I am receiving a LiveKernelEvent141 and a specific app is crashing, but I cannot figure out why? Details below...

[RKerw]

Hi All,

My first post, and bear with me, I'm not the most technical when it comes to this sort of stuff.

I was wondering if anybody could help. About a month or so back I bought a brand new HP Laptop running Windows 10 (version 1909), however, I'm running into some issues when I run one certain application on it. I can run games on the laptop no problem, however, when I run the application Zwift (an online cycling app), the application will sometimes freeze (I get an error message saying 'zwiftapp.exe has stopped responding', and then when I click anywhere I get a white screen and an prompted to either wait for the programme to respond (which it never will) or close the programme.

This is not an issue with the application itself as the wider Zwift community is not suffering and I can run the app smoothly on an iPad, nor is it an issue with internet connection. The spec of my laptop is as follows, and I have also included the min spec for Zwift:

Processor: Intel(R) Core i5-1035G1 CPU @ 1.00GHZ

Display Adaptor: Intel(R) UHD Graphics

RAM: 8GB

System: 64-bit operating system, x64-based processor

Zwift requires a minimum of 4GB of RAM and 4GB of free storage, both of which I have in abundance.

The application will freeze when I ride in a group (i.e. the FPS are lower), and I am currently running the app on it's lowest graphic spec. I can sometimes run the application for hours with no issues, sometimes it will freeze after a matter of minutes, there does not seem to be a correlation. After every time the application freezes, I check the reliability monitor in the control panel and have two submissions in there, one for Zwift as follows:

Description

A problem caused this program to stop interacting with Windows.

Faulting Application Path: C:\Program Files (x86)\Zwift\ZwiftApp.exe

Problem signature

Problem Event Name: AppHangB1

Application Name: ZwiftApp.exe

Application Version: 0.0.0.0

Application Timestamp: 5eab4e52

Hang Signature: a464

Hang Type: 134217728

OS Version: 10.0.18363.2.0.0.768.101

Locale ID: 2057

Additional Hang Signature 1: a464541b280f2546ca5735344bb734f4

Additional Hang Signature 2: 22b9

Additional Hang Signature 3: 22b96e4a81fb62325845f67e73182e24

Additional Hang Signature 4: a464

Additional Hang Signature 5: a464541b280f2546ca5735344bb734f4

Additional Hang Signature 6: 22b9

Additional Hang Signature 7: 22b96e4a81fb62325845f67e73182e24

And another submission with a 'hardware error' as follows:

Description

A problem with your hardware caused Windows to stop working correctly.

Problem signature

Problem Event Name: LiveKernelEvent

Code: 141

Parameter 1: ffffc90267c2b010

Parameter 2: fffff8007e3b2e10

Parameter 3: 0

Parameter 4: 1584

OS version: 10_0_18363

Service Pack: 0_0

Product: 768_1

OS Version: 10.0.18363.2.0.0.768.101

Locale ID: 2057

I have noticed when running the Zwift app that the fans on my laptop seem to be quite loud (I have tried having an extrenal fan on the machine to cool it but has not stopped it crashing), and I have also noticed that the Zwift app uses up between circa 80-100% of GPU when running.

I have tried unistalling and reinstalling the Graphics drivers, to see if this would resolve the issue but it has not. I have also ensured I'm running the latest version of Windows 10. I have also initiated a clean boot on the machine.

A side note - I also use Bluetooth functionality when in the app, and use a USB extended with a Bluetooth dongle as BT connectivity directly from my laptop isn't always the strngest. I have run the app without any Bluetooth enabled as a test, but I can still have crashes on the laptop, albeit not as often.

If anyone could help this would be very much appreciated, as I have purchased this laptop with the main function being to use this app. If you require any further information, please let me know.

Thanks,

Ross

[Stefan3D]

Did you uninstall and reinstall the same driver?

If so, go to: https://downloadcenter.intel.com/product/196603/Intel-Core-i5-1035G1-Processor-6M-Cache-up-to-3-60-GHz-

Hit "show more" button and try different drivers.

Unfortunately the LiveKernelEvent messages contain no useful infos.

Is there an application crash dump at

c:\Users\%username%\AppData\Local\CrashDumps\

c:\Users\%username%\AppData\Local\Temp\

[RKerw]

Stefan,

Thanks so much for your quick response.

I'll download a previous version and see if that solves the problem.

In terms of the app crash dump, I don't have the AppData folder in my c drive, but do have a minidump folder within the 'Windows' folder in the c drive, however, I have no way to open and read the DMP file?

Thanks

Ross

[Stefan3D]

Appdata folder is hidden in Windows Explorer.

Go to c:\Users\%username%\ , click the address field and add AppData manually to the path.

The minidump folder contains kernel crash dumps, that can be analysed with Microsoft WINDBG

[RKerw]

Hi Stefan,

Thanks for your reply, I have installed a previous graphics driver but this did not resolve the issue.

I have found crash dump folders for the app, and 9 app crash dumps that exist in there between 28/04/20 - 12/05/20.

The minidump file reads as follows:

Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\minidump\043020-6625-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 18362 MP (8 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS Personal

18362.1.amd64fre.19h1_release.190318-1202

Machine Name:

Kernel base = 0xfffff803`62a00000 PsLoadedModuleList = 0xfffff803`62e48150

Debug session time: Thu Apr 30 09:49:35.510 2020 (UTC + 1:00)

System Uptime: 0 days 0:03:31.247

Loading Kernel Symbols

...............................................................

................................................................

................................................................

..................

Loading User Symbols

Loading unloaded module list

..........

For analysis of this file, run !analyze -v

nt!KeBugCheckEx:

fffff803`62bc2390 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff818b`5aad6280=00000000000000ef

6: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

CRITICAL_PROCESS_DIED (ef)

A critical system process died

Arguments:

Arg1: ffffd8861b3a72c0, Process object or thread object

Arg2: 0000000000000000, If this is 0, a process died. If this is 1, a thread died.

Arg3: 0000000000000000

Arg4: 0000000000000000

Debugging Details:

------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.Sec

Value: 3

Key : Analysis.DebugAnalysisProvider.CPP

Value: Create: 8007007e on LAPTOP-NDK1HF0C

Key : Analysis.DebugData

Value: CreateObject

Key : Analysis.DebugModel

Value: CreateObject

Key : Analysis.Elapsed.Sec

Value: 27

Key : Analysis.Memory.CommitPeak.Mb

Value: 70

Key : Analysis.System

Value: CreateObject

ADDITIONAL_XML: 1

BUGCHECK_CODE: ef

BUGCHECK_P1: ffffd8861b3a72c0

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME: svchost.exe

CRITICAL_PROCESS: svchost.exe

ERROR_CODE: (NTSTATUS) 0x24b47080 - <Unable to get error code text>

CRITICAL_PROCESS_REPORTGUID: {f6f0cbac-5bf6-4a05-b524-a12ad938a5a5}

IMAGE_NAME: SInspector.dll

MODULE_NAME: SInspector

FAULTING_MODULE: 0000000000000000

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

STACK_TEXT:

ffff818b`5aad6278 fffff803`632cb8a9 : 00000000`000000ef ffffd886`1b3a72c0 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx

ffff818b`5aad6280 fffff803`631ecbdf : ffffd886`1b3a72c0 fffff803`62a88065 ffffd886`1b3a72c0 fffff803`62a880e0 : nt!PspCatchCriticalBreak+0x115

ffff818b`5aad6320 fffff803`630700c0 : ffffd886`00000000 00000000`00000000 ffffd886`1b3a72c0 ffffd886`1b3a72c0 : nt!PspTerminateAllThreads+0x17b193

ffff818b`5aad6390 fffff803`6306fce9 : ffffffff`ffffffff ffff818b`5aad64c0 ffffd886`1b3a72c0 ffffd886`24b47001 : nt!PspTerminateProcess+0xe0

ffff818b`5aad63d0 fffff803`62bd414e : 000000b9`00000144 ffffd886`24b47080 ffffd886`1b3a72c0 00000000`00000000 : nt!NtTerminateProcess+0xa9

ffff818b`5aad6440 00007ffe`9209c5f4 : 00007ffe`9206ce72 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x2b9

000000b9`6b87f778 00007ffe`9206ce72 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`9209c5f4

000000b9`6b87f780 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`9206ce72

STACK_COMMAND: .thread ; .cxr ; kb

FAILURE_BUCKET_ID: 0xEF_svchost.exe_BUGCHECK_CRITICAL_PROCESS_24b47080_SInspector.dll!_IMAGE_SInspector.dll

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {8fa451d3-e359-32d9-c2a7-297e1cd1ef67}

Followup: MachineOwner

[RKerw]

The latest crash dump from the app reads as follows:

Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\rossk\AppData\Local\CrashDumps\ZwiftApp.exe.5432.dmp]

User Mini Dump File: Only registers, stack and portions of memory are available

Symbol search path is: srv*

Executable search path is:

Windows 10 Version 18363 MP (8 procs) Free x64

Product: WinNt, suite: SingleUserTS Personal

18362.1.amd64fre.19h1_release.190318-1202

Machine Name:

Debug session time: Tue May 12 19:33:47.000 2020 (UTC + 1:00)

System Uptime: not available

Process Uptime: 0 days 0:39:44.000

................................................................

......................

Loading unloaded module list

.........

This dump file has an exception of interest stored in it.

The stored exception information can be accessed via .ecxr.

(1538.1430): Access violation - code c0000005 (first/second chance not available)

For analysis of this file, run !analyze -v

ntdll!NtWaitForMultipleObjects+0x14:

00007ff8`cbd7cbc4 c3 ret

0:002> !analyze -v

*******************************************************************************

* *

* Exception Analysis *

* *

*******************************************************************************

*** WARNING: Unable to verify timestamp for ig11icd64.dll

KEY_VALUES_STRING: 1

Key : AV.Fault

Value: Write

Key : Analysis.CPU.Sec

Value: 3

Key : Analysis.DebugAnalysisProvider.CPP

Value: Create: 8007007e on LAPTOP-NDK1HF0C

Key : Analysis.DebugData

Value: CreateObject

Key : Analysis.DebugModel

Value: CreateObject

Key : Analysis.Elapsed.Sec

Value: 107

Key : Analysis.Memory.CommitPeak.Mb

Value: 109

Key : Analysis.System

Value: CreateObject

Key : Timeline.Process.Start.DeltaSec

Value: 2384

ADDITIONAL_XML: 1

NTGLOBALFLAG: 0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

APPLICATION_VERIFIER_FLAGS: 0

CONTEXT: (.ecxr)

rax=00000000000095b4 rbx=000001d822d7e530 rcx=0000000000000022

rdx=000001d822ce5212 rsi=000001d822cf53d0 rdi=00000000000101be

rip=00007ff707560d19 rsp=000000d0741ff3d8 rbp=0000000000000000

r8=0000000000000022 r9=ffffffffffffffff r10=000001d822cf53d0

r11=00000000000101be r12=00007ff7078210f0 r13=0000000000000000

r14=000001d80c2a11f0 r15=0000000000000001

iopl=0 nv up ei pl nz ac po cy

cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010217

ZwiftApp!AK::StreamMgr::SetFileLocationResolver+0x368a9:

00007ff7`07560d19 f3a4 rep movs byte ptr [rdi],byte ptr [rsi]

Resetting default scope

EXCEPTION_RECORD: (.exr -1)

ExceptionAddress: 00007ff707560d19 (ZwiftApp!AK::StreamMgr::SetFileLocationResolver+0x00000000000368a9)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 0000000000000001

Parameter[1]: 00000000000101be

Attempt to write to address 00000000000101be

PROCESS_NAME: ZwiftApp.exe

WRITE_ADDRESS: 00000000000101be

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000001

EXCEPTION_PARAMETER2: 00000000000101be

IP_ON_HEAP: 000001d822cf53d0

The fault address in not in any loaded module, please check your build's rebase

log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may

contain the address if it were loaded.

FRAME_ONE_INVALID: 1

STACK_TEXT:

000000d0`741ff3d8 000001d8`22cf53d0 : 00000000`00000022 00007ff7`06e02ce5 00000000`00001490 00007ff8`cbd1d6e2 : ZwiftApp!AK::StreamMgr::SetFileLocationResolver+0x368a9

000000d0`741ff3e0 00000000`00000022 : 00007ff7`06e02ce5 00000000`00001490 00007ff8`cbd1d6e2 000001d8`0c230000 : 0x000001d8`22cf53d0

000000d0`741ff3e8 00007ff7`06e02ce5 : 00000000`00001490 00007ff8`cbd1d6e2 000001d8`0c230000 000001d8`6cc69158 : 0x22

000000d0`741ff3f0 00007ff7`0737499f : 000001d8`6cc69060 00000000`00000005 000001d8`6cc691a0 00000000`00000000 : ZwiftApp!DeviceComponent::operator=+0x1965

000000d0`741ff420 00007ff7`073710e6 : 00000000`00000000 00000000`00000149 000001d8`6cc69060 000001d8`6cc69060 : ZwiftApp!AK::WriteBytesMem::Bytes+0x39c8df

000000d0`741ff4a0 00007ff7`06e0bcff : 000001d8`6cc69060 000001d8`0c2a11f0 00000000`00000000 00007ff7`078210f0 : ZwiftApp!AK::WriteBytesMem::Bytes+0x399026

000000d0`741ff4d0 00007ff7`06e5e2af : 000001d8`22cf5cd0 000001d8`22cf52d0 00000002`00000005 00000000`000003a0 : ZwiftApp!AK::WriteBytesMem::Count+0x19f

000000d0`741ff510 00007ff7`06e5d6d5 : 00000000`00000005 00000000`00000000 00000000`00000000 00000002`00000005 : ZwiftApp!AK::MemoryMgr::SetPoolName+0xc1df

000000d0`741ff6e0 00007ff7`07198c8b : 00000002`00000005 00000000`00000000 00000000`00000000 00007ff7`07b8f198 : ZwiftApp!AK::MemoryMgr::SetPoolName+0xb605

000000d0`741ff830 00007ff7`07569f9b : 00000002`00000005 00000000`00000000 00000000`00000000 000001d8`0f5f0490 : ZwiftApp!AK::WriteBytesMem::Bytes+0x1c0bcb

000000d0`741ff870 00007ff7`0756a142 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ZwiftApp!AK::StreamMgr::SetFileLocationResolver+0x3fb2b

000000d0`741ff8a0 00007ff8`ca2a7bd4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ZwiftApp!AK::StreamMgr::SetFileLocationResolver+0x3fcd2

000000d0`741ff8d0 00007ff8`cbd4ce51 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14

000000d0`741ff900 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21

SYMBOL_NAME: ZwiftApp!AK::StreamMgr::SetFileLocationResolver+368a9

MODULE_NAME: ZwiftApp

IMAGE_NAME: ZwiftApp.exe

STACK_COMMAND: ~2s ; .ecxr ; kb

FAILURE_BUCKET_ID: INVALID_POINTER_WRITE_c0000005_ZwiftApp.exe!AK::StreamMgr::SetFileLocationResolver

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {748d74be-503a-a623-6c13-d7f4af15f739}

Followup: MachineOwner

---------

[Stefan3D]

The kernel dump analysis exposes a malware named Security Inspector. Get rid of it.

https://www.bleepingcomputer.com/virus-removal/remove-security-inspector-2010#accordion-1

The app crash dump should be debugged with Microsoft Visual Studio to get more infos.

[RKerw]

Hi Stefan,

Thanks for the advice.

I'm struggling to open the .dmg files on Microsoft Visual Studio, any tips on how to do so? It is saying there is no editor available for my .dmp file?

Ross

[Stefan3D]

In VS installer add workloads/desktop development with C++

Make sure "just in time debugger" is checked.

[RKerw]

Thanks, downloaded and opened the .dmg file.

I have tried the 'Debug with Native only' option for this file, however when doing this I get the following message: 'ZwiftApp.pdb contains the debug information required to find the source for the module ZwiftApp.exe' but it says 'ZwiftApp.pdb not loaded' at the top?

Can you let me know what code/data you need to help debug? I've done a disassembly of the file..

Ross

[Stefan3D]

ZwiftApp.pdb is a private file on the developer's PC.

Click the button "symbol path". Add and activate:

https://software.intel.com/sites/downloads/symbols/

'Debug with Native only' . Let symbols load. After exception window pops up, check the output window.

The last line is the "program counter" which points to the culprit.

[RKerw]

Hi Stefan,

I ran the debugger, and the last few lines of the output section revealed the following:

'ZwiftApp.exe.5432.dmp' (Minidump): Loaded 'C:\Windows\System32\resourcepolicyclient.dll'. Symbols loaded.

'ZwiftApp.exe.5432.dmp' (Minidump): Loaded 'C:\Windows\System32\rsaenh.dll'. Symbols loaded.

'ZwiftApp.exe.5432.dmp' (Minidump): Loaded 'C:\Users\rossk\AppData\Local\Temp\SymbolCache\Windows.Devices.Radios.dll\f2944d313a000\Windows.Devices.Radios.dll'. Symbols loaded.

Unhandled exception at 0x00007FF707560D19 (ZwiftApp.exe) in ZwiftApp.exe.5432.dmp: 0xC0000005: Access violation writing location 0x00000000000101BE.

[Stefan3D]

Looks like an application bug to me.

Otherwise the last line would read sth. like "Unhandled exception at 0xDEADC0DE (intel_whatever.dll) in ZwiftApp.exe"

Send the crash dump to the application developer. Using his private PDB file he should be able to find the matching source code.

[RKerw]

No worries Stefan, really appreciate your help.

Ross

[RKerw]

Hi Stefan,

I spoke to the applications team about this issue, and from looking at the event viewer every time I get a crash or 'App Hang', the below message with a display warning comes with it:

"The Open procedure for service "WmiApRpl" in DLL "C:\windows\system32\wbem\wmiaprpl.dll" failed with error code The device is not ready.. Performance data for this service will not be available."

Do you have any idea what the issue is from this?

Thanks,

Ross

[Stefan3D]

That DLL is part of Windows. Don't know what it does.

I would take a closer look at:

c:\Windows\System32\wbem\WMIMigration.log

c:\Windows\System32\wbem\Performance\WmiApRpl.ini

c:\Windows\System32\wbem\AutoRecover\

You should get help here:

https://social.technet.microsoft.com/Forums

[LeeGriffiths]

Just wondering if this has been resolved - I have exactly the same problem.  

Same laptop specifications, same faulting app (Zwift), same intense frustration!

Thanks

[Al16]

Zwift told me they have a know issue with Intel integrated graphics drivers for generations 10 and 11.  I'm the same, I match or beat their minimum specs, but they blame Intel.  They have been working on the issue now for about 5 months (or so they say) with no known date for a fix.

[AlHill]

So the Intel support engineers can have more information about your system, Download, run, and save the results of this utility as a text file:
https://downloadcenter.intel.com/download/25293/Intel-System-Support-Utility

Then ATTACH the text file using the instructions under the reply window ( Drag and drop here or browse files to attach ).

Doc (not an Intel employee or contractor)

[Al16]

Hi

please see attached file.