Microsoft (R) Windows Debugger Version 10.0.10240.9 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Administrator\Downloads\Compressed\Minidump\Minidump\112515-127015-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
No .natvis files found at C:\Program Files\Windows Kits\10\Debuggers\x86\Visualizers.
Windows 10 Kernel Version 10240 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10240.16430.x86fre.th1.150807-2049
Machine Name:
Kernel base = 0x82671000 PsLoadedModuleList = 0x828b2a38
Debug session time: Wed Nov 25 13:43:03.423 2015 (UTC + 8:00)
System Uptime: 4 days 5:33:47.739
Loading Kernel Symbols
.
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
..............................................................
................................................................
................................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1, 2, 0, 8274c055}
Probably caused by : memory_corruption ( nt!MiGetVadWakeList+75 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8274c055, address which referenced memory
Debugging Details:
------------------
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: System Version
BIOS_DATE: 07/18/2011
BASEBOARD_PRODUCT: P8H61-M LX
BASEBOARD_VERSION: Rev x.0x
BUGCHECK_P1: 1
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffff8274c055
READ_ADDRESS: 828d516c: Unable to get MiVisibleState
00000001
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiGetVadWakeList+75
8274c055 8b08 mov ecx,dword ptr [eax]
CPU_COUNT: 2
CPU_MHZ: a22
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 2a
CPU_STEPPING: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: splwow64.exe
ANALYSIS_VERSION: 10.0.10240.9 x86fre
TRAP_FRAME: cb90c978 -- (.trap 0xffffffffcb90c978)
ErrCode = 00000000
eax=00000001 ebx=bb671650 ecx=00000001 edx=00000002 esi=c9d91974 edi=00000000
eip=8274c055 esp=cb90c9ec ebp=cb90ca04 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!MiGetVadWakeList+0x75:
8274c055 8b08 mov ecx,dword ptr [eax] ds:0023:00000001=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 827a9706 to 827972e0
STACK_TEXT:
cb90c8d0 827a9706 0000000a 00000001 00000002 nt!KiBugCheck2
cb90c8d0 8274c055 0000000a 00000001 00000002 nt!KiTrap0E+0x1ca
cb90ca04 829e7f21 c9d91780 d7ec5148 ffffd000 nt!MiGetVadWakeList+0x75
cb90ca3c 8274cba6 acd8bc60 8e48dc80 d7ec5148 nt!MiRemoveVadCharges+0x161
cb90ca60 8274c69a 00000000 05340000 05342fff nt!MiFinishVadDeletion+0xd6
cb90caf8 829f0e5c ca73b040 c9d91780 00000000 nt!MiDeleteVad+0x56a
cb90cb28 829811ca ca73b040 ceaa1030 c9d91780 nt!MmCleanProcessAddressSpace+0x6a
cb90cb80 829d340e 2272197c ca73b040 c9d91780 nt!PspRundownSingleProcess+0xfc
cb90cc10 82968b0c ffffffff 0022f8e0 8e60f110 nt!PspExitThread+0x55e
cb90cc5c 8e60f1a9 ffffffff 00000000 ca73b2b8 nt!NtTerminateProcess+0xec
WARNING: Frame IP not in any known module. Following frames may be wrong.
cb90cd04 827a603b ffffffff 00000000 0022f9ac 0x8e60f1a9
cb90cd04 773046f0 ffffffff 00000000 0022f9ac nt!KiSystemServicePostCall
0022f9ac 00000000 00000000 00000000 00000000 0x773046f0
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiGetVadWakeList+75
8274c055 8b08 mov ecx,dword ptr [eax]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!MiGetVadWakeList+75
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 55c59dd5
IMAGE_VERSION: 10.0.10240.16430
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 75
FAILURE_BUCKET_ID: AV_nt!MiGetVadWakeList
BUCKET_ID: AV_nt!MiGetVadWakeList
PRIMARY_PROBLEM_CLASS: AV_nt!MiGetVadWakeList
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!migetvadwakelist
FAILURE_ID_HASH: {3f3cb3df-6855-eaad-d359-d7ff0ccf673a}
Followup: MachineOwner
---------
1: kd> .trap 0xffffffffcb90c978
ErrCode = 00000000
eax=00000001 ebx=bb671650 ecx=00000001 edx=00000002 esi=c9d91974 edi=00000000
eip=8274c055 esp=cb90c9ec ebp=cb90ca04 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!MiGetVadWakeList+0x75:
8274c055 8b08 mov ecx,dword ptr [eax] ds:0023:00000001=????????
1: kd> lmvm nt
Browse full module list
start end module name
82671000 82cd6000 nt (pdb symbols) d:\symbols\ntkrpamp.pdb\EAC9650DDABA40709A60AC955302BBCE1\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: d:\symbols\ntoskrnl.exe\55C59DD5665000\ntoskrnl.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Browse all global symbols functions data
Timestamp: Sat Aug 08 14:12:37 2015 (55C59DD5)
CheckSum: 00605939
ImageSize: 00665000
File version: 10.0.10240.16430
Product version: 10.0.10240.16430
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 10.0.10240.16430
FileVersion: 10.0.10240.16430 (th1.150807-2049)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
splwow64.exe，打印机程序？
多次出现：nt!MiGetVadWakeList@伊川书院 |
发表于 2015-11-26 15:45:44
楼主