xxbing
V2EX  ›  问与答

一直用得好好的 WIN10 今天突然蓝屏 3 次,用 WinDbg 分析了一下 DMP 文件.有大佬能解读一下吗

  •  
  •   xxbing · Sep 17, 2022 · 2124 views
    This topic created in 1359 days ago, the information mentioned may be changed or developed.
    
    Microsoft (R) Windows Debugger Version 10.0.25136.1001 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    Loading Dump File [C:\Windows\Minidump\091722-24328-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: srv*
    Executable search path is: 
    Windows 10 Kernel Version 19041 MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
    Machine Name:
    Kernel base = 0xfffff806`71a00000 PsLoadedModuleList = 0xfffff806`7262a290
    Debug session time: Sat Sep 17 17:39:02.293 2022 (UTC + 8:00)
    System Uptime: 0 days 0:44:47.986
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................................................
    .....................
    Loading User Symbols
    Loading unloaded module list
    ..........
    For analysis of this file, run !analyze -v
    nt!KeBugCheckEx:
    fffff806`71df8fa0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffffdd0c`b6883a10=000000000000001e
    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common BugCheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: ffffcc8c4720bc08, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 0000000000000000, Parameter 1 of the exception
    Debugging Details:
    ------------------
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: ExceptionRecord                               ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that     ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: ContextRecord                                 ***
    ***                                                                   ***
    *************************************************************************
    *** WARNING: Unable to verify checksum for win32k.sys
    KEY_VALUES_STRING: 1
        Key  : Analysis.CPU.mSec
        Value: 6764
        Key  : Analysis.DebugAnalysisManager
        Value: Create
        Key  : Analysis.Elapsed.mSec
        Value: 47135
        Key  : Analysis.Init.CPU.mSec
        Value: 858
        Key  : Analysis.Init.Elapsed.mSec
        Value: 99523
        Key  : Analysis.Memory.CommitPeak.Mb
        Value: 99
        Key  : Bugcheck.Code.DumpHeader
        Value: 0x1e
        Key  : Bugcheck.Code.Register
        Value: 0x1e
        Key  : WER.OS.Branch
        Value: vb_release
        Key  : WER.OS.Timestamp
        Value: 2019-12-06T14:06:00Z
        Key  : WER.OS.Version
        Value: 10.0.19041.1
    FILE_IN_CAB:  091722-24328-01.dmp
    BUGCHECK_CODE:  1e
    BUGCHECK_P1: ffffffffc0000005
    BUGCHECK_P2: ffffcc8c4720bc08
    BUGCHECK_P3: 0
    BUGCHECK_P4: 0
    EXCEPTION_PARAMETER1:  0000000000000000
    EXCEPTION_PARAMETER2:  0000000000000000
    READ_ADDRESS: fffff806726fb390: Unable to get MiVisibleState
    Unable to get NonPagedPoolStart
    Unable to get NonPagedPoolEnd
    Unable to get PagedPoolStart
    Unable to get PagedPoolEnd
    unable to get nt!MmSpecialPagesInUse
     0000000000000000 
    BLACKBOXBSD: 1 (!blackboxbsd)
    BLACKBOXNTFS: 1 (!blackboxntfs)
    BLACKBOXPNP: 1 (!blackboxpnp)
    BLACKBOXWINLOGON: 1
    CUSTOMER_CRASH_COUNT:  1
    PROCESS_NAME:  System
    TRAP_FRAME:  ffff800000000000 -- (.trap 0xffff800000000000)
    Unable to read trap frame at ffff8000`00000000
    STACK_TEXT:  
    ffffdd0c`b6883a08 fffff806`71e3cd15     : 00000000`0000001e ffffffff`c0000005 ffffcc8c`4720bc08 00000000`00000000 : nt!KeBugCheckEx
    ffffdd0c`b6883a10 fffff806`71e0b0ac     : 00000000`00001000 ffffdd0c`b68842b0 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x1c6825
    ffffdd0c`b68840d0 fffff806`71e07243     : 00000000`00000000 ffffdd0c`b6884390 ffffdd0c`b6884310 00000000`00000000 : nt!KiExceptionDispatch+0x12c
    ffffdd0c`b68842b0 ffffcc8c`4720bc08     : ffffcc8c`4722dab0 00000000`00000000 ffffcc8c`4d4e9ac0 ffffbb80`4eb27180 : nt!KiPageFault+0x443
    ffffdd0c`b6884440 ffffcc8c`4722dab0     : 00000000`00000000 ffffcc8c`4d4e9ac0 ffffbb80`4eb27180 aca58bb9`00000091 : 0xffffcc8c`4720bc08
    ffffdd0c`b6884448 00000000`00000000     : ffffcc8c`4d4e9ac0 ffffbb80`4eb27180 aca58bb9`00000091 acb188ae`0000009b : 0xffffcc8c`4722dab0
    SYMBOL_NAME:  nt!KiDispatchException+1c6825
    MODULE_NAME: nt
    IMAGE_NAME:  ntkrnlmp.exe
    IMAGE_VERSION:  10.0.19041.2006
    STACK_COMMAND:  .cxr; .ecxr ; kb
    BUCKET_ID_FUNC_OFFSET:  1c6825
    FAILURE_BUCKET_ID:  AV_R_nt!KiDispatchException
    OS_VERSION:  10.0.19041.1
    BUILDLAB_STR:  vb_release
    OSPLATFORM_TYPE:  x64
    OSNAME:  Windows 10
    FAILURE_ID_HASH:  {36796e09-312c-3519-a508-ce00ff2df497}
    Followup:     MachineOwner
    ---------
    
    6 replies    2022-09-19 10:29:05 +08:00
    kokutou
        1
    kokutou  
       Sep 17, 2022
    3 个都不一样考虑内存不稳定,插拔内存,然后内存电压 1.4v 电它。
    virtualworld
        2
    virtualworld  
       Sep 17, 2022
    我也是今天突然蓝屏了,是从睡眠中恢复的时候发生的,代码是 WHEA_uncorrectable_error ,重启能进系统,但会自动重启,搜了一下说是硬件问题,根据 intel 官网提示重置了 BIOS ,删除了前两天的更新,目前暂时没再蓝屏
    francis59
        3
    francis59  
       Sep 17, 2022
    Google "ntkrnlmp.exe 蓝屏"
    tux
        4
    tux  
       Sep 18, 2022
    最近,空闲莫名重启...win10
    kokutou
        5
    kokutou  
       Sep 18, 2022 via Android   ❤️ 1
    @slrey
    whea 是 CPU 核心电压不足,BIOS 里 CPU 电压 offset 模式+0.05v
    lookingmoon
        6
    lookingmoon  
       Sep 19, 2022
    @tux 看看 bios c-state 有没有关掉 然后 cpu 防掉压开起来
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Solana   ·   5898 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 71ms · UTC 03:34 · PVG 11:34 · LAX 20:34 · JFK 23:34
    ♥ Do have faith in what you're doing.