Windows stop KMODE_EXCEPTION_NOT_HANDLED error

Updated: 06/07/2020 by Computer Hope
windows stop kmode exception not handled error

Before determining what's causing this error, you must identify the exception. Three common exception codes are:

0x80000002 STATUS_DATATYPE_MISALIGNMENT.

An unaligned data reference was encountered.

0x80000003 STATUS_BREAKPOINT.

A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system.

0xC0000005 STATUS_ACCESS_VIOLATION.

A memory access violated occurred.
Parameter 4 (above) is the address that the driver attempted to access.

A complete list of exception codes is found in the ntstatus.h file, in the inc directory of the Windows Driver Kit.

Basic troubleshooting and solution

At a more basic level, start with these basic troubleshooting steps.

  • If the driver at fault, disable the driver or check for driver updates.
  • Try changing the video card in the computer, to see if the issue is resolved.
  • Check the motherboard manufacturer's website for a BIOS update.
  • Access the BIOS and disable memory caching or memory shadowing.

If your issue is not resolved, compare any recently installed hardware to the Windows Marketplace Tested Products list and verify it's compatible with your version of Windows.

If a device driver is faulty, use the Safe Mode environment by pressing F8 on the keyboard when your computer is starting up (before entering Windows). Select Safe Mode from the startup menu when it's displayed. In Safe Mode, you can delete the faulty device driver and restart the computer. Proceed with installing an updated driver, if one is available.

You can also check the System Log in the Event Viewer to see if there are any error messages. These error messages may help to identify the source of the issue.

Complex troubleshooting

Additional, more complex troubleshooting steps can be taken if the above solutions do not solve the issue. These steps involve accessing a stack trace to determine what's causing the issue.

To get a stack trace, follow these steps:

  1. Execute the kb (Display Stack Backtrace) command to display the parameters in the stack trace. Look for a call to NT!PspUnhandledExceptionInSystemThread.
  2. The first parameter in the call points to a structure containing additional pointers to an except statement.
  3. Execute the dd (Display Memory) command on the address to retrieve and display the appropriate information.
  4. Execute the .exr (Display Exception Record) and .cxr (Display Context Record) commands using the two values retrieved in the previous step as the arguments for the commands.
  5. After executing the .cxr command, use the kb command to view the stack trace based on the context record data. The stack trace will indicate where the unhandled exception occurred.

If you cannot find the call in Step 1, look for ntoskrnl!KiDispatchException instead. Using the trap frame address (the third parameter), execute the .trap (Display Trap Frame) command. This action sets the Register Context to the appropriate value to run stack traces and other commands.