win10吧 关注:694,703贴子:5,375,126
  • 0回复贴,共1

irql not less or equal 换了内存正常了,读了下dmp看不懂

取消只看楼主收藏回复

Microsoft (R) Windows Debugger Version 10.0.22621.1 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\060322-6109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`53e00000 PsLoadedModuleList = 0xfffff800`54a2a2b0
Debug session time: Fri Jun 3 17:10:52.492 2022 (UTC + 8:00)
System Uptime: 0 days 10:44:51.232
Loading Kernel Symbols
...............................................................
................................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.................
For analysis of this file, run !analyze -v
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000888, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8005408a8bb, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3484
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 78103
Key : Analysis.Init.CPU.mSec
Value: 1764
Key : Analysis.Init.Elapsed.mSec
Value: 59735
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 060322-6109-01.dmp
BUGCHECK_CODE: a
BUGCHECK_P1: 888
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8005408a8bb
READ_ADDRESS: fffff80054afb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000888
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffff8203b9b925a0 -- (.trap 0xffff8203b9b925a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8005408a8bb rsp=ffff8203b9b92730 rbp=ffff8203b9b92ac8
r8=0000000000000000 r9=0000000000d2e7c0 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiUnlinkFreeOrZeroedPage+0x18b:
fffff800`5408a8bb 4d8b8cc680080000 mov r9,qword ptr [r14+rax*8+880h] ds:00000000`00000888=????????????????
Resetting default scope
STACK_TEXT:
ffff8203`b9b92458 fffff800`54209c69 : 00000000`0000000a 00000000`00000888 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffff8203`b9b92460 fffff800`54205f69 : ffff8203`b9b925b0 fffff800`5408a282 00000000`00000000 00007ffe`a746a470 : nt!KiBugCheckDispatch+0x69
ffff8203`b9b925a0 fffff800`5408a8bb : 00000000`00000001 fffff8ec`fd5a1d30 fffff800`54af3a20 fffff800`54a51c28 : nt!KiPageFault+0x469
ffff8203`b9b92730 fffff800`5408826d : 00000000`00000000 00000000`00000000 ffffdf09`00000000 fffff800`00000001 : nt!MiUnlinkFreeOrZeroedPage+0x18b
ffff8203`b9b927c0 fffff800`54087598 : ffffdf09`d9cb4690 00000000`00000001 fffff800`54a50bc0 ffffdf09`d9cd0050 : nt!MiZeroPage+0xbed
ffff8203`b9b92970 fffff800`541ad2a8 : ffffdf09`d9cb4690 ffff8203`00000003 fffff800`00000000 00000000`00000008 : nt!MiZeroLargePages+0xd08
ffff8203`b9b92a60 fffff800`540eea75 : 00000000`00000000 ffffdf09`d9cd0050 fffff580`00007000 fffff800`54a50bc0 : nt!MiZeroLargePageThread+0x88
ffff8203`b9b92b10 fffff800`541ff3b8 : ffff9481`184dc180 ffffdf09`d9d26040 fffff800`540eea20 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8203`b9b92b60 00000000`00000000 : ffff8203`b9b93000 ffff8203`b9b8c000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiUnlinkFreeOrZeroedPage+18b
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1706
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 18b
FAILURE_BUCKET_ID: AV_nt!MiUnlinkFreeOrZeroedPage
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4d80c6f1-7129-03cf-724f-15365f86912d}
Followup: MachineOwner
---------
0: kd> .trap 0xffff8203b9b925a0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8005408a8bb rsp=ffff8203b9b92730 rbp=ffff8203b9b92ac8
r8=0000000000000000 r9=0000000000d2e7c0 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiUnlinkFreeOrZeroedPage+0x18b:
fffff800`5408a8bb 4d8b8cc680080000 mov r9,qword ptr [r14+rax*8+880h] ds:00000000`00000888=????????????????


IP属地:浙江1楼2022-06-03 18:18回复