windows系统启动蓝屏。使用windbg分析后,交给AI进行分析,AI分析完后定位是360Box64.sys引起的。
分析代码如下:
nt!KeBugCheckEx:
fffff805`2ac1e230 48894c2408 mov qword ptr [rsp+8],rcx ss:ffffcf8d`c574d620=0000000000000050
15: kd> !analyze -v
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
................................................................
................................................................
.............................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000031`b9909018). Type ".hh dbgerr001" for details
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffaf8bfe1f9038, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the processor decided the fault was due to a corrupted PTE.
bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
- ARM64: bit 1 is set if the fault was due to a write, clear if a read.
bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff8052eea8d3d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for 360Box64.sys
*** WARNING: Check Image - Checksum mismatch - Dump: 0x204147, File: 0x20476f - C:\ProgramData\Dbg\sym\BTHport.sys\BD905E87202000\BTHport.sys
KEY_VALUES_STRING: 1
Key : AV.PTE
Value: Invalid
Key : AV.Page.Virtual
Value: 0xffffaf8bfe1f0000
Key : AV.Type
Value: Read
Key : Analysis.CPU.mSec
Value: 625
Key : Analysis.Elapsed.mSec
Value: 70862
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 1
Key : Analysis.IO.Write.Mb
Value: 4
Key : Analysis.Init.CPU.mSec
Value: 328
Key : Analysis.Init.Elapsed.mSec
Value: 97662
Key : Analysis.Memory.CommitPeak.Mb
Value: 127
Key : Analysis.Version.DbgEng
Value: 10.0.29547.1002
Key : Analysis.Version.Description
Value: 10.2602.27.2 amd64fre
Key : Analysis.Version.Ext
Value: 1.2602.27.2
Key : Bugcheck.Code.LegacyAPI
Value: 0x50
Key : Bugcheck.Code.TargetModel
Value: 0x50
Key : Dump.Attributes.AsUlong
Value: 0x1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0x0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: AV_luafv!LuafvGenerateFileName
Key : Failure.Exception.IP.Address
Value: 0xfffff8052eea8d3d
Key : Failure.Exception.IP.Module
Value: Ntfs
Key : Failure.Exception.IP.Offset
Value: 0x8d3d
Key : Failure.Hash
Value: {abf5ecf5-4c01-6e43-b3ba-860d3b4dc133}
Key : Faulting.IP.Type
Value: Paged
Key : WER.System.BIOSRevision
Value: 1.30.0.0
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffaf8bfe1f9038
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8052eea8d3d
BUGCHECK_P4: 0
FILE_IN_CAB: 071026-12625-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
FAULTING_THREAD: ffff88842c0de080
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffaf8bfe1f9038
READ_ADDRESS: fffff8052b51d470: Unable to get MiVisibleState
ffffaf8bfe1f9038
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1 (!blackboxwinlogon) (!blackboxwinlogonnotify)
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: IntelGraphicsS
IP_IN_PAGED_CODE:
Ntfs!NtfsInitializeIrpContextInternal+9d
fffff805`2eea8d3d 4839a9b8000000 cmp qword ptr [rcx+0B8h],rbp
STACK_TEXT:
ffffcf8d`c574d618 fffff805`2ac867e8 : 00000000`00000050 ffffaf8b`fe1f9038 00000000`00000000 ffffcf8d`c574d840 : nt!KeBugCheckEx
ffffcf8d`c574d620 fffff805`2aa355ec : 00000000`00000000 00000000`00000000 00000000`00000000 ffffaf8b`fe1f9038 : nt!MiSystemFault+0x225768
ffffcf8d`c574d720 fffff805`2ac2f47e : ffff8884`00100000 ffff8884`29b19a30 00000000`00000000 ffffcf8d`c574d888 : nt!MmAccessFault+0x29c
ffffcf8d`c574d840 fffff805`2eea8d3d : ffffaf8b`ff5e5780 fffff805`2aaad654 00000000`00020f30 fffff805`2eea8b78 : nt!KiPageFault+0x37e
ffffcf8d`c574d9d0 fffff805`2ef7d9a2 : ffffcf8d`c574db70 ffffcf8d`c574db70 ffff8884`2c0478b0 00000000`00000001 : Ntfs!NtfsInitializeIrpContextInternal+0x9d
ffffcf8d`c574da20 fffff805`2ef7d2c0 : ffffcf8d`c574db70 ffff8884`2b89b1a0 ffff8884`2b89b1a0 00000000`00000000 : Ntfs!NtfsFsdDispatchSwitch+0xa2
ffffcf8d`c574db50 fffff805`2aa2ef65 : 00000000`00000000 fffff805`2ab32871 00000000`0000000e ffffaf8b`fe9abc04 : Ntfs!NtfsFsdDispatchWait+0x40
ffffcf8d`c574de20 fffff805`2df60f8d : ffff8884`2bdc6130 ffff8884`2bdc6130 ffff8884`2b89b1a0 00000000`000000fc : nt!IofCallDriver+0x55
ffffcf8d`c574de60 fffff805`2df619e5 : ffff8884`2bb182a0 ffff8884`2bdc6130 00000000`00000000 00000000`00000000 : FLTMGR!FltpGetFileName+0x1cd
ffffcf8d`c574df00 fffff805`2df61796 : ffff8884`2bedad48 fffff805`2aa311e0 ffffaf8b`fe1f8fc8 00000000`00000000 : FLTMGR!FltpGetOpenedFileName+0x19
ffffcf8d`c574df30 fffff805`2df61386 : ffff8884`2bedad00 ffff8884`2bdc6130 ffff8884`2bedadb3 fffff805`2aa2e965 : FLTMGR!FltpCallOpenedFileNameHandler+0x152
ffffcf8d`c574df80 fffff805`2df5f364 : ffff8884`2bdc6130 ffff8884`02dee2c0 ffff8884`2bedad44 ffff8884`2bedadb3 : FLTMGR!FltpGetNormalizedFileNameWorker+0x26
ffffcf8d`c574dfd0 fffff805`2df28d68 : ffffcf8d`c5750000 ffffcf8d`c5749000 00000000`00000000 ffff8884`2c0478b0 : FLTMGR!FltpCreateFileNameInformation+0x164
ffffcf8d`c574e040 fffff805`2df61ce8 : ffff8884`00008000 ffff8884`2bedad40 00000000`00000000 ffffaf8b`ffae55b8 : FLTMGR!FltpGetFileNameInformation+0x5e8
ffffcf8d`c574e0e0 fffff805`5a16194c : ffff8884`2bdc6020 ffff8884`2c0478b0 00000000`00000000 ffff8884`02c42d60 : FLTMGR!FltGetFileNameInformationUnsafe+0x98
ffffcf8d`c574e160 fffff805`2df616b4 : ffff8884`2bedad48 00000000`00000000 ffff8884`2bdc6020 00000000`00000000 : luafv!LuafvGenerateFileName+0xec
ffffcf8d`c574e190 fffff805`2df61386 : ffff8884`2bedad00 ffff8884`2bdc6020 ffff8884`2bedadb3 fffff805`2aa2e965 : FLTMGR!FltpCallOpenedFileNameHandler+0x70
ffffcf8d`c574e1e0 fffff805`2df5f364 : ffff8884`2bdc6020 ffff8884`02dee2c0 ffff8884`2bedad44 ffff8884`2bedadb3 : FLTMGR!FltpGetNormalizedFileNameWorker+0x26
ffffcf8d`c574e230 fffff805`2df28d68 : ffffcf8d`c5750000 ffffcf8d`c5749000 00000000`00000000 ffff8884`2c0478b0 : FLTMGR!FltpCreateFileNameInformation+0x164
ffffcf8d`c574e2a0 fffff805`2df61ce8 : 00000000`00008000 ffff8884`2bedad40 ffff8884`298be030 ffffaf8b`ffae55b8 : FLTMGR!FltpGetFileNameInformation+0x5e8
ffffcf8d`c574e340 fffff805`433f5655 : 00000000`00000000 00000000`00000000 00000000`00000000 ffff8883`ff556040 : FLTMGR!FltGetFileNameInformationUnsafe+0x98
ffffcf8d`c574e3c0 00000000`00000000 : 00000000`00000000 00000000`00000000 ffff8883`ff556040 00000000`00000000 : 360Box64+0x25655
SYMBOL_NAME: luafv!LuafvGenerateFileName+ec
MODULE_NAME: luafv
IMAGE_NAME: luafv.sys
IMAGE_VERSION: 10.0.22621.6630
STACK_COMMAND: .process /r /p 0xffff88842be39080; .thread /r /p 0xffff88842c0de080 ; kb
BUCKET_ID_FUNC_OFFSET: ec
FAILURE_BUCKET_ID: AV_luafv!LuafvGenerateFileName
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {abf5ecf5-4c01-6e43-b3ba-860d3b4dc133}
Followup: MachineOwner
---------
|
|
|
|
|
|
评论
直达楼层