0000000000053796 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!ExAllocateHeapPool+0x2fb:
fffff802`27a4bd4b 884702 mov byte ptr [rdi+2],al ds:00000000`00000002=??
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: eldenring.exe

STACK_TEXT:
ffff8881`feb9dd08 fffff802`27c126a9 : 00000000`0000007f 00000000`00000008 ffff8881`feb9de50 ffff9984`b9590fa0 : nt!KeBugCheckEx
ffff8881`feb9dd10 fffff802`27c0cb52 : 83485708`245c8948 00282464`834830ec 00202464`83f98b49 dec53d83`48d88b41 : nt!KiBugCheckDispatch+0x69
ffff8881`feb9de50 fffff802`27a3fe1f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0x2d2
ffff9984`b9590fa0 fffff802`27a3f49b : fffff802`28450e00 00000000`00000045 00000000`00000045 00000000`00000000 : nt!MiGetPage+0x4f
ffff9984`b9591080 fffff802`27a3cb08 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiGetPageChain+0x48b
ffff9984`b95912c0 fffff802`27a3c058 : ffff9984`b9591450 fffff802`2844f300 fffff47a`00000000 00000000`00000000 : nt!MiResolvePrivateZeroFault+0x6e8
ffff9984`b95913f0 fffff802`27a3b42d : 00000000`c0000016 00000000`00000002 00000000`00000000 00000000`00000002 : nt!MiResolveDemandZeroFault+0x208
ffff9984`b95914e0 fffff802`27a39519 : ffff3475`b6db5490 00000000`00000002 00000000`c0000016 00000000`00000000 : nt!MiDispatchFault+0x22d
ffff9984`b9591620 fffff802`27c0df6d : ffffe203`37805480 00000000`0001ce10 00000000`00000110 00000000`00000001 : nt!MmAccessFault+0x189
ffff9984`b95917c0 fffff802`27a4bd4b : ffffe203`37800340 ffffe203`37802400 ffffe203`37805480 00000000`00000110 : nt!KiPageFault+0x36d
ffff9984`b9591950 fffff802`281b7074 : 00000000`00000000 ffffcd09`094d4520 ffffcd08`6d4e6f49 ffffcd08`f95362b0 : nt!ExAllocateHeapPool+0x2fb
ffff9984`b9591a90 fffff802`27e3e05b : ffffcd08`e3b3ec40 ffff9984`b9591d50 ffffcd09`094d4908 00000000`00000000 : nt!ExAllocatePoolWithTag+0x64
ffff9984`b9591ae0 fffff802`27e32417 : ffffcd08`e3b3ec40 ffffcd08`e3b3ec10 ffffcd09`094d4a30 ffffe203`387d0100 : nt!IopParseDevice+0xf5b
ffff9984`b9591c50 fffff802`27e3a9ba : ffffcd09`094d4a01 ffff9984`b9591eb8 00000000`00000240 ffffcd08`dff65c40 : nt!ObpLookupObjectName+0x1117
ffff9984`b9591e20 fffff802`27e29d7b : ffff9984`00000000 ffff9984`b9592330 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1fa
ffff9984`b9591f50 fffff802`27e27ea9 : ffff9984`b9592380 ffff9984`00120089 ffff9984`b9592330 ffff9984`b9592320 : nt!IopCreateFile+0x132b
ffff9984`b9592010 fffff802`27c11e05 : 00000000`00000000 ffffcd08`f95362b0 ffffcd09`094d4520 fffff802`2c0dbd10 : nt!NtCreateFile+0x79
ffff9984`b95920a0 fffff802`27c02c40 : fffff804`a989feea ffff9984`b9592400 fffff804`a9914f3c 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
ffff9984`b95922a8 fffff804`a989feea : ffff9984`b9592400 fffff804`a9914f3c 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
ffff9984`b95922b0 ffff9984`b9592400 : fffff804`a9914f3c 00000000`00000000 00000000`00000000 00000000`00000000 : EasyAntiCheat_EOS+0x3feea
ffff9984`b95922b8 fffff804`a9914f3c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000080 : 0xffff9984`b9592400
ffff9984`b95922c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000080 00000000`00000007 : EasyAntiCheat_EOS+0xb4f3c


SYMBOL_NAME: EasyAntiCheat_EOS+3feea

MODULE_NAME: EasyAntiCheat_EOS

IMAGE_NAME: EasyAntiCheat_EOS.sys

STACK_COMMAND: .process /r /p 0xffffcd0907ad8340; .thread 0xffffcd08fdbe5080 ; kb

BUCKET_ID_FUNC_OFFSET: 3feea

FAILURE_BUCKET_ID: 0x7f_8_EasyAntiCheat_EOS!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {9d5b0e91-8976-ce0a-e55f-fa940c7a1997}

Followup: MachineOwner
---------


fffff802`27bfde50 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8881`feb9dd10=000000000000007f

[dark-breed]

Αναρτήθηκε αρχικά από Sleepy Kilik:

Αναρτήθηκε αρχικά από dark-breed:

Since the last EAC update a lot of virtual device drivers (specific software that contain only runtime virtual devices) are incompatible.
EAC send a ident call and for what ever reason this trigger a kernel mode trap.

I think it is related to a missing exception list in the EAC Implementation and this implementation simply ask any running device what it is, this also explain why logitech background app cause malfunctions, it also contain a only runtime virtual device.

After Reformatting, removing 2 broken m.2 Drives, Replacing ram with brand new ram....
BSOD Unexpected Kernel MODE Trap strikes again...

I am posting the minidump file


************* Preparing the environment for Debugger Extensions Gallery repositories **************
ExtensionRepository : Implicit
UseExperimentalFeatureForNugetShare : true
AllowNugetExeUpdate : true
NonInteractiveNuget : true
AllowNugetMSCredentialProviderInstall : true
AllowParallelInitializationOfLocalRepositories : true
EnableRedirectToChakraJsProvider : false

-- Configuring repositories
----> Repository : LocalInstalled, Enabled: true
----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds
----> Repository : UserExtensions, Enabled: true, Packages count: 0
----> Repository : LocalInstalled, Enabled: true, Packages count: 42

Microsoft (R) Windows Debugger Version 10.0.27668.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Dr. Light\Desktop\081324-8171-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Kernel base = 0xfffff802`27800000 PsLoadedModuleList = 0xfffff802`2842a8c0
Debug session time: Tue Aug 13 17:36:29.203 2024 (UTC - 7:00)
System Uptime: 0 days 0:13:46.059
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000a4`8db5b018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:

Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
BugCheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffff8881feb9de50
Arg3: ffff9984b9590fa0
Arg4: fffff80227a3fe1f

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 2406

Key : Analysis.Elapsed.mSec
Value: 3350

Key : Analysis.IO.Other.Mb
Value: 7

Key : Analysis.IO.Read.Mb
Value: 0

Key : Analysis.IO.Write.Mb
Value: 20

Key : Analysis.Init.CPU.mSec
Value: 859

Key : Analysis.Init.Elapsed.mSec
Value: 70379

Key : Analysis.Memory.CommitPeak.Mb
Value: 84

Key : Bugcheck.Code.LegacyAPI
Value: 0x7f

Key : Bugcheck.Code.TargetModel
Value: 0x7f

Key : Failure.Bucket
Value: 0x7f_8_EasyAntiCheat_EOS!unknown_function

Key : Failure.Hash
Value: {9d5b0e91-8976-ce0a-e55f-fa940c7a1997}

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Version
Value: 10.0.19041.1


BUGCHECK_CODE: 7f

BUGCHECK_P1: 8

BUGCHECK_P2: ffff8881feb9de50

BUGCHECK_P3: ffff9984b9590fa0

BUGCHECK_P4: fffff80227a3fe1f

FILE_IN_CAB: 081324-8171-01.dmp

FAULTING_THREAD: ffffcd08fdbe5080

TRAP_FRAME: ffff9984b95917c0 -- (.trap 0xffff9984b95917c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000011 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80227a4bd4b rsp=ffff9984b9591950 rbp=ffff9984b9591a31
r8=ffff9984b9591810 r9=7fffe20353796018 r10=000000006d4e6f49
r11=0000000000053796 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!ExAllocateHeapPool+0x2fb:
fffff802`27a4bd4b 884702 mov byte ptr [rdi+2],al ds:00000000`00000002=??
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: eldenring.exe

STACK_TEXT:
ffff8881`feb9dd08 fffff802`27c126a9 : 00000000`0000007f 00000000`00000008 ffff8881`feb9de50 ffff9984`b9590fa0 : nt!KeBugCheckEx
ffff8881`feb9dd10 fffff802`27c0cb52 : 83485708`245c8948 00282464`834830ec 00202464`83f98b49 dec53d83`48d88b41 : nt!KiBugCheckDispatch+0x69
ffff8881`feb9de50 fffff802`27a3fe1f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0x2d2
ffff9984`b9590fa0 fffff802`27a3f49b : fffff802`28450e00 00000000`00000045 00000000`00000045 00000000`00000000 : nt!MiGetPage+0x4f
ffff9984`b9591080 fffff802`27a3cb08 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiGetPageChain+0x48b
ffff9984`b95912c0 fffff802`27a3c058 : ffff9984`b9591450 fffff802`2844f300 fffff47a`00000000 00000000`00000000 : nt!MiResolvePrivateZeroFault+0x6e8
ffff9984`b95913f0 fffff802`27a3b42d : 00000000`c0000016 00000000`00000002 00000000`00000000 00000000`00000002 : nt!MiResolveDemandZeroFault+0x208
ffff9984`b95914e0 fffff802`27a39519 : ffff3475`b6db5490 00000000`00000002 00000000`c0000016 00000000`00000000 : nt!MiDispatchFault+0x22d
ffff9984`b9591620 fffff802`27c0df6d : ffffe203`37805480 00000000`0001ce10 00000000`00000110 00000000`00000001 : nt!MmAccessFault+0x189
ffff9984`b95917c0 fffff802`27a4bd4b : ffffe203`37800340 ffffe203`37802400 ffffe203`37805480 00000000`00000110 : nt!KiPageFault+0x36d
ffff9984`b9591950 fffff802`281b7074 : 00000000`00000000 ffffcd09`094d4520 ffffcd08`6d4e6f49 ffffcd08`f95362b0 : nt!ExAllocateHeapPool+0x2fb
ffff9984`b9591a90 fffff802`27e3e05b : ffffcd08`e3b3ec40 ffff9984`b9591d50 ffffcd09`094d4908 00000000`00000000 : nt!ExAllocatePoolWithTag+0x64
ffff9984`b9591ae0 fffff802`27e32417 : ffffcd08`e3b3ec40 ffffcd08`e3b3ec10 ffffcd09`094d4a30 ffffe203`387d0100 : nt!IopParseDevice+0xf5b
ffff9984`b9591c50 fffff802`27e3a9ba : ffffcd09`094d4a01 ffff9984`b9591eb8 00000000`00000240 ffffcd08`dff65c40 : nt!ObpLookupObjectName+0x1117
ffff9984`b9591e20 fffff802`27e29d7b : ffff9984`00000000 ffff9984`b9592330 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1fa
ffff9984`b9591f50 fffff802`27e27ea9 : ffff9984`b9592380 ffff9984`00120089 ffff9984`b9592330 ffff9984`b9592320 : nt!IopCreateFile+0x132b
ffff9984`b9592010 fffff802`27c11e05 : 00000000`00000000 ffffcd08`f95362b0 ffffcd09`094d4520 fffff802`2c0dbd10 : nt!NtCreateFile+0x79
ffff9984`b95920a0 fffff802`27c02c40 : fffff804`a989feea ffff9984`b9592400 fffff804`a9914f3c 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
ffff9984`b95922a8 fffff804`a989feea : ffff9984`b9592400 fffff804`a9914f3c 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
ffff9984`b95922b0 ffff9984`b9592400 : fffff804`a9914f3c 00000000`00000000 00000000`00000000 00000000`00000000 : EasyAntiCheat_EOS+0x3feea
ffff9984`b95922b8 fffff804`a9914f3c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000080 : 0xffff9984`b9592400
ffff9984`b95922c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000080 00000000`00000007 : EasyAntiCheat_EOS+0xb4f3c


SYMBOL_NAME: EasyAntiCheat_EOS+3feea

MODULE_NAME: EasyAntiCheat_EOS

IMAGE_NAME: EasyAntiCheat_EOS.sys

STACK_COMMAND: .process /r /p 0xffffcd0907ad8340; .thread 0xffffcd08fdbe5080 ; kb

BUCKET_ID_FUNC_OFFSET: 3feea

FAILURE_BUCKET_ID: 0x7f_8_EasyAntiCheat_EOS!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {9d5b0e91-8976-ce0a-e55f-fa940c7a1997}

Followup: MachineOwner
---------


fffff802`27bfde50 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff8881`feb9dd10=000000000000007f

The minidumb is useless to find out which virtual driver is installed at the system That cause the BSOD.
Post a background app printout

Tasklist > c:\tasks.txt

[Sleepy Kilik]

Is it this?

Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 8 K
System 4 Services 0 1,400 K
Registry 148 Services 0 87,444 K
smss.exe 648 Services 0 1,212 K
csrss.exe 760 Services 0 5,748 K
wininit.exe 804 Services 0 7,208 K
csrss.exe 816 Console 1 6,088 K
services.exe 888 Services 0 10,632 K
lsass.exe 936 Services 0 21,480 K
svchost.exe 704 Services 0 27,280 K
fontdrvhost.exe 764 Services 0 7,152 K
svchost.exe 1048 Services 0 15,280 K
svchost.exe 1108 Services 0 8,740 K
winlogon.exe 1156 Console 1 11,572 K
fontdrvhost.exe 1220 Console 1 8,328 K
svchost.exe 1336 Services 0 5,680 K
svchost.exe 1364 Services 0 20,584 K
svchost.exe 1396 Services 0 10,052 K
svchost.exe 1404 Services 0 12,240 K
svchost.exe 1456 Services 0 9,168 K
svchost.exe 1524 Services 0 6,880 K
svchost.exe 1544 Services 0 7,916 K
svchost.exe 1552 Services 0 7,968 K
svchost.exe 1716 Services 0 8,156 K
svchost.exe 1812 Services 0 11,656 K
dwm.exe 1828 Console 1 72,432 K
svchost.exe 1908 Services 0 15,556 K
NVDisplay.Container.exe 2004 Services 0 46,344 K
svchost.exe 1216 Services 0 10,224 K
svchost.exe 1540 Services 0 14,332 K
svchost.exe 1532 Services 0 11,988 K
svchost.exe 1884 Services 0 11,148 K
svchost.exe 2052 Services 0 6,200 K
svchost.exe 2060 Services 0 14,020 K
svchost.exe 2148 Services 0 8,952 K
svchost.exe 2160 Services 0 10,188 K
Memory Compression 2240 Services 0 12 K
svchost.exe 2340 Services 0 6,440 K
svchost.exe 2400 Services 0 7,864 K
svchost.exe 2540 Services 0 8,412 K
svchost.exe 2628 Services 0 7,480 K
NVDisplay.Container.exe 2856 Console 1 62,312 K
svchost.exe 2884 Services 0 19,276 K
svchost.exe 3220 Services 0 14,576 K
svchost.exe 3344 Services 0 16,468 K
svchost.exe 3360 Services 0 9,800 K
svchost.exe 3368 Services 0 6,768 K
svchost.exe 3452 Services 0 13,448 K
spoolsv.exe 3568 Services 0 26,716 K
svchost.exe 3596 Services 0 18,860 K
svchost.exe 3644 Services 0 8,400 K
Aura.Service.exe 3900 Services 0 407,924 K
svchost.exe 3908 Services 0 43,960 K
svchost.exe 3916 Services 0 13,224 K
svchost.exe 3928 Services 0 20,308 K
svchost.exe 3936 Services 0 8,364 K
AuWatchDogService.exe 3944 Services 0 18,976 K
OneApp.IGCC.WinService.ex 3952 Services 0 54,740 K
svchost.exe 3960 Services 0 11,156 K
svchost.exe 3972 Services 0 6,096 K
svchost.exe 3992 Services 0 20,440 K
DTSAPO3Service.exe 4044 Services 0 11,524 K
WMIRegistrationService.ex 4056 Services 0 12,824 K
ErgonomicKBNotificationSe 4068 Services 0 7,156 K
svchost.exe 3100 Services 0 17,256 K
RtkAudUService64.exe 2320 Services 0 10,064 K
RstMwService.exe 3264 Services 0 9,028 K
OfficeClickToRun.exe 3768 Services 0 40,360 K
svchost.exe 4228 Services 0 9,544 K
svchost.exe 4328 Services 0 5,864 K
dasHost.exe 4416 Services 0 12,772 K
AuDBServer.exe 4600 Services 0 7,596 K
conhost.exe 4668 Services 0 10,816 K
svchost.exe 4788 Services 0 8,864 K
sihost.exe 5636 Console 1 27,308 K
svchost.exe 5672 Console 1 27,916 K
svchost.exe 5816 Console 1 38,248 K
svchost.exe 5824 Services 0 22,624 K
taskhostw.exe 5988 Console 1 16,380 K
SearchIndexer.exe 6116 Services 0 26,792 K
svchost.exe 6200 Services 0 18,504 K
taskhostw.exe 6244 Console 1 9,056 K
explorer.exe 6292 Console 1 197,052 K
svchost.exe 6300 Services 0 8,284 K
ctfmon.exe 6384 Console 1 20,880 K
dasHost.exe 6540 Services 0 5,484 K
svchost.exe 7108 Console 1 23,284 K
Aura.App.exe 3884 Console 1 182,960 K
dllhost.exe 3816 Console 1 7,176 K
AggregatorHost.exe 7216 Services 0 4,812 K
StartMenuExperienceHost.e 7340 Console 1 65,780 K
RuntimeBroker.exe 7612 Console 1 28,052 K
SearchApp.exe 7832 Console 1 284,416 K
RuntimeBroker.exe 7940 Console 1 45,608 K
WmiPrvSE.exe 7488 Services 0 9,864 K
PowerToys.exe 9200 Console 1 17,100 K
RuntimeBroker.exe 5148 Console 1 26,812 K
dllhost.exe 5960 Services 0 11,676 K
PowerToys.FancyZones.exe 4772 Console 1 22,928 K
SecurityHealthSystray.exe 3440 Console 1 9,556 K
SecurityHealthService.exe 916 Services 0 17,380 K
RtkAudUService64.exe 5524 Console 1 12,036 K
BBPrint.exe 5240 Console 1 6,928 K
svchost.exe 9772 Services 0 9,616 K
OneDrive.exe 9752 Console 1 158,168 K
svchost.exe 9392 Services 0 12,360 K
Microsoft.SharePoint.exe 9352 Console 1 45,296 K
GoogleDriveFS.exe 10592 Console 1 19,972 K
crashpad_handler.exe 10656 Console 1 6,016 K
GoogleDriveFS.exe 10720 Console 1 98,896 K
GoogleDriveFS.exe 10912 Console 1 68,532 K
conhost.exe 10960 Console 1 15,852 K
GoogleDriveFS.exe 11044 Console 1 24,412 K
GoogleDriveFS.exe 11052 Console 1 32,964 K
PhoneExperienceHost.exe 11192 Console 1 437,136 K
GoogleDriveFS.exe 11236 Console 1 32,184 K
GoogleDriveFS.exe 11248 Console 1 67,712 K
svchost.exe 11280 Services 0 13,908 K
svchost.exe 12040 Services 0 6,232 K
svchost.exe 12136 Services 0 13,284 K
YourPhoneAppProxy.exe 12204 Console 1 105,692 K
svchost.exe 12216 Services 0 19,328 K
RuntimeBroker.exe 12284 Console 1 16,908 K
svchost.exe 12404 Services 0 27,816 K
svchost.exe 12444 Services 0 9,448 K
UserOOBEBroker.exe 1564 Console 1 9,696 K
SystemSettings.exe 12756 Console 1 66,408 K
ApplicationFrameHost.exe 6328 Console 1 29,920 K
svchost.exe 8872 Services 0 9,224 K
IAStorIcon.exe 10108 Console 1 45,996 K
svchost.exe 10816 Console 1 12,824 K
svchost.exe 832 Services 0 19,000 K
WmiPrvSE.exe 1380 Services 0 13,688 K
svchost.exe 1508 Services 0 11,952 K
IAStorDataMgrSvc.exe 4180 Services 0 74,632 K
jhi_service.exe 4484 Services 0 6,840 K
LMS.exe 6136 Services 0 13,476 K
SgrmBroker.exe 7448 Services 0 8,988 K
svchost.exe 8760 Services 0 12,812 K
ShellExperienceHost.exe 12916 Console 1 62,672 K
RuntimeBroker.exe 11040 Console 1 18,264 K
audiodg.exe 12232 Services 0 12,396 K
TextInputHost.exe 2620 Console 1 54,284 K
dllhost.exe 11752 Console 1 13,868 K
msedge.exe 7896 Console 1 140,960 K
msedge.exe 836 Console 1 8,084 K
msedge.exe 11928 Console 1 40,188 K
msedge.exe 12064 Console 1 34,128 K
msedge.exe 7560 Console 1 17,964 K
msedge.exe 13232 Console 1 124,920 K
msedge.exe 6060 Console 1 29,040 K
smartscreen.exe 9976 Console 1 23,740 K
svchost.exe 9632 Services 0 8,260 K
CompPkgSrv.exe 13252 Console 1 9,124 K
svchost.exe 7584 Services 0 12,100 K
rundll32.exe 5692 Console 1 9,492 K
chrome.exe 8124 Console 1 194,064 K
chrome.exe 13288 Console 1 9,176 K
chrome.exe 10060 Console 1 112,720 K
chrome.exe 1068 Console 1 46,876 K
chrome.exe 5564 Console 1 21,576 K
chrome.exe 5868 Console 1 18,096 K
chrome.exe 3356 Console 1 130,260 K
chrome.exe 3328 Console 1 158,780 K
chrome.exe 10568 Console 1 59,688 K
chrome.exe 884 Console 1 78,168 K
svchost.exe 13196 Services 0 7,640 K
chrome.exe 5336 Console 1 161,016 K
chrome.exe 10928 Console 1 30,516 K
cmd.exe 9872 Console 1 4,764 K
conhost.exe 10192 Console 1 19,552 K
tasklist.exe 6128 Console 1 9,060 K

[EldenFarx]

If it works with the anticheat disabled, the easy solution would be to disable EAC and only play the singleplayer game offline, and the best part about playing elden ring singleplayer with eac disabled is you can use Cheat Engine.

NOTE: ONLY PLAY THE SINGLEPLAYER MODE WITH EAC DISABLED, NOT ONLINE

[dark-breed]

In question are

Bbprint.exe (contain a virtual device)
Aura Software
DTSAPO3Service.exe

[Sleepy Kilik]

Αναρτήθηκε αρχικά από dark-breed:

In question are

Bbprint.exe (contain a virtual device)
Aura Software
DTSAPO3Service.exe

bbprint is a construction infrastructure architect program I use for business.

Ora is antivirus. I've tried running the game with this program off.
i'll have to check DTSA. I'm not sure what the TSA is

[Sleepy Kilik]

Disabling DTS got it to work for the first time in a week. Im not sure what it is as I just reformatted the whole computer...

[Sleepy Kilik]

Αναρτήθηκε αρχικά από Sleepy Kilik:

Disabling DTS got it to work for the first time in a week. Im not sure what it is as I just reformatted the whole computer...

Furthermore I uninstalled the DTSAPO3Service.exe. I then restarted the machine. BSOD returned. Following up to that I am disabling aura and BBprint. BSOD keeps happening,

[Sleepy Kilik]

Αναρτήθηκε αρχικά από Sleepy Kilik:

Αναρτήθηκε αρχικά από Sleepy Kilik:

Disabling DTS got it to work for the first time in a week. Im not sure what it is as I just reformatted the whole computer...

Furthermore I uninstalled the DTSAPO3Service.exe. I then restarted the machine. BSOD returned. Following up to that I am disabling aura and BBprint. BSOD keeps happening,

DTSAPO3Service.exe keeps restarting itself as in reinstalling itself... I think it is malware. Persisting even after reformat... odd... anyone know how to remove it?