查看: 133072|回复: 8
收起左侧

[系统] win10 经常出现“IRQL-NOT-LESS-OR EQUAL”错误(已上传dmp)。

[复制链接]
Lianfenghao
发表于 2015-11-26 15:45:44 | 显示全部楼层 |阅读模式
本帖最后由 Lianfenghao 于 2015-11-27 09:59 编辑

已经上传了dmp,烦请大神分析一下,谢谢。

win10最近经常出现“IRQL-NOT-LESS-OR EQUAL”错误,不知道是什么问题。



本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
伊川书院
发表于 2015-11-26 18:34:52 | 显示全部楼层
本帖最后由 伊川书院 于 2015-11-26 18:36 编辑

当100%之后,%SystemRoot%或%SystemRoot%\Minidump\ 目录下看看有没有XXXXX.DMP

有的话上传个看看,win10的还没看到过
扬帆起航
发表于 2015-11-26 22:31:24 | 显示全部楼层
上传dmp
Lianfenghao
 楼主| 发表于 2015-11-27 10:00:35 | 显示全部楼层
伊川书院 发表于 2015-11-26 18:34
当100%之后,%SystemRoot%或%SystemRoot%\Minidump\ 目录下看看有没有XXXXX.DMP

有的话上传个看看,win1 ...

已经上传dmp,麻烦您有时间帮我看看,谢谢。
Lianfenghao
 楼主| 发表于 2015-11-27 10:03:00 | 显示全部楼层

已经上传dmp,麻烦您有时间帮我看看,谢谢。
扬帆起航
发表于 2015-11-27 20:01:32 | 显示全部楼层
Lianfenghao 发表于 2015-11-27 10:03
已经上传dmp,麻烦您有时间帮我看看,谢谢。

Microsoft (R) Windows Debugger Version 10.0.10240.9 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Administrator\Downloads\Compressed\Minidump\Minidump\112515-127015-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
No .natvis files found at C:\Program Files\Windows Kits\10\Debuggers\x86\Visualizers.
Windows 10 Kernel Version 10240 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10240.16430.x86fre.th1.150807-2049
Machine Name:
Kernel base = 0x82671000 PsLoadedModuleList = 0x828b2a38
Debug session time: Wed Nov 25 13:43:03.423 2015 (UTC + 8:00)
System Uptime: 4 days 5:33:47.739
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
................................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1, 2, 0, 8274c055}

Probably caused by : memory_corruption ( nt!MiGetVadWakeList+75 )

Followup:     MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8274c055, address which referenced memory

Debugging Details:
------------------


SYSTEM_SKU:  To be filled by O.E.M.

SYSTEM_VERSION:  System Version

BIOS_DATE:  07/18/2011

BASEBOARD_PRODUCT:  P8H61-M LX

BASEBOARD_VERSION:  Rev x.0x

BUGCHECK_P1: 1

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: ffffffff8274c055

READ_ADDRESS: 828d516c: Unable to get MiVisibleState
00000001

CURRENT_IRQL:  2

FAULTING_IP:
nt!MiGetVadWakeList+75

8274c055 8b08            mov     ecx,dword ptr [eax]

CPU_COUNT: 2

CPU_MHZ: a22

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 2a

CPU_STEPPING: 7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  splwow64.exe

ANALYSIS_VERSION: 10.0.10240.9 x86fre

TRAP_FRAME:  cb90c978 -- (.trap 0xffffffffcb90c978)
ErrCode = 00000000
eax=00000001 ebx=bb671650 ecx=00000001 edx=00000002 esi=c9d91974 edi=00000000
eip=8274c055 esp=cb90c9ec ebp=cb90ca04 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
nt!MiGetVadWakeList+0x75:
8274c055 8b08            mov     ecx,dword ptr [eax]  ds:0023:00000001=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 827a9706 to 827972e0

STACK_TEXT:  
cb90c8d0 827a9706 0000000a 00000001 00000002 nt!KiBugCheck2
cb90c8d0 8274c055 0000000a 00000001 00000002 nt!KiTrap0E+0x1ca
cb90ca04 829e7f21 c9d91780 d7ec5148 ffffd000 nt!MiGetVadWakeList+0x75
cb90ca3c 8274cba6 acd8bc60 8e48dc80 d7ec5148 nt!MiRemoveVadCharges+0x161
cb90ca60 8274c69a 00000000 05340000 05342fff nt!MiFinishVadDeletion+0xd6
cb90caf8 829f0e5c ca73b040 c9d91780 00000000 nt!MiDeleteVad+0x56a
cb90cb28 829811ca ca73b040 ceaa1030 c9d91780 nt!MmCleanProcessAddressSpace+0x6a
cb90cb80 829d340e 2272197c ca73b040 c9d91780 nt!PspRundownSingleProcess+0xfc
cb90cc10 82968b0c ffffffff 0022f8e0 8e60f110 nt!PspExitThread+0x55e
cb90cc5c 8e60f1a9 ffffffff 00000000 ca73b2b8 nt!NtTerminateProcess+0xec
WARNING: Frame IP not in any known module. Following frames may be wrong.
cb90cd04 827a603b ffffffff 00000000 0022f9ac 0x8e60f1a9
cb90cd04 773046f0 ffffffff 00000000 0022f9ac nt!KiSystemServicePostCall
0022f9ac 00000000 00000000 00000000 00000000 0x773046f0


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiGetVadWakeList+75
8274c055 8b08            mov     ecx,dword ptr [eax]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!MiGetVadWakeList+75

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  55c59dd5

IMAGE_VERSION:  10.0.10240.16430

IMAGE_NAME:  memory_corruption

BUCKET_ID_FUNC_OFFSET:  75

FAILURE_BUCKET_ID:  AV_nt!MiGetVadWakeList

BUCKET_ID:  AV_nt!MiGetVadWakeList

PRIMARY_PROBLEM_CLASS:  AV_nt!MiGetVadWakeList

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_nt!migetvadwakelist

FAILURE_ID_HASH:  {3f3cb3df-6855-eaad-d359-d7ff0ccf673a}

Followup:     MachineOwner
---------

1: kd> .trap 0xffffffffcb90c978
ErrCode = 00000000
eax=00000001 ebx=bb671650 ecx=00000001 edx=00000002 esi=c9d91974 edi=00000000
eip=8274c055 esp=cb90c9ec ebp=cb90ca04 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
nt!MiGetVadWakeList+0x75:
8274c055 8b08            mov     ecx,dword ptr [eax]  ds:0023:00000001=????????
1: kd> lmvm nt
Browse full module list
start    end        module name
82671000 82cd6000   nt         (pdb symbols)          d:\symbols\ntkrpamp.pdb\EAC9650DDABA40709A60AC955302BBCE1\ntkrpamp.pdb
    Loaded symbol image file: ntkrpamp.exe
    Mapped memory image file: d:\symbols\ntoskrnl.exe\55C59DD5665000\ntoskrnl.exe
    Image path: ntkrpamp.exe
    Image name: ntkrpamp.exe
    Browse all global symbols  functions  data
    Timestamp:        Sat Aug 08 14:12:37 2015 (55C59DD5)
    CheckSum:         00605939
    ImageSize:        00665000
    File version:     10.0.10240.16430
    Product version:  10.0.10240.16430
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrpamp.exe
    OriginalFilename: ntkrpamp.exe
    ProductVersion:   10.0.10240.16430
    FileVersion:      10.0.10240.16430 (th1.150807-2049)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

splwow64.exe,打印机程序?

多次出现:nt!MiGetVadWakeList@伊川书院
伊川书院
发表于 2015-11-27 21:28:19 | 显示全部楼层
扬帆起航 发表于 2015-11-27 20:01
Microsoft (R) Windows Debugger Version 10.0.10240.9 X86
Copyright (c) Microsoft Corporation. All  ...


不清楚啊啊,
楼主是X86的系统,怎么会有64位的服务呢?不清楚了

应该是驱动方面的问题吧。。提示是:无效地址
扬帆起航
发表于 2015-11-27 21:56:36 | 显示全部楼层
伊川书院 发表于 2015-11-27 21:28
不清楚啊啊,
楼主是X86的系统,怎么会有64位的服务呢?不清楚了

难道是打印机驱动
伊川书院
发表于 2015-11-27 22:26:31 | 显示全部楼层

不清楚了,猜测应该是相关的驱动,又没有第三方中断,

您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-29 16:10 , Processed in 0.133207 second(s), 17 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表