none
WIN10蓝屏,附dump分析日志,信息提示IRQL_NOT_LESS_OR_EQUAL RRS feed

  • 问题

  • Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\minidump\021220-31375-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 18362 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Machine Name:
    Kernel base = 0xfffff806`21e00000 PsLoadedModuleList = 0xfffff806`22248150
    Debug session time: Wed Feb 12 10:56:03.042 2020 (UTC + 8:00)
    System Uptime: 1 days 5:15:16.482
    Loading Kernel Symbols
    ..

    Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
    Run !sym noisy before .reload to track down problems loading symbols.

    .............................................................
    ................................................................
    ................................................................
    .......................................................
    Loading User Symbols
    Loading unloaded module list
    .............................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {fffffa88f68eee70, 2, 1, fffff80621e4c53b}

    *** WARNING: Unable to verify timestamp for win32k.sys
    *** ERROR: Module load completed but symbols could not be loaded for win32k.sys
    Probably caused by : memory_corruption

    Followup: memory_corruption
    ---------

     *** Memory manager detected 202975 instance(s) of page corruption, target is likely to have memory corruption.

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffffa88f68eee70, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80621e4c53b, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
    unable to get nt!MmSpecialPoolEnd
    unable to get nt!MmPoolCodeStart
    unable to get nt!MmPoolCodeEnd
     fffffa88f68eee70 

    CURRENT_IRQL:  2

    FAULTING_IP: 
    nt!KeReleaseMutant+db
    fffff806`21e4c53b 89842480000000  mov     dword ptr [rsp+80h],eax

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  CODE_CORRUPTION

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  QQPCTray.exe

    BAD_PAGES_DETECTED: 318df

    LAST_CONTROL_TRANSFER:  from fffff80621fd32e9 to fffff80621fc14e0

    STACK_TEXT:  
    fffffa88`f1c1eb18 fffff806`21fd32e9 : 00000000`0000000a fffffa88`f68eee70 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffffa88`f1c1eb20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69


    STACK_COMMAND:  kb

    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
        fffff80621e4c0bd - nt!MiInsertCachedPte+4d
    [ f6:84 ]
        fffff80621e4c294 - nt!MiInsertCachedPte+224 (+0x1d7)
    [ f6:84 ]
    2 errors : !nt (fffff80621e4c0bd-fffff80621e4c294)

    MODULE_NAME: memory_corruption

    IMAGE_NAME:  memory_corruption

    FOLLOWUP_NAME:  memory_corruption

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    MEMORY_CORRUPTOR:  LARGE

    FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

    BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

    Followup: memory_corruption
    ---------

     *** Memory manager detected 202975 instance(s) of page corruption, target is likely to have memory corruption.
    2020年2月12日 12:43