通过

windows server 2012 R2 Standard蓝屏分析日志，请求帮助定位问题。

匿名
2023-12-04T01:49:04+00:00

Microsoft (R) Windows Debugger Version 10.0.22621.2428 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\86949\Downloads\MEMORY\MEMORY.DMP]

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*

Executable search path is:

Windows 8.1 Kernel Version 9600 MP (4 procs) Free x64

Product: Server, suite: TerminalServer

Edition build lab: 9600.17041.amd64fre.winblue_gdr.140305-1710

Machine Name:

Kernel base = 0xfffff8006ee78000 PsLoadedModuleList = 0xfffff8006f1422d0

Debug session time: Thu Nov 30 20:18:44.001 2023 (UTC + 8:00)

System Uptime: 0 days 4:03:40.739

Loading Kernel Symbols

...............................................................

................................................................

.................

Loading User Symbols

Loading unloaded module list

.....

For analysis of this file, run !analyze -v

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except.

Typically the address is just plain bad or it is pointing at freed memory.

Arguments:

Arg1: ffffe00085e54000, memory referenced.

Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.

Arg3: fffff8008daab2d8, If non-zero, the instruction address which referenced the bad memory 

address.

Arg4: 0000000000000000, (reserved)

Debugging Details:

KEY_VALUES_STRING: 1 

Key  : AV.Type 

Value: Write 

Key  : Analysis.CPU.mSec 

Value: 2796 

Key  : Analysis.DebugAnalysisManager 

Value: Create 

Key  : Analysis.Elapsed.mSec 

Value: 7378 

Key  : Analysis.Init.CPU.mSec 

Value: 5046 

Key  : Analysis.Init.Elapsed.mSec 

Value: 123597 

Key  : Analysis.Memory.CommitPeak.Mb 

Value: 91 

Key  : WER.OS.Branch 

Value: winblue\_gdr 

Key  : WER.OS.Timestamp 

Value: 2014-03-05T17:10:00Z 

Key  : WER.OS.Version 

Value: 8.1.9600.17041

FILE_IN_CAB: MEMORY.DMP

BUGCHECK_CODE: 50

BUGCHECK_P1: ffffe00085e54000

BUGCHECK_P2: 1

BUGCHECK_P3: fffff8008daab2d8

BUGCHECK_P4: 0

WRITE_ADDRESS: ffffe00085e54000 Nonpaged pool

MM_INTERNAL_CODE: 0

IMAGE_NAME: srv.sys

MODULE_NAME: srv

FAULTING_MODULE: fffff8008da35000 srv

PROCESS_NAME: System

TRAP_FRAME: ffffd001e5da7720 -- (.trap 0xffffd001e5da7720)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000000000000 rbx=0000000000000000 rcx=ffffe00085e54000

rdx=ffffc0007b7fa09a rsi=0000000000000000 rdi=0000000000000000

rip=fffff8008daab2d8 rsp=ffffd001e5da78b0 rbp=ffffc0007b7fa095

r8=0000000000000000 r9=0000000000000000 r10=0000000000000801

r11=ffffe00085e54000 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei ng nz na po nc

srv!SrvOs2FeaToNt+0x48:

fffff8008daab2d8 c60300 mov byte ptr [rbx],0 ds:0000000000000000=??

Resetting default scope

STACK_TEXT:

ffffd001e5da7538 fffff8006effd0e7 : 0000000000000050 ffffe00085e54000 0000000000000001 ffffd001e5da7720 : nt!KeBugCheckEx

ffffd001e5da7540 fffff8006eedf9c9 : 0000000000000001 ffffe000855ab040 ffffd001e5da7720 0000000000000011 : nt! ?? ::FNODOBFM::`string'+0x20c37

ffffd001e5da75e0 fffff8006efd622f : 0000000000000001 ffffe00085e54000 0000000000010f00 ffffd001e5da7720 : nt!MmAccessFault+0x7a9

ffffd001e5da7720 fffff8008daab2d8 : 0000000000010fe8 0000000000000018 ffffd001e5da79d8 ffffd001e5da79d0 : nt!KiPageFault+0x12f

ffffd001e5da78b0 fffff8008daab21d : ffffc0007b7fa095 ffffe00085e53ff8 4465366266613539 ffffc0007b7fa138 : srv!SrvOs2FeaToNt+0x48

ffffd001e5da78e0 fffff8008daba9df : ffffe000855d8e40 0000000000000000 ffffc0007b7ea010 fffff8006f15e180 : srv!SrvOs2FeaListToNt+0x125

ffffd001e5da7930 fffff8008da80cc7 : 0000000000000000 fffff80000010fe8 ffffe00085e43010 ffffe000855d8e40 : srv!SrvSmbOpen2+0xc3

ffffd001e5da79d0 fffff8008dac068e : ffffc0007b7ea010 0000000000001000 ffffe0008559e6a0 ffffe000855d8e40 : srv!ExecuteTransaction+0x117

ffffd001e5da7a10 fffff8008da37d6d : ffffe00000000000 fffff80000000000 fffff80000000035 fffff7800000f3d0 : srv!SrvSmbTransactionSecondary+0x40b

ffffd001e5da7ab0 fffff8008da37c54 : fffff8008da53010 ffffe000855d98b0 ffffe000855d8e40 ffffe00000000000 : srv!SrvProcessSmb+0xdd

ffffd001e5da7b30 fffff8008da8d7e1 : ffffe000855a89a0 000000000000000a 0000000000000009 ffffe000855d8e50 : srv!SrvRestartReceive+0xc4

ffffd001e5da7b70 fffff8006f392ca6 : 0000000000000000 ffffe000855d8e40 0000000000000000 ffffc00020206f49 : srv!WorkerThread+0x111

ffffd001e5da7bd0 fffff8006ef47794 : ffffe000855ab040 ffffe000855ab040 0000000000000000 ffffe000835782d0 : nt!IopThreadStart+0x26

ffffd001e5da7c00 fffff8006efd25c6 : ffffd001e38da180 ffffe000855ab040 ffffe00084de1080 fffff8006ef6c61b : nt!PspSystemThreadStartup+0x58

ffffd001e5da7c60 0000000000000000 : ffffd001e5da8000 ffffd001e5da1000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x16

SYMBOL_NAME: srv!SrvOs2FeaToNt+48

STACK_COMMAND: .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET: 48

FAILURE_BUCKET_ID: AV_W_(null)_srv!SrvOs2FeaToNt

OS_VERSION: 8.1.9600.17041

BUILDLAB_STR: winblue_gdr

OSPLATFORM_TYPE: x64

OSNAME: Windows 8.1

FAILURE_ID_HASH: {76d8dedf-2864-2055-350f-9d345eca667c}

Followup: MachineOwner

Windows 商业版 | Windows Server | 性能 | 系统性能

锁定的问题。 此问题已从 Microsoft 支持社区迁移。 你可投票决定它是否有用，但不能添加评论或回复，也不能关注问题。 为了保护隐私，对于已迁移的问题，用户个人资料是匿名的。

0 个注释

1 个答案

排序依据： 非常有帮助
非常有帮助 最新 最早
  1. 匿名
    2023-12-04T07:10:00+00:00

    Hello

    Thank you for posting in Microsoft Community forum.

    It looks like you've got a detailed crash dump analysis report here, specifically related to a PAGE_FAULT_IN_NONPAGED_AREA (error code 50) on a Windows 8.1 system. This particular crash seems to involve the srv.sys driver, which is associated with the server service in Windows.

    The error indicates that there was an attempt to access invalid memory, possibly pointing to freed memory or a bad memory address. The arguments provided in the report (such as the memory referenced, operation type, and instruction address) help in diagnosing the issue.

    The debugging information mentions that the instruction at address fffff8008daab2d8 attempted to write to a memory address in the non-paged pool (ffffe00085e54000), which led to the crash.

    Here's a breakdown of the information in the report:

    Bugcheck Parameters:

    Arg1: Memory referenced (ffffe00085e54000)

    Arg2: Operation type (1 for write operation)

    Arg3: Instruction address that referenced bad memory

    Arg4: Reserved

    Faulting Module: srv.sys

    Process Name: System (The crash occurred within the system process)

    Stack Trace: It provides a trace of the function calls before the crash, indicating where the issue occurred.

    Failure Bucket ID: This gives more information about the type of error and the function offset where the error occurred within the srv.sys module.

    OS Version: Windows 8.1

    From the analysis, it seems like there might be a problem with the srv.sys driver attempting to write to an invalid memory address, causing the system to crash.

    Troubleshooting steps might involve:

    1. Driver Updates: Ensuring all drivers, especially the srv.sys driver, are up-to-date.
    2. Memory Tests: Running diagnostics to check for any issues with RAM.
    3. System File Checker: Using tools like SFC to scan and repair system files.
    4. Examining Recent Changes: Any recent software or hardware changes could be related; reverting changes might help.

    If this is a recurring issue, checking for specific updates, patches, or hotfixes related to srv.sys or similar reported issues might provide a solution.

    0 个注释