阅读553 返回首页    go 微软 go windows

win10 最近突然频繁蓝屏

蓝屏错误：A critical system process died

Probably caused by : ntdll.dll ( ntdll!RtlLookupFunctionEntry+11a )

PROCESS_NAME:  svchost.exe
CRITICAL_PROCESS:  svchost.exe
EXCEPTION_CODE: (Win32) 0x2931b080 (691122304) - <Unable to get error code text>
ERROR_CODE: (NTSTATUS) 0x2931b080 - <Unable to get error code text>

堆栈信息为：

 # Child-SP          RetAddr           Call Site
00 ffffc380`275b9cb8 fffff801`67901cae nt!KeBugCheckEx
01 ffffc380`275b9cc0 fffff801`678236f5 nt!PspCatchCriticalBreak+0xd6
02 ffffc380`275b9d20 fffff801`677242a9 nt! ?? ::NNGAKEGL::`string'+0x27265
03 ffffc380`275b9d90 fffff801`67724060 nt!PspTerminateProcess+0x101
04 ffffc380`275b9dd0 fffff801`673e1893 nt!NtTerminateProcess+0x9c
05 ffffc380`275b9e40 fffff801`673d9dc0 nt!KiSystemServiceCopyEnd+0x13
06 ffffc380`275b9fd8 fffff801`6740b807 nt!KiServiceLinkage
07 ffffc380`275b9fe0 fffff801`673e1e02 nt! ?? ::FNODOBFM::`string'+0x25777
08 ffffc380`275ba8a0 fffff801`673e02e1 nt!KiExceptionDispatch+0xc2
09 ffffc380`275baa80 00007ff9`278cac9a nt!KiPageFault+0x221
0a 000000bd`79b81630 00007ff9`278c9694 ntdll!RtlLookupFunctionEntry+0x11a
0b 000000bd`79b81680 00007ff9`27929cba ntdll!RtlDispatchException+0xf4
0c 000000bd`79b81d80 00007ff9`278cac9a ntdll!KiUserExceptionDispatch+0x3a
...中间重复了一大堆KiUserExceptionDispatch、RtlDispatchException、RtlLookupFunctionEntry...
334 000000bd`79c7e830 00007ff9`278c9694 ntdll!RtlLookupFunctionEntry+0x11a
335 000000bd`79c7e880 00007ff9`27929cba ntdll!RtlDispatchException+0xf4
336 000000bd`79c7ef80 00007ff9`1aba4eb0 ntdll!KiUserExceptionDispatch+0x3a
337 000000bd`79c7f708 00007ff9`278931dd fwpuclnt!McGenControlCallbackV2
338 000000bd`79c7f710 00007ff9`27892e65 ntdll!EtwpEventApiCallback+0xbd
339 000000bd`79c7f7a0 00007ff9`2789555b ntdll!EtwpUpdateEnableInfoAndCallback+0xb9
33a 000000bd`79c7f7e0 00007ff9`2789531b ntdll!EtwpProcessNotification+0x43
33b 000000bd`79c7f810 00007ff9`2789504c ntdll!EtwDeliverDataBlock+0x8b
33c 000000bd`79c7f870 00007ff9`278cf450 ntdll!EtwpNotificationThread+0x6c
33d 000000bd`79c7f9e0 00007ff9`278b36e3 ntdll!TppExecuteWaitCallback+0x8c
33e 000000bd`79c7fa20 00007ff9`25118364 ntdll!TppWorkerThread+0x923
33f 000000bd`79c7fe20 00007ff9`278e70d1 KERNEL32!BaseThreadInitThunk+0x14
340 000000bd`79c7fe50 00000000`00000000 ntdll!RtlUserThreadStart+0x21

这个堆栈信息我是看不太懂的，不知道是不是在处理用户异常的函数KiUserExceptionDispatch内又爆发了异常，然后就不断反复调用，直到最后堆栈溢出到页不存在的地方，所以就PageFault了？ 除了这个直接出错的线程意外，还有一个感觉相关的线程堆栈是：

00 ffffc380`2667aa98 fffff80e`165fc422 nt!KeAcquireSpinLockRaiseToDpc
01 ffffc380`2667aaa0 fffff80e`16618786 CLASSPNP!ClassInterpretSenseInfo+0x532
02 ffffc380`2667ad70 fffff80e`16608fa2 CLASSPNP!InterpretTransferPacketError+0x83e
03 ffffc380`2667aeb0 fffff801`672b9ff2 CLASSPNP!TransferPktComplete+0x14e82
04 ffffc380`2667b100 fffff80e`1549695e nt!IopfCompleteRequest+0x112
05 ffffc380`2667b220 fffff80e`1549ad1c storport!RaidCompleteRequestEx+0x8e
06 ffffc380`2667b2f0 fffff80e`1549647a storport!RaUnitAsyncError+0x16c
07 ffffc380`2667b380 fffff80e`154a6ece storport!RaidUnitCompleteRequest+0x8da
08 ffffc380`2667b510 fffff80e`15494396 storport!RaidCheckPerProcessorCompletions+0xda
09 ffffc380`2667b540 fffff80e`15493a32 storport!RaidStartIoPacket+0x686
0a ffffc380`2667b620 fffff80e`1549389a storport!RaUnitScsiIrp+0x152
0b ffffc380`2667b6c0 fffff80e`16bd602c storport!RaDriverScsiIrp+0x5a
0c ffffc380`2667b700 fffff80e`14f23b8c EhStorClass!FilterDeviceEvtWdmIoctlIrpPreprocess+0x20c
0d (Inline Function) --------`-------- Wdf01000!PreprocessIrp+0x34 [d:\rs1\minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1502] 
0e (Inline Function) --------`-------- Wdf01000!DispatchWorker+0x776 [d:\rs1\minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1565] 
0f (Inline Function) --------`-------- Wdf01000!FxDevice::Dispatch+0x782 [d:\rs1\minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1586] 
10 ffffc380`2667b730 fffff80e`165f5f01 Wdf01000!FxDevice::DispatchWithLock+0x7ec [d:\rs1\minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1430] 
11 ffffc380`2667b820 fffff80e`165f582d CLASSPNP!SubmitTransferPacket+0x201
12 ffffc380`2667b8a0 fffff80e`165f5124 CLASSPNP!ServiceTransferRequest+0x29d
13 ffffc380`2667b950 fffff80e`152d1937 CLASSPNP!ClassReadWrite+0x164
14 ffffc380`2667ba80 fffff80e`152d1db7 partmgr!PmGlobalDispatch+0xf7
15 ffffc380`2667bb10 fffff80e`152d18a3 partmgr!PartitionIo+0x177
16 ffffc380`2667bba0 fffff80e`15391109 partmgr!PmGlobalDispatch+0x63
17 ffffc380`2667bc30 fffff80e`16413288 volmgr!VmReadWrite+0x109
18 ffffc380`2667bc70 fffff80e`165b37bf fvevol!FveFilterRundownReadWrite+0x2e8
19 ffffc380`2667bd50 fffff80e`165b472f iorate!IoRateIssueAndRecordIo+0x7b
1a ffffc380`2667bd90 fffff80e`165b48d6 iorate!IoRateProcessIrp+0x153
1b ffffc380`2667bee0 fffff80e`164c1521 iorate!IoRateDispatchReadWrite+0x76
1c ffffc380`2667bf20 fffff80e`15cd00c6 volsnap!VolSnapReadFilter+0x61
1d ffffc380`2667bf50 fffff801`673d9a97 NTFS!NtfsStorageDriverCallout+0x16
1e ffffc380`2667bf80 fffff801`673d9a5d nt!KxSwitchKernelStackCallout+0x27
1f ffffc380`28ba7d00 fffff801`67323a04 nt!KiSwitchKernelStackContinue
20 ffffc380`28ba7d20 fffff801`67323776 nt!KiExpandKernelStackAndCalloutOnStackSegment+0x134
21 ffffc380`28ba7da0 fffff801`6732363f nt!KiExpandKernelStackAndCalloutSwitchStack+0xa6
22 ffffc380`28ba7e00 fffff80e`15cb9c41 nt!KeExpandKernelStackAndCalloutInternal+0x2f
23 ffffc380`28ba7e50 fffff80e`15cb8a82 NTFS!NtfsMultipleAsync+0xd1
24 ffffc380`28ba7ec0 fffff80e`15cb710f NTFS!NtfsNonCachedIo+0x3d2
25 ffffc380`28ba8160 fffff80e`15cb629c NTFS!NtfsCommonRead+0xc8f
26 ffffc380`28ba8330 fffff80e`14c15206 NTFS!NtfsFsdRead+0x1dc
27 ffffc380`28ba85b0 fffff80e`14c13146 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x1a6
28 ffffc380`28ba8640 fffff801`672c6d20 FLTMGR!FltpDispatch+0xb6
29 ffffc380`28ba86a0 fffff801`673665c3 nt!IoPageReadEx+0x2b0
2a ffffc380`28ba8710 fffff801`672ca57d nt!MiIssueHardFaultIo+0xcb
2b ffffc380`28ba87a0 fffff801`672dd6c8 nt!MiIssueHardFault+0x15d
2c ffffc380`28ba8880 fffff801`673e01fc nt!MmAccessFault+0x11e8
2d ffffc380`28ba8a80 00007ff9`278cac9a nt!KiPageFault+0x13c
2e 000000a3`bbba8330 00000000`00000000 ntdll!RtlLookupFunctionEntry+0x11a

这个相关堆栈看起来就更奇怪了，一上来就直接PageFault。。哎，根本就不知道到底发生了什么。。

来社区这里寻求帮助主要是因为自个排查不出这个蓝屏到底和什么有关，用过verifier来排除掉一些windows认为验证不通过的sys文件（感觉好像也不是驱动导致的，一般如果是驱动导致的，Probably caused by这里就直接显示驱动的名字了，对吧？），也用过sfc /scannow（但没发现什么问题）

这个蓝屏的表现是这样的，它不是突然的就蓝屏。是会让你感觉到卡顿了一下，然后鼠标就随之失去响应，然后过那么1-2秒就蓝屏了。

笔记本刚买半年左右的时间，应该硬件方面的故障概率也不太大吧？

下面这个是自动内存转储，压缩后再上传的，下载280m左右吧：

https://1drv.ms/u/s!AnajmqYDv5YA0BFmn84gfsZb6-Lm

最后更新：2017-05-25 04:21:30

  上一篇：go win10个人帐户的文件搜索不能使用，但是本地帐户可以
  下一篇：go 声音设置中的“虚拟环绕声”该如何使用？