蓝屏吧 关注：27,740贴子：152,134
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffff9453d7ca6114, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff804784c8d9c, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2046
Key : Analysis.Elapsed.mSec
Value: 7017
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 202
Key : Analysis.Init.Elapsed.mSec
Value: 6972
Key : Analysis.Memory.CommitPeak.Mb
Value: 85
Key : Bugcheck.Code.LegacyAPI
Value: 0xa
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: AV_nt!MmMapIoSpaceEx
Key : Failure.Hash
Value: {330358d0-a162-8f6d-8d1c-902f983a8e19}
BUGCHECK_CODE: a
BUGCHECK_P1: ffff9453d7ca6114
BUGCHECK_P2: ff
BUGCHECK_P3: 0
BUGCHECK_P4: fffff804784c8d9c
FILE_IN_CAB: 111923-9906-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
READ_ADDRESS: fffff80478f1d470: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff9453d7ca6114
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffcd8e316d13d0 -- (.trap 0xffffcd8e316d13d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=59dde6a774040000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff804784c8d9c rsp=ffffcd8e316d1560 rbp=0000000000027100
r8=0000000000000000 r9=0000000000000000 r10=00000000efb5b8f4
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na pe nc
nt!MmMapIoSpaceEx+0x2c:
fffff804`784c8d9c 4883c438 add rsp,38h
Resetting default scope
STACK_TEXT:
ffffcd8e`316d1288 fffff804`7862bfa9 : 00000000`0000000a ffff9453`d7ca6114 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffffcd8e`316d1290 fffff804`78627634 : ffffac81`104a9180 fffff804`7840e397 00000000`0000d518 ffffac81`104a9180 : nt!KiBugCheckDispatch+0x69
ffffcd8e`316d13d0 fffff804`784c8d9c : 00000015`6b2f0000 00000000`00000000 ffff9453`d7ca6104 00000000`00027100 : nt!KiPageFault+0x474
ffffcd8e`316d1560 00000000`00000000 : ffffac81`104a9180 fffff804`784129ae 00000000`00000000 00000000`00989680 : nt!MmMapIoSpaceEx+0x2c
SYMBOL_NAME: nt!MmMapIoSpaceEx+2c
MODULE_NAME: nt
IMAGE_VERSION: 10.0.22621.2715
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 2c
FAILURE_BUCKET_ID: AV_nt!MmMapIoSpaceEx
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {330358d0-a162-8f6d-8d1c-902f983a8e19}
Followup: MachineOwner
---------
能帮忙看下么
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffff9453d7ca6114, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff804784c8d9c, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2046
Key : Analysis.Elapsed.mSec
Value: 7017
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 202
Key : Analysis.Init.Elapsed.mSec
Value: 6972
Key : Analysis.Memory.CommitPeak.Mb
Value: 85
Key : Bugcheck.Code.LegacyAPI
Value: 0xa
Key : Dump.Attributes.AsUlong
Value: 1008
Key : Dump.Attributes.DiagDataWrittenToHeader
Value: 1
Key : Dump.Attributes.ErrorCode
Value: 0
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : Dump.Attributes.LastLine
Value: Dump completed successfully.
Key : Dump.Attributes.ProgressPercentage
Value: 0
Key : Failure.Bucket
Value: AV_nt!MmMapIoSpaceEx
Key : Failure.Hash
Value: {330358d0-a162-8f6d-8d1c-902f983a8e19}
BUGCHECK_CODE: a
BUGCHECK_P1: ffff9453d7ca6114
BUGCHECK_P2: ff
BUGCHECK_P3: 0
BUGCHECK_P4: fffff804784c8d9c
FILE_IN_CAB: 111923-9906-01.dmp
DUMP_FILE_ATTRIBUTES: 0x1008
Kernel Generated Triage Dump
READ_ADDRESS: fffff80478f1d470: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff9453d7ca6114
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffcd8e316d13d0 -- (.trap 0xffffcd8e316d13d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=59dde6a774040000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff804784c8d9c rsp=ffffcd8e316d1560 rbp=0000000000027100
r8=0000000000000000 r9=0000000000000000 r10=00000000efb5b8f4
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz na pe nc
nt!MmMapIoSpaceEx+0x2c:
fffff804`784c8d9c 4883c438 add rsp,38h
Resetting default scope
STACK_TEXT:
ffffcd8e`316d1288 fffff804`7862bfa9 : 00000000`0000000a ffff9453`d7ca6114 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffffcd8e`316d1290 fffff804`78627634 : ffffac81`104a9180 fffff804`7840e397 00000000`0000d518 ffffac81`104a9180 : nt!KiBugCheckDispatch+0x69
ffffcd8e`316d13d0 fffff804`784c8d9c : 00000015`6b2f0000 00000000`00000000 ffff9453`d7ca6104 00000000`00027100 : nt!KiPageFault+0x474
ffffcd8e`316d1560 00000000`00000000 : ffffac81`104a9180 fffff804`784129ae 00000000`00000000 00000000`00989680 : nt!MmMapIoSpaceEx+0x2c
SYMBOL_NAME: nt!MmMapIoSpaceEx+2c
MODULE_NAME: nt
IMAGE_VERSION: 10.0.22621.2715
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 2c
FAILURE_BUCKET_ID: AV_nt!MmMapIoSpaceEx
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {330358d0-a162-8f6d-8d1c-902f983a8e19}
Followup: MachineOwner
---------
能帮忙看下么
大佬能帮我看看吗
今天更新吧友的一个故障，代码 比较新奇少见FAT_FILE_SYSTEM (23)，图片如下：
有很多人会把这个和NTFS.sys故障搞混淆，觉得是不是自己的硬盘坏了，退一万不讲，即使是NTFS.sys也不可能一定就是 硬盘故障。
初步看的话，上面显示文件系统异常，这个文件系统大家肯定不熟悉，以前在win7和XP上常见，是fat系列 的文件系统，比如优盘的fat32就是其中的一种类型。
为什么会突然出现fat文件系统异常，这个我们留在后面说，打开如下的dump文件：
我们看文件的第一张图，显示了蓝屏的归类，文件系统类fat，第二张图我们仔细看栈文件有没有硬件崩溃的 情况，经过反复的查看，确定没有硬件崩溃，只是单纯的fat文件系统崩溃，这个时候我们看第三张图，显示的guid为驱动组，一切无碍。
因为吧友的系统现在已经是没法进去的，进去直接蓝屏，然后吧友说自己是有PE并且带远程的，我们进去看了下，发现fastfat文件MD5校验数据异常，验证为系统文件异常。吧友的这个PE不能完全将系统盘脱机，无法替换正常系统内的fastfat文件，遂重新使用我们的pe进去控制，搜索到drivers的fastfat文件，替换，开机成功启动。这里要注意的是，替换系统文件的时候，可以优先选择系统备份文件，因为吧友的是win10企业版，备份文件一样被崩溃了，所以调用我的虚拟机里面的企业版替换的。开机正常如下图：
开机正常后弹出文件系统错误，程序是联想的什么程序，让客户自行安装杀毒软件杀毒即可。
他这个 是因为安装了 恶意程序，强制修改了fat文件系统，导致开机蓝屏。如果误判的话，可能就是重装系统或者是换硬盘了。
最后，还是那句，平常要看的dump比较多，可能不能及时在贴吧更新作品，或者无法及时回复你们的问题（一般我在线就会上来查看），私信发不了联系，直接TB搜店铺大米饭的phy发DUMP 给我客服就行了，他们会及时将 DUMP发给我的。
。
有很多人会把这个和NTFS.sys故障搞混淆，觉得是不是自己的硬盘坏了，退一万不讲，即使是NTFS.sys也不可能一定就是 硬盘故障。初步看的话，上面显示文件系统异常，这个文件系统大家肯定不熟悉，以前在win7和XP上常见，是fat系列 的文件系统，比如优盘的fat32就是其中的一种类型。
为什么会突然出现fat文件系统异常，这个我们留在后面说，打开如下的dump文件：
我们看文件的第一张图，显示了蓝屏的归类，文件系统类fat，第二张图我们仔细看栈文件有没有硬件崩溃的 情况，经过反复的查看，确定没有硬件崩溃，只是单纯的fat文件系统崩溃，这个时候我们看第三张图，显示的guid为驱动组，一切无碍。
因为吧友的系统现在已经是没法进去的，进去直接蓝屏，然后吧友说自己是有PE并且带远程的，我们进去看了下，发现fastfat文件MD5校验数据异常，验证为系统文件异常。吧友的这个PE不能完全将系统盘脱机，无法替换正常系统内的fastfat文件，遂重新使用我们的pe进去控制，搜索到drivers的fastfat文件，替换，开机成功启动。这里要注意的是，替换系统文件的时候，可以优先选择系统备份文件，因为吧友的是win10企业版，备份文件一样被崩溃了，所以调用我的虚拟机里面的企业版替换的。开机正常如下图：
开机正常后弹出文件系统错误，程序是联想的什么程序，让客户自行安装杀毒软件杀毒即可。
他这个 是因为安装了 恶意程序，强制修改了fat文件系统，导致开机蓝屏。如果误判的话，可能就是重装系统或者是换硬盘了。
最后，还是那句，平常要看的dump比较多，可能不能及时在贴吧更新作品，或者无法及时回复你们的问题（一般我在线就会上来查看），私信发不了联系，直接TB搜店铺大米饭的phy发DUMP 给我客服就行了，他们会及时将 DUMP发给我的。
。
终止代码：IRQL_NOT_LESS_OR_EQUAL
大佬，可以帮我分析一下吗？！
具体情况是这样的：
01.
win11开机后，1到3分钟就蓝屏，自动重启后就正常使用，没有任何问题
02.
关机后不断电再开机，不会蓝屏；关机后断电再开机，就会蓝屏重启
03.
系统自动重启后就没有任何异常，能正常使用
DUMP
链接: https://pan.baidu.com/s/1cMnC3YBShgicJuF8vHNsDg?pwd=2fdi
提取码: 2fdi
大佬，可以帮我分析一下吗？！
具体情况是这样的：
01.
win11开机后，1到3分钟就蓝屏，自动重启后就正常使用，没有任何问题
02.
关机后不断电再开机，不会蓝屏；关机后断电再开机，就会蓝屏重启
03.
系统自动重启后就没有任何异常，能正常使用
DUMP
链接: https://pan.baidu.com/s/1cMnC3YBShgicJuF8vHNsDg?pwd=2fdi
提取码: 2fdi
水遁
No .natvis files found at C:\Windows\SYSTEM32\Visualizers.
No .natvis files found at C:\Users\azs91\AppData\Local\Dbg\Visualizers.
Microsoft (R) Windows Debugger Version 10.0.22621.2506 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\112323-6937-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows 10 Kernel Version 22621 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
Machine Name:
Kernel base = 0xfffff804`4ac00000 PsLoadedModuleList = 0xfffff804`4b8134a0
Debug session time: Thu Nov 23 10:02:45.027 2023 (UTC + 8:00)
System Uptime: 0 days 0:01:35.701
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
........
************* Symbol Loading Error Summary **************
Module name Error
ntoskrnl The system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
Unable to add extension DLL: kdexts
Unable to add extension DLL: kext
Unable to add extension DLL: exts
For analysis of this file, run !analyze -v
No .natvis files found at C:\Users\azs91\AppData\Local\Dbg\Visualizers.
Microsoft (R) Windows Debugger Version 10.0.22621.2506 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\112323-6937-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows 10 Kernel Version 22621 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22621.1.amd64fre.ni_release.220506-1250
Machine Name:
Kernel base = 0xfffff804`4ac00000 PsLoadedModuleList = 0xfffff804`4b8134a0
Debug session time: Thu Nov 23 10:02:45.027 2023 (UTC + 8:00)
System Uptime: 0 days 0:01:35.701
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
........
************* Symbol Loading Error Summary **************
Module name Error
ntoskrnl The system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
Unable to add extension DLL: kdexts
Unable to add extension DLL: kext
Unable to add extension DLL: exts
For analysis of this file, run !analyze -v
