吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 3205|回复: 2
收起左侧

救救孩子吧,莫名其妙的蓝屏,有dmp文件,麻烦大佬进来帮忙分析分析

[复制链接]
han474380076 发表于 2021-7-28 23:27
使用论坛附件上传样本压缩包时必须使用压缩密码保护,压缩密码:52pojie,否则会导致论坛被杀毒软件等误报,论坛有权随时删除相关附件和帖子!
病毒分析分区附件样本、网址谨慎下载点击,可能对计算机产生破坏,仅供安全人员在法律允许范围内研究,禁止非法用途!
禁止求非法渗透测试、非法网络攻击、获取隐私等违法内容,即使对方是非法内容,也应向警方求助!
25吾爱币
真是不知道为什么,同样的硬件我装机的,装了4台,就这一台莫名其妙蓝屏,救救孩子 好 几次的代码,全都放进去了
https://wwr.lanzoui.com/iKtfsryxmhi


发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

 楼主| han474380076 发表于 2021-7-28 23:29
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000030, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff803192cbde1, address which referenced memory

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 1

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on DESKTOP-RVB6HTI

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 1

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 66

    Key  : Analysis.System
    Value: CreateObject


DUMP_FILE_ATTRIBUTES: 0x8
  Kernel Generated Triage Dump

BUGCHECK_CODE:  a

BUGCHECK_P1: 0

BUGCHECK_P2: ff

BUGCHECK_P3: 30

BUGCHECK_P4: fffff803192cbde1

READ_ADDRESS: fffff8031963f338: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8031958adf8: Unable to get Flags value from nt!KdVersionBlock
0000000000000000

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

TRAP_FRAME:  ffffdf0111377790 -- (.trap 0xffffdf0111377790)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffb30ab1616c90
rdx=ffffb30ab163b9b0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803192cbde1 rsp=ffffdf0111377920 rbp=0000000000001d00
r8=0000000000000000  r9=ffffb30ab1616c50 r10=ffffdf0111358100
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl zr na po nc
nt!PpmIdlePrepare+0x3f1:
fffff803`192cbde1 448828          mov     byte ptr [rax],r13b ds:00000000`00000000=??
Resetting default scope

STACK_TEXT:  
ffffdf01`11377648 fffff803`19406329 : 00000000`0000000a 00000000`00000000 00000000`000000ff 00000000`00000030 : nt!KeBugCheckEx
ffffdf01`11377650 fffff803`1940346c : ffffb30a`ae02ec00 fffff801`8cb24a12 00000000`00000076 ffffdf01`11377968 : nt!KiBugCheckDispatch+0x69
ffffdf01`11377790 fffff803`192cbde1 : 00000000`0004c4b4 00000000`00001d10 ffffdf01`11358180 ffffffff`ffffffff : nt!KiPageFault+0x42c
ffffdf01`11377920 fffff803`192c9f47 : fffff803`192c8950 014a5cfc`014a5cfc 00000000`00000001 00000000`00000001 : nt!PpmIdlePrepare+0x3f1
ffffdf01`11377b00 fffff803`193f990c : ffffffff`00000000 ffffdf01`11358180 ffffdf01`11368400 ffffb30a`d68ef800 : nt!PoIdle+0x1b7
ffffdf01`11377c60 00000000`00000000 : ffffdf01`11378000 ffffdf01`11372000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c


SYMBOL_NAME:  nt!PpmIdlePrepare+3f1

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.14393.4169

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  3f1

FAILURE_BUCKET_ID:  AV_nt!PpmIdlePrepare

OS_VERSION:  10.0.14393.4169

BUILDLAB_STR:  rs1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {dd7d0096-4602-c4e5-a984-978d6ab3aa71}

Followup:     MachineOwner
---------

yunlongzhuhuo 发表于 2021-11-14 22:07
ntkrnlmp.exe引起蓝屏,可以搭配蓝屏代码百度一下
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告:本版块禁止灌水或回复与主题无关内容,违者重罚!

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2024-5-21 04:54

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表