积极答复者
win7蓝屏 4天内出现2次 求助！！！
问题
-
第一次：
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" /><EventID Qualifiers="16384">1001</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime="2012-05-30T13:41:57.000000000Z" /><EventRecordID>10661</EventRecordID><Correlation /><Execution ProcessID="0" ThreadID="0" /><Channel>System</Channel><Computer>AShawn-PC</Computer><Security /></System><Data Name="param1">0x00000050 (0xfffff6a0000f1478, 0x0000000000000000, 0xfffff800042b2b6b, 0x0000000000000005)</Data><Data Name="param2">C:\Windows\MEMORY.DMP</Data><Data Name="param3">053012-18486-01</Data></EventData></Event>
第二次：
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" /><EventID Qualifiers="16384">1001</EventID><Version>0</Version><Level>2</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime="2012-06-03T12:12:35.000000000Z" /><EventRecordID>11923</EventRecordID><Correlation /><Execution ProcessID="0" ThreadID="0" /><Channel>System</Channel><Computer>AShawn-PC</Computer><Security /></System><Data Name="param1">0x00000050 (0xffffb900c31a3080, 0x0000000000000000, 0xfffff960000bc6d6, 0x0000000000000007)</Data><Data Name="param2">C:\Windows\MEMORY.DMP</Data><Data Name="param3">060312-19468-01</Data></EventData></Event>求高手帮分析一下是不是硬件有问题
答案
-
0x00000050 错误可能原因较多，比较常见的是软件兼容问题。请在“启动与故障恢复”选项中将“完全内存转储”修改为“小内存转储（128KB）”。如果再次蓝屏，请提供一下 Windows\minidump 中生成的 .DMP文件进行分析。--Alexis Zhanghttp://mvp.support.microsoft.com/profile/jiehttp://blogs.itecn.net/blogs/alexis推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。本帖是回复帖，原帖作者是楼上的 "foresight1111"求高手帮分析一下是不是硬件有问题
- 已标记为答案 foresight1111 2012年6月6日 12:22
全部回复
-
0x00000050 错误可能原因较多，比较常见的是软件兼容问题。请在“启动与故障恢复”选项中将“完全内存转储”修改为“小内存转储（128KB）”。如果再次蓝屏，请提供一下 Windows\minidump 中生成的 .DMP文件进行分析。--Alexis Zhanghttp://mvp.support.microsoft.com/profile/jiehttp://blogs.itecn.net/blogs/alexis推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。本帖是回复帖，原帖作者是楼上的 "foresight1111"求高手帮分析一下是不是硬件有问题
- 已标记为答案 foresight1111 2012年6月6日 12:22
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\060612-19110-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`04a00000 PsLoadedModuleList = 0xfffff800`04c44670
Debug session time: Wed Jun 6 19:54:23.432 2012 (UTC + 8:00)
System Uptime: 0 days 0:35:24.728
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff96000105960, fffff880053d1f60, 0}
Probably caused by : win32k.sys ( win32k!InternalRebuildHwndListForIMEClass+94 )
Followup: MachineOwner------------------------------------------------------------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\060312-19468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`04a5a000 PsLoadedModuleList = 0xfffff800`04c9e670
Debug session time: Sun Jun 3 20:10:50.036 2012 (UTC + 8:00)
System Uptime: 0 days 5:36:27.420
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffb900c31a3080, 0, fffff960000bc6d6, 7}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!RFONTOBJ::bGetGlyphMetricsPlus+216 )
Followup: MachineOwner-----------------------------------------------------------------------------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\053012-18486-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`0424a000 PsLoadedModuleList = 0xfffff800`0448e670
Debug session time: Wed May 30 21:40:10.505 2012 (UTC + 8:00)
System Uptime: 0 days 2:13:56.800
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff6a0000f1478, 0, fffff800042b2b6b, 5}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1d1 )
Followup: MachineOwner -
0x0000003B 错误表示一个从没有权限的代码传送至有权限的代码时遇到了例外的错误，一般是软件兼容性问题引起页面库占用过多，或者用户模式的显示驱动传送了不正确的代码。结合之前出现的 0x00000050 错误，问题应该还是与软件兼容性或内存稳定性有关。你经常在做什么操作时容易引起此问题？--Alexis Zhanghttp://mvp.support.microsoft.com/profile/jiehttp://blogs.itecn.net/blogs/alexis推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。本帖是回复帖，原帖作者是楼上的 "foresight1111"BugCheck 3B, {c0000005, fffff96000105960, fffff880053d1f60, 0}Probably caused by : win32k.sys ( win32k!InternalRebuildHwndListForIMEClass+94 )
-
刚才用win7自带检测软件2条内存检测都通过了，我也没方向了。
我又看了一下系统日志，发现每次蓝屏之前都会有一个kernel-power的关键错误，如下：
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" /><EventID>41</EventID><Version>2</Version><Level>1</Level><Task>63</Task><Opcode>0</Opcode><Keywords>0x8000000000000002</Keywords><TimeCreated SystemTime="2012-06-06T11:55:47.612014300Z" /><EventRecordID>12783</EventRecordID><Correlation /><Execution ProcessID="4" ThreadID="8" /><Channel>System</Channel><Computer>AShawn-PC</Computer><Security UserID="S-1-5-18" /></System><Data Name="BugcheckCode">59</Data><Data Name="BugcheckParameter1">0xc0000005</Data><Data Name="BugcheckParameter2">0xfffff96000105960</Data><Data Name="BugcheckParameter3">0xfffff880053d1f60</Data><Data Name="BugcheckParameter4">0x0</Data><Data Name="SleepInProgress">false</Data><Data Name="PowerButtonTimestamp">0</Data></EventData></Event>
--------------------------------------------------------------------------------------------------------------
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" /><EventID>41</EventID><Version>2</Version><Level>1</Level><Task>63</Task><Opcode>0</Opcode><Keywords>0x8000000000000002</Keywords><TimeCreated SystemTime="2012-06-03T12:12:16.053609800Z" /><EventRecordID>11897</EventRecordID><Correlation /><Execution ProcessID="4" ThreadID="8" /><Channel>System</Channel><Computer>AShawn-PC</Computer><Security UserID="S-1-5-18" /></System><Data Name="BugcheckCode">80</Data><Data Name="BugcheckParameter1">0xffffb900c31a3080</Data><Data Name="BugcheckParameter2">0x0</Data><Data Name="BugcheckParameter3">0xfffff960000bc6d6</Data><Data Name="BugcheckParameter4">0x7</Data><Data Name="SleepInProgress">false</Data><Data Name="PowerButtonTimestamp">0</Data></EventData></Event>
---------------------------------------------------------------------------------------------------------------------
日志名称: System
来源: Microsoft-Windows-Kernel-Power
日期: 2012/5/30 21:41:38
事件 ID: 41
任务类别: (63)
级别: 关键
关键字: (2)
用户: SYSTEM
计算机: AShawn-PC
描述:
系统在未首先正常关机的情况下重新启动。当系统停止响应、出现故障或意外断电时，会发生此错误。
事件 Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>2</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2012-05-30T13:41:38.226808300Z" />
<EventRecordID>10650</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>AShawn-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">80</Data>
<Data Name="BugcheckParameter1">0xfffff6a0000f1478</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0xfffff800042b2b6b</Data>
<Data Name="BugcheckParameter4">0x5</Data>
<Data Name="SleepInProgress">false</Data>
<Data Name="PowerButtonTimestamp">0</Data>
</EventData>
</Event>帮忙看一下，谢谢！
- 已编辑 foresight1111 2012年6月8日 6:36
-
你有在电源选项中设置任何自动待机、睡眠、休眠的电源选项吗？试一试取消所有自动电源操作，将电源方案修改为始终打开，看看是否还会蓝屏、还有此类日志生成。--Alexis Zhanghttp://mvp.support.microsoft.com/profile/jiehttp://blogs.itecn.net/blogs/alexis推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。本帖是回复帖，原帖作者是楼上的 "foresight1111"刚才用win7自带检测软件2条内存检测都通过了，我也没方向了。我又看了一下系统日志，发现每次蓝屏之前都会有一个kernel-power的关键错误，如下：
-
-
把电源里面的选项设置为始终打开不睡眠又一次出现蓝屏了
日志名称: System
来源: Microsoft-Windows-Kernel-Power
日期: 2012/6/12 21:25:38
事件 ID: 41
任务类别: (63)
级别: 关键
关键字: (2)
用户: SYSTEM
计算机: AShawn-PC
描述:
系统在未首先正常关机的情况下重新启动。当系统停止响应、出现故障或意外断电时，会发生此错误。
事件 Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>2</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2012-06-12T13:25:38.166006500Z" />
<EventRecordID>14792</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>AShawn-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">80</Data>
<Data Name="BugcheckParameter1">0xfffff6a00001a550</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0xfffff80004a86b6b</Data>
<Data Name="BugcheckParameter4">0x5</Data>
<Data Name="SleepInProgress">false</Data>
<Data Name="PowerButtonTimestamp">0</Data>
</EventData>
</Event>------------------------------------------------------------------------------------------------
错误还是0x00000050
我真的怀疑是内存问题，但是用检测工具测有没事，不知道为什么。
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\061212-18844-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`04a1e000 PsLoadedModuleList = 0xfffff800`04c62670
Debug session time: Tue Jun 12 21:23:29.519 2012 (UTC + 8:00)
System Uptime: 0 days 1:13:19.815
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff6a00001a550, 0, fffff80004a86b6b, 5}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1d1 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff6a00001a550, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80004a86b6b, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004ccc100
fffff6a00001a550
FAULTING_IP:
nt!MiAgeWorkingSet+1d1
fffff800`04a86b6b 488b19 mov rbx,qword ptr [rcx]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: Thunder5.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88004916680 -- (.trap 0xfffff88004916680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff6a00001a550
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80004a86b6b rsp=fffff88004916810 rbp=000000200001a550
r8=0000000000000001 r9=fffffa8008a273f8 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!MiAgeWorkingSet+0x1d1:
fffff800`04a86b6b 488b19 mov rbx,qword ptr [rcx] ds:fffff6a0`0001a550=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80004a43f1f to fffff80004a9d1c0
STACK_TEXT:
fffff880`04916518 fffff800`04a43f1f : 00000000`00000050 fffff6a0`0001a550 00000000`00000000 fffff880`04916680 : nt!KeBugCheckEx
fffff880`04916520 fffff800`04a9b2ee : 00000000`00000000 fffff6a0`0001a550 00000000`00001000 00000980`00000000 : nt! ?? ::FNODOBFM::`string'+0x43d51
fffff880`04916680 fffff800`04a86b6b : 00000003`00000000 9a900000`58e59867 00000000`00000000 00000000`000029a9 : nt!KiPageFault+0x16e
fffff880`04916810 fffff800`04b154f5 : fffffa80`08a273f8 fffff880`00000001 00000000`00000001 fffff880`04916a70 : nt!MiAgeWorkingSet+0x1d1
fffff880`049169c0 fffff800`04a87116 : 00000000`00001131 00000000`00000000 fffffa80`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x4cd46
fffff880`04916a40 fffff800`04a875cb : 00000000`00000008 fffff880`04916ad0 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`04916a90 fffff800`04d33e6a : fffffa80`071b3040 00000000`00000080 fffffa80`0718e9e0 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`04916c00 fffff800`04a8df06 : fffff880`009e9180 fffffa80`071b3040 fffff880`009f3fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`04916c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiAgeWorkingSet+1d1
fffff800`04a86b6b 488b19 mov rbx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiAgeWorkingSet+1d1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4f76721c
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiAgeWorkingSet+1d1
BUCKET_ID: X64_0x50_nt!MiAgeWorkingSet+1d1
Followup: MachineOwner
--------- -
这回蓝屏是在运行迅雷的时候出现的吗？之前的蓝屏是否也与运行迅雷有关？--Alexis Zhanghttp://mvp.support.microsoft.com/profile/jiehttp://blogs.itecn.net/blogs/alexis推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。本帖是回复帖，原帖作者是楼上的 "foresight1111"BugCheck 50, {fffff6a00001a550, 0, fffff80004a86b6b, 5}PROCESS_NAME: Thunder5.exe
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\060612-19110-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Inaccessible path: 'C:\MyCodesSymbols'
WARNING: Whitespace at start of path element
Symbol search path is: C:\MyCodesSymbols; SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`04a00000 PsLoadedModuleList = 0xfffff800`04c44670
Debug session time: Wed Jun 6 19:54:23.432 2012 (UTC + 8:00)
System Uptime: 0 days 0:35:24.728
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff96000105960, fffff880053d1f60, 0}
Probably caused by : win32k.sys ( win32k!InternalRebuildHwndListForIMEClass+94 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000105960, Address of the instruction which caused the bugcheck
Arg3: fffff880053d1f60, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
FAULTING_IP:
win32k!InternalRebuildHwndListForIMEClass+94
fffff960`00105960 498b8398000000 mov rax,qword ptr [r11+98h]
CONTEXT: fffff880053d1f60 -- (.cxr 0xfffff880053d1f60)
rax=fffff900c0894790 rbx=fffff900c2ff97e0 rcx=000000000000c026
rdx=0000000000000001 rsi=fffff900c2acc3e0 rdi=fffff900c2ff97e0
rip=fffff96000105960 rsp=fffff880053d2940 rbp=fffff900c089d610
r8=fffff900c0580a70 r9=0000000000000012 r10=fffff880051e8cc8
r11=0000400000000000 r12=fffff900c2ff93e0 r13=fffff900c2acc3e0
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210206
win32k!InternalRebuildHwndListForIMEClass+0x94:
fffff960`00105960 498b8398000000 mov rax,qword ptr [r11+98h] ds:002b:00004000`00000098=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: G10-Editor.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff96000105960
STACK_TEXT:
fffff880`053d2940 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!InternalRebuildHwndListForIMEClass+0x94
FOLLOWUP_IP:
win32k!InternalRebuildHwndListForIMEClass+94
fffff960`00105960 498b8398000000 mov rax,qword ptr [r11+98h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!InternalRebuildHwndListForIMEClass+94
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f76756e
STACK_COMMAND: .cxr 0xfffff880053d1f60 ; kb
FAILURE_BUCKET_ID: X64_0x3B_win32k!InternalRebuildHwndListForIMEClass+94
BUCKET_ID: X64_0x3B_win32k!InternalRebuildHwndListForIMEClass+94
Followup: MachineOwner
---------
WARNING: Inaccessible path: 'C:\MyCodesSymbols'
WARNING: Whitespace at start of path element
WARNING: Inaccessible path: '“C:\MyCodesSymbols'
Loading Dump File [C:\Windows\Minidump\060312-19468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Inaccessible path: 'C:\MyCodesSymbols'
WARNING: Whitespace at start of path element
WARNING: Inaccessible path: '“C:\MyCodesSymbols'
Symbol search path is: C:\MyCodesSymbols; SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols;“C:\MyCodesSymbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`04a5a000 PsLoadedModuleList = 0xfffff800`04c9e670
Debug session time: Sun Jun 3 20:10:50.036 2012 (UTC + 8:00)
System Uptime: 0 days 5:36:27.420
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffb900c31a3080, 0, fffff960000bc6d6, 7}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!RFONTOBJ::bGetGlyphMetricsPlus+216 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffb900c31a3080, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff960000bc6d6, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004d08100
ffffb900c31a3080
FAULTING_IP:
win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
fffff960`000bc6d6 48833e00 cmp qword ptr [rsi],0
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88002e9fb20 -- (.trap 0xfffff88002e9fb20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c4980020 rbx=0000000000000000 rcx=fffff900c2ea5bb0
rdx=000000000000000a rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000bc6d6 rsp=fffff88002e9fcb0 rbp=fffff900c0081168
r8=fffff900c0081028 r9=fffff900c0081158 r10=0000000000000002
r11=fffff88002e9fdb8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x216:
fffff960`000bc6d6 48833e00 cmp qword ptr [rsi],0 ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80004a7fea7 to fffff80004ad91c0
STACK_TEXT:
fffff880`02e9f9b8 fffff800`04a7fea7 : 00000000`00000050 ffffb900`c31a3080 00000000`00000000 fffff880`02e9fb20 : nt!KeBugCheckEx
fffff880`02e9f9c0 fffff800`04ad72ee : 00000000`00000000 ffffb900`c31a3080 3fe00000`00000000 fffff880`02e9fef0 : nt! ?? ::FNODOBFM::`string'+0x43cd1
fffff880`02e9fb20 fffff960`000bc6d6 : 00000000`00000004 00000000`00000000 fffff900`c0213638 fffff960`00285f1c : nt!KiPageFault+0x16e
fffff880`02e9fcb0 fffff960`00254e41 : fffff900`c0081158 fffff900`c0081028 fffff880`02e9fef0 00000000`00000000 : win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x216
fffff880`02e9fd30 fffff960`000bbc6f : 00000000`00000001 fffff880`02ea02d0 00000000`00000000 fffff900`c00c0010 : win32k!ESTROBJ::vCharPos_H1+0x81
fffff880`02e9fdc0 fffff960`00092e5a : fffff880`41800000 00000000`00000000 00000000`0000000a fffff880`02ea02d0 : win32k!ESTROBJ::vInit+0x27f
fffff880`02e9fe50 fffff960`000922db : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!GreExtTextOutWLocked+0xb12
fffff880`02ea0270 fffff960`0025d709 : 00000000`00000000 fffff880`02ea05e0 fffff900`c0081158 00000000`00000001 : win32k!GreExtTextOutWInternal+0x10f
fffff880`02ea0320 fffff800`04ad8453 : fffff900`c319eca0 00000000`00000000 0000000d`00000011 00000005`00000004 : win32k!NtGdiExtTextOutW+0x341
fffff880`02ea04f0 000007fe`fe893dea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0253dea8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fe893dea
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
fffff960`000bc6d6 48833e00 cmp qword ptr [rsi],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f76756e
FAILURE_BUCKET_ID: X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
BUCKET_ID: X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
Followup: MachineOwner
---------Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004d08100
ffffb900c31a3080
FAULTING_IP:
win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
fffff960`000bc6d6 48833e00 cmp qword ptr [rsi],0
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88002e9fb20 -- <link cmd=".trap 0xfffff88002e9fb20">(.trap 0xfffff88002e9fb20)</exec>
NOTE: The trap frame does not contain all registers.
<col fg="emphfg" bg="emphbg">Some register values may be zeroed or incorrect.</col>
rax=fffff900c4980020 rbx=0000000000000000 rcx=fffff900c2ea5bb0
rdx=000000000000000a rsi=0000000000000000 rdi=0000000000000000
rip=fffff960000bc6d6 rsp=fffff88002e9fcb0 rbp=fffff900c0081168
r8=fffff900c0081028 r9=fffff900c0081158 r10=0000000000000002
r11=fffff88002e9fdb8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x216:
fffff960`000bc6d6 48833e00 cmp qword ptr [rsi],0 ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80004a7fea7 to fffff80004ad91c0
STACK_TEXT:
fffff880`02e9f9b8 fffff800`04a7fea7 : 00000000`00000050 ffffb900`c31a3080 00000000`00000000 fffff880`02e9fb20 : nt!KeBugCheckEx
fffff880`02e9f9c0 fffff800`04ad72ee : 00000000`00000000 ffffb900`c31a3080 3fe00000`00000000 fffff880`02e9fef0 : nt! ?? ::FNODOBFM::`string'+0x43cd1
fffff880`02e9fb20 fffff960`000bc6d6 : 00000000`00000004 00000000`00000000 fffff900`c0213638 fffff960`00285f1c : nt!KiPageFault+0x16e
fffff880`02e9fcb0 fffff960`00254e41 : fffff900`c0081158 fffff900`c0081028 fffff880`02e9fef0 00000000`00000000 : win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x216
fffff880`02e9fd30 fffff960`000bbc6f : 00000000`00000001 fffff880`02ea02d0 00000000`00000000 fffff900`c00c0010 : win32k!ESTROBJ::vCharPos_H1+0x81
fffff880`02e9fdc0 fffff960`00092e5a : fffff880`41800000 00000000`00000000 00000000`0000000a fffff880`02ea02d0 : win32k!ESTROBJ::vInit+0x27f
fffff880`02e9fe50 fffff960`000922db : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!GreExtTextOutWLocked+0xb12
fffff880`02ea0270 fffff960`0025d709 : 00000000`00000000 fffff880`02ea05e0 fffff900`c0081158 00000000`00000001 : win32k!GreExtTextOutWInternal+0x10f
fffff880`02ea0320 fffff800`04ad8453 : fffff900`c319eca0 00000000`00000000 0000000d`00000011 00000005`00000004 : win32k!NtGdiExtTextOutW+0x341
fffff880`02ea04f0 000007fe`fe893dea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0253dea8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fe893dea
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
fffff960`000bc6d6 48833e00 cmp qword ptr [rsi],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: <link cmd="lmvm win32k">win32k</exec>
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f76756e
FAILURE_BUCKET_ID: X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
BUCKET_ID: X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
Followup: MachineOwner
---------
Loading Dump File [C:\Windows\Minidump\053012-18486-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Inaccessible path: 'C:\MyCodesSymbols'
WARNING: Whitespace at start of path element
WARNING: Inaccessible path: '“C:\MyCodesSymbols'
Symbol search path is: C:\MyCodesSymbols; SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols;“C:\MyCodesSymbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`0424a000 PsLoadedModuleList = 0xfffff800`0448e670
Debug session time: Wed May 30 21:40:10.505 2012 (UTC + 8:00)
System Uptime: 0 days 2:13:56.800
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff6a0000f1478, 0, fffff800042b2b6b, 5}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1d1 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff6a0000f1478, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800042b2b6b, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800044f8100
fffff6a0000f1478
FAULTING_IP:
nt!MiAgeWorkingSet+1d1
fffff800`042b2b6b 488b19 mov rbx,qword ptr [rcx]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88004916680 -- (.trap 0xfffff88004916680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff6a0000f1478
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800042b2b6b rsp=fffff88004916810 rbp=00000020000f1478
r8=0000000000000001 r9=fffffa80076bfb28 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!MiAgeWorkingSet+0x1d1:
fffff800`042b2b6b 488b19 mov rbx,qword ptr [rcx] ds:fffff6a0`000f1478=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000426ff1f to fffff800042c91c0
STACK_TEXT:
fffff880`04916518 fffff800`0426ff1f : 00000000`00000050 fffff6a0`000f1478 00000000`00000000 fffff880`04916680 : nt!KeBugCheckEx
fffff880`04916520 fffff800`042c72ee : 00000000`00000000 fffff6a0`000f1478 00000000`00000000 00000980`00000000 : nt! ?? ::FNODOBFM::`string'+0x43d51
fffff880`04916680 fffff800`042b2b6b : 00000003`00000000 7a900000`09ddf867 00000000`00000000 00000000`00015fa9 : nt!KiPageFault+0x16e
fffff880`04916810 fffff800`043414f5 : fffffa80`076bfb28 fffff800`00000001 00000000`00000001 fffff880`04916a70 : nt!MiAgeWorkingSet+0x1d1
fffff880`049169c0 fffff800`042b3116 : 00000000`00001f66 00000000`00000000 fffffa80`00000000 00000000`00000005 : nt! ?? ::FNODOBFM::`string'+0x4cd46
fffff880`04916a40 fffff800`042b35cb : 00000000`00000008 fffff880`04916ad0 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`04916a90 fffff800`0455fe6a : fffffa80`071b3040 00000000`00000080 fffffa80`0718e9e0 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`04916c00 fffff800`042b9f06 : fffff880`009e9180 fffffa80`071b3040 fffff880`009f3fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`04916c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiAgeWorkingSet+1d1
fffff800`042b2b6b 488b19 mov rbx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiAgeWorkingSet+1d1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4f76721c
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiAgeWorkingSet+1d1
BUCKET_ID: X64_0x50_nt!MiAgeWorkingSet+1d1
Followup: MachineOwner
---------
-
老大，6月30日凌晨又来了一次，麻烦帮我看看一下吧，谢谢啦！
帮我看看到底是硬件问题还是系统兼容问题啊。。。
---------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\063012-24944-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Inaccessible path: 'C:\MyCodesSymbols'
WARNING: Whitespace at start of path element
Symbol search path is: C:\MyCodesSymbols; SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
Machine Name:
Kernel base = 0xfffff800`04a0a000 PsLoadedModuleList = 0xfffff800`04c4e670
Debug session time: Sat Jun 30 00:37:51.505 2012 (UTC + 8:00)
System Uptime: 0 days 5:30:07.800
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffb400045661b, 0, fffff80004a72d7f, 7}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+425 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffb400045661b, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80004a72d7f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004cb8100
fffffb400045661b
FAULTING_IP:
nt!MiAgeWorkingSet+425
fffff800`04a72d7f 410fb65e1b movzx ebx,byte ptr [r14+1Bh]
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff88004916680 -- (.trap 0xfffff88004916680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000058000000000 rbx=0000000000000000 rcx=fffff6fc50065058
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80004a72d7f rsp=fffff88004916810 rbp=007ffffc5006505e
r8=0000000000000001 r9=fffff80004cbb600 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiAgeWorkingSet+0x425:
fffff800`04a72d7f 410fb65e1b movzx ebx,byte ptr [r14+1Bh] ds:00000000`0000001b=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80004a2fe97 to fffff80004a891c0
STACK_TEXT:
fffff880`04916518 fffff800`04a2fe97 : 00000000`00000050 fffffb40`0045661b 00000000`00000000 fffff880`04916680 : nt!KeBugCheckEx
fffff880`04916520 fffff800`04a872ee : 00000000`00000000 fffffb40`0045661b 00000000`00001000 fb204000`17220943 : nt! ?? ::FNODOBFM::`string'+0x43cd1
fffff880`04916680 fffff800`04a72d7f : 00000003`00000000 fa800000`2eb98963 00000000`00000000 00000000`0000bfa8 : nt!KiPageFault+0x16e
fffff880`04916810 fffff800`04b014b5 : fffff800`04cbb600 fffff800`00000001 00000000`00000001 fffff880`04916a70 : nt!MiAgeWorkingSet+0x425
fffff880`049169c0 fffff800`04a730d6 : 00000000`00004d61 00000000`00000000 fffffa80`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x4cd46
fffff880`04916a40 fffff800`04a7358b : 00000000`00000008 fffff880`04916ad0 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`04916a90 fffff800`04d1fe6a : fffffa80`071b3040 00000000`00000080 fffffa80`0718e9e0 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`04916c00 fffff800`04a79ec6 : fffff880`009e9180 fffffa80`071b3040 fffff880`009f3fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`04916c40 00000000`00000000 : fffff880`04917000 fffff880`04911000 fffff880`049165c0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiAgeWorkingSet+425
fffff800`04a72d7f 410fb65e1b movzx ebx,byte ptr [r14+1Bh]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiAgeWorkingSet+425
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4fa390f3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiAgeWorkingSet+425
BUCKET_ID: X64_0x50_nt!MiAgeWorkingSet+425
Followup: MachineOwner
---------
