Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Fri Nov 7 10:08:04.781 2014 (UTC + 8:00)
System Uptime: 0 days 0:12:25.479
Loading Kernel Symbols
...............................................................
................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd800c). Type ".hh dbgerr001" for details
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 1, 80523800}
*** ERROR: Module load completed but symbols could not be loaded for 360rosdrv.sys
Probably caused by : 360rosdrv.sys
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80523800, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 00000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRemovePageByColor+66
80523800 ff08 dec dword ptr [eax]
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xA
PROCESS_NAME: StormPlayer.exe
TRAP_FRAME: ab44134c -- (.trap 0xffffffffab44134c)
ErrCode = 00000000
eax=02600000 ebx=e152e458 ecx=00001000 edx=fffff000 esi=02400000 edi=02600000
eip=80617561 esp=ab4413c0 ebp=ab4413c8 iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!ProbeForWrite+0x39:
80617561 8a06 mov al,byte ptr [esi] ds:0023:02400000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from 80523800 to 8054580c
STACK_TEXT:
ab44118c 80523800 badb0d00 00000003 ab4411f4 nt!KiTrap0E+0x180
ab44121c 80523b98 00000001 00000003 c0600090 nt!MiRemovePageByColor+0x66
ab441238 80515c1f c0600090 00000000 00000000 nt!MiRemoveZeroPage+0x8a
ab441250 80517683 c0012000 c0600090 89816020 nt!MiResolveDemandZeroFault+0xc5
ab4412c8 80521555 00000000 c0012000 c0600090 nt!MiDispatchFault+0x145
ab441334 8054575c 00000000 02400000 00000000 nt!MmAccessFault+0xa7d
ab441334 80617561 00000000 02400000 00000000 nt!KiTrap0E+0xd0
ab4413c8 bf84258e 02340048 002bfb00 00000004 nt!ProbeForWrite+0x39
ab441448 805427e8 b5011015 1d050f7f 00000000 win32k!NtGdiGetDIBitsInternal+0x218
ab441448 7c92e514 b5011015 1d050f7f 00000000 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b4ee00 00000000 00000000 00000000 00000000 0x7c92e514
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804ff7c7-804ff7cb 5 bytes - nt!KiDispatchException+305
[ a1 70 d6 55 80:e9 a0 fb 95 39 ]
805055d4-805055d5 2 bytes - nt!KiServiceTable+64 (+0x5e0d)
[ 64 d5:a9 66 ]
805055d7 - nt!KiServiceTable+67 (+0x03)
[ 80:ac ]
80505604-80505607 4 bytes - nt!KiServiceTable+94 (+0x2d)
[ a2 a0 57 80:6a 07 e1 ae ]
80505614-80505617 4 bytes - nt!KiServiceTable+a4 (+0x10)
[ 6a 52 62 80:d3 6b 5b ac ]
80505638-8050563b 4 bytes - nt!KiServiceTable+c8 (+0x24)
[ fc c3 5a 80:cc f6 5b ac ]
80505644-80505647 4 bytes - nt!KiServiceTable+d4 (+0x0c)
[ 68 20 5d 80:72 08 5c ac ]
80505654-80505657 4 bytes - nt!KiServiceTable+e4 (+0x10)
[ b2 4c 64 80:11 06 5c ac ]
80505668-8050566f 8 bytes - nt!KiServiceTable+f8 (+0x14)
[ 4a 7c 57 80 06 57 62 80:00 06 e1 ae bc 60 5b ac ]
80505674-80505677 4 bytes - nt!KiServiceTable+104 (+0x0c)
[ d6 58 62 80:e6 61 5b ac ]
80505679-8050567b 3 bytes - nt!KiServiceTable+109 (+0x05)
[ a2 57 80:6d 5c ac ]
8050568c-8050568f 4 bytes - nt!KiServiceTable+11c (+0x13)
[ b6 5a 62 80:c2 1f 5d ac ]
80505694-80505697 4 bytes - nt!KiServiceTable+124 (+0x08)
[ 20 5d 62 80:b2 0e 5d ac ]
805056bc-805056c3 8 bytes - nt!KiServiceTable+14c (+0x28)
[ e6 3f 5b 80 9c a2 57 80:e0 06 5c ac 60 77 5c ac ]
805056e4-805056e5 2 bytes - nt!KiServiceTable+174 (+0x28)
[ 9e 94:92 54 ]
805056e7 - nt!KiServiceTable+177 (+0x03)
[ 80:ac ]
805056f4-805056f7 4 bytes - nt!KiServiceTable+184 (+0x0d)
[ 72 51 58 80:33 5e 5c ac ]
80505740-80505743 4 bytes - nt!KiServiceTable+1d0 (+0x4c)
[ a0 b1 57 80:24 09 e1 ae ]
8050574c-8050574f 4 bytes - nt!KiServiceTable+1dc (+0x0c)
[ 48 66 62 80:ad 10 5d ac ]
80505758-8050575b 4 bytes - nt!KiServiceTable+1e8 (+0x0c)
[ 86 c4 5c 80:04 85 b1 ab ]
80505764-80505767 4 bytes - nt!KiServiceTable+1f4 (+0x0c)
[ 20 b4 5a 80:53 42 5c ac ]
80505794-80505797 4 bytes - nt!KiServiceTable+224 (+0x30)
[ 52 94 5b 80:9a 86 b1 ab ]
8050579c-8050579f 4 bytes - nt!KiServiceTable+22c (+0x08)
[ f4 7e 57 80:f2 6a e1 ae ]
805057f0-805057f3 4 bytes - nt!KiServiceTable+280 (+0x54)
[ 8a 69 62 80:21 15 5d ac ]
80505834-80505837 4 bytes - nt!KiServiceTable+2c4 (+0x44)
[ 8e 34 62 80:45 71 5b ac ]
80505840-80505843 4 bytes - nt!KiServiceTable+2d0 (+0x0c)
[ 86 37 5d 80:af f5 5b ac ]
80505848-8050584b 4 bytes - nt!KiServiceTable+2d8 (+0x08)
[ 04 60 61 80:cb 54 5c ac ]
80505858-8050585b 4 bytes - nt!KiServiceTable+2e8 (+0x10)
[ f6 52 5b 80:d2 4e e0 ae ]
80505870-80505873 4 bytes - nt!KiServiceTable+300 (+0x18)
[ 8c 4c 62 80:b0 74 5b ac ]
80505890-80505893 4 bytes - nt!KiServiceTable+320 (+0x20)
[ aa 3d 5a 80:96 63 5c ac ]
805058a0-805058a3 4 bytes - nt!KiServiceTable+330 (+0x10)
[ 4a 6c 62 80:e8 66 5b ac ]
805058c4-805058c7 4 bytes - nt!KiServiceTable+354 (+0x24)
[ 4a 3c 5d 80:9a fb 5b ac ]
805058f0-805058f3 4 bytes - nt!KiServiceTable+380 (+0x2c)
[ 2e c0 57 80:44 05 e1 ae ]
80505900-80505903 4 bytes - nt!KiServiceTable+390 (+0x10)
[ d0 ee 5c 80:72 e9 5b ac ]
80505930-8050593b 12 bytes - nt!KiServiceTable+3c0 (+0x30)
[ 98 0e 61 80 18 4e 65 80:4f 48 5c ac 59 54 5c ac ]
8050594c-8050594f 4 bytes - nt!KiServiceTable+3dc (+0x1c)
[ dc 37 62 80:70 11 3b ba ]
80505954-80505957 4 bytes - nt!KiServiceTable+3e4 (+0x08)
[ 22 41 61 80:2d 47 5c ac ]
80505964-8050597f 28 bytes - nt!KiServiceTable+3f4 (+0x10)
[ 10 5b 5d 80 82 59 5d 80:1f fb 5b ac f0 f5 5b ac ]
8050599c-8050599f 4 bytes - nt!KiServiceTable+42c (+0x38)
[ 7c 3e 5b 80:85 06 5c ac ]
805059b8-805059bb 4 bytes - nt!KiServiceTable+448 (+0x1c)
[ 10 df 57 80:cd 5c 5c ac ]
805059c4-805059c5 2 bytes - nt!KiServiceTable+454 (+0x0c)
[ 00 54:2d f6 ]
805059c7 - nt!KiServiceTable+457 (+0x03)
[ 80:ac ]
805427c5-805427c9 5 bytes - nt!KiSystemServiceAccessTeb+28 (+0x3cdfe)
[ 2b e1 c1 e9 02:e9 16 97 d6 09 ]
8054573e-80545741 4 bytes - nt!KiTrap0E+b2 (+0x2f79)
[ ca 00 00 00:32 b1 91 39 ]
8054805c-80548061 6 bytes - nt!RtlpGetStackLimits (+0x291e)
[ 64 a1 08 00 00 00:e9 83 53 91 39 90 ]
805a2d0b-805a2d0d 3 bytes - nt!KeUserModeCallback+9
[ a0 f9 ff:90 86 2e ]
805b2e25-805b2e2b 7 bytes - nt!MmUnsecureVirtualMemory+13 (+0x1011a)
[ cc cc cc cc cc 8b ff:e9 10 87 8a 39 eb f9 ]
805b3e77-805b3e7d 7 bytes - nt!MmUnmapViewOfSection+17 (+0x1052)
[ cc cc cc cc cc 8b ff:e9 2a ff 84 2e eb f9 ]
805d3353-805d3354 2 bytes - nt!NtTerminateProcess+4b (+0x1f4dc)
[ b3 91:6b 18 ]
805d3356 - nt!NtTerminateProcess+4e (+0x03)
[ ff:2b ]
228 errors : !nt (804ff7c7-805d3356)
MODULE_NAME: 360rosdrv
IMAGE_NAME: 360rosdrv.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 54042f50
FOLLOWUP_NAME: MachineOwner
MEMORY_CORRUPTOR: PATCH_360rosdrv
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_PATCH_360rosdrv
BUCKET_ID: MEMORY_CORRUPTION_PATCH_360rosdrv
Followup: MachineOwner
---------
1: kd> lmvm 360rosdrv
start end module name
b9e57000 b9ea1780 360rosdrv (no symbols)
Loaded symbol image file: 360rosdrv.sys
Image path: 360rosdrv.sys
Image name: 360rosdrv.sys
Timestamp: Mon Sep 01 16:33:20 2014 (54042F50)
CheckSum: 00054969
ImageSize: 0004A780
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
1: kd> !process
PROCESS 89816020 SessionId: 0 Cid: 0d04 Peb: 7ffd8000 ParentCid: 07b4
DirBase: 0a890780 ObjectTable: e3222dd0 HandleCount: 112.
Image: StormPlayer.exe
VadRoot 8962c258 Vads 101 Clone 0 Private 2524. Modified 21. Locked 0.
DeviceMap e1c13670
Token e1756998
ElapsedTime 00:00:01.343
UserTime 00:00:00.187
KernelTime 00:00:00.062
QuotaPoolUsage[PagedPool] 90204
QuotaPoolUsage[NonPagedPool] 4920
Working Set Sizes (now,min,max) (3638, 50, 345) (14552KB, 200KB, 1380KB)
PeakWorkingSetSize 4656
VirtualSize 61 Mb
PeakVirtualSize 68 Mb
PageFaultCount 6324
MemoryPriority BACKGROUND
BasePriority 10
CommitCharge 3207
THREAD 8953d760 Cid 0d04.02dc Teb: 7ffdf000 Win32Thread: e1ff2008 WAIT: (WrUserRequest) UserMode Non-Alertable
89748178 SynchronizationEvent
THREAD 896c6400 Cid 0d04.0854 Teb: 7ffdd000 Win32Thread: e37d4008 RUNNING on processor 1
THREAD 8973c598 Cid 0d04.15d4 Teb: 7ffde000 Win32Thread: 00000000 WAIT: (WrLpcReceive) UserMode Non-Alertable
89ad5a08 Semaphore Limit 0x7fffffff
8973c688 NotificationTimer
THREAD 89f88450 Cid 0d04.0ae0 Teb: 7ffdc000 Win32Thread: 00000000 WAIT: (DelayExecution) UserMode Non-Alertable
89f88540 NotificationTimer
THREAD 89558aa8 Cid 0d04.0f70 Teb: 7ffdb000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
896a0b38 SynchronizationEvent
THREAD 896119e8 Cid 0d04.114c Teb: 7ffda000 Win32Thread: e3307ab0 WAIT: (UserRequest) UserMode Non-Alertable
8953e378 NotificationEvent
8a00c2d0 SynchronizationEvent
1: kd> !process
PROCESS 89816020 SessionId: 0 Cid: 0d04 Peb: 7ffd8000 ParentCid: 07b4
DirBase: 0a890780 ObjectTable: e3222dd0 HandleCount: 112.
Image: StormPlayer.exe
VadRoot 8962c258 Vads 101 Clone 0 Private 2524. Modified 21. Locked 0.
DeviceMap e1c13670
Token e1756998
ElapsedTime 00:00:01.343
UserTime 00:00:00.187
KernelTime 00:00:00.062
QuotaPoolUsage[PagedPool] 90204
QuotaPoolUsage[NonPagedPool] 4920
Working Set Sizes (now,min,max) (3638, 50, 345) (14552KB, 200KB, 1380KB)
PeakWorkingSetSize 4656
VirtualSize 61 Mb
PeakVirtualSize 68 Mb
PageFaultCount 6324
MemoryPriority BACKGROUND
BasePriority 10
CommitCharge 3207
THREAD 8953d760 Cid 0d04.02dc Teb: 7ffdf000 Win32Thread: e1ff2008 WAIT: (WrUserRequest) UserMode Non-Alertable
89748178 SynchronizationEvent
THREAD 896c6400 Cid 0d04.0854 Teb: 7ffdd000 Win32Thread: e37d4008 RUNNING on processor 1
THREAD 8973c598 Cid 0d04.15d4 Teb: 7ffde000 Win32Thread: 00000000 WAIT: (WrLpcReceive) UserMode Non-Alertable
89ad5a08 Semaphore Limit 0x7fffffff
8973c688 NotificationTimer
THREAD 89f88450 Cid 0d04.0ae0 Teb: 7ffdc000 Win32Thread: 00000000 WAIT: (DelayExecution) UserMode Non-Alertable
89f88540 NotificationTimer
THREAD 89558aa8 Cid 0d04.0f70 Teb: 7ffdb000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
896a0b38 SynchronizationEvent
THREAD 896119e8 Cid 0d04.114c Teb: 7ffda000 Win32Thread: e3307ab0 WAIT: (UserRequest) UserMode Non-Alertable
8953e378 NotificationEvent
8a00c2d0 SynchronizationEvent
1: kd> lmvm 360rosdrv
start end module name
b9e57000 b9ea1780 360rosdrv (no symbols)
Loaded symbol image file: 360rosdrv.sys
Image path: 360rosdrv.sys
Image name: 360rosdrv.sys
Timestamp: Mon Sep 01 16:33:20 2014 (54042F50)
CheckSum: 00054969
ImageSize: 0004A780
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
这是我用windbg分析出来的蓝屏记录，上面显示的好像和暴风影音和360某驱动有关，但是蓝屏是我加了一条内存条后才开始频繁的（后来拔了原先的内存留下新增的内存依然会蓝屏），跪求达人帮忙看看蓝屏是甚么引起的
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [E:\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Fri Nov 7 10:08:04.781 2014 (UTC + 8:00)
System Uptime: 0 days 0:12:25.479
Loading Kernel Symbols
...............................................................
................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd800c). Type ".hh dbgerr001" for details
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 1, 80523800}
*** ERROR: Module load completed but symbols could not be loaded for 360rosdrv.sys
Probably caused by : 360rosdrv.sys
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80523800, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 00000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRemovePageByColor+66
80523800 ff08 dec dword ptr [eax]
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xA
PROCESS_NAME: StormPlayer.exe
TRAP_FRAME: ab44134c -- (.trap 0xffffffffab44134c)
ErrCode = 00000000
eax=02600000 ebx=e152e458 ecx=00001000 edx=fffff000 esi=02400000 edi=02600000
eip=80617561 esp=ab4413c0 ebp=ab4413c8 iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!ProbeForWrite+0x39:
80617561 8a06 mov al,byte ptr [esi] ds:0023:02400000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from 80523800 to 8054580c
STACK_TEXT:
ab44118c 80523800 badb0d00 00000003 ab4411f4 nt!KiTrap0E+0x180
ab44121c 80523b98 00000001 00000003 c0600090 nt!MiRemovePageByColor+0x66
ab441238 80515c1f c0600090 00000000 00000000 nt!MiRemoveZeroPage+0x8a
ab441250 80517683 c0012000 c0600090 89816020 nt!MiResolveDemandZeroFault+0xc5
ab4412c8 80521555 00000000 c0012000 c0600090 nt!MiDispatchFault+0x145
ab441334 8054575c 00000000 02400000 00000000 nt!MmAccessFault+0xa7d
ab441334 80617561 00000000 02400000 00000000 nt!KiTrap0E+0xd0
ab4413c8 bf84258e 02340048 002bfb00 00000004 nt!ProbeForWrite+0x39
ab441448 805427e8 b5011015 1d050f7f 00000000 win32k!NtGdiGetDIBitsInternal+0x218
ab441448 7c92e514 b5011015 1d050f7f 00000000 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b4ee00 00000000 00000000 00000000 00000000 0x7c92e514
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804ff7c7-804ff7cb 5 bytes - nt!KiDispatchException+305
[ a1 70 d6 55 80:e9 a0 fb 95 39 ]
805055d4-805055d5 2 bytes - nt!KiServiceTable+64 (+0x5e0d)
[ 64 d5:a9 66 ]
805055d7 - nt!KiServiceTable+67 (+0x03)
[ 80:ac ]
80505604-80505607 4 bytes - nt!KiServiceTable+94 (+0x2d)
[ a2 a0 57 80:6a 07 e1 ae ]
80505614-80505617 4 bytes - nt!KiServiceTable+a4 (+0x10)
[ 6a 52 62 80:d3 6b 5b ac ]
80505638-8050563b 4 bytes - nt!KiServiceTable+c8 (+0x24)
[ fc c3 5a 80:cc f6 5b ac ]
80505644-80505647 4 bytes - nt!KiServiceTable+d4 (+0x0c)
[ 68 20 5d 80:72 08 5c ac ]
80505654-80505657 4 bytes - nt!KiServiceTable+e4 (+0x10)
[ b2 4c 64 80:11 06 5c ac ]
80505668-8050566f 8 bytes - nt!KiServiceTable+f8 (+0x14)
[ 4a 7c 57 80 06 57 62 80:00 06 e1 ae bc 60 5b ac ]
80505674-80505677 4 bytes - nt!KiServiceTable+104 (+0x0c)
[ d6 58 62 80:e6 61 5b ac ]
80505679-8050567b 3 bytes - nt!KiServiceTable+109 (+0x05)
[ a2 57 80:6d 5c ac ]
8050568c-8050568f 4 bytes - nt!KiServiceTable+11c (+0x13)
[ b6 5a 62 80:c2 1f 5d ac ]
80505694-80505697 4 bytes - nt!KiServiceTable+124 (+0x08)
[ 20 5d 62 80:b2 0e 5d ac ]
805056bc-805056c3 8 bytes - nt!KiServiceTable+14c (+0x28)
[ e6 3f 5b 80 9c a2 57 80:e0 06 5c ac 60 77 5c ac ]
805056e4-805056e5 2 bytes - nt!KiServiceTable+174 (+0x28)
[ 9e 94:92 54 ]
805056e7 - nt!KiServiceTable+177 (+0x03)
[ 80:ac ]
805056f4-805056f7 4 bytes - nt!KiServiceTable+184 (+0x0d)
[ 72 51 58 80:33 5e 5c ac ]
80505740-80505743 4 bytes - nt!KiServiceTable+1d0 (+0x4c)
[ a0 b1 57 80:24 09 e1 ae ]
8050574c-8050574f 4 bytes - nt!KiServiceTable+1dc (+0x0c)
[ 48 66 62 80:ad 10 5d ac ]
80505758-8050575b 4 bytes - nt!KiServiceTable+1e8 (+0x0c)
[ 86 c4 5c 80:04 85 b1 ab ]
80505764-80505767 4 bytes - nt!KiServiceTable+1f4 (+0x0c)
[ 20 b4 5a 80:53 42 5c ac ]
80505794-80505797 4 bytes - nt!KiServiceTable+224 (+0x30)
[ 52 94 5b 80:9a 86 b1 ab ]
8050579c-8050579f 4 bytes - nt!KiServiceTable+22c (+0x08)
[ f4 7e 57 80:f2 6a e1 ae ]
805057f0-805057f3 4 bytes - nt!KiServiceTable+280 (+0x54)
[ 8a 69 62 80:21 15 5d ac ]
80505834-80505837 4 bytes - nt!KiServiceTable+2c4 (+0x44)
[ 8e 34 62 80:45 71 5b ac ]
80505840-80505843 4 bytes - nt!KiServiceTable+2d0 (+0x0c)
[ 86 37 5d 80:af f5 5b ac ]
80505848-8050584b 4 bytes - nt!KiServiceTable+2d8 (+0x08)
[ 04 60 61 80:cb 54 5c ac ]
80505858-8050585b 4 bytes - nt!KiServiceTable+2e8 (+0x10)
[ f6 52 5b 80:d2 4e e0 ae ]
80505870-80505873 4 bytes - nt!KiServiceTable+300 (+0x18)
[ 8c 4c 62 80:b0 74 5b ac ]
80505890-80505893 4 bytes - nt!KiServiceTable+320 (+0x20)
[ aa 3d 5a 80:96 63 5c ac ]
805058a0-805058a3 4 bytes - nt!KiServiceTable+330 (+0x10)
[ 4a 6c 62 80:e8 66 5b ac ]
805058c4-805058c7 4 bytes - nt!KiServiceTable+354 (+0x24)
[ 4a 3c 5d 80:9a fb 5b ac ]
805058f0-805058f3 4 bytes - nt!KiServiceTable+380 (+0x2c)
[ 2e c0 57 80:44 05 e1 ae ]
80505900-80505903 4 bytes - nt!KiServiceTable+390 (+0x10)
[ d0 ee 5c 80:72 e9 5b ac ]
80505930-8050593b 12 bytes - nt!KiServiceTable+3c0 (+0x30)
[ 98 0e 61 80 18 4e 65 80:4f 48 5c ac 59 54 5c ac ]
8050594c-8050594f 4 bytes - nt!KiServiceTable+3dc (+0x1c)
[ dc 37 62 80:70 11 3b ba ]
80505954-80505957 4 bytes - nt!KiServiceTable+3e4 (+0x08)
[ 22 41 61 80:2d 47 5c ac ]
80505964-8050597f 28 bytes - nt!KiServiceTable+3f4 (+0x10)
[ 10 5b 5d 80 82 59 5d 80:1f fb 5b ac f0 f5 5b ac ]
8050599c-8050599f 4 bytes - nt!KiServiceTable+42c (+0x38)
[ 7c 3e 5b 80:85 06 5c ac ]
805059b8-805059bb 4 bytes - nt!KiServiceTable+448 (+0x1c)
[ 10 df 57 80:cd 5c 5c ac ]
805059c4-805059c5 2 bytes - nt!KiServiceTable+454 (+0x0c)
[ 00 54:2d f6 ]
805059c7 - nt!KiServiceTable+457 (+0x03)
[ 80:ac ]
805427c5-805427c9 5 bytes - nt!KiSystemServiceAccessTeb+28 (+0x3cdfe)
[ 2b e1 c1 e9 02:e9 16 97 d6 09 ]
8054573e-80545741 4 bytes - nt!KiTrap0E+b2 (+0x2f79)
[ ca 00 00 00:32 b1 91 39 ]
8054805c-80548061 6 bytes - nt!RtlpGetStackLimits (+0x291e)
[ 64 a1 08 00 00 00:e9 83 53 91 39 90 ]
805a2d0b-805a2d0d 3 bytes - nt!KeUserModeCallback+9
[ a0 f9 ff:90 86 2e ]
805b2e25-805b2e2b 7 bytes - nt!MmUnsecureVirtualMemory+13 (+0x1011a)
[ cc cc cc cc cc 8b ff:e9 10 87 8a 39 eb f9 ]
805b3e77-805b3e7d 7 bytes - nt!MmUnmapViewOfSection+17 (+0x1052)
[ cc cc cc cc cc 8b ff:e9 2a ff 84 2e eb f9 ]
805d3353-805d3354 2 bytes - nt!NtTerminateProcess+4b (+0x1f4dc)
[ b3 91:6b 18 ]
805d3356 - nt!NtTerminateProcess+4e (+0x03)
[ ff:2b ]
228 errors : !nt (804ff7c7-805d3356)
MODULE_NAME: 360rosdrv
IMAGE_NAME: 360rosdrv.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 54042f50
FOLLOWUP_NAME: MachineOwner
MEMORY_CORRUPTOR: PATCH_360rosdrv
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_PATCH_360rosdrv
BUCKET_ID: MEMORY_CORRUPTION_PATCH_360rosdrv
Followup: MachineOwner
---------
1: kd> lmvm 360rosdrv
start end module name
b9e57000 b9ea1780 360rosdrv (no symbols)
Loaded symbol image file: 360rosdrv.sys
Image path: 360rosdrv.sys
Image name: 360rosdrv.sys
Timestamp: Mon Sep 01 16:33:20 2014 (54042F50)
CheckSum: 00054969
ImageSize: 0004A780
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
1: kd> !process
PROCESS 89816020 SessionId: 0 Cid: 0d04 Peb: 7ffd8000 ParentCid: 07b4
DirBase: 0a890780 ObjectTable: e3222dd0 HandleCount: 112.
Image: StormPlayer.exe
VadRoot 8962c258 Vads 101 Clone 0 Private 2524. Modified 21. Locked 0.
DeviceMap e1c13670
Token e1756998
ElapsedTime 00:00:01.343
UserTime 00:00:00.187
KernelTime 00:00:00.062
QuotaPoolUsage[PagedPool] 90204
QuotaPoolUsage[NonPagedPool] 4920
Working Set Sizes (now,min,max) (3638, 50, 345) (14552KB, 200KB, 1380KB)
PeakWorkingSetSize 4656
VirtualSize 61 Mb
PeakVirtualSize 68 Mb
PageFaultCount 6324
MemoryPriority BACKGROUND
BasePriority 10
CommitCharge 3207
THREAD 8953d760 Cid 0d04.02dc Teb: 7ffdf000 Win32Thread: e1ff2008 WAIT: (WrUserRequest) UserMode Non-Alertable
89748178 SynchronizationEvent
THREAD 896c6400 Cid 0d04.0854 Teb: 7ffdd000 Win32Thread: e37d4008 RUNNING on processor 1
THREAD 8973c598 Cid 0d04.15d4 Teb: 7ffde000 Win32Thread: 00000000 WAIT: (WrLpcReceive) UserMode Non-Alertable
89ad5a08 Semaphore Limit 0x7fffffff
8973c688 NotificationTimer
THREAD 89f88450 Cid 0d04.0ae0 Teb: 7ffdc000 Win32Thread: 00000000 WAIT: (DelayExecution) UserMode Non-Alertable
89f88540 NotificationTimer
THREAD 89558aa8 Cid 0d04.0f70 Teb: 7ffdb000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
896a0b38 SynchronizationEvent
THREAD 896119e8 Cid 0d04.114c Teb: 7ffda000 Win32Thread: e3307ab0 WAIT: (UserRequest) UserMode Non-Alertable
8953e378 NotificationEvent
8a00c2d0 SynchronizationEvent
1: kd> !process
PROCESS 89816020 SessionId: 0 Cid: 0d04 Peb: 7ffd8000 ParentCid: 07b4
DirBase: 0a890780 ObjectTable: e3222dd0 HandleCount: 112.
Image: StormPlayer.exe
VadRoot 8962c258 Vads 101 Clone 0 Private 2524. Modified 21. Locked 0.
DeviceMap e1c13670
Token e1756998
ElapsedTime 00:00:01.343
UserTime 00:00:00.187
KernelTime 00:00:00.062
QuotaPoolUsage[PagedPool] 90204
QuotaPoolUsage[NonPagedPool] 4920
Working Set Sizes (now,min,max) (3638, 50, 345) (14552KB, 200KB, 1380KB)
PeakWorkingSetSize 4656
VirtualSize 61 Mb
PeakVirtualSize 68 Mb
PageFaultCount 6324
MemoryPriority BACKGROUND
BasePriority 10
CommitCharge 3207
THREAD 8953d760 Cid 0d04.02dc Teb: 7ffdf000 Win32Thread: e1ff2008 WAIT: (WrUserRequest) UserMode Non-Alertable
89748178 SynchronizationEvent
THREAD 896c6400 Cid 0d04.0854 Teb: 7ffdd000 Win32Thread: e37d4008 RUNNING on processor 1
THREAD 8973c598 Cid 0d04.15d4 Teb: 7ffde000 Win32Thread: 00000000 WAIT: (WrLpcReceive) UserMode Non-Alertable
89ad5a08 Semaphore Limit 0x7fffffff
8973c688 NotificationTimer
THREAD 89f88450 Cid 0d04.0ae0 Teb: 7ffdc000 Win32Thread: 00000000 WAIT: (DelayExecution) UserMode Non-Alertable
89f88540 NotificationTimer
THREAD 89558aa8 Cid 0d04.0f70 Teb: 7ffdb000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
896a0b38 SynchronizationEvent
THREAD 896119e8 Cid 0d04.114c Teb: 7ffda000 Win32Thread: e3307ab0 WAIT: (UserRequest) UserMode Non-Alertable
8953e378 NotificationEvent
8a00c2d0 SynchronizationEvent
1: kd> lmvm 360rosdrv
start end module name
b9e57000 b9ea1780 360rosdrv (no symbols)
Loaded symbol image file: 360rosdrv.sys
Image path: 360rosdrv.sys
Image name: 360rosdrv.sys
Timestamp: Mon Sep 01 16:33:20 2014 (54042F50)
CheckSum: 00054969
ImageSize: 0004A780
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
这是我用windbg分析出来的蓝屏记录，上面显示的好像和暴风影音和360某驱动有关，但是蓝屏是我加了一条内存条后才开始频繁的（后来拔了原先的内存留下新增的内存依然会蓝屏），跪求达人帮忙看看蓝屏是甚么引起的
