937
win10 使用過程中經常性出現ndis.sys藍屏，有藍屏日誌
藍屏代碼如下：
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\062617-6156-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 15063 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`8fe12000 PsLoadedModuleList = 0xfffff800`9015e5a0
Debug session time: Mon Jun 26 06:12:05.699 2017 (GMT+8)
System Uptime: 0 days 0:03:57.565
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
............
Cannot read PEB32 from WOW64 TEB32 0000d407 - Win32 error 0n30
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {28, 2, 1, fffff80480aaf0ff}
Unable to load image ndis.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ndis.sys
*** ERROR: Module load completed but symbols could not be loaded for ndis.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : hardware_ram ( PAGE_NOT_ZERO )
Followup: MachineOwner
---------
*** Memory manager detected 54279 instance(s) of page corruption, target is likely to have memory corruption.
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff80480aaf0ff, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
FAULTING_MODULE: fffff8008fe12000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 0
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
0000000000000028
CURRENT_IRQL: 0
FAULTING_IP:
ndis+4f0ff
fffff804`80aaf0ff 894128 mov dword ptr [rcx+28h],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
BAD_PAGES_DETECTED: d407
LAST_CONTROL_TRANSFER: from fffff8008ff893a9 to fffff8008ff7dfd0
STACK_TEXT:
ffffdc01`d3dbcc38 fffff800`8ff893a9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000001 : nt+0x16bfd0
ffffdc01`d3dbcc40 00000000`0000000a : 00000000`00000028 00000000`00000002 00000000`00000001 fffff804`80aaf0ff : nt+0x1773a9
ffffdc01`d3dbcc48 00000000`00000028 : 00000000`00000002 00000000`00000001 fffff804`80aaf0ff ffff838e`e22da650 : 0xa
ffffdc01`d3dbcc50 00000000`00000002 : 00000000`00000001 fffff804`80aaf0ff ffff838e`e22da650 00000000`00000000 : 0x28
ffffdc01`d3dbcc58 00000000`00000001 : fffff804`80aaf0ff ffff838e`e22da650 00000000`00000000 00000000`00000000 : 0x2
ffffdc01`d3dbcc60 fffff804`80aaf0ff : ffff838e`e22da650 00000000`00000000 00000000`00000000 00000000`00000000 : 0x1
ffffdc01`d3dbcc68 ffff838e`e22da650 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis+0x4f0ff
ffffdc01`d3dbcc70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffff838e`e22da650
STACK_COMMAND: kb
SYMBOL_NAME: PAGE_NOT_ZERO
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: hardware_ram
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
*** Memory manager detected 54279 instance(s) of page corruption, target is likely to have memory corruption.
-----獲取symbols後的debug結果
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff80480aaf0ff, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 0000000000000028
CURRENT_IRQL: 2
FAULTING_IP:
ndis!ndisFreeConvertedPacket+1f
fffff804`80aaf0ff 894128 mov dword ptr [rcx+28h],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
BAD_PAGES_DETECTED: d407
LAST_CONTROL_TRANSFER: from fffff8008ff893a9 to fffff8008ff7dfd0
STACK_TEXT:
ffffdc01`d3dbcc38 fffff800`8ff893a9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffdc01`d3dbcc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
STACK_COMMAND: kb
SYMBOL_NAME: PAGE_NOT_ZERO
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: PAGE_NOT_ZERO
Followup: MachineOwner
---------
*** Memory manager detected 54279 instance(s) of page corruption, target is likely to have memory corruption.
嚐試過更新驅動，無效。刪除驅動後重啟，係統自動安裝的驅動也會有這個問題。
最後更新：2017-06-26 06:46:19
上一篇：
應用商店不能下載東西提示錯誤代碼為0x80070422
下一篇： limited app for Nokia window phone
- 你的設備已過期，並缺少重要的安全和質量更新，因此存在風險。讓我們帶你重回正軌，這樣
- Microsoft store 無法聯網，顯示Microsoft Store需要聯網，你似乎沒有聯網
- 設備以遷移 由於僅部分匹配或匹配不明確，因此無法遷移設備
- 由於在創建轉儲期間出錯，創建轉儲文件失敗。
- 發生臨時 DNS 錯誤
- 應用商店，在我們這邊發生問題，無法使你登陸，錯誤代碼: 0xD000000D
- 照相機不可用，錯誤代碼：0xA00F4244(0xC00DABE0)
- 應用商店打開異常提示“清單中指定了未知的布局”
- 自定義掃描Windows defender裏麵的設備性能和運行狀況 黃色感歎號問題
- windows預口體驗成員內口版本遇到問題需要重啟
熱門內容
- windows10 點開此電腦後，有兩個顯示硬盤盤符的目錄是怎麼回事?
- windows 10 專業版無法下載中文語言包
- KB4056892
- win10不能共享文件夾
- 在Surfacebook上用Windows to go 1703版本，更新後重啟藍屏，無法進入係統
- windows10 1709版本更新失敗，錯誤0x8007001f
- microdoft visual c++ 2015 redistributable
- WIN10 Insider Preview 17025更新失敗，錯誤代碼0x80096004
- 計算機管理服務 出現一個內部錯誤（INVALID
- 關於控製麵板中的安全和維護內提示Windows defender 防病毒已關閉的問題