BLOG

我的Windows11的csrss.exe导致蓝屏

我的电脑一开始是正常待机状态,然后我点击鼠标试图唤醒电脑,但是发现电脑自动重启。

采用WinDBG分析dmp文件内容如下:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\070724-14156-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 7 Kernel Version 22621 MP (20 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Machine Name:

Kernel base = 0xfffff8014de00000 PsLoadedModuleList = 0xfffff8014ea13530

Debug session time: Sun Jul 7 00:40:55.892 2024 (UTC + 8:00)

System Uptime: 0 days 13:48:08.600

Loading Kernel Symbols

...............................................................

................................................................

................................................................

................................................................

..............................................

Loading User Symbols

Loading unloaded module list

.......................

Cannot read PEB32 from WOW64 TEB32 0002a6a8 - Win32 error 0n30

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19C, {50, ffff8104f4b4b080, 0, 0}

Probably caused by : Unknown_Image ( PAGE_NOT_ZERO )

Followup: MachineOwner

*** Memory manager detected 173736 instance(s) of page corruption, target is likely to have memory corruption.

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Unknown bugcheck code (19c)

Unknown bugcheck description

Arguments:

Arg1: 0000000000000050

Arg2: ffff8104f4b4b080

Arg3: 0000000000000000

Arg4: 0000000000000000

Debugging Details:

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x19C

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

BAD_PAGES_DETECTED: 2a6a8

LAST_CONTROL_TRANSFER: from fffff8014e2faa1a to fffff8014e215ea0

STACK_TEXT:

ffffe5807b157808 fffff8014e2faa1a : 000000000000019c 0000000000000050 ffff8104f4b4b080 0000000000000000 : nt!KeBugCheckEx

ffffe5807b157810 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!PopWatchdogWorker+0x12a0aa

STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner

*** Memory manager detected 173736 instance(s) of page corruption, target is likely to have memory corruption.

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Unknown bugcheck code (19c)

Unknown bugcheck description

Arguments:

Arg1: 0000000000000050

Arg2: ffff8104f4b4b080

Arg3: 0000000000000000

Arg4: 0000000000000000

Debugging Details:

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x19C

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

BAD_PAGES_DETECTED: 2a6a8

LAST_CONTROL_TRANSFER: from fffff8014e2faa1a to fffff8014e215ea0

STACK_TEXT:

ffffe5807b157808 fffff8014e2faa1a : 000000000000019c 0000000000000050 ffff8104f4b4b080 0000000000000000 : nt!KeBugCheckEx

ffffe5807b157810 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!PopWatchdogWorker+0x12a0aa

STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner

*** Memory manager detected 173736 instance(s) of page corruption, target is likely to have memory corruption.

我的dmp原始文件下载地址如下:

链接: https://pan.baidu.com/s/1MFlX8jtoG0DxyWnEulCs8Q?pwd=0000

提取码: 0000