94      windows

WIN10 x64 蓝屏文件分析

问题：电脑今天出现三次蓝屏 提示都是 Memory_Corruption,下面是其中的一个蓝屏文件，请帮忙分析下，非常感谢！

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\011618-10828-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*D:\Symbols*https://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 16299 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 16299.15.amd64fre.rs3_release.170928-1534
Machine Name:
Kernel base = 0xfffff803`71604000 PsLoadedModuleList = 0xfffff803`7196afd0
Debug session time: Tue Jan 16 16:57:22.756 2018 (UTC + 8:00)
System Uptime: 0 days 1:39:55.598
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1, 2, 0, fffff803716ef1cf}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000001, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff803716ef1cf, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 0000000000000001 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KxWaitForLockChainValid+1f
fffff803`716ef1cf 488b07          mov     rax,qword ptr [rdi]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from fffff8037178c729 to fffff803717796e0

STACK_TEXT:  
fffffd89`ed88f658 fffff803`7178c729 : 00000000`0000000a 00000000`00000001 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffd89`ed88f660 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69


STACK_COMMAND:  .bugcheck ; kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80371654ea4 - nt!MiResolvePageTablePage+74
[ f6:fa ]
    fffff80371654eae - nt!MiResolvePageTablePage+7e (+0x0a)
[ f6:fa ]
2 errors : !nt (fffff80371654ea4-fffff80371654eae)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

最近的三个蓝屏文件我已经上传到百度网盘，麻烦专家帮我分析下万分感谢！

百度网盘：https://pan.baidu.com/s/1qZZoSsk

您好！

可能是nvlddmkm.sys导致的蓝屏问题。

nvlddmkm.sys是显卡的驱动程序，查看当前电脑安装的显卡驱动版本，查看品牌机，NVIDIA的官网是否有最新的显卡驱动下载安装。

希望以上的信息可以帮助到您。

您好！

可能是nvlddmkm.sys导致的蓝屏问题。

nvlddmkm.sys是显卡的驱动程序，查看当前电脑安装的显卡驱动版本，查看品牌机，NVIDIA的官网是否有最新的显卡驱动下载安装。

希望以上的信息可以帮助到您。

最后更新：2018-01-17 11:04:32

  上一篇： Win10蓝屏（memory

  下一篇： 蓝屏代码0x00000050——经过检测工具结论是tcpip.sys