none
win7蓝屏 4天内出现2次 求助!!! RRS feed

  • 问题

  • 第一次:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-30T13:41:57.000000000Z" />
    <EventRecordID>10661</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>AShawn-PC</Computer>
    <Security />
    </System>
    - <EventData>
    <Data Name="param1">0x00000050 (0xfffff6a0000f1478, 0x0000000000000000, 0xfffff800042b2b6b, 0x0000000000000005)</Data>
    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
    <Data Name="param3">053012-18486-01</Data>
    </EventData>

    </Event>

    第二次:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-03T12:12:35.000000000Z" />
    <EventRecordID>11923</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>AShawn-PC</Computer>
    <Security />
    </System>
    - <EventData>
    <Data Name="param1">0x00000050 (0xffffb900c31a3080, 0x0000000000000000, 0xfffff960000bc6d6, 0x0000000000000007)</Data>
    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
    <Data Name="param3">060312-19468-01</Data>
    </EventData>
    </Event>

    求高手帮分析一下是不是硬件有问题

    2012年6月3日 12:39

答案

  • 0x00000050 错误可能原因较多,比较常见的是软件兼容问题。
     
    请在“启动与故障恢复”选项中将“完全内存转储”修改为“小内存转储(128KB)”。如果再次蓝屏,请提供一下 Windows\minidump 中生成的 .DMP
    文件进行分析。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "foresight1111"
     
    求高手帮分析一下是不是硬件有问题
     
     
    2012年6月3日 22:29

全部回复

  • 0x00000050 错误可能原因较多,比较常见的是软件兼容问题。
     
    请在“启动与故障恢复”选项中将“完全内存转储”修改为“小内存转储(128KB)”。如果再次蓝屏,请提供一下 Windows\minidump 中生成的 .DMP
    文件进行分析。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "foresight1111"
     
    求高手帮分析一下是不是硬件有问题
     
     
    2012年6月3日 22:29
  • Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\060612-19110-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
    Machine Name:
    Kernel base = 0xfffff800`04a00000 PsLoadedModuleList = 0xfffff800`04c44670
    Debug session time: Wed Jun  6 19:54:23.432 2012 (UTC + 8:00)
    System Uptime: 0 days 0:35:24.728
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 3B, {c0000005, fffff96000105960, fffff880053d1f60, 0}

    Probably caused by : win32k.sys ( win32k!InternalRebuildHwndListForIMEClass+94 )

    Followup: MachineOwner

    ------------------------------------------------------------------------------------------------------------------------

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\060312-19468-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
    Machine Name:
    Kernel base = 0xfffff800`04a5a000 PsLoadedModuleList = 0xfffff800`04c9e670
    Debug session time: Sun Jun  3 20:10:50.036 2012 (UTC + 8:00)
    System Uptime: 0 days 5:36:27.420
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {ffffb900c31a3080, 0, fffff960000bc6d6, 7}


    Could not read faulting driver name
    Probably caused by : win32k.sys ( win32k!RFONTOBJ::bGetGlyphMetricsPlus+216 )

    Followup: MachineOwner

    -----------------------------------------------------------------------------------------------------------------------------------------

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\053012-18486-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
    Machine Name:
    Kernel base = 0xfffff800`0424a000 PsLoadedModuleList = 0xfffff800`0448e670
    Debug session time: Wed May 30 21:40:10.505 2012 (UTC + 8:00)
    System Uptime: 0 days 2:13:56.800
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffff6a0000f1478, 0, fffff800042b2b6b, 5}


    Could not read faulting driver name
    Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1d1 )

    Followup: MachineOwner

    2012年6月6日 12:58
  • 0x0000003B 错误表示一个从没有权限的代码传送至有权限的代码时遇到了例外的错误,一般是软件兼容性问题引起页面库占用过多,或者用户模式的显示驱动传送了不正确的代码。
     
    结合之前出现的 0x00000050 错误,问题应该还是与软件兼容性或内存稳定性有关。你经常在做什么操作时容易引起此问题?
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "foresight1111"
     
    BugCheck 3B, {c0000005, fffff96000105960, fffff880053d1f60, 0}
    Probably caused by : win32k.sys ( win32k!InternalRebuildHwndListForIMEClass+94 )
     
     
    2012年6月7日 5:23
  • 前两次x50的蓝屏是在没有任何操作的情况下突然蓝屏的,我真的怀疑是内存有问题哦····
    2012年6月7日 13:38
  • 和你一样以前遇到过一次,CPU超频或内存故障会导致此错误,希望能帮到你。

    有问必答,有求必应。 疑难解答论坛:http://tulip-studio.oicp.net

    2012年6月7日 16:43
  • 那么请用 Windows 7 安装程序提供的内存检测工具检测一下内存稳定性。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "foresight1111"
     
    前两次x50的蓝屏是在没有任何操作的情况下突然蓝屏的,我真的怀疑是内存有问题哦····
     
     
    2012年6月8日 2:46
  • 刚才用win7自带检测软件2条内存检测都通过了,我也没方向了。

    我又看了一下系统日志,发现每次蓝屏之前都会有一个kernel-power的关键错误,如下:

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>41</EventID>
    <Version>2</Version>
    <Level>1</Level>
    <Task>63</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2012-06-06T11:55:47.612014300Z" />
    <EventRecordID>12783</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>AShawn-PC</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    - <EventData>
    <Data Name="BugcheckCode">59</Data>
    <Data Name="BugcheckParameter1">0xc0000005</Data>
    <Data Name="BugcheckParameter2">0xfffff96000105960</Data>
    <Data Name="BugcheckParameter3">0xfffff880053d1f60</Data>
    <Data Name="BugcheckParameter4">0x0</Data>
    <Data Name="SleepInProgress">false</Data>
    <Data Name="PowerButtonTimestamp">0</Data>
    </EventData>

    </Event>

    --------------------------------------------------------------------------------------------------------------

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>41</EventID>
    <Version>2</Version>
    <Level>1</Level>
    <Task>63</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2012-06-03T12:12:16.053609800Z" />
    <EventRecordID>11897</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>AShawn-PC</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    - <EventData>
    <Data Name="BugcheckCode">80</Data>
    <Data Name="BugcheckParameter1">0xffffb900c31a3080</Data>
    <Data Name="BugcheckParameter2">0x0</Data>
    <Data Name="BugcheckParameter3">0xfffff960000bc6d6</Data>
    <Data Name="BugcheckParameter4">0x7</Data>
    <Data Name="SleepInProgress">false</Data>
    <Data Name="PowerButtonTimestamp">0</Data>
    </EventData>

    </Event>

    ---------------------------------------------------------------------------------------------------------------------

    日志名称:          System
    来源:            Microsoft-Windows-Kernel-Power
    日期:            2012/5/30 21:41:38
    事件 ID:         41
    任务类别:          (63)
    级别:            关键
    关键字:           (2)
    用户:            SYSTEM
    计算机:           AShawn-PC
    描述:
    系统在未首先正常关机的情况下重新启动。当系统停止响应、出现故障或意外断电时,会发生此错误。
    事件 Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
        <EventID>41</EventID>
        <Version>2</Version>
        <Level>1</Level>
        <Task>63</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000002</Keywords>
        <TimeCreated SystemTime="2012-05-30T13:41:38.226808300Z" />
        <EventRecordID>10650</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="8" />
        <Channel>System</Channel>
        <Computer>AShawn-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="BugcheckCode">80</Data>
        <Data Name="BugcheckParameter1">0xfffff6a0000f1478</Data>
        <Data Name="BugcheckParameter2">0x0</Data>
        <Data Name="BugcheckParameter3">0xfffff800042b2b6b</Data>
        <Data Name="BugcheckParameter4">0x5</Data>
        <Data Name="SleepInProgress">false</Data>
        <Data Name="PowerButtonTimestamp">0</Data>
      </EventData>
    </Event>

    帮忙看一下,谢谢!

    2012年6月8日 3:15
  • 你有在电源选项中设置任何自动待机、睡眠、休眠的电源选项吗?试一试取消所有自动电源操作,将电源方案修改为始终打开,看看是否还会蓝屏、还有此类日志生成。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "foresight1111"
     
    刚才用win7自带检测软件2条内存检测都通过了,我也没方向了。
    我又看了一下系统日志,发现每次蓝屏之前都会有一个kernel-power的关键错误,如下:
     
     
    2012年6月8日 23:04
  • 我不确定是不是这个原因,因为蓝屏都是在正常的情况下发生的,我试试测试看看吧。
    2012年6月9日 16:49
  • 根据上一次提供的信息,如果经测试不设置任何自动执行的电源操作不会出现问题,则蓝屏可能是 ACPI 高级电源选项设置不正确所致。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "foresight1111"
     
    我不确定是不是这个原因,因为蓝屏都是在正常的情况下发生的,我试试测试看看吧。
     
     
    2012年6月10日 1:34
  • 把电源里面的选项设置为始终打开不睡眠又一次出现蓝屏了

    日志名称:          System
    来源:            Microsoft-Windows-Kernel-Power
    日期:            2012/6/12 21:25:38
    事件 ID:         41
    任务类别:          (63)
    级别:            关键
    关键字:           (2)
    用户:            SYSTEM
    计算机:           AShawn-PC
    描述:
    系统在未首先正常关机的情况下重新启动。当系统停止响应、出现故障或意外断电时,会发生此错误。
    事件 Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
        <EventID>41</EventID>
        <Version>2</Version>
        <Level>1</Level>
        <Task>63</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000002</Keywords>
        <TimeCreated SystemTime="2012-06-12T13:25:38.166006500Z" />
        <EventRecordID>14792</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="8" />
        <Channel>System</Channel>
        <Computer>AShawn-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="BugcheckCode">80</Data>
        <Data Name="BugcheckParameter1">0xfffff6a00001a550</Data>
        <Data Name="BugcheckParameter2">0x0</Data>
        <Data Name="BugcheckParameter3">0xfffff80004a86b6b</Data>
        <Data Name="BugcheckParameter4">0x5</Data>
        <Data Name="SleepInProgress">false</Data>
        <Data Name="PowerButtonTimestamp">0</Data>
      </EventData>
    </Event>

    ------------------------------------------------------------------------------------------------

    错误还是0x00000050

    我真的怀疑是内存问题,但是用检测工具测有没事,不知道为什么。

    2012年6月12日 13:46
  • 请提供一下最新这次的 MiniDump。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "foresight1111"
     
    把电源里面的选项设置为始终打开不睡眠又一次出现蓝屏了
    系统在未首先正常关机的情况下重新启动。当系统停止响应、出现故障或意外断电时,会发生此错误。
     
     
    2012年6月12日 22:36

  • Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\061212-18844-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
    Machine Name:
    Kernel base = 0xfffff800`04a1e000 PsLoadedModuleList = 0xfffff800`04c62670
    Debug session time: Tue Jun 12 21:23:29.519 2012 (UTC + 8:00)
    System Uptime: 0 days 1:13:19.815
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffff6a00001a550, 0, fffff80004a86b6b, 5}


    Could not read faulting driver name
    Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1d1 )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff6a00001a550, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80004a86b6b, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000005, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004ccc100
     fffff6a00001a550

    FAULTING_IP:
    nt!MiAgeWorkingSet+1d1
    fffff800`04a86b6b 488b19          mov     rbx,qword ptr [rcx]

    MM_INTERNAL_CODE:  5

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  Thunder5.exe

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff88004916680 -- (.trap 0xfffff88004916680)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff6a00001a550
    rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80004a86b6b rsp=fffff88004916810 rbp=000000200001a550
     r8=0000000000000001  r9=fffffa8008a273f8 r10=0000000000000005
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po cy
    nt!MiAgeWorkingSet+0x1d1:
    fffff800`04a86b6b 488b19          mov     rbx,qword ptr [rcx] ds:fffff6a0`0001a550=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80004a43f1f to fffff80004a9d1c0

    STACK_TEXT:  
    fffff880`04916518 fffff800`04a43f1f : 00000000`00000050 fffff6a0`0001a550 00000000`00000000 fffff880`04916680 : nt!KeBugCheckEx
    fffff880`04916520 fffff800`04a9b2ee : 00000000`00000000 fffff6a0`0001a550 00000000`00001000 00000980`00000000 : nt! ?? ::FNODOBFM::`string'+0x43d51
    fffff880`04916680 fffff800`04a86b6b : 00000003`00000000 9a900000`58e59867 00000000`00000000 00000000`000029a9 : nt!KiPageFault+0x16e
    fffff880`04916810 fffff800`04b154f5 : fffffa80`08a273f8 fffff880`00000001 00000000`00000001 fffff880`04916a70 : nt!MiAgeWorkingSet+0x1d1
    fffff880`049169c0 fffff800`04a87116 : 00000000`00001131 00000000`00000000 fffffa80`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x4cd46
    fffff880`04916a40 fffff800`04a875cb : 00000000`00000008 fffff880`04916ad0 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
    fffff880`04916a90 fffff800`04d33e6a : fffffa80`071b3040 00000000`00000080 fffffa80`0718e9e0 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
    fffff880`04916c00 fffff800`04a8df06 : fffff880`009e9180 fffffa80`071b3040 fffff880`009f3fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`04916c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!MiAgeWorkingSet+1d1
    fffff800`04a86b6b 488b19          mov     rbx,qword ptr [rcx]

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  nt!MiAgeWorkingSet+1d1

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4f76721c

    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+1d1

    BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+1d1

    Followup: MachineOwner
    ---------
    2012年6月13日 13:07
  • 这回蓝屏是在运行迅雷的时候出现的吗?之前的蓝屏是否也与运行迅雷有关?
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "foresight1111"
     
    BugCheck 50, {fffff6a00001a550, 0, fffff80004a86b6b, 5}
    PROCESS_NAME: Thunder5.exe
     
     
    2012年6月14日 22:34
  • Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\060612-19110-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Inaccessible path: 'C:\MyCodesSymbols'
    WARNING: Whitespace at start of path element
    Symbol search path is: C:\MyCodesSymbols; SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
    Machine Name:
    Kernel base = 0xfffff800`04a00000 PsLoadedModuleList = 0xfffff800`04c44670
    Debug session time: Wed Jun  6 19:54:23.432 2012 (UTC + 8:00)
    System Uptime: 0 days 0:35:24.728
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 3B, {c0000005, fffff96000105960, fffff880053d1f60, 0}

    Probably caused by : win32k.sys ( win32k!InternalRebuildHwndListForIMEClass+94 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff96000105960, Address of the instruction which caused the bugcheck
    Arg3: fffff880053d1f60, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

    FAULTING_IP:
    win32k!InternalRebuildHwndListForIMEClass+94
    fffff960`00105960 498b8398000000  mov     rax,qword ptr [r11+98h]

    CONTEXT:  fffff880053d1f60 -- (.cxr 0xfffff880053d1f60)
    rax=fffff900c0894790 rbx=fffff900c2ff97e0 rcx=000000000000c026
    rdx=0000000000000001 rsi=fffff900c2acc3e0 rdi=fffff900c2ff97e0
    rip=fffff96000105960 rsp=fffff880053d2940 rbp=fffff900c089d610
     r8=fffff900c0580a70  r9=0000000000000012 r10=fffff880051e8cc8
    r11=0000400000000000 r12=fffff900c2ff93e0 r13=fffff900c2acc3e0
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206
    win32k!InternalRebuildHwndListForIMEClass+0x94:
    fffff960`00105960 498b8398000000  mov     rax,qword ptr [r11+98h] ds:002b:00004000`00000098=????????????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x3B

    PROCESS_NAME:  G10-Editor.exe

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff96000105960

    STACK_TEXT:  
    fffff880`053d2940 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!InternalRebuildHwndListForIMEClass+0x94


    FOLLOWUP_IP:
    win32k!InternalRebuildHwndListForIMEClass+94
    fffff960`00105960 498b8398000000  mov     rax,qword ptr [r11+98h]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  win32k!InternalRebuildHwndListForIMEClass+94

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4f76756e

    STACK_COMMAND:  .cxr 0xfffff880053d1f60 ; kb

    FAILURE_BUCKET_ID:  X64_0x3B_win32k!InternalRebuildHwndListForIMEClass+94

    BUCKET_ID:  X64_0x3B_win32k!InternalRebuildHwndListForIMEClass+94

    Followup: MachineOwner
    ---------
    WARNING: Inaccessible path: 'C:\MyCodesSymbols'
    WARNING: Whitespace at start of path element
    WARNING: Inaccessible path: '“C:\MyCodesSymbols'

    Loading Dump File [C:\Windows\Minidump\060312-19468-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Inaccessible path: 'C:\MyCodesSymbols'
    WARNING: Whitespace at start of path element
    WARNING: Inaccessible path: '“C:\MyCodesSymbols'
    Symbol search path is: C:\MyCodesSymbols; SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols;“C:\MyCodesSymbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
    Machine Name:
    Kernel base = 0xfffff800`04a5a000 PsLoadedModuleList = 0xfffff800`04c9e670
    Debug session time: Sun Jun  3 20:10:50.036 2012 (UTC + 8:00)
    System Uptime: 0 days 5:36:27.420
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {ffffb900c31a3080, 0, fffff960000bc6d6, 7}


    Could not read faulting driver name
    Probably caused by : win32k.sys ( win32k!RFONTOBJ::bGetGlyphMetricsPlus+216 )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: ffffb900c31a3080, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff960000bc6d6, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000007, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004d08100
     ffffb900c31a3080

    FAULTING_IP:
    win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
    fffff960`000bc6d6 48833e00        cmp     qword ptr [rsi],0

    MM_INTERNAL_CODE:  7

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  explorer.exe

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff88002e9fb20 -- (.trap 0xfffff88002e9fb20)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff900c4980020 rbx=0000000000000000 rcx=fffff900c2ea5bb0
    rdx=000000000000000a rsi=0000000000000000 rdi=0000000000000000
    rip=fffff960000bc6d6 rsp=fffff88002e9fcb0 rbp=fffff900c0081168
     r8=fffff900c0081028  r9=fffff900c0081158 r10=0000000000000002
    r11=fffff88002e9fdb8 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe nc
    win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x216:
    fffff960`000bc6d6 48833e00        cmp     qword ptr [rsi],0 ds:00000000`00000000=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80004a7fea7 to fffff80004ad91c0

    STACK_TEXT:  
    fffff880`02e9f9b8 fffff800`04a7fea7 : 00000000`00000050 ffffb900`c31a3080 00000000`00000000 fffff880`02e9fb20 : nt!KeBugCheckEx
    fffff880`02e9f9c0 fffff800`04ad72ee : 00000000`00000000 ffffb900`c31a3080 3fe00000`00000000 fffff880`02e9fef0 : nt! ?? ::FNODOBFM::`string'+0x43cd1
    fffff880`02e9fb20 fffff960`000bc6d6 : 00000000`00000004 00000000`00000000 fffff900`c0213638 fffff960`00285f1c : nt!KiPageFault+0x16e
    fffff880`02e9fcb0 fffff960`00254e41 : fffff900`c0081158 fffff900`c0081028 fffff880`02e9fef0 00000000`00000000 : win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x216
    fffff880`02e9fd30 fffff960`000bbc6f : 00000000`00000001 fffff880`02ea02d0 00000000`00000000 fffff900`c00c0010 : win32k!ESTROBJ::vCharPos_H1+0x81
    fffff880`02e9fdc0 fffff960`00092e5a : fffff880`41800000 00000000`00000000 00000000`0000000a fffff880`02ea02d0 : win32k!ESTROBJ::vInit+0x27f
    fffff880`02e9fe50 fffff960`000922db : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!GreExtTextOutWLocked+0xb12
    fffff880`02ea0270 fffff960`0025d709 : 00000000`00000000 fffff880`02ea05e0 fffff900`c0081158 00000000`00000001 : win32k!GreExtTextOutWInternal+0x10f
    fffff880`02ea0320 fffff800`04ad8453 : fffff900`c319eca0 00000000`00000000 0000000d`00000011 00000005`00000004 : win32k!NtGdiExtTextOutW+0x341
    fffff880`02ea04f0 000007fe`fe893dea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0253dea8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fe893dea


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
    fffff960`000bc6d6 48833e00        cmp     qword ptr [rsi],0

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  win32k!RFONTOBJ::bGetGlyphMetricsPlus+216

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4f76756e

    FAILURE_BUCKET_ID:  X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+216

    BUCKET_ID:  X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+216

    Followup: MachineOwner
    ---------

    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004d08100
     ffffb900c31a3080

    FAULTING_IP:
    win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
    fffff960`000bc6d6 48833e00        cmp     qword ptr [rsi],0

    MM_INTERNAL_CODE:  7

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  explorer.exe

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff88002e9fb20 -- <link cmd=".trap 0xfffff88002e9fb20">(.trap 0xfffff88002e9fb20)</exec>
    NOTE: The trap frame does not contain all registers.
    <col fg="emphfg" bg="emphbg">Some register values may be zeroed or incorrect.</col>
    rax=fffff900c4980020 rbx=0000000000000000 rcx=fffff900c2ea5bb0
    rdx=000000000000000a rsi=0000000000000000 rdi=0000000000000000
    rip=fffff960000bc6d6 rsp=fffff88002e9fcb0 rbp=fffff900c0081168
     r8=fffff900c0081028  r9=fffff900c0081158 r10=0000000000000002
    r11=fffff88002e9fdb8 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe nc
    win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x216:
    fffff960`000bc6d6 48833e00        cmp     qword ptr [rsi],0 ds:00000000`00000000=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80004a7fea7 to fffff80004ad91c0

    STACK_TEXT:  
    fffff880`02e9f9b8 fffff800`04a7fea7 : 00000000`00000050 ffffb900`c31a3080 00000000`00000000 fffff880`02e9fb20 : nt!KeBugCheckEx
    fffff880`02e9f9c0 fffff800`04ad72ee : 00000000`00000000 ffffb900`c31a3080 3fe00000`00000000 fffff880`02e9fef0 : nt! ?? ::FNODOBFM::`string'+0x43cd1
    fffff880`02e9fb20 fffff960`000bc6d6 : 00000000`00000004 00000000`00000000 fffff900`c0213638 fffff960`00285f1c : nt!KiPageFault+0x16e
    fffff880`02e9fcb0 fffff960`00254e41 : fffff900`c0081158 fffff900`c0081028 fffff880`02e9fef0 00000000`00000000 : win32k!RFONTOBJ::bGetGlyphMetricsPlus+0x216
    fffff880`02e9fd30 fffff960`000bbc6f : 00000000`00000001 fffff880`02ea02d0 00000000`00000000 fffff900`c00c0010 : win32k!ESTROBJ::vCharPos_H1+0x81
    fffff880`02e9fdc0 fffff960`00092e5a : fffff880`41800000 00000000`00000000 00000000`0000000a fffff880`02ea02d0 : win32k!ESTROBJ::vInit+0x27f
    fffff880`02e9fe50 fffff960`000922db : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!GreExtTextOutWLocked+0xb12
    fffff880`02ea0270 fffff960`0025d709 : 00000000`00000000 fffff880`02ea05e0 fffff900`c0081158 00000000`00000001 : win32k!GreExtTextOutWInternal+0x10f
    fffff880`02ea0320 fffff800`04ad8453 : fffff900`c319eca0 00000000`00000000 0000000d`00000011 00000005`00000004 : win32k!NtGdiExtTextOutW+0x341
    fffff880`02ea04f0 000007fe`fe893dea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`0253dea8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fe893dea


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    win32k!RFONTOBJ::bGetGlyphMetricsPlus+216
    fffff960`000bc6d6 48833e00        cmp     qword ptr [rsi],0

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  win32k!RFONTOBJ::bGetGlyphMetricsPlus+216

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: <link cmd="lmvm win32k">win32k</exec>

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4f76756e

    FAILURE_BUCKET_ID:  X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+216

    BUCKET_ID:  X64_0x50_win32k!RFONTOBJ::bGetGlyphMetricsPlus+216

    Followup: MachineOwner
    ---------


    Loading Dump File [C:\Windows\Minidump\053012-18486-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Inaccessible path: 'C:\MyCodesSymbols'
    WARNING: Whitespace at start of path element
    WARNING: Inaccessible path: '“C:\MyCodesSymbols'
    Symbol search path is: C:\MyCodesSymbols; SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols;“C:\MyCodesSymbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
    Machine Name:
    Kernel base = 0xfffff800`0424a000 PsLoadedModuleList = 0xfffff800`0448e670
    Debug session time: Wed May 30 21:40:10.505 2012 (UTC + 8:00)
    System Uptime: 0 days 2:13:56.800
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffff6a0000f1478, 0, fffff800042b2b6b, 5}


    Could not read faulting driver name
    Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1d1 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffff6a0000f1478, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff800042b2b6b, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000005, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800044f8100
     fffff6a0000f1478

    FAULTING_IP:
    nt!MiAgeWorkingSet+1d1
    fffff800`042b2b6b 488b19          mov     rbx,qword ptr [rcx]

    MM_INTERNAL_CODE:  5

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  firefox.exe

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff88004916680 -- (.trap 0xfffff88004916680)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff6a0000f1478
    rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800042b2b6b rsp=fffff88004916810 rbp=00000020000f1478
     r8=0000000000000001  r9=fffffa80076bfb28 r10=0000000000000005
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po cy
    nt!MiAgeWorkingSet+0x1d1:
    fffff800`042b2b6b 488b19          mov     rbx,qword ptr [rcx] ds:fffff6a0`000f1478=????????????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff8000426ff1f to fffff800042c91c0

    STACK_TEXT:  
    fffff880`04916518 fffff800`0426ff1f : 00000000`00000050 fffff6a0`000f1478 00000000`00000000 fffff880`04916680 : nt!KeBugCheckEx
    fffff880`04916520 fffff800`042c72ee : 00000000`00000000 fffff6a0`000f1478 00000000`00000000 00000980`00000000 : nt! ?? ::FNODOBFM::`string'+0x43d51
    fffff880`04916680 fffff800`042b2b6b : 00000003`00000000 7a900000`09ddf867 00000000`00000000 00000000`00015fa9 : nt!KiPageFault+0x16e
    fffff880`04916810 fffff800`043414f5 : fffffa80`076bfb28 fffff800`00000001 00000000`00000001 fffff880`04916a70 : nt!MiAgeWorkingSet+0x1d1
    fffff880`049169c0 fffff800`042b3116 : 00000000`00001f66 00000000`00000000 fffffa80`00000000 00000000`00000005 : nt! ?? ::FNODOBFM::`string'+0x4cd46
    fffff880`04916a40 fffff800`042b35cb : 00000000`00000008 fffff880`04916ad0 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
    fffff880`04916a90 fffff800`0455fe6a : fffffa80`071b3040 00000000`00000080 fffffa80`0718e9e0 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
    fffff880`04916c00 fffff800`042b9f06 : fffff880`009e9180 fffffa80`071b3040 fffff880`009f3fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`04916c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!MiAgeWorkingSet+1d1
    fffff800`042b2b6b 488b19          mov     rbx,qword ptr [rcx]

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  nt!MiAgeWorkingSet+1d1

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4f76721c

    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+1d1

    BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+1d1

    Followup: MachineOwner
    ---------

    2012年6月15日 10:09
  • 老大,6月30日凌晨又来了一次,麻烦帮我看看一下吧,谢谢啦!

    帮我看看到底是硬件问题还是系统兼容问题啊。。。

    ---------------------------------------------------------------------


    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\063012-24944-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Inaccessible path: 'C:\MyCodesSymbols'
    WARNING: Whitespace at start of path element
    Symbol search path is: C:\MyCodesSymbols; SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
    Machine Name:
    Kernel base = 0xfffff800`04a0a000 PsLoadedModuleList = 0xfffff800`04c4e670
    Debug session time: Sat Jun 30 00:37:51.505 2012 (UTC + 8:00)
    System Uptime: 0 days 5:30:07.800
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {fffffb400045661b, 0, fffff80004a72d7f, 7}


    Could not read faulting driver name
    Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+425 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffb400045661b, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80004a72d7f, If non-zero, the instruction address which referenced the bad memory
        address.
    Arg4: 0000000000000007, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004cb8100
     fffffb400045661b

    FAULTING_IP:
    nt!MiAgeWorkingSet+425
    fffff800`04a72d7f 410fb65e1b      movzx   ebx,byte ptr [r14+1Bh]

    MM_INTERNAL_CODE:  7

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  System

    CURRENT_IRQL:  0

    TRAP_FRAME:  fffff88004916680 -- (.trap 0xfffff88004916680)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000058000000000 rbx=0000000000000000 rcx=fffff6fc50065058
    rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80004a72d7f rsp=fffff88004916810 rbp=007ffffc5006505e
     r8=0000000000000001  r9=fffff80004cbb600 r10=0000000000000005
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    nt!MiAgeWorkingSet+0x425:
    fffff800`04a72d7f 410fb65e1b      movzx   ebx,byte ptr [r14+1Bh] ds:00000000`0000001b=??
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80004a2fe97 to fffff80004a891c0

    STACK_TEXT:  
    fffff880`04916518 fffff800`04a2fe97 : 00000000`00000050 fffffb40`0045661b 00000000`00000000 fffff880`04916680 : nt!KeBugCheckEx
    fffff880`04916520 fffff800`04a872ee : 00000000`00000000 fffffb40`0045661b 00000000`00001000 fb204000`17220943 : nt! ?? ::FNODOBFM::`string'+0x43cd1
    fffff880`04916680 fffff800`04a72d7f : 00000003`00000000 fa800000`2eb98963 00000000`00000000 00000000`0000bfa8 : nt!KiPageFault+0x16e
    fffff880`04916810 fffff800`04b014b5 : fffff800`04cbb600 fffff800`00000001 00000000`00000001 fffff880`04916a70 : nt!MiAgeWorkingSet+0x425
    fffff880`049169c0 fffff800`04a730d6 : 00000000`00004d61 00000000`00000000 fffffa80`00000000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x4cd46
    fffff880`04916a40 fffff800`04a7358b : 00000000`00000008 fffff880`04916ad0 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
    fffff880`04916a90 fffff800`04d1fe6a : fffffa80`071b3040 00000000`00000080 fffffa80`0718e9e0 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
    fffff880`04916c00 fffff800`04a79ec6 : fffff880`009e9180 fffffa80`071b3040 fffff880`009f3fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`04916c40 00000000`00000000 : fffff880`04917000 fffff880`04911000 fffff880`049165c0 00000000`00000000 : nt!KxStartSystemThread+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!MiAgeWorkingSet+425
    fffff800`04a72d7f 410fb65e1b      movzx   ebx,byte ptr [r14+1Bh]

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  nt!MiAgeWorkingSet+425

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4fa390f3

    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+425

    BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+425

    Followup: MachineOwner
    ---------

    2012年6月29日 17:04