系统最近频繁蓝屏 Windows Debugger 分析结果如下： Microsoft (R) Windows Debugger Version 10.0.22621.755 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\MEMORY.DMP] Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available. Dump completed successfully, progress percentage: 100 ************* Path validation summary ************** Response Time (ms) Location Deferred SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 10 Kernel Version 22000 MP (12 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Edition build lab: 22000.1.amd64fre.co_release.210604-1628 Machine Name: Kernel base = 0xfffff805`13000000 PsLoadedModuleList = 0xfffff805`13c29a40 Debug session time: Thu Nov 17 15:29:37.747 2022 (UTC + 8:00) System Uptime: 0 days 22:00:23.557 Loading Kernel Symbols ............................................................... ................................................................ .................................................Page 4464da not present in the dump file. Type ".hh dbgerr004" for details .....Page 12eab3 not present in the dump file. Type ".hh dbgerr004" for details .......... ............................................. Loading User Symbols PEB is paged out (Peb.Ldr = 00000000`002b8018). Type ".hh dbgerr001" for details Loading unloaded module list .................................................. For analysis of this file, run !analyze -v 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000000000000, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000008, value 0 = read operation, 1 = write operation Arg4: 0000000000000000, address which referenced memory Debugging Details: ------------------ Unable to load image \??\C:\WINDOWS\system32\Drivers\SURE_Engine.sys, Win32 error 0n2 Unable to load image \SystemRoot\system32\DRIVERS\rtf64x64.sys, Win32 error 0n2 Unable to load image \SystemRoot\System32\drivers\SangforVnic.sys, Win32 error 0n2 KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 9155 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 43132 Key : Analysis.Init.CPU.mSec Value: 2562 Key : Analysis.Init.Elapsed.mSec Value: 179369 Key : Analysis.Memory.CommitPeak.Mb Value: 138 Key : WER.OS.Branch Value: co_release Key : WER.OS.Timestamp Value: 2021-06-04T16:28:00Z Key : WER.OS.Version Value: 10.0.22000.1 FILE_IN_CAB: MEMORY.DMP DUMP_FILE_ATTRIBUTES: 0x1000 BUGCHECK_CODE: d1 BUGCHECK_P1: 0 BUGCHECK_P2: 2 BUGCHECK_P3: 8 BUGCHECK_P4: 0 READ_ADDRESS: 0000000000000000 PROCESS_NAME: SangforServiceClient.exe BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 TRAP_FRAME: ffff9c09067d5a20 -- (.trap 0xffff9c09067d5a20) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffff810646e5d0a0 rbx=0000000000000000 rcx=0000000000000000 rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000 rip=0000000000000000 rsp=ffff9c09067d5bb8 rbp=0000000000000016 r8=ffff9c09067d5d80 r9=0000000000000018 r10=0000000000000016 r11=0000000000000001 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac po cy 00000000`00000000 ?? ??? Resetting default scope IP_IN_FREE_BLOCK: 0 FAILED_INSTRUCTION_ADDRESS: +0 STACK_TEXT: ffff9c09`067d5bb8 fffff805`4da93707 : 00000000`00000000 ffff8106`46e5d0a0 ffff8106`420ac390 ffff8106`46e5d0a0 : 0x0 ffff9c09`067d5bc0 fffff805`2944175e : ffff8106`46e5d010 ffff8106`3c7c3a50 ffff9c09`067d5d60 ffff8106`1fd18470 : SURE_Engine+0x3707 ffff9c09`067d5c60 fffff805`16b222cb : 00000000`00000000 00000000`00000000 ffff8106`1feb5000 00000000`00000000 : tdx!TdxEventReceiveMessagesTransportAddress+0x34e ffff9c09`067d5e60 fffff805`16b2099d : ffff8106`4a0a9210 ffff9c09`067d6180 ffff8106`4a0a9211 ffff8106`1fd18470 : tcpip!UdpDeliverDatagrams+0x2fb ffff9c09`067d6080 fffff805`16b1fd70 : ffff8106`418ef7c0 00000000`00000000 ffff8106`1fdb9c20 00000000`00000001 : tcpip!UdpReceiveDatagrams+0xc1d ffff9c09`067d62e0 fffff805`16af4063 : 00000000`00000001 ffff6211`112bc056 00000000`00009411 fffff805`16ced250 : tcpip!UdpNlClientReceiveDatagrams+0x10 ffff9c09`067d6310 fffff805`16af3e59 : ffff8106`1feb5000 ffff9c09`00000011 ffff8106`418ef940 ffff9c09`067d6460 : tcpip!IppProcessDeliverList+0xb3 ffff9c09`067d6400 fffff805`16af50aa : fffff805`16ced250 ffff8106`1fe748a0 ffff8106`1feb5000 ffff8106`1feb5000 : tcpip!IppReceiveHeaderBatch+0x3a9 ffff9c09`067d64f0 fffff805`16b4700e : ffff8106`37fbff00 00000000`00000000 ffff9c09`067d6600 00000000`00000000 : tcpip!IppReceivePackets+0x36a ffff9c09`067d6600 fffff805`16b44f78 : ffff8106`37fbff00 ffff8106`37792700 fffff805`16b535f0 ffff9c09`067d69d0 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x29e ffff9c09`067d6700 fffff805`132a3f48 : 00000000`00000001 fffff805`16b44de0 ffff8106`47c0d080 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x198 ffff9c09`067d6840 fffff805`132a3ebd : fffff805`16b44de0 ffff9c09`067d69f0 ffff8106`1fcc9130 00000000`00000001 : nt!KeExpandKernelStackAndCalloutInternal+0x78 ffff9c09`067d68b0 fffff805`16b52e9d : 00000029`87980009 ffff8106`426ff560 ffff8106`426ff3d0 ffff8106`426ff3d0 : nt!KeExpandKernelStackAndCalloutEx+0x1d ffff9c09`067d68f0 fffff805`16b5261c : 00000000`00000001 ffff9c09`067d6a50 ffff8106`37792770 ffff8106`426ff6f0 : tcpip!NetioExpandKernelStackAndCallout+0x8d ffff9c09`067d6950 fffff805`16872d6c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!FlReceiveNetBufferListChain+0x5ec ffff9c09`067d6c40 fffff805`168727f0 : ffff8106`37d93460 ffff8106`418ef700 ffff8106`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0x15c ffff9c09`067d6d20 fffff805`168a48dc : ffff8106`378e51a0 ffff8106`00000000 ffff8106`378e51a0 fffff805`13424216 : ndis!ndisMTopReceiveNetBufferLists+0x240 ffff9c09`067d6e00 fffff805`168a6da9 : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000000 : ndis!ndisInvokeNextReceiveHandler+0x54 ffff9c09`067d6e60 fffff805`295c14c7 : 00000000`00000000 00000000`00000000 ffff8106`00000000 00000000`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x305b9 ffff9c09`067d6f10 fffff805`168a4869 : 00000000`00000000 ffff8106`23e320d0 00000000`00000000 ffff9c09`067d7188 : rtf64x64+0x14c7 ffff9c09`067d6fb0 fffff805`168a42eb : 00000000`000060e8 ffff9c09`067d70d0 00000000`00000000 fffff805`13268ea5 : ndis!ndisCallReceiveHandler+0xb9 ffff9c09`067d7000 fffff805`168a8be0 : ffff9c09`067d70e8 00000000`00000000 ffff9c09`067d7140 ffff9c09`067d7190 : ndis!ndisCallNextDatapathHandler<2,void * __ptr64 & __ptr64,void (__cdecl*& __ptr64)(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long),void * __ptr64 & __ptr64,_NET_BUFFER_LIST * __ptr64 & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64>+0x3f ffff9c09`067d7050 fffff805`168a4963 : ffff8106`418ef7c0 fffff805`00000000 00000000`00000001 00000000`00000000 : ndis!ndisExpandDataPathStack<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0xae ffff9c09`067d70f0 fffff805`168a6da9 : 00000000`00000000 ffff9c09`067d7261 00000000`00000001 00000000`00000000 : ndis!ndisInvokeNextReceiveHandler+0xdb ffff9c09`067d7150 fffff805`16e912dc : ffff8106`418ef700 ffff8106`1ff5a080 ffff9c09`00000000 ffff8106`00000001 : ndis!NdisFIndicateReceiveNetBufferLists+0x305b9 ffff9c09`067d7200 fffff805`168a4869 : ffffc6d1`00000001 ffff8106`418ef7c0 ffff8106`378e5100 00000000`00000001 : wfplwfs!LwfLowerRecvNetBufferLists+0x14c ffff9c09`067d72c0 fffff805`168a42eb : 00000000`000063f8 ffff9c09`067d73e0 00000000`00000000 fffff805`13268ea5 : ndis!ndisCallReceiveHandler+0xb9 ffff9c09`067d7310 fffff805`168a8be0 : ffff9c09`067d73f8 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisCallNextDatapathHandler<2,void * __ptr64 & __ptr64,void (__cdecl*& __ptr64)(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long),void * __ptr64 & __ptr64,_NET_BUFFER_LIST * __ptr64 & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64,unsigned long & __ptr64>+0x3f ffff9c09`067d7360 fffff805`168a4963 : ffff8106`418ef7c0 00000000`00000000 00000000`00000001 00000000`00000000 : ndis!ndisExpandDataPathStack<2,void __cdecl(void * __ptr64,_NET_BUFFER_LIST * __ptr64,unsigned long,unsigned long,unsigned long)>+0xae ffff9c09`067d7400 fffff805`16934341 : 00000000`00000000 ffff9c09`067d74d8 ffff8106`418ef7c0 00000000`00000000 : ndis!ndisInvokeNextReceiveHandler+0xdb ffff9c09`067d7460 fffff805`16935f9f : ffff9c09`067d7500 ffff9c09`067d7568 00000000`00000000 00000000`00000001 : ndis!ndisMIndicatePacketsToNetBufferLists+0x171 ffff9c09`067d7520 fffff805`16935c11 : ffffc6e3`00000000 ffff8106`3792f650 ffffa201`f3688a2d ffff9c09`0000000e : ndis!ndisLWM5IndicateReceive+0x37f ffff9c09`067d75d0 fffff805`29b73938 : ffff8106`3792f650 ffff8106`00000000 fffff805`1695b050 00000000`00000000 : ndis!EthIndicateReceive+0x31 ffff9c09`067d7620 fffff805`16878030 : ffff8106`37d93a50 fffff805`1695b050 ffff8106`37d93a50 ffff8106`37d93900 : SangforVnic+0x3938 ffff9c09`067d7730 fffff805`13242665 : ffff8106`48c13c40 ffff9c09`067d7821 00000000`00000001 00000000`00000001 : ndis!ndisDummyIrpHandler+0x100 ffff9c09`067d7780 fffff805`136941b2 : ffff8106`48c13c40 00000000`00000001 ffff9c09`067d7821 ffff8106`40dd2080 : nt!IofCallDriver+0x55 ffff9c09`067d77c0 fffff805`136cbf28 : ffff8106`37d93900 ffff8106`48c13d58 00000000`06f2f100 ffff8106`48c13c40 : nt!IopSynchronousServiceTail+0x1d2 ffff9c09`067d7870 fffff805`1342f985 : ffff8106`45b7bee0 00000000`000003ec 00000000`00000001 00000000`06f2f264 : nt!NtWriteFile+0x8d8 ffff9c09`067d7970 00000000`772a1cf3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 00000000`06e3f0c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772a1cf3 STACK_COMMAND: .trap 0xffff9c09067d5a20 ; kb SYMBOL_NAME: SURE_Engine+3707 MODULE_NAME: SURE_Engine IMAGE_NAME: SURE_Engine.sys BUCKET_ID_FUNC_OFFSET: 3707 FAILURE_BUCKET_ID: AV_CODE_AV_NULL_IP_SURE_Engine!unknown_function OS_VERSION: 10.0.22000.1 BUILDLAB_STR: co_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {97bef196-986b-49da-ec97-da0f34c38224} Followup: MachineOwner ---------