659
win10 RS3 16215版本，test HLK，在HLK
讓HLK測項跑起來之後，測試DF部分測項fail之後會出現藍屏問題BSOD，通過windbg tool查看memory.dmp及minidump下的dmp文件，可以看到是ntkrnlmp.exe導致的藍屏，不知道是不是OS本身的問題。
dump文件如下：
Loading Dump File [E:\RS3_test\062017-22593-01.dmp]Mini Kernel Dump File: Only registers and stack trace are available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 16215 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16215.1000.amd64fre.rs_prerelease.170603-1840
Machine Name:
Kernel base = 0xfffff801`d4489000 PsLoadedModuleList = 0xfffff801`d47e5b70
Debug session time: Tue Jun 20 21:38:05.524 2017 (UTC - 7:00)
System Uptime: 0 days 2:53:45.189
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
..............................................................
..................................
Loading User Symbols
Loading unloaded module list
......................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff801d4910c3c, 2, 8, fffff801d4910c3c}
Probably caused by : ntkrnlmp.exe ( nt!NtSetInformationThread+168c )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff801d4910c3c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff801d4910c3c, address which referenced memory
Debugging Details:
------------------
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_DATE: 11/05/2015
BASEBOARD_PRODUCT: B150-PRO
BASEBOARD_VERSION: Rev X.0x
BUGCHECK_P1: fffff801d4910c3c
BUGCHECK_P2: 2
BUGCHECK_P3: 8
BUGCHECK_P4: fffff801d4910c3c
READ_ADDRESS: fffff801d487c378: Unable to get MiVisibleState
fffff801d4910c3c
CURRENT_IRQL: 2
FAULTING_IP:
nt!NtSetInformationThread+168c
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi
IP_IN_PAGED_CODE:
nt!NtSetInformationThread+168c
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi
CPU_COUNT: 4
CPU_MHZ: c78
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 5e
CPU_STEPPING: 3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: AV
PROCESS_NAME: svchost.exe
ANALYSIS_VERSION: 10.0.10240.9 x86fre
TRAP_FRAME: fffffd822cfc75c0 -- (.trap 0xfffffd822cfc75c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000080000000
rdx=0000000080000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801d4910c3c rsp=fffffd822cfc7750 rbp=fffffd822cfc7a80
r8=ffff9d0df2e63ca0 r9=0000000000000001 r10=fffff801d490f5b0
r11=0000000000141290 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!NtSetInformationThread+0x168c:
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi ds:00000000`00000778=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff801d4618fe9 to fffff801d460d740
FAILED_INSTRUCTION_ADDRESS:
nt!NtSetInformationThread+168c
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi
STACK_TEXT:
fffffd82`2cfc7478 fffff801`d4618fe9 : 00000000`0000000a fffff801`d4910c3c 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffffd82`2cfc7480 fffff801`d461737d : ffff9d0d`f8969080 ffffc00c`5353a6c0 00000000`00000006 fffff801`d46173a0 : nt!KiBugCheckDispatch+0x69
fffffd82`2cfc75c0 fffff801`d4910c3c : ffff9d0d`f7c815c0 ffffaf00`00000400 ffff9d0d`f2e63ca0 ffff9d0d`f8969080 : nt!KiPageFault+0x23d
fffffd82`2cfc7750 fffff801`d4618b53 : 00000000`00000021 ffff9d0d`f7cc7700 ffff9d0d`f7cc7700 00000000`00000000 : nt!NtSetInformationThread+0x168c
fffffd82`2cfc7a00 00007ffa`ea9ff734 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000084`e8aff6c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`ea9ff734
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtSetInformationThread+168c
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!NtSetInformationThread+168c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5933a904
IMAGE_VERSION: 10.0.16215.1000
BUCKET_ID_FUNC_OFFSET: 168c
FAILURE_BUCKET_ID: AV_VRF_CODE_AV_PAGED_IP_nt!NtSetInformationThread
BUCKET_ID: AV_VRF_CODE_AV_PAGED_IP_nt!NtSetInformationThread
PRIMARY_PROBLEM_CLASS: AV_VRF_CODE_AV_PAGED_IP_nt!NtSetInformationThread
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_vrf_code_av_paged_ip_nt!ntsetinformationthread
FAILURE_ID_HASH: {1a8d713a-fa5e-ce29-22cf-58c80383fa06}
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff801d4910c3c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff801d4910c3c, address which referenced memory
Debugging Details:
------------------
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_DATE: 11/05/2015
BASEBOARD_PRODUCT: B150-PRO
BASEBOARD_VERSION: Rev X.0x
BUGCHECK_P1: fffff801d4910c3c
BUGCHECK_P2: 2
BUGCHECK_P3: 8
BUGCHECK_P4: fffff801d4910c3c
READ_ADDRESS: fffff801d487c378: Unable to get MiVisibleState
fffff801d4910c3c
CURRENT_IRQL: 2
FAULTING_IP:
nt!NtSetInformationThread+168c
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi
IP_IN_PAGED_CODE:
nt!NtSetInformationThread+168c
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi
CPU_COUNT: 4
CPU_MHZ: c78
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 5e
CPU_STEPPING: 3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: AV
PROCESS_NAME: svchost.exe
ANALYSIS_VERSION: 10.0.10240.9 x86fre
TRAP_FRAME: fffffd822cfc75c0 -- (.trap 0xfffffd822cfc75c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000080000000
rdx=0000000080000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801d4910c3c rsp=fffffd822cfc7750 rbp=fffffd822cfc7a80
r8=ffff9d0df2e63ca0 r9=0000000000000001 r10=fffff801d490f5b0
r11=0000000000141290 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!NtSetInformationThread+0x168c:
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi ds:00000000`00000778=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff801d4618fe9 to fffff801d460d740
FAILED_INSTRUCTION_ADDRESS:
nt!NtSetInformationThread+168c
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi
STACK_TEXT:
fffffd82`2cfc7478 fffff801`d4618fe9 : 00000000`0000000a fffff801`d4910c3c 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffffd82`2cfc7480 fffff801`d461737d : ffff9d0d`f8969080 ffffc00c`5353a6c0 00000000`00000006 fffff801`d46173a0 : nt!KiBugCheckDispatch+0x69
fffffd82`2cfc75c0 fffff801`d4910c3c : ffff9d0d`f7c815c0 ffffaf00`00000400 ffff9d0d`f2e63ca0 ffff9d0d`f8969080 : nt!KiPageFault+0x23d
fffffd82`2cfc7750 fffff801`d4618b53 : 00000000`00000021 ffff9d0d`f7cc7700 ffff9d0d`f7cc7700 00000000`00000000 : nt!NtSetInformationThread+0x168c
fffffd82`2cfc7a00 00007ffa`ea9ff734 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000084`e8aff6c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`ea9ff734
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtSetInformationThread+168c
fffff801`d4910c3c 4989be78070000 mov qword ptr [r14+778h],rdi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!NtSetInformationThread+168c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5933a904
IMAGE_VERSION: 10.0.16215.1000
BUCKET_ID_FUNC_OFFSET: 168c
FAILURE_BUCKET_ID: AV_VRF_CODE_AV_PAGED_IP_nt!NtSetInformationThread
BUCKET_ID: AV_VRF_CODE_AV_PAGED_IP_nt!NtSetInformationThread
PRIMARY_PROBLEM_CLASS: AV_VRF_CODE_AV_PAGED_IP_nt!NtSetInformationThread
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_vrf_code_av_paged_ip_nt!ntsetinformationthread
FAILURE_ID_HASH: {1a8d713a-fa5e-ce29-22cf-58c80383fa06}
Followup: MachineOwner
---------
3: kd> !process
PROCESS ffff9d0df7c815c0
SessionId: 0 Cid: 04b8 Peb: 84e860b000 ParentCid: 02e0
DirBase: 29ee4000 ObjectTable: ffffc00c533f2140 HandleCount: <Data Not Accessible>
Image: svchost.exe
VadRoot ffff9d0df7c74290 Vads 116 Clone 0 Private 1949. Modified 81341. Locked 0.
DeviceMap ffffc00c5343c240
Token ffffc00c5353b060
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
ElapsedTime 00:00:00.000
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 123680
QuotaPoolUsage[NonPagedPool] 32912
Working Set Sizes (now,min,max) (0, 0, 0) (0KB, 0KB, 0KB)
PeakWorkingSetSize 0
VirtualSize 2097264 Mb
PeakVirtualSize 2097273 Mb
PageFaultCount 0
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 2280
Job ffff9d0df7c8a060
*** Error in reading nt!_ETHREAD @ ffff9d0df7c82080
最後更新：2017-06-21 17:46:20
上一篇：
win10 Edge瀏覽器太難用
下一篇： 升級win10 15063後，更新提示：某些設置隱藏或由你的組織管理。這是咋回事？
- 你的設備已過期，並缺少重要的安全和質量更新，因此存在風險。讓我們帶你重回正軌，這樣
- Microsoft store 無法聯網，顯示Microsoft Store需要聯網，你似乎沒有聯網
- 設備以遷移 由於僅部分匹配或匹配不明確，因此無法遷移設備
- 由於在創建轉儲期間出錯，創建轉儲文件失敗。
- 發生臨時 DNS 錯誤
- 應用商店，在我們這邊發生問題，無法使你登陸，錯誤代碼: 0xD000000D
- 照相機不可用，錯誤代碼：0xA00F4244(0xC00DABE0)
- 應用商店打開異常提示“清單中指定了未知的布局”
- 自定義掃描Windows defender裏麵的設備性能和運行狀況 黃色感歎號問題
- windows預口體驗成員內口版本遇到問題需要重啟
熱門內容
- windows10 點開此電腦後，有兩個顯示硬盤盤符的目錄是怎麼回事?
- windows 10 專業版無法下載中文語言包
- KB4056892
- win10不能共享文件夾
- 在Surfacebook上用Windows to go 1703版本，更新後重啟藍屏，無法進入係統
- windows10 1709版本更新失敗，錯誤0x8007001f
- microdoft visual c++ 2015 redistributable
- WIN10 Insider Preview 17025更新失敗，錯誤代碼0x80096004
- 計算機管理服務 出現一個內部錯誤（INVALID
- 關於控製麵板中的安全和維護內提示Windows defender 防病毒已關閉的問題