阅读556 返回首页    go 阿里云 go 技术社区[云栖]

蓝屏日志使用winDBG分析，是什么原因导致的蓝屏？？


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\zqq\Desktop\蓝屏日志\110617-19468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 16299 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`70c80000 PsLoadedModuleList = 0xfffff800`70fe1fd0
Debug session time: Mon Nov  6 19:27:09.438 2017 (UTC + 8:00)
System Uptime: 1 days 3:55:26.295
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {18, 2, 1, fffff80070d23f65}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

 *** Memory manager detected 45919 instance(s) of page corruption, target is likely to have memory corruption.

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000018, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80070d23f65, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 0000000000000018 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiUnlockProtoPoolPage+15
fffff800`70d23f65 f0480fba69183f  lock bts qword ptr [rcx+18h],3Fh

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0xA

PROCESS_NAME:  csrss.exe

BAD_PAGES_DETECTED: b35f

LAST_CONTROL_TRANSFER:  from fffff80070def1e9 to fffff80070de3960

STACK_TEXT:  
ffffb700`e2936da8 fffff800`70def1e9 : 00000000`0000000a 00000000`00000018 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffb700`e2936db0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80070d23526 - nt!MiFlushSectionInternal+256
[ fa:97 ]
    fffff80070d2354d - nt!MiFlushSectionInternal+27d (+0x27)
[ fa:97 ]
    fffff80070d23aa9 - nt!MiFlushSectionInternal+7d9 (+0x55c)
[ fa:97 ]
    fffff80070d23feb-fffff80070d23fec  2 bytes - nt!MiGetPteAddress+17 (+0x542)
[ 80 f6:00 9b ]
5 errors : !nt (fffff80070d23526-fffff80070d23fec)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

 *** Memory manager detected 45919 instance(s) of page corruption, target is likely to have memory corruption.

2: kd> lmvm memory_corruption
start             end                 module name

最后更新：2017-11-06 22:03:51

  上一篇：go 为何win10无法激活?
  下一篇：go Windows Update 磁盘占用100%