V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
V2EX 提问指南
xxbing
V2EX  ›  问与答

一直用得好好的 WIN10 今天突然蓝屏 3 次,用 WinDbg 分析了一下 DMP 文件.有大佬能解读一下吗

  •  
  •   xxbing · 2022-09-17 20:54:52 +08:00 · 1241 次点击
    这是一个创建于 558 天前的主题,其中的信息可能已经有所发展或是发生改变。
    
    Microsoft (R) Windows Debugger Version 10.0.25136.1001 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    Loading Dump File [C:\Windows\Minidump\091722-24328-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: srv*
    Executable search path is: 
    Windows 10 Kernel Version 19041 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
    Machine Name:
    Kernel base = 0xfffff806`71a00000 PsLoadedModuleList = 0xfffff806`7262a290
    Debug session time: Sat Sep 17 17:39:02.293 2022 (UTC + 8:00)
    System Uptime: 0 days 0:44:47.986
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    .....................
    Loading User Symbols
    Loading unloaded module list
    ..........
    For analysis of this file, run !analyze -v
    nt!KeBugCheckEx:
    fffff806`71df8fa0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffdd0c`b6883a10=000000000000001e
    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common BugCheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: ffffcc8c4720bc08, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 0000000000000000, Parameter 1 of the exception
    Debugging Details:
    ------------------
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: ExceptionRecord                               ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: ContextRecord                                 ***
    ***                                                                   ***
    *************************************************************************
    *** WARNING: Unable to verify checksum for win32k.sys
    KEY_VALUES_STRING: 1
        Key  : Analysis.CPU.mSec
        Value: 6764
        Key  : Analysis.DebugAnalysisManager
        Value: Create
        Key  : Analysis.Elapsed.mSec
        Value: 47135
        Key  : Analysis.Init.CPU.mSec
        Value: 858
        Key  : Analysis.Init.Elapsed.mSec
        Value: 99523
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 99
        Key  : Bugcheck.Code.DumpHeader
        Value: 0x1e
        Key  : Bugcheck.Code.Register
        Value: 0x1e
        Key  : WER.OS.Branch
        Value: vb_release
        Key  : WER.OS.Timestamp
        Value: 2019-12-06T14:06:00Z
        Key  : WER.OS.Version
        Value: 10.0.19041.1
    FILE_IN_CAB:  091722-24328-01.dmp
    BUGCHECK_CODE:  1e
    BUGCHECK_P1: ffffffffc0000005
    BUGCHECK_P2: ffffcc8c4720bc08
    BUGCHECK_P3: 0
    BUGCHECK_P4: 0
    EXCEPTION_PARAMETER1:  0000000000000000
    EXCEPTION_PARAMETER2:  0000000000000000
    READ_ADDRESS: fffff806726fb390: Unable to get MiVisibleState
    Unable to get NonPagedPoolStart
    Unable to get NonPagedPoolEnd
    Unable to get PagedPoolStart
    Unable to get PagedPoolEnd
    unable to get nt!MmSpecialPagesInUse
     0000000000000000 
    BLACKBOXBSD: 1 (!blackboxbsd)
    BLACKBOXNTFS: 1 (!blackboxntfs)
    BLACKBOXPNP: 1 (!blackboxpnp)
    BLACKBOXWINLOGON: 1
    CUSTOMER_CRASH_COUNT:  1
    PROCESS_NAME:  System
    TRAP_FRAME:  ffff800000000000 -- (.trap 0xffff800000000000)
    Unable to read trap frame at ffff8000`00000000
    STACK_TEXT:  
    ffffdd0c`b6883a08 fffff806`71e3cd15     : 00000000`0000001e ffffffff`c0000005 ffffcc8c`4720bc08 00000000`00000000 : nt!KeBugCheckEx
    ffffdd0c`b6883a10 fffff806`71e0b0ac     : 00000000`00001000 ffffdd0c`b68842b0 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x1c6825
    ffffdd0c`b68840d0 fffff806`71e07243     : 00000000`00000000 ffffdd0c`b6884390 ffffdd0c`b6884310 00000000`00000000 : nt!KiExceptionDispatch+0x12c
    ffffdd0c`b68842b0 ffffcc8c`4720bc08     : ffffcc8c`4722dab0 00000000`00000000 ffffcc8c`4d4e9ac0 ffffbb80`4eb27180 : nt!KiPageFault+0x443
    ffffdd0c`b6884440 ffffcc8c`4722dab0     : 00000000`00000000 ffffcc8c`4d4e9ac0 ffffbb80`4eb27180 aca58bb9`00000091 : 0xffffcc8c`4720bc08
    ffffdd0c`b6884448 00000000`00000000     : ffffcc8c`4d4e9ac0 ffffbb80`4eb27180 aca58bb9`00000091 acb188ae`0000009b : 0xffffcc8c`4722dab0
    SYMBOL_NAME:  nt!KiDispatchException+1c6825
    MODULE_NAME: nt
    IMAGE_NAME:  ntkrnlmp.exe
    IMAGE_VERSION:  10.0.19041.2006
    STACK_COMMAND:  .cxr; .ecxr ; kb
    BUCKET_ID_FUNC_OFFSET:  1c6825
    FAILURE_BUCKET_ID:  AV_R_nt!KiDispatchException
    OS_VERSION:  10.0.19041.1
    BUILDLAB_STR:  vb_release
    OSPLATFORM_TYPE:  x64
    OSNAME:  Windows 10
    FAILURE_ID_HASH:  {36796e09-312c-3519-a508-ce00ff2df497}
    Followup:     MachineOwner
    ---------
    
    6 条回复    2022-09-19 10:29:05 +08:00
    kokutou
        1
    kokutou  
       2022-09-17 22:58:44 +08:00
    3 个都不一样考虑内存不稳定,插拔内存,然后内存电压 1.4v 电它。
    slrey
        2
    slrey  
       2022-09-17 23:03:45 +08:00
    我也是今天突然蓝屏了,是从睡眠中恢复的时候发生的,代码是 WHEA_uncorrectable_error ,重启能进系统,但会自动重启,搜了一下说是硬件问题,根据 intel 官网提示重置了 BIOS ,删除了前两天的更新,目前暂时没再蓝屏
    francis59
        3
    francis59  
       2022-09-17 23:12:58 +08:00
    Google "ntkrnlmp.exe 蓝屏"
    tux
        4
    tux  
       2022-09-18 00:27:44 +08:00
    最近,空闲莫名重启...win10
    kokutou
        5
    kokutou  
       2022-09-18 11:42:38 +08:00 via Android   ❤️ 1
    @slrey
    whea 是 CPU 核心电压不足,BIOS 里 CPU 电压 offset 模式+0.05v
    lookingmoon
        6
    lookingmoon  
       2022-09-19 10:29:05 +08:00
    @tux 看看 bios c-state 有没有关掉 然后 cpu 防掉压开起来
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   我们的愿景   ·   实用小工具   ·   1554 人在线   最高记录 6543   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 27ms · UTC 17:14 · PVG 01:14 · LAX 10:14 · JFK 13:14
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.