Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`04816000 PsLoadedModuleList = 0xfffff800`04a5be90
Debug session time: Sun Nov 10 22:33:25.194 2013 (GMT+8)
System Uptime: 0 days 0:00:06.990
Loading Kernel Symbols
...............................................................
..........
Loading User Symbols
The context is partially valid. Only x86 user-mode context is available.
The wow64exts extension must be loaded to access 32-bit state.
.load wow64exts will do this if you haven't loaded it already.
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7E, {ffffffffc0000005, fffff80004b92060, fffff880009a8d38, fffff880009a8590}
Probably caused by : Unknown_Image ( nt!ObOpenObjectByName+410 )
Followup: MachineOwner
---------
16.0: kd:x86> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80004b92060, The address that the exception occurred at
Arg3: fffff880009a8d38, Exception Record Address
Arg4: fffff880009a8590, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
FAULTING_IP:
nt!ObOpenObjectByName+410
04b92060 48 dec eax
EXCEPTION_RECORD: fffff880009a8d38 -- (.exr 0xfffff880009a8d38)
ExceptionAddress: 0000000000000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 79241312
Parameter[0]: fffffffffffff800
Parameter[1]: 0000000000000002
Parameter[2]: 0000000000000000
Parameter[3]: 0000000000000001
Parameter[4]: 0000000000000000
Parameter[5]: 0000000000000000
Parameter[6]: 0000000000000000
Parameter[7]: 0000000000000001
Parameter[8]: 0000000000000000
Parameter[9]: 0000000000000000
Parameter[10]: 0000000000000000
Parameter[11]: ffffffffffffffff
Parameter[12]: 000000000000007f
Parameter[13]: 0000000000000000
Parameter[14]: 0000000000000000
Attempt to execute non-executable address 0000000000000002
CONTEXT: fffff880009a8590 -- (.cxr 0xfffff880009a8590)
Unable to read context, NTSTATUS 0xC0000147
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x7E
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000
STACK_TEXT:
00000000 00000000 00000000 00000000 00000000 0x0
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!ObOpenObjectByName+410
04b92060 48 dec eax
SYMBOL_NAME: nt!ObOpenObjectByName+410
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: INVALID_KERNEL_CONTEXT
MODULE_NAME: Unknown_Module
Followup: MachineOwner
---------
16.0: kd:x86> lmvm Unknown_Module
start end module name
开始以为是内存问题，但换过内存也是这样。
win7 X64 凡是冷启动就蓝屏7E，不知道是什么原因，请高手帮忙分析一下蓝屏DUMP，感谢
