Win10蓝屏dmp文件分析原因
程序员文章站
2024-03-21 17:11:16
...
最近苦于蓝屏困扰，烦死了。按照网上贴子分析原因，把过程记录一下，以供同道人借鉴。
一、调试信息设置。当蓝屏发生后，会将原因记录下来（指可能的原因，也许没卵用）。二、如果蓝屏重启电脑后，相关原因可能从.dmp文件中查找。.dmp文件位于：C:\Windows\Minidump 目录下。
我电脑上的dmp文件如下所示。
三、电脑安装WinDbg工具。近按照微软官方要求来安装SDK，并扩展WinDbg(https://docs.microsoft.com/zh-cn/windows-hardware/drivers/debugger/debugger-download-tools#small-windbg-preview-logoimageswindbgx-preview-logopng-download-windbg-preview)这一过程比较烦，下载时间有点长。
安装好了从开始中找到WinDbg，右键->更多->以管理员身份运行。四、WinDbg需设置Sybmol符号。
还需要配置Symbol符号路径，要不然调试出来看不到原因。会有以下提示：
按照官方网提示（https://docs.microsoft.com/zh-cn/windows-hardware/drivers/debugger/microsoft-public-symbols），Symbol符号不再提供下载，可通过以下方式直接引用符号路径中的公共符号服务器：
set _NT_SYMBOL_PATH=srvDownstreamStorehttps://msdl.microsoft.com/download/symbols
将上面语句填入下图所示地方。
五、打开.dmp文件。选择最近一次蓝屏时间的.dmp文件。
打开后在调试.dmp文件，要等一会儿。
结果出来了。可能的原因如下
结合我自己的电脑是组装，从8G内存，换成了32G。估计是内存兼容不好。没有办法，Crying !!!
写这篇文章时，又蓝屏了一次。开机一看，又是内存崩了：Memory_corruption
在最下面输入框： kd> 后面输入命令：!analyze -v 看更详细的原因。
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000b911bc, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff802102212a6, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
0000000000b911bc
CURRENT_IRQL: 0
FAULTING_IP:
nt!PoIdle+46
fffff802`102212a6 0080bc11b900 add byte ptr [rax+0B911BCh],al
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xA
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from fffff802103d32e9 to fffff802103c14e0
STACK_TEXT:
ffff848e`bda5f718 fffff802`103d32e9 : 00000000`0000000a 00000000`00b911bc 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffff848e`bda5f720 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
STACK_COMMAND: .bugcheck ; kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8021022125a-fffff8021022125f 6 bytes - nt!MiCheckProcessorPteCache+6ea
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff802102216af-fffff802102216b0 2 bytes - nt!PoIdle+44f (+0x455)
[ 48 ff:4c 8b ]
fffff802102216b6-fffff802102216b9 4 bytes - nt!PoIdle+456 (+0x07)
[ 0f 1f 44 00:e8 b5 6a a9 ]
fffff802102216c9-fffff802102216ca 2 bytes - nt!PoIdle+469 (+0x13)
[ 48 ff:4c 8b ]
fffff802102216d0-fffff802102216d3 4 bytes - nt!PoIdle+470 (+0x07)
[ 0f 1f 44 00:e8 eb dc aa ]
fffff8021022176a-fffff8021022176f 6 bytes - nt!PoIdle+50a (+0x9a)
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff80210221f2f-fffff80210221f30 2 bytes - nt!PpmIdleExecuteTransition+7bf (+0x7c5)
[ 48 ff:4c 8b ]
fffff80210221f36-fffff80210221f39 4 bytes - nt!PpmIdleExecuteTransition+7c6 (+0x07)
[ 0f 1f 44 00:e8 85 58 a9 ]
fffff802102e08c2-fffff802102e08c7 6 bytes - nt!PspReaper+a2 (+0xbe98c)
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff802103643ce-fffff802103643d3 6 bytes - nt!KiTimerExpirationDpc+de (+0x83b0c)
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff8021037527a-fffff8021037527f 6 bytes - nt!xKdUnmapVirtualAddress+a (+0x10eac)
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff802103752b6-fffff802103752bb 6 bytes - nt!IoAllocateErrorLogEntry+36 (+0x3c)
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff802103c14ba-fffff802103c14bb 2 bytes - nt!ZwWaitLowEventPair+2a (+0x4c204)
[ 84 00:4c 87 ]
fffff802103c14bd-fffff802103c14bf 3 bytes - nt!ZwWaitLowEventPair+2d (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c14da-fffff802103c14db 2 bytes - nt!KiBugCheckReturn+16 (+0x1d)
[ 84 00:4c 87 ]
fffff802103c14dd-fffff802103c14df 3 bytes - nt!KiBugCheckReturn+19 (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c160a-fffff802103c160b 2 bytes - nt!KeBugCheckEx+12a (+0x12d)
[ 84 00:4c 87 ]
fffff802103c160d-fffff802103c160f 3 bytes - nt!KeBugCheckEx+12d (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c170a-fffff802103c170b 2 bytes - nt!KeContextToKframes+fa (+0xfd)
[ 84 00:4c 87 ]
fffff802103c170d-fffff802103c170f 3 bytes - nt!KeContextToKframes+fd (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c175a-fffff802103c175b 2 bytes - nt!KiSaveInitialProcessorControlState+4a (+0x4d)
[ 84 00:4c 87 ]
fffff802103c175d-fffff802103c175f 3 bytes - nt!KiSaveInitialProcessorControlState+4d (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c182a-fffff802103c182f 6 bytes - nt!KiRestoreProcessorControlState+ca (+0xcd)
[ 66 0f 1f 44 00 00:4c 87 00 98 c3 90 ]
fffff802103c19aa-fffff802103c19ab 2 bytes - nt!KiSaveProcessorControlState+17a (+0x180)
[ 84 00:4c 87 ]
fffff802103c19ad-fffff802103c19af 3 bytes - nt!KiSaveProcessorControlState+17d (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c1a2a-fffff802103c1a2f 6 bytes - nt!KiRestoreDebugRegisterState+7a (+0x7d)
[ cc 0f 1f 44 00 00:4c 87 00 98 c3 90 ]
fffff802103c1bba-fffff802103c1bbb 2 bytes - nt!KiSaveDebugRegisterState+18a (+0x190)
[ 84 00:4c 87 ]
fffff802103c1bbd-fffff802103c1bbf 3 bytes - nt!KiSaveDebugRegisterState+18d (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c1bca-fffff802103c1bcf 6 bytes - nt!KeGetCurrentStackPointer+a (+0x0d)
[ cc cc 0f 1f 40 00:4c 87 00 98 c3 90 ]
fffff802103c1bda-fffff802103c1bdb 2 bytes - nt!KeResetLegacyFloatingPointState+a (+0x10)
[ 1f 80:4c 87 ]
fffff802103c1bdd-fffff802103c1bdf 3 bytes - nt!KeResetLegacyFloatingPointState+d (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c1bea-fffff802103c1bef 6 bytes - nt!KeSaveLegacyFloatingPointControlWord+a (+0x0d)
[ cc cc 0f 1f 40 00:4c 87 00 98 c3 90 ]
fffff802103c1c0a-fffff802103c1c0b 2 bytes - nt!KeRestoreLegacyFloatingPointControlWord+1a (+0x20)
[ 84 00:4c 87 ]
fffff802103c1c0d-fffff802103c1c0f 3 bytes - nt!KeRestoreLegacyFloatingPointControlWord+1d (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c1eda-fffff802103c1edb 2 bytes - nt!NtContinue+2ca (+0x2cd)
[ 84 00:4c 87 ]
fffff802103c1edd-fffff802103c1edf 3 bytes - nt!NtContinue+2cd (+0x03)
[ 00 00 00:98 c3 90 ]
fffff802103c82ca-fffff802103c82cf 6 bytes - nt!KiSwapContext+da (+0x63ed)
[ cc cc 0f 1f 40 00:4c 87 00 98 c3 90 ]
fffff802103c835a-fffff802103c835f 6 bytes - nt!KiDispatchInterruptContinue+4a (+0x90)
[ cc cc cc 0f 1f 00:4c 87 00 98 c3 90 ]
fffff802103d32fa-fffff802103d32ff 6 bytes - nt!KiBugCheckDispatch+7a (+0xafa0)
[ 66 0f 1f 44 00 00:4c 87 00 98 c3 90 ]
fffff8021048500e-fffff80210485013 6 bytes - nt!HvlDummyInterruptCallback+e (+0xb1d14)
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff802104b2f3a-fffff802104b2f3f 6 bytes - nt!KiForceIdleStopDpcRoutine+ea (+0x2df2c)
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff80210acb0ea-fffff80210acb0ef 6 bytes - nt!PspProcessRundownWorker+aa
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
fffff80210acb152-fffff80210acb157 6 bytes - nt!PspProcessRundownWorkerSingle+62 (+0x68)
[ cc cc cc cc cc cc:4c 87 00 98 c3 90 ]
170 errors : !nt (fffff8021022125a-fffff80210acb157)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE
BUCKET_ID: X64_MEMORY_CORRUPTION_LARGE
Followup: memory_corruption
---------
也看不出什么所以然。
拔了内存涮了灰，别无他法，希望能好。