18,141
社区成员




设备:台式机 i5-12400F RX6600XT
问题:偶尔上半蓝屏,下半花屏,分析蓝屏文件显示 ntkrnlmp.exe 错误(可正常开机,可以正常使用。)
蓝屏文件分析内容:
7: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 0000000000256327, page frame number Arg3: 0000000000000007, current page state Arg4: 0000000000000001, 0 Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 2171 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 42568 Key : Analysis.Init.CPU.mSec Value: 343 Key : Analysis.Init.Elapsed.mSec Value: 4099 Key : Analysis.Memory.CommitPeak.Mb Value: 92 Key : Bugcheck.Code.DumpHeader Value: 0x4e Key : Bugcheck.Code.Register Value: 0x4e Key : WER.OS.Branch Value: vb_release Key : WER.OS.Timestamp Value: 2019-12-06T14:06:00Z Key : WER.OS.Version Value: 10.0.19041.1 FILE_IN_CAB: 081822-6906-01.dmp BUGCHECK_CODE: 4e BUGCHECK_P1: 99 BUGCHECK_P2: 256327 BUGCHECK_P3: 7 BUGCHECK_P4: 1 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: r5apex.exe STACK_TEXT: ffff9c85`de40eca8 fffff800`223efc47 : 00000000`0000004e 00000000`00000099 00000000`00256327 00000000`00000007 : nt!KeBugCheckEx ffff9c85`de40ecb0 fffff800`2229acb8 : 00000000`002f2028 fffff800`22c50b00 00000000`00000001 ffffd583`00000028 : nt!MiBadShareCount+0x5b ffff9c85`de40ecf0 fffff800`2229b48e : 00000000`00000000 ffff9c85`de40f400 fffff200`f7028000 ffff9c85`de40f350 : nt!MiDeletePteRun+0x1798 ffff9c85`de40ef00 fffff800`222cebed : 00000000`00000000 ffffd583`535d0700 ffff9c85`de40f350 fffff200`f7027ff8 : nt!MiDeleteVaTail+0x6e ffff9c85`de40ef30 fffff800`222ce80b : fffff279`00000000 ffffd583`535d0700 ffff9c85`00000000 ffff9c85`de40f3a0 : nt!MiWalkPageTablesRecursively+0xc6d ffff9c85`de40efd0 fffff800`222ce80b : fffff279`3c803dc0 ffffd583`535d0700 ffff9c85`00000001 ffff9c85`de40f3b0 : nt!MiWalkPageTablesRecursively+0x88b ffff9c85`de40f070 fffff800`222ce80b : fffff279`3c803000 ffffd583`535d0700 ffff9c85`00000002 ffff9c85`de40f3c0 : nt!MiWalkPageTablesRecursively+0x88b ffff9c85`de40f110 fffff800`222217db : ffff9c85`de40f238 ffffd583`535d0700 00000000`00000003 ffff9c85`de40f3d0 : nt!MiWalkPageTablesRecursively+0x88b ffff9c85`de40f1b0 fffff800`2229c0b1 : ffff9c85`de40f350 ffffd583`00000000 ffffd583`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b ffff9c85`de40f2b0 fffff800`222a63b0 : 00000000`00000001 ffff9c85`00000000 ffffd583`535d0550 ffffd583`4982e080 : nt!MiDeletePagablePteRange+0x4f1 ffff9c85`de40f5c0 fffff800`2231c177 : 00000000`1ee05ac4 00000000`00000000 ffffd583`00000000 fffff800`00000000 : nt!MiDeleteVad+0x360 ffff9c85`de40f6d0 fffff800`2265ff7c : ffff9c85`00000000 00000000`00000000 ffff9c85`de40f830 000001ee`04a70000 : nt!MiFreeVadRange+0xa3 ffff9c85`de40f730 fffff800`2265fa55 : 00000000`00000000 00000000`0000001e ffffc28d`1c368000 00000000`00000000 : nt!MmFreeVirtualMemory+0x4ec ffff9c85`de40f880 fffff800`39e08f1e : 00000000`00000000 00000000`00000056 ffff9c85`de40f910 fffff800`2265d8e0 : nt!NtFreeVirtualMemory+0x95 ffff9c85`de40f8e0 00000000`00000000 : 00000000`00000056 ffff9c85`de40f910 fffff800`2265d8e0 ffff9c85`de40f930 : 360Hvm64+0x18f1e SYMBOL_NAME: nt!MiBadShareCount+5b MODULE_NAME: nt IMAGE_VERSION: 10.0.19041.1826 STACK_COMMAND: .cxr; .ecxr ; kb IMAGE_NAME: ntkrnlmp.exe BUCKET_ID_FUNC_OFFSET: 5b FAILURE_BUCKET_ID: 0x4E_99_nt!MiBadShareCount OS_VERSION: 10.0.19041.1 BUILDLAB_STR: vb_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {60e553e9-e4c5-ed08-9be6-c353e0011003} Followup: MachineOwner --------- 7: kd> lmvm nt Browse full module list start end module name fffff800`22000000 fffff800`23046000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\5D6312DA6921E3A4E7F938B88330B0771\ntkrnlmp.pdb Loaded symbol image file: ntkrnlmp.exe Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\73F1C0C41046000\ntkrnlmp.exe Image path: ntkrnlmp.exe Image name: ntkrnlmp.exe Browse all global symbols functions data Image was built with /Brepro flag. Timestamp: 73F1C0C4 (This is a reproducible build file hash, not a timestamp) CheckSum: 00A65799 ImageSize: 01046000 File version: 10.0.19041.1826 Product version: 10.0.19041.1826 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 1.0 App File date: 00000000.00000000 Translations: 0409.04b0 Information from resource tables: CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: ntkrnlmp.exe OriginalFilename: ntkrnlmp.exe ProductVersion: 10.0.19041.1826 FileVersion: 10.0.19041.1826 (WinBuild.160101.0800) FileDescription: NT Kernel & System LegalCopyright: © Microsoft Corporation. All rights reserved.
PROCESS_NAME: r5apex.exe
...
STACK_TEXT:
...
ffff9c85`de40f930 : 360Hvm64+0x18f1e
搜索 360Hvm64 说是 360 安全卫士的,可能和其它类似软件有冲突,全卸载了试试?