好友
阅读权限10
听众
最后登录1970-1-1
|
使用论坛附件上传样本压缩包时必须使用压缩密码保护,压缩密码:52pojie,否则会导致论坛被杀毒软件等误报,论坛有权随时删除相关附件和帖子! 病毒分析分区附件样本、网址谨慎下载点击,可能对计算机产生破坏,仅供安全人员在法律允许范围内研究,禁止非法用途! 禁止求非法渗透测试、非法网络攻击、获取隐私等违法内容,即使对方是非法内容,也应向警方求助!
本帖最后由 191904357AB 于 2024-1-8 13:02 编辑
- 2: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************IRQL_NOT_LESS_OR_EQUAL (a)An attempt was made to access a pageable (or completely invalid) address at aninterrupt request level (IRQL) that is too high. This is usuallycaused by drivers using improper addresses.If a kernel debugger is available get the stack backtrace.Arguments:Arg1: 0000000000027139, memory referencedArg2: 00000000000000ff, IRQLArg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)Arg4: fffff80629086390, address which referenced memoryDebugging Details:------------------KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 2359 Key : Analysis.Elapsed.mSec Value: 11443 Key : Analysis.IO.Other.Mb Value: 1 Key : Analysis.IO.Read.Mb Value: 0 Key : Analysis.IO.Write.Mb Value: 26 Key : Analysis.Init.CPU.mSec Value: 171 Key : Analysis.Init.Elapsed.mSec Value: 51935 Key : Analysis.Memory.CommitPeak.Mb Value: 95 Key : Bugcheck.Code.LegacyAPI Value: 0xa Key : Dump.Attributes.AsUlong Value: 1008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: AV_nt!EtwWriteEx Key : Failure.Hash Value: {5b5c208e-dd81-1cdb-9d06-c421e0ca4c60}BUGCHECK_CODE: aBUGCHECK_P1: 27139BUGCHECK_P2: ffBUGCHECK_P3: 0BUGCHECK_P4: fffff80629086390FILE_IN_CAB: 010624-12843-01.dmpDUMP_FILE_ATTRIBUTES: 0x1008 Kernel Generated Triage DumpREAD_ADDRESS: fffff80629b1d470: Unable to get MiVisibleStateUnable to get NonPagedPoolStartUnable to get NonPagedPoolEndUnable to get PagedPoolStartUnable to get PagedPoolEndunable to get nt!MmSpecialPagesInUse 0000000000027139 BLACKBOXBSD: 1 (!blackboxbsd)BLACKBOXNTFS: 1 (!blackboxntfs)BLACKBOXPNP: 1 (!blackboxpnp)BLACKBOXWINLOGON: 1CUSTOMER_CRASH_COUNT: 1PROCESS_NAME: SystemTRAP_FRAME: ffffa9068da53050 -- (.trap 0xffffa9068da53050)NOTE: The trap frame does not contain all registers.Some register values may be zeroed or incorrect.rax=ffff5d7775dc05d9 rbx=0000000000000000 rcx=0000000000000000rdx=fffff80628e0fd70 rsi=0000000000000000 rdi=0000000000000000rip=fffff80629086390 rsp=ffffa9068da531e0 rbp=0000000000027106 r8=0000000000000000 r9=0000000000000000 r10=0000fffff8062916r11=ffffa9068da53398 r12=0000000000000000 r13=0000000000000000r14=0000000000000000 r15=0000000000000000iopl=0 nv up di pl zr na po ncnt!EtwWriteEx:fffff806`29086390 4053 push rbxResetting default scopeSTACK_TEXT: ffffa906`8da52f08 fffff806`2922bfa9 : 00000000`0000000a 00000000`00027139 00000000`000000ff 00000000`00000000 : nt!KeBugCheckExffffa906`8da52f10 fffff806`29227634 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69ffffa906`8da53050 fffff806`29086390 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x474ffffa906`8da531e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff806`2916fad0 : nt!EtwWriteExSYMBOL_NAME: nt!EtwWriteEx+0MODULE_NAME: ntIMAGE_NAME: ntkrnlmp.exeIMAGE_VERSION: 10.0.22621.2715STACK_COMMAND: .cxr; .ecxr ; kbBUCKET_ID_FUNC_OFFSET: 0FAILURE_BUCKET_ID: AV_nt!EtwWriteExOSPLATFORM_TYPE: x64OSNAME: Windows 10FAILURE_ID_HASH: {5b5c208e-dd81-1cdb-9d06-c421e0ca4c60}Followup: MachineOwner---------
|
|
发帖前要善用【论坛搜索】功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。 |
|
|
|
|