Microsoft (R) Windows Debugger Version 10.0.22549.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\fancl\Desktop\032022-21468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff801`0d200000 PsLoadedModuleList = 0xfffff801`0de2a2d0
Debug session time: Sun Mar 20 20:22:59.008 2022 (UTC + 8:00)
System Uptime: 0 days 0:38:51.705
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff801`0d5f7620 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff583`fa69e340=000000000000007e
13: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common BugCheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8010d408d0c, The address that the exception occurred at
Arg3: fffff583fa69f338, Exception Record Address
Arg4: fffff583fa69eb70, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 3687
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 408457
Key : Analysis.Init.CPU.mSec
Value: 296
Key : Analysis.Init.Elapsed.mSec
Value: 13349
Key : Analysis.Memory.CommitPeak.Mb
Value: 102
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 032022-21468-01.dmp
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8010d408d0c
BUGCHECK_P3: fffff583fa69f338
BUGCHECK_P4: fffff583fa69eb70
EXCEPTION_RECORD: fffff583fa69f338 -- (.exr 0xfffff583fa69f338)
ExceptionAddress: fffff8010d408d0c (nt!ExAcquireResourceExclusiveLite+0x000000000000001c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000c1a
Attempt to read from address 0000000000000c1a
CONTEXT: fffff583fa69eb70 -- (.cxr 0xfffff583fa69eb70)
rax=0000000000000702 rbx=0000000000000c00 rcx=0000000000000c01
rdx=ffffbc8f9788d101 rsi=ffffce00f59032c0 rdi=fffff583fa69f800
rip=fffff8010d408d0c rsp=fffff583fa69f570 rbp=fffff80111048ce0
r8=ffffbc8f9788d180 r9=fffff583fa69f784 r10=fffff8010d408cf0
r11=fffff583fa69f748 r12=fffff583fa69f784 r13=0000000000000000
r14=0000000000000001 r15=ffffbc8f9788d100
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050202
nt!ExAcquireResourceExclusiveLite+0x1c:
fffff801`0d408d0c 0fb7431a movzx eax,word ptr [rbx+1Ah] ds:002b:00000000`00000c1a=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff8010defa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000c1a
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p 0x%p %s
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000c1a
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffff583`fa69f570 fffff801`110291f8 : 00000000`00000000 fffff801`11048ce0 ffffce00`f69f7810 00000000`00000000 : nt!ExAcquireResourceExclusiveLite+0x1c
fffff583`fa69f600 fffff801`1104901c : fffff583`fa69f800 ffffbc8f`9788d180 ffffce00`f59032c0 fffff583`fa69f784 : Ntfs!NtfsFlushVolumeFlushSingleFcb+0xc8
fffff583`fa69f750 fffff801`0d4b86d5 : ffffbc8f`978e72c0 ffffbc8f`978e72c0 ffffbc8f`908a2cc0 00000000`00000000 : Ntfs!NtfsFlushVolumeMultiThreadFcbWalkerWorker+0x33c
fffff583`fa69fb30 fffff801`0d555a15 : ffffbc8f`978e72c0 00000000`00000080 ffffbc8f`908d3040 000fe067`bcbbbdff : nt!ExpWorkerThread+0x105
fffff583`fa69fbd0 fffff801`0d5fec78 : fffff801`09f32180 ffffbc8f`978e72c0 fffff801`0d5559c0 af3226c3`4399c633 : nt!PspSystemThreadStartup+0x55
fffff583`fa69fc20 00000000`00000000 : fffff583`fa6a0000 fffff583`fa699000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!ExAcquireResourceExclusiveLite+1c
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1586
STACK_COMMAND: .cxr 0xfffff583fa69eb70 ; kb
BUCKET_ID_FUNC_OFFSET: 1c
FAILURE_BUCKET_ID: AV_nt!ExAcquireResourceExclusiveLite
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {d1328bfd-2b11-7819-3ef8-5888a1d52bca}
Followup: MachineOwner
---------
13: kd> .exr 0xfffff583fa69f338
ExceptionAddress: fffff8010d408d0c (nt!ExAcquireResourceExclusiveLite+0x000000000000001c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000c1a
Attempt to read from address 0000000000000c1a
|
|
|
|
评论
直达楼层