WIN10蓝屏代码IRQL_NOT_LESS_OR_EQUAL MINIDUMP文件分析日志 求助

news/2024/11/24 11:04:12/

最近电脑频繁出现蓝屏,错误代码IRQL_NOT_LESS_OR_EQUAL,用WINDBUG分析了DMP日志,自己不太看得懂,有没有大佬能帮忙指点下,谢谢!以下为分析日志:

Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [C:\Windows\minidump\040923-26812-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 18362 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff804`38e00000 PsLoadedModuleList = 0xfffff804`392461b0
Debug session time: Sun Apr  9 09:02:29.083 2023 (UTC + 8:00)
System Uptime: 0 days 1:04:55.960
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff804`38fc3b20 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffce08`1b45ed00=000000000000000a
4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffcf038a42dfe0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :bit 0 : value 0 = read operation, 1 = write operationbit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff804396fee6e, address which referenced memoryDebugging Details:
------------------*** WARNING: Unable to verify checksum for win32k.sysKEY_VALUES_STRING: 1Key  : Analysis.CPU.mSecValue: 2905Key  : Analysis.DebugAnalysisManagerValue: CreateKey  : Analysis.Elapsed.mSecValue: 41284Key  : Analysis.IO.Other.MbValue: 18Key  : Analysis.IO.Read.MbValue: 0Key  : Analysis.IO.Write.MbValue: 22Key  : Analysis.Init.CPU.mSecValue: 1296Key  : Analysis.Init.Elapsed.mSecValue: 386655Key  : Analysis.Memory.CommitPeak.MbValue: 94Key  : Bugcheck.Code.DumpHeaderValue: 0xaKey  : Bugcheck.Code.RegisterValue: 0xaKey  : WER.OS.BranchValue: 19h1_releaseKey  : WER.OS.TimestampValue: 2019-03-18T12:02:00ZKey  : WER.OS.VersionValue: 10.0.18362.1FILE_IN_CAB:  040923-26812-01.dmpBUGCHECK_CODE:  aBUGCHECK_P1: ffffcf038a42dfe0BUGCHECK_P2: 2BUGCHECK_P3: 0BUGCHECK_P4: fffff804396fee6eREAD_ADDRESS: fffff804393713b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUseffffcf038a42dfe0 BLACKBOXBSD: 1 (!blackboxbsd)BLACKBOXNTFS: 1 (!blackboxntfs)BLACKBOXPNP: 1 (!blackboxpnp)BLACKBOXWINLOGON: 1CUSTOMER_CRASH_COUNT:  1PROCESS_NAME:  SystemTRAP_FRAME:  ffffce081b45ee40 -- (.trap 0xffffce081b45ee40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9286df00ab20 rbx=0000000000000000 rcx=ffff9286d0c169e0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff804396fee6e rsp=ffffce081b45efd8 rbp=ffffce081b45f030r8=0000000000000004  r9=8000000000002000 r10=ffffcf038a42dfd0
r11=ffff9286d0c169e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!EtwpApplyLevelKwFilter+0x1a:
fffff804`396fee6e 418a4210        mov     al,byte ptr [r10+10h] ds:ffffcf03`8a42dfe0=04
Resetting default scopeSTACK_TEXT:  
ffffce08`1b45ecf8 fffff804`38fd5929     : 00000000`0000000a ffffcf03`8a42dfe0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffce08`1b45ed00 fffff804`38fd1c69     : 00000000`00000000 ffffbc80`7f5c5101 ffff88ee`8fefc7d5 ffff9286`ddcb7080 : nt!KiBugCheckDispatch+0x69
ffffce08`1b45ee40 fffff804`396fee6e     : fffff804`38ec084e ffff9286`e87edc02 00000000`00000001 00000000`00000001 : nt!KiPageFault+0x469
ffffce08`1b45efd8 fffff804`38ec084e     : ffff9286`e87edc02 00000000`00000001 00000000`00000001 ffff9286`e87ed9a0 : nt!EtwpApplyLevelKwFilter+0x1a
ffffce08`1b45efe0 fffff804`38e3644e     : ffff9286`cfc02000 ffffce08`1b45f480 ffffffff`ffffffff fffff804`00000000 : nt!EtwpEventWriteFull+0x6ae
ffffce08`1b45f360 fffff804`39131162     : 00000000`00000000 00000000`00000000 00000000`00000000 ffffce08`1b45f500 : nt!EtwWriteEx+0x14e
ffffce08`1b45f470 fffff804`39131205     : 00000000`0000001b ffffce08`1b45f590 ffff9286`ea12d8a0 fffff804`3938c9c0 : nt!EtwpTiFillVadEventWrite+0x116
ffffce08`1b45f4c0 fffff804`39130d77     : 01d96a7e`f4df3263 ffffce08`1b45f590 fffff804`39195c90 fffff804`00000000 : nt!EtwpTiVadQueryEventWrite+0x81
ffffce08`1b45f510 fffff804`39022afa     : ffffbc80`7f5c5101 ffff9286`e2bd48c8 ffffbc80`7f5c5101 00000000`00000000 : nt!EtwTiLogInsertQueueUserApc+0x2a7
ffffce08`1b45f5d0 fffff804`38efec95     : ffff9286`e2bd4901 ffff9286`e2bd4880 00000000`00000000 00000000`00000000 : nt!KeInsertQueueApc+0x173e4a
ffffce08`1b45f670 fffff804`38ec3559     : ffff9286`e2bd4920 ffff9286`e2bd4880 00000000`00000002 00000000`00000001 : nt!ExpTimerDpcRoutine+0xa5
ffffce08`1b45f840 fffff804`38ec22b9     : 00000000`0000001a 00000000`00989680 00000000`0002448b 00000000`000000a3 : nt!KiProcessExpiredTimerList+0x169
ffffce08`1b45f930 fffff804`38fc764e     : ffffffff`00000000 ffffbc80`7f5c5180 ffffbc80`7f5d6440 ffff9286`e7ab7080 : nt!KiRetireDpcList+0x4e9
ffffce08`1b45fb60 00000000`00000000     : ffffce08`1b460000 ffffce08`1b459000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x7eCHKIMG_EXTENSION: !chkimg -lo 50 -d !halfffff80438d5dc5a-fffff80438d5dc5f  6 bytes - hal!HalSendSoftwareInterrupt+10a[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
6 errors : !hal (fffff80438d5dc5a-fffff80438d5dc5f)MODULE_NAME: memory_corruptionIMAGE_NAME:  memory_corruptionMEMORY_CORRUPTOR:  LARGESTACK_COMMAND:  .cxr; .ecxr ; kbFAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGEOS_VERSION:  10.0.18362.1BUILDLAB_STR:  19h1_releaseOSPLATFORM_TYPE:  x64OSNAME:  Windows 10FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}Followup:     memory_corruption
---------


http://www.ppmy.cn/news/574811.html

相关文章

Dump

文章目录 Dump概念解析Dump文件的生成 gdb使用gdb 操作 Dump 概念解析 dump 译为 “转储”,在计算机中可以从动词和名词两个角度理解。 动词:程序运行时候,CPU,内存,IO等数据都是动态的,因此想要获得这些信息&#…

用windbg分析minidump

许多人可能经常遇见计算机频繁重新启动的问题,总是难于解决问题,最后只能重新安装操作系统.我介绍的这篇文章应该能解决许多人这样的痛苦. 通常在荡机的瞬间,操作系统会形成一个存储器转储文件。 这个文件是当计算机死…

(Windbg调试一)minidump崩溃捕捉

(Windbg调试一)minidump崩溃捕捉 一,系统的异常处理顺序二,SetUnhandleExceptionFilter函数三,Minidump四,代码演示五,windbg生成Dump 在日常工作中,本地c代码发生崩溃时&#xff0c…

异常处理与MiniDump详解 4 MiniDump

分享一下我老师大神的人工智能教程!零基础,通俗易懂!http://blog.csdn.net/jiangjunshow 也欢迎大家转载本篇文章。分享知识,造福人民,实现我们中华民族伟大复兴! 异常处理与MiniDump详解(4) MiniDump writ…

自己创建 minidump

以前曾写过一个 bugslayer.dll 的介绍. 在程序出错时将调用栈写到文件. 觉得不错. 后来开始用 windbg. 知道了 userdump. 知道了如何调试 dump... 才知道程序崩溃的时候写 dump 文件其实可以获取比调用栈多得多的信息. 如果你的程序什么都不干. 那么在程序出错的时候. drwts…

MiniDump不生成或者生成0字节

今天在使用C写一个Windows多线程程序时&#xff0c;发现退出过程中有段错误&#xff0c;为了方便快速的定位问题&#xff0c;我使用了MiniDump。 MiniDump.c源码如下&#xff1a; #include <stdio.h> #include <stdlib.h> #include <time.h> #include <…

MiniDump文件的生成(一)

使用DbgHelp提供的MiniDumpWriteDump函数可以在程序崩溃的时候产生包含足够多信息的MiniDump文件供调试程序使用。 1. MiniDumpWriteDump的声明如下 详见: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680360(vvs.85).aspx 2. 作为示例&#xff0c;下面…

用windbg分析蓝屏文件minidump随记!!

用windbg分析蓝屏文件minidump&#xff0c;以解决加载驱动蓝屏的相关问题随记。 案例1&#xff1a;能够正常进入操作系统&#xff0c;按照如下提示设置: a. 右击“我的电脑”选择“属性”; b. 在弹出的对话框中选择 “高级”&#xff0d;> “设置”; c.“自动重新启动…