系统最近频繁蓝屏

刚子qwadsad — Thu, 17 Nov 2022 08:20:37 GMT

系统最近频繁蓝屏

Windows Debugger 分析结果如下：

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Dump completed successfully, progress percentage: 100

************* Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 22000 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 22000.1.amd64fre.co_release.210604-1628
Machine Name:
Kernel base = 0xfffff805`13000000 PsLoadedModuleList = 0xfffff805`13c29a40
Debug session time: Thu Nov 17 15:29:37.747 2022 (UTC + 8:00)
System Uptime: 0 days 22:00:23.557
Loading Kernel Symbols
...............................................................
................................................................
.................................................Page 4464da not present in the dump file. Type ".hh dbgerr004" for details
.....Page 12eab3 not present in the dump file. Type ".hh dbgerr004" for details
..........
.............................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`002b8018). Type ".hh dbgerr001" for details
Loading unloaded module list
..................................................
For analysis of this file, run !analyze -v
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory

Debugging Details:
------------------

Unable to load image \??\C:\WINDOWS\system32\Drivers\SURE_Engine.sys, Win32 error 0n2
Unable to load image \SystemRoot\system32\DRIVERS\rtf64x64.sys, Win32 error 0n2
Unable to load image \SystemRoot\System32\drivers\SangforVnic.sys, Win32 error 0n2

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 9155

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 43132

Key : Analysis.Init.CPU.mSec
Value: 2562

Key : Analysis.Init.Elapsed.mSec
Value: 179369

Key : Analysis.Memory.CommitPeak.Mb
Value: 138

Key : WER.OS.Branch
Value: co_release

Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key : WER.OS.Version
Value: 10.0.22000.1

FILE_IN_CAB: MEMORY.DMP

DUMP_FILE_ATTRIBUTES: 0x1000

BUGCHECK_CODE: d1

BUGCHECK_P1: 0

BUGCHECK_P2: 2

BUGCHECK_P3: 8

BUGCHECK_P4: 0

READ_ADDRESS: 0000000000000000

PROCESS_NAME: SangforServiceClient.exe

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

TRAP_FRAME: ffff9c09067d5a20 -- (.trap 0xffff9c09067d5a20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff810646e5d0a0 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=ffff9c09067d5bb8 rbp=0000000000000016
r8=ffff9c09067d5d80 r9=0000000000000018 r10=0000000000000016
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
00000000`00000000 ?? ???
Resetting default scope

IP_IN_FREE_BLOCK: 0

FAILED_INSTRUCTION_ADDRESS:
+0
STACK_TEXT:
ffff9c09`067d5bb8 fffff805`4da93707 : 00000000`00000000 ffff8106`46e5d0a0 ffff8106`420ac390 ffff8106`46e5d0a0 : 0x0
ffff9c09`067d5bc0 fffff805`2944175e : ffff8106`46e5d010 ffff8106`3c7c3a50 ffff9c09`067d5d60 ffff8106`1fd18470 : SURE_Engine+0x3707
ffff9c09`067d5c60 fffff805`16b222cb : 00000000`00000000 00000000`00000000 ffff8106`1feb5000 00000000`00000000 : tdx!TdxEventReceiveMessagesTransportAddress+0x34e
ffff9c09`067d5e60 fffff805`16b2099d : ffff8106`4a0a9210 ffff9c09`067d6180 ffff8106`4a0a9211 ffff8106`1fd18470 : tcpip!UdpDeliverDatagrams+0x2fb
ffff9c09`067d6080 fffff805`16b1fd70 : ffff8106`418ef7c0 00000000`00000000 ffff8106`1fdb9c20 00000000`00000001 : tcpip!UdpReceiveDatagrams+0xc1d
ffff9c09`067d62e0 fffff805`16af4063 : 00000000`00000001 ffff6211`112bc056 00000000`00009411 fffff805`16ced250 : tcpip!UdpNlClientReceiveDatagrams+0x10
ffff9c09`067d6310 fffff805`16af3e59 : ffff8106`1feb5000 ffff9c09`00000011 ffff8106`418ef940 ffff9c09`067d6460 : tcpip!IppProcessDeliverList+0xb3
ffff9c09`067d6400 fffff805`16af50aa : fffff805`16ced250 ffff8106`1fe748a0 ffff8106`1feb5000 ffff8106`1feb5000 : tcpip!IppReceiveHeaderBatch+0x3a9
ffff9c09`067d64f0 fffff805`16b4700e : ffff8106`37fbff00 00000000`00000000 ffff9c09`067d6600 00000000`00000000 : tcpip!IppReceivePackets+0x36a
ffff9c09`067d6600 fffff805`16b44f78 : ffff8106`37fbff00 ffff8106`37792700 fffff805`16b535f0 ffff9c09`067d69d0 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x29e
ffff9c09`067d6700 fffff805`132a3f48 : 00000000`00000001 fffff805`16b44de0 ffff8106`47c0d080 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x198
ffff9c09`067d6840 fffff805`132a3ebd : fffff805`16b44de0 ffff9c09`067d69f0 ffff8106`1fcc9130 00000000`00000001 : nt!KeExpandKernelStackAndCalloutInternal+0x78
ffff9c09`067d68b0 fffff805`16b52e9d : 00000029`87980009 ffff8106`426ff560 ffff8106`426ff3d0 ffff8106`426ff3d0 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffff9c09`067d68f0 fffff805`16b5261c : 00000000`00000001 ffff9c09`067d6a50 ffff8106`37792770 ffff8106`426ff6f0 : tcpip!NetioExpandKernelStackAndCallout+0x8d
ffff9c09`067d6950 fffff805`16872d6c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!FlReceiveNetBufferListChain+0x5ec
ffff9c09`067d6c40 fffff805`168727f0 : ffff8106`37d93460 ffff8106`418ef700 ffff8106`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x15c
ffff9c09`067d6d20 fffff805`168a48dc : ffff8106`378e51a0 ffff8106`00000000 ffff8106`378e51a0 fffff805`13424216 : ndis!ndisMTopReceiveNetBufferLists+0x240
ffff9c09`067d6e00 fffff805`168a6da9 : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000000 : ndis!ndisInvokeNextReceiveHandler+0x54
ffff9c09`067d6e60 fffff805`295c14c7 : 00000000`00000000 00000000`00000000 ffff8106`00000000 00000000`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x305b9
ffff9c09`067d6f10 fffff805`168a4869 : 00000000`00000000 ffff8106`23e320d0 00000000`00000000 ffff9c09`067d7188 : rtf64x64+0x14c7
ffff9c09`067d6fb0 fffff805`168a42eb : 00000000`000060e8 ffff9c09`067d70d0 00000000`00000000 fffff805`13268ea5 : ndis!ndisCallReceiveHandler+0xb9
ffff9c09`067d7000 fffff805`168a8be0 : ffff9c09`067d70e8 00000000`00000000 ffff9c09`067d7140 ffff9c09`067d7190 : ndis!ndisCallNextDatapathHandler<2,void * __ptr64 & __ptr64,void (__cdecl*& __ptr64)(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long),void * __ptr64 & __ptr64,_NET_BUFFER_LIST * __ptr64 & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64>+0x3f
ffff9c09`067d7050 fffff805`168a4963 : ffff8106`418ef7c0 fffff805`00000000 00000000`00000001 00000000`00000000 : ndis!ndisExpandDataPathStack<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0xae
ffff9c09`067d70f0 fffff805`168a6da9 : 00000000`00000000 ffff9c09`067d7261 00000000`00000001 00000000`00000000 : ndis!ndisInvokeNextReceiveHandler+0xdb
ffff9c09`067d7150 fffff805`16e912dc : ffff8106`418ef700 ffff8106`1ff5a080 ffff9c09`00000000 ffff8106`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x305b9
ffff9c09`067d7200 fffff805`168a4869 : ffffc6d1`00000001 ffff8106`418ef7c0 ffff8106`378e5100 00000000`00000001 : wfplwfs!LwfLowerRecvNetBufferLists+0x14c
ffff9c09`067d72c0 fffff805`168a42eb : 00000000`000063f8 ffff9c09`067d73e0 00000000`00000000 fffff805`13268ea5 : ndis!ndisCallReceiveHandler+0xb9
ffff9c09`067d7310 fffff805`168a8be0 : ffff9c09`067d73f8 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisCallNextDatapathHandler<2,void * __ptr64 & __ptr64,void (__cdecl*& __ptr64)(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long),void * __ptr64 & __ptr64,_NET_BUFFER_LIST * __ptr64 & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64>+0x3f
ffff9c09`067d7360 fffff805`168a4963 : ffff8106`418ef7c0 00000000`00000000 00000000`00000001 00000000`00000000 : ndis!ndisExpandDataPathStack<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0xae
ffff9c09`067d7400 fffff805`16934341 : 00000000`00000000 ffff9c09`067d74d8 ffff8106`418ef7c0 00000000`00000000 : ndis!ndisInvokeNextReceiveHandler+0xdb
ffff9c09`067d7460 fffff805`16935f9f : ffff9c09`067d7500 ffff9c09`067d7568 00000000`00000000 00000000`00000001 : ndis!ndisMIndicatePacketsToNetBufferLists+0x171
ffff9c09`067d7520 fffff805`16935c11 : ffffc6e3`00000000 ffff8106`3792f650 ffffa201`f3688a2d ffff9c09`0000000e : ndis!ndisLWM5IndicateReceive+0x37f
ffff9c09`067d75d0 fffff805`29b73938 : ffff8106`3792f650 ffff8106`00000000 fffff805`1695b050 00000000`00000000 : ndis!EthIndicateReceive+0x31
ffff9c09`067d7620 fffff805`16878030 : ffff8106`37d93a50 fffff805`1695b050 ffff8106`37d93a50 ffff8106`37d93900 : SangforVnic+0x3938
ffff9c09`067d7730 fffff805`13242665 : ffff8106`48c13c40 ffff9c09`067d7821 00000000`00000001 00000000`00000001 : ndis!ndisDummyIrpHandler+0x100
ffff9c09`067d7780 fffff805`136941b2 : ffff8106`48c13c40 00000000`00000001 ffff9c09`067d7821 ffff8106`40dd2080 : nt!IofCallDriver+0x55
ffff9c09`067d77c0 fffff805`136cbf28 : ffff8106`37d93900 ffff8106`48c13d58 00000000`06f2f100 ffff8106`48c13c40 : nt!IopSynchronousServiceTail+0x1d2
ffff9c09`067d7870 fffff805`1342f985 : ffff8106`45b7bee0 00000000`000003ec 00000000`00000001 00000000`06f2f264 : nt!NtWriteFile+0x8d8
ffff9c09`067d7970 00000000`772a1cf3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`06e3f0c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772a1cf3

STACK_COMMAND: .trap 0xffff9c09067d5a20 ; kb

SYMBOL_NAME: SURE_Engine+3707

MODULE_NAME: SURE_Engine

IMAGE_NAME: SURE_Engine.sys

BUCKET_ID_FUNC_OFFSET: 3707

FAILURE_BUCKET_ID: AV_CODE_AV_NULL_IP_SURE_Engine!unknown_function

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {97bef196-986b-49da-ec97-da0f34c38224}

Followup: MachineOwner
---------

回复：系统最近频繁蓝屏

y2kim — Thu, 17 Nov 2022 12:19:26 GMT

系统桌面按Win+R打开运行，输入

powershell

按键盘ctrl+shift+回车

或者按键盘ctrl+shift，鼠标点确定

命令行打开显示PS C:\Windows\system32>则是成功以管理员运行打开了powershell，否则以上重试

在命令行窗口中复制粘贴下面命令回车

(Get-Item (gwmi win32_systemdriver | ? caption -match 'realtek').pathname).versioninfo;(Get-Item C:\WINDOWS\system32\Drivers\SURE_Engine.sys).versioninfo

命令行窗口的内容文字可以鼠标全选之后回车完成复制。或者点窗口左上角，从菜单选择全选，然后回车完成复制。复制成功后粘贴回复出来。

该主题

系统最近频繁蓝屏

回复： 系统最近频繁蓝屏

回复：系统最近频繁蓝屏