94      微軟  windows

WIN10 x64 藍屏文件分析

問題：電腦今天出現三次藍屏 提示都是 Memory_Corruption,下麵是其中的一個藍屏文件，請幫忙分析下，非常感謝！

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\011618-10828-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*D:\Symbols*https://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 16299 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff803`71604000 PsLoadedModuleList = 0xfffff803`7196afd0
Debug session time: Tue Jan 16 16:57:22.756 2018 (UTC + 8:00)
System Uptime: 0 days 1:39:55.598
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1, 2, 0, fffff803716ef1cf}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000001, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff803716ef1cf, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 0000000000000001 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KxWaitForLockChainValid+1f
fffff803`716ef1cf 488b07          mov     rax,qword ptr [rdi]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from fffff8037178c729 to fffff803717796e0

STACK_TEXT:  
fffffd89`ed88f658 fffff803`7178c729 : 00000000`0000000a 00000000`00000001 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffd89`ed88f660 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69


STACK_COMMAND:  .bugcheck ; kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80371654ea4 - nt!MiResolvePageTablePage+74
[ f6:fa ]
    fffff80371654eae - nt!MiResolvePageTablePage+7e (+0x0a)
[ f6:fa ]
2 errors : !nt (fffff80371654ea4-fffff80371654eae)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

最近的三個藍屏文件我已經上傳到百度網盤，麻煩專家幫我分析下萬分感謝！

百度網盤：https://pan.baidu.com/s/1qZZoSsk

您好！

可能是nvlddmkm.sys導致的藍屏問題。

nvlddmkm.sys是顯卡的驅動程序，查看當前電腦安裝的顯卡驅動版本，查看品牌機，NVIDIA的官網是否有最新的顯卡驅動下載安裝。

希望以上的信息可以幫助到您。

您好！

可能是nvlddmkm.sys導致的藍屏問題。

nvlddmkm.sys是顯卡的驅動程序，查看當前電腦安裝的顯卡驅動版本，查看品牌機，NVIDIA的官網是否有最新的顯卡驅動下載安裝。

希望以上的信息可以幫助到您。

最後更新：2018-01-17 11:04:32

  上一篇： Win10藍屏（memory

  下一篇： 藍屏代碼0x00000050——經過檢測工具結論是tcpip.sys