Share via

为什么会蓝屏，能看出是哪个硬件或者驱动导致的吗

维聪 邱 20 Reputation points
2024-06-06T15:19:35.3233333+00:00

ntkrnlmp蓝屏，蓝屏代码百度云链接：https://pan.baidu.com/s/1zb21QlJY3xNPt_bDNqeimg

提取码：1234

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
12,077 questions
0 comments
Accepted answer
  1. Wesley Li 11,125 Reputation points
    2024-06-07T15:35:23.7+00:00

    您好，

    很抱歉，论坛没有权限下载并分析您的蓝屏文件。

    你可以将蓝屏截图上传到这里，或者使用WinDbg分析工具，输入命令 !analyze -v 来获取异常的概述并上传至此：

    [https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-kernel-mode-dump-file-with-windbg](https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fwindows-hardware%2Fdrivers%2Fdebugger%2Fanalyzing-a-kernel-mode-dump-file-with-windbg&data=05%7C02%7Cwesleyl%40wicresoft.com%7Cb82fceef00a843dc06d008dc87046157%7Cb2ae8dd9097749768706861b488b1512%7C0%7C0%7C638533700125995837%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=mBnuX0TZGL%2FFBX1NSo%2BEpzLPpCbwG7RiZKB1SMw9UKY%3D&reserved=0"原始 URL: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-kernel-mode-dump-file-with-windbg。如果你信任此链接, 请单击或点击。")

    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  2. 维聪 邱 20 Reputation points
    2024-06-12T08:29:11.4533333+00:00 
    For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff805`7b270be0 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:ffff8407`2b1089d0=000000000000007e
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common BugCheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8057b128d00, The address that the exception occurred at
Arg3: ffff84072b1099e8, Exception Record Address
Arg4: ffff84072b109230, Context Record Address

Debugging Details:
------------------

Page 231f5c not present in the dump file. Type ".hh dbgerr004" for details

KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 4265

    Key  : Analysis.Elapsed.mSec
    Value: 4293

    Key  : Analysis.IO.Other.Mb
    Value: 10

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 18

    Key  : Analysis.Init.CPU.mSec
    Value: 1546

    Key  : Analysis.Init.Elapsed.mSec
    Value: 1656554

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 97

    Key  : Bugcheck.Code.KiBugCheckData
    Value: 0x7e

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x7e

    Key  : Bugcheck.Code.TargetModel
    Value: 0x7e

    Key  : Failure.Bucket
    Value: AV_nt!MiDemoteCombinedPte

    Key  : Failure.Hash
    Value: {c577c73b-79a7-0c44-6c62-58e1d697b6d8}

    Key  : Hypervisor.Enlightenments.Value
    Value: 0

    Key  : Hypervisor.Enlightenments.ValueHex
    Value: 0

    Key  : Hypervisor.Flags.AnyHypervisorPresent
    Value: 0

    Key  : Hypervisor.Flags.ApicEnlightened
    Value: 0

    Key  : Hypervisor.Flags.AsyncMemoryHint
    Value: 0

    Key  : Hypervisor.Flags.CpuManager
    Value: 0

    Key  : Hypervisor.Flags.DeprecateAutoEoi
    Value: 0

    Key  : Hypervisor.Flags.DynamicCpuDisabled
    Value: 0

    Key  : Hypervisor.Flags.Epf
    Value: 0

    Key  : Hypervisor.Flags.ExtendedProcessorMasks
    Value: 0

    Key  : Hypervisor.Flags.HardwareMbecAvailable
    Value: 1

    Key  : Hypervisor.Flags.MaxBankNumber
    Value: 0

    Key  : Hypervisor.Flags.MemoryZeroingControl
    Value: 0

    Key  : Hypervisor.Flags.NoExtendedRangeFlush
    Value: 0

    Key  : Hypervisor.Flags.NoNonArchCoreSharing
    Value: 0

    Key  : Hypervisor.Flags.Phase0InitDone
    Value: 0

    Key  : Hypervisor.Flags.PowerSchedulerQos
    Value: 0

    Key  : Hypervisor.Flags.RootScheduler
    Value: 0

    Key  : Hypervisor.Flags.SynicAvailable
    Value: 0

    Key  : Hypervisor.Flags.UseQpcBias
    Value: 0

    Key  : Hypervisor.Flags.Value
    Value: 131072

    Key  : Hypervisor.Flags.ValueHex
    Value: 20000

    Key  : Hypervisor.Flags.VpAssistPage
    Value: 0

    Key  : Hypervisor.Flags.VsmAvailable
    Value: 0

    Key  : Hypervisor.RootFlags.Value
    Value: 0

    Key  : Hypervisor.RootFlags.ValueHex
    Value: 0

    Key  : WER.OS.Branch
    Value: rs5_release

    Key  : WER.OS.Version
    Value: 10.0.17763.1


BUGCHECK_CODE:  7e

BUGCHECK_P1: ffffffffc0000005

BUGCHECK_P2: fffff8057b128d00

BUGCHECK_P3: ffff84072b1099e8

BUGCHECK_P4: ffff84072b109230

FILE_IN_CAB:  MEMORY.DMP

EXCEPTION_RECORD:  ffff84072b1099e8 -- (.exr 0xffff84072b1099e8)
ExceptionAddress: fffff8057b128d00 (nt!MiDemoteCombinedPte+0x0000000000000040)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  ffff84072b109230 -- (.cxr 0xffff84072b109230)
rax=fffffcfe7f3f9000 rbx=0000000000000001 rcx=ffffe6081579e580
rdx=fffffc8000014c88 rsi=fffffc8000014c88 rdi=fffff90000000000
rip=fffff8057b128d00 rsp=ffff84072b109c20 rbp=0000000000000000
 r8=8000000000000000  r9=0000000000000000 r10=fffffcfe7f3f9000
r11=fffffc8000000000 r12=ffffe608282a5da0 r13=ffff84072b10a350
r14=8000000000000000 r15=ffffe6081579e580
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!MiDemoteCombinedPte+0x40:
fffff805`7b128d00 498378f001      cmp     qword ptr [r8-10h],1 ds:002b:7fffffff`fffffff0=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXPNP: 1 (!blackboxpnp)


PROCESS_NAME:  NIMax.exe

READ_ADDRESS: unable to get nt!PspSessionIdBitmap
 ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p            0x%p                    %s

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

EXCEPTION_STR:  0xc0000005

STACK_TEXT:  
ffff8407`2b109c20 fffff805`7b127c49     : ffffe608`282a5da0 ffffe608`1579e580 ffff8407`2b10a250 ffff8407`2b10a350 : nt!MiDemoteCombinedPte+0x40
ffff8407`2b109cf0 fffff805`7b12cc7a     : 00000000`00000000 fffffc80`00000000 fffffc80`00014c88 00000000`00000000 : nt!MiAgePte+0x3b9
ffff8407`2b109d80 fffff805`7b12c775     : ffff8407`2b10a350 00000000`00000000 00000000`00000000 ffff8407`00000000 : nt!MiWalkPageTablesRecursively+0x133a
ffff8407`2b109e50 fffff805`7b12c775     : ffff8407`2b10a350 00000000`00000000 00000000`00000001 fffff805`7b26b41f : nt!MiWalkPageTablesRecursively+0xe35
ffff8407`2b109f20 fffff805`7b12c775     : ffff8407`2b10a350 00000000`00000000 00000000`00000002 fffff805`00000000 : nt!MiWalkPageTablesRecursively+0xe35
ffff8407`2b109ff0 fffff805`7b12b5da     : ffff8407`2b10a350 ffffe608`00000000 ffff8407`00000003 fffff805`7b40204d : nt!MiWalkPageTablesRecursively+0xe35
ffff8407`2b10a0c0 fffff805`7b12ac9e     : ffff8407`2b10a350 ffffe608`00000002 ffffe608`00000000 00000000`00000000 : nt!MiWalkPageTables+0x1da
ffff8407`2b10a1c0 fffff805`7b12a425     : ffffe608`18c5c080 fffff805`00000000 03830dfb`00000400 00000000`00000000 : nt!MiAgeWorkingSet+0x38e
ffff8407`2b10a6d0 fffff805`7b129be5     : 00000000`00000000 ffff8407`2b10a980 ffff8407`2b10a8b0 00000000`00000000 : nt!MiTrimOrAgeWorkingSet+0x3e5
ffff8407`2b10a7b0 fffff805`7b1d70c2     : fffff805`00000003 00000000`00000000 fffff805`7b4f3780 ffffe608`056430f0 : nt!MiProcessWorkingSets+0x255
ffff8407`2b10a960 fffff805`7b237eb7     : 00000000`00000003 00000000`00000003 00000000`ffffffff 00000000`00000001 : nt!MiWorkingSetManager+0xaa
ffff8407`2b10aa20 fffff805`7b1bca85     : ffffe608`0579c040 00000000`00000080 fffff805`7b237d70 00000000`00000000 : nt!KeBalanceSetManager+0x147
ffff8407`2b10ab10 fffff805`7b2799fc     : ffffa900`c9c40180 ffffe608`0579c040 fffff805`7b1bca30 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff8407`2b10ab60 00000000`00000000     : ffff8407`2b10b000 ffff8407`2b104000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x1c


SYMBOL_NAME:  nt!MiDemoteCombinedPte+40

MODULE_NAME: nt

STACK_COMMAND:  .cxr 0xffff84072b109230 ; kb

IMAGE_NAME:  ntkrnlmp.exe

BUCKET_ID_FUNC_OFFSET:  40

FAILURE_BUCKET_ID:  AV_nt!MiDemoteCombinedPte

OS_VERSION:  10.0.17763.1

BUILDLAB_STR:  rs5_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {c577c73b-79a7-0c44-6c62-58e1d697b6d8}

Followup:     MachineOwner
---------
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.