Microsoft (R) Windows Debugger Version 10.0.22549.1000 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\040122-11625-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 19041 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Machine Name: Kernel base = 0xfffff806`4a000000 PsLoadedModuleList = 0xfffff806`4ac2a2d0 Debug session time: Fri Apr 1 18:09:32.418 2022 (UTC 8:00) System Uptime: 0 days 4:45:24.151 Loading Kernel Symbols .. Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. ............................................................. ................................................................ ................................................................ ................ Loading User Symbols Loading unloaded module list ............... For analysis of this file, run !analyze -v nt!ObfDereferenceObjectWithTag 0x35: fffff806`4a2082c5 488b5c2440 mov rbx,qword ptr [rsp 40h] ss:0018:00000000`739154b0=???????????????? 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the BugCheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate use .tss on the part before the colon, then kv. Else if kv shows a trapframe use .trap on that value Else .trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap) Endif kb will then show the corrected stack. Arguments: Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT Arg2: fffff8064e89de50 Arg3: 0000000073915470 Arg4: fffff8064a2082c5 Debugging Details: ------------------ KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 8061 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 13664 Key : Analysis.Init.CPU.mSec Value: 2406 Key : Analysis.Init.Elapsed.mSec Value: 49846 Key : Analysis.Memory.CommitPeak.Mb Value: 92 FILE_IN_CAB: 040122-11625-01.dmp DUMP_FILE_ATTRIBUTES: 0x8 Kernel Generated Triage Dump BUGCHECK_CODE: 7f BUGCHECK_P1: 8 BUGCHECK_P2: fffff8064e89de50 BUGCHECK_P3: 73915470 BUGCHECK_P4: fffff8064a2082c5 BAD_STACK_POINTER: 0000000073915470 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: msedge.exe STACK_TEXT: 00000000`73915470 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObfDereferenceObjectWithTag 0x35 SYMBOL_NAME: nt!ObfDereferenceObjectWithTag 35 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe IMAGE_VERSION: 10.0.19041.1620 STACK_COMMAND: .cxr; .ecxr ; kb BUCKET_ID_FUNC_OFFSET: 35 FAILURE_BUCKET_ID: 0x7f_8_STACKPTR_ERROR_nt!ObfDereferenceObjectWithTag OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {6a4a1b12-f466-6871-8df2-a99b3b1590f6} Followup: MachineOwner --------- 0: kd> lmvm nt Browse full module list start end module name fffff806`4a000000 fffff806`4b046000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\F7CAAA94CB0E01AE142BBD2FC8634CD41\ntkrnlmp.pdb Loaded symbol image file: ntkrnlmp.exe Mapped memory image file: C:\ProgramData\Dbg\sym\ntkrnlmp.exe\1DBB86C21046000\ntkrnlmp.exe Image path: ntkrnlmp.exe Image name: ntkrnlmp.exe Browse all global symbols functions data Image was built with /Brepro flag. Timestamp: 1DBB86C2 (This is a reproducible build file hash, not a timestamp) CheckSum: 00A640E9 ImageSize: 01046000 File version: 10.0.19041.1620 Product version: 10.0.19041.1620 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 1.0 App File date: 00000000.00000000 Translations: 0409.04b0 Information from resource tables: CompanyName: Microsoft Corporation ProductName: Microsoft® Windows® Operating System InternalName: ntkrnlmp.exe OriginalFilename: ntkrnlmp.exe ProductVersion: 10.0.19041.1620 FileVersion: 10.0.19041.1620 (WinBuild.160101.0800) FileDescription: NT Kernel & System LegalCopyright: © Microsoft Corporation. All rights reserved.
Hi,I'mPaulandI'mheretohelpyouwithyourconcern.Theminidumpfiledidn'tnameanydriver.Itonlyindicatedasystemkerneldriver"ntkrnlmp.exe".Sinceit'sasystemfileitmeanssomethingelsedroveitintoafault.Itcouldbehardware,software,oradriver.DoyouhaveotherminidumpfilesthatIcanalsoanalyze?Ifyouhave,uploadthemtoOneDriveorGoogleDrivethensharethelinkhere.Thanks.此是否有帮助？是否抱歉，这没有帮助。太棒了！感谢你的反馈。你对此的满意度如何?感谢你的反馈，它能帮助改进网站。你对此的满意度如何?感谢你的反馈。
嗨，保罗，来帮助你解决你的问题的。minidump文件没有命名任何驱动程序。它只表示一个系统内核驱动程序“ntkrnlmp.exe”。由于它是一个系统文件，这意味着其他东西导致它出现故障。它可以是硬件、软件或驱动程序。您还有其他我可以分析的小型转储文件吗？如果有，请将它们上传到OneDrive或GoogleDrive，然后在此处分享链接。谢谢。此是否有帮助？是否抱歉，这没有帮助。太棒了！感谢你的反馈。你对此的满意度如何?感谢你的反馈，它能帮助改进网站。你对此的满意度如何?感谢你的反馈。
