程大彪 chenghang0816
关注数: 81 粉丝数: 206 发帖数: 13,189 关注贴吧数: 32
有没有大佬帮忙分析一下蓝屏的原因,经常出现 Microsoft (R) Windows Debugger Version 10.0.21349.1004 AMD64Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [C:\Windows\Minidump\071821-10046-01.dmp]Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: srv*Executable search path is: Windows 10 Kernel Version 19041 MP (12 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSMachine Name:Kernel base = 0xfffff805`2c400000 PsLoadedModuleList = 0xfffff805`2d02a1d0Debug session time: Sun Jul 18 23:14:04.447 2021 (UTC + 8:00)System Uptime: 0 days 2:46:40.215Loading Kernel Symbols..Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.Run !sym noisy before .reload to track down problems loading symbols............................................................................................................................................................................................................Loading User SymbolsLoading unloaded module list..................For analysis of this file, run !analyze -vnt!KeBugCheckEx:fffff805`2c7f6f20 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffc0d`78cc2880=000000000000000a10: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************IRQL_NOT_LESS_OR_EQUAL (a)An attempt was made to access a pageable (or completely invalid) address at aninterrupt request level (IRQL) that is too high. This is usuallycaused by drivers using improper addresses.If a kernel debugger is available get the stack backtrace.Arguments:Arg1: 0000000000000000, memory referencedArg2: 0000000000000002, IRQLArg3: 0000000000000000, bitfield :bit 0 : value 0 = read operation, 1 = write operationbit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)Arg4: fffff8052c686cd3, address which referenced memoryDebugging Details:------------------KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 2562 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 6605 Key : Analysis.Init.CPU.mSec Value: 515 Key : Analysis.Init.Elapsed.mSec Value: 25736 Key : Analysis.Memory.CommitPeak.Mb Value: 79DUMP_FILE_ATTRIBUTES: 0x8 Kernel Generated Triage DumpBUGCHECK_CODE: aBUGCHECK_P1: 0BUGCHECK_P2: 2BUGCHECK_P3: 0BUGCHECK_P4: fffff8052c686cd3READ_ADDRESS: fffff8052d0fa390: Unable to get MiVisibleStateUnable to get NonPagedPoolStartUnable to get NonPagedPoolEndUnable to get PagedPoolStartUnable to get PagedPoolEndunable to get nt!MmSpecialPagesInUse 0000000000000000 BLACKBOXBSD: 1 (!blackboxbsd)BLACKBOXNTFS: 1 (!blackboxntfs)BLACKBOXPNP: 1 (!blackboxpnp)BLACKBOXWINLOGON: 1CUSTOMER_CRASH_COUNT: 1PROCESS_NAME: WeChat.exeIRP_ADDRESS: fffffc0d78cc2c88TRAP_FRAME: fffffc0d78cc29c0 -- (.trap 0xfffffc0d78cc29c0)NOTE: The trap frame does not contain all registers.Some register values may be zeroed or incorrect.rax=0000000000000000 rbx=0000000000000000 rcx=fffffc0d78cc2698rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000rip=fffff8052c686cd3 rsp=fffffc0d78cc2b50 rbp=ffff918194740180 r8=0000000000000000 r9=ffff918194753000 r10=fffff8052d058f80r11=ffffb68659bf8d60 r12=0000000000000000 r13=0000000000000000r14=0000000000000000 r15=0000000000000000iopl=0 nv up ei pl nz na po cynt!KeSetEvent+0x173:fffff805`2c686cd3 4d8b6d00 mov r13,qword ptr [r13] ds:00000000`00000000=????????????????Resetting default scopeSTACK_TEXT: fffffc0d`78cc2878 fffff805`2c808e69 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckExfffffc0d`78cc2880 fffff805`2c805169 : fffffc0d`78cc29f0 00000000`00000000 ffffdc8d`9bbc4200 00000000`00000003 : nt!KiBugCheckDispatch+0x69fffffc0d`78cc29c0 fffff805`2c686cd3 : fffffc0d`78cc2698 00000000`00000000 0058005c`00740061 00670075`006c0050 : nt!KiPageFault+0x469fffffc0d`78cc2b50 fffff805`2c68633d : fffffc0d`00000001 fffffc0d`78cc2d20 ffffb686`5c5e9c20 fffff805`2c629768 : nt!KeSetEvent+0x173fffffc0d`78cc2be0 fffff805`2c60ee00 : fffffc0d`78cc2d00 fffff805`2c6a77d4 00000000`00000000 ffffb686`5bbb9080 : nt!IopCompleteRequest+0x34dfffffc0d`78cc2ca0 fffff805`2c7fb280 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffee00`0156c970 : nt!KiDeliverApc+0x1b0fffffc0d`78cc2d50 fffff805`2c6a18ad : 00000000`00008000 00000000`00000000 ffff8000`00000000 00000000`00000000 : nt!KiApcInterrupt+0x2f0fffffc0d`78cc2ee0 fffff805`2c69f31b : 00000000`00000114 00000000`00000000 ffffa307`fa5c0000 00000000`00000000 : nt!MiUnlockWorkingSetShared+0xadfffffc0d`78cc2f10 fffff805`2c63138b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x21bfffffc0d`78cc30b0 fffff805`2c6233a5 : 00000000`00000000 00000000`00000000 fffffc0d`78cc32f0 fffffc0d`78cc32d4 : nt!MmCheckCachedPageStates+0x17ebfffffc0d`78cc3280 fffff805`2c62232a : ffffb686`59e46d30 00000000`13c2fd20 fffffc0d`78cc3478 ffffb686`00000000 : nt!CcMapAndCopyInToCache+0x605fffffc0d`78cc3420 fffff805`307c815c : 00000000`00000000 fffffc0d`78cc3700 ffffb686`58869d28 00000000`00000000 : nt!CcCopyWriteEx+0xeafffffc0d`78cc34a0 fffff805`307c3de3 : ffffb686`58869d28 ffffb686`5e074b20 fffffc0d`78cc3740 00000000`00000000 : Ntfs!NtfsCommonWrite+0x3f0cfffffc0d`78cc36d0 fffff805`2c68f865 : ffffb686`5b93db20 ffffb686`5e074b20 ffffb686`5e074b20 ffffb686`4e7b0d60 : Ntfs!NtfsFsdWrite+0x1d3fffffc0d`78cc37a0 fffff805`2a686ccf : 00000000`00000000 fffffc0d`78cc38a0 00000000`00000006 fffff805`2a686ccf : nt!IofCallDriver+0x55fffffc0d`78cc37e0 fffff805`2a6848d3 : fffffc0d`78cc3870 00000000`00000000 00000000`00000000 fffff805`2c60827e : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28ffffffc0d`78cc3850 fffff805`2c68f865 : ffffb686`5e074b20 00000000`00000204 ffffb686`61fb3a80 fffff805`2c68f865 : FLTMGR!FltpDispatch+0xa3fffffc0d`78cc38b0 fffff805`2ca75588 : 00000000`00000001 ffffb686`61fb1b40 00000000`00000001 ffffb686`5e074f08 : nt!IofCallDriver+0x55fffffc0d`78cc38f0 fffff805`2ca8b77f : ffffb686`00000000 fffffc0d`78cc3b80 00000000`1ab4dde8 fffffc0d`78cc3b80 : nt!IopSynchronousServiceTail+0x1a8fffffc0d`78cc3990 fffff805`2c8088b8 : ffffb686`5bbb9080 00000000`00000c88 00000000`00000000 00000000`11aad564 : nt!NtWriteFile+0x66ffffffc0d`78cc3a90 00000000`77161cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x2800000000`19daf078 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77161cfcSYMBOL_NAME: nt!KeSetEvent+173MODULE_NAME: ntIMAGE_NAME: ntkrnlmp.exeIMAGE_VERSION: 10.0.19041.1110STACK_COMMAND: .thread ; .cxr ; kbBUCKET_ID_FUNC_OFFSET: 173FAILURE_BUCKET_ID: AV_nt!KeSetEventOSPLATFORM_TYPE: x64OSNAME: Windows 10FAILURE_ID_HASH: {c42bf4ac-5ef0-4bd6-418f-0d54b7c20876}Followup: MachineOwner---------
1 下一页