如何使用 Windbg 排查出 Win10 蓝屏原因？

[gakuen]

最近经常蓝屏，蓝屏代码每次都一样，但是又不怎么会用 Windbg。

求大神指教一下如何使用 Windbg。

顺便附上 DMP 文件：

链接： https://pan.baidu.com/s/1k0MyWlv-cmdes7Bm7I2Viw

提取码：53c9

在顺便贴点 DMP 信息：

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff8015eddfbae, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff8015eddfbae, address which referenced memory

TRAP_FRAME:  ffffb78a58ba9450 -- (.trap 0xffffb78a58ba9450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000334000 rbx=0000000000000000 rcx=00000000c0000100
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8015eddfbae rsp=ffffb78a58ba95e0 rbp=000024edbd9bbfff
 r8=ffffb98be2cc3080  r9=0000000000000002 r10=0000000100000092
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
fffff801`5eddfbae ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80118ddd869 to fffff80118dcc130

FAILED_INSTRUCTION_ADDRESS: 
+0
fffff801`5eddfbae ??              ???

STACK_TEXT:  
ffffb78a`58ba9308 fffff801`18ddd869 : 00000000`0000000a fffff801`5eddfbae 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
ffffb78a`58ba9310 fffff801`18dd9c8e : 000024ed`bd9bbfff ffffb78a`58ba9600 ffffb98b`00000001 ffffb98b`00000000 : nt!KiBugCheckDispatch+0x69
ffffb78a`58ba9450 fffff801`5eddfbae : 000024ed`bd9bbfff 00000000`00000000 fffff801`00000001 ffffa700`00000000 : nt!KiPageFault+0x44e
ffffb78a`58ba95e0 000024ed`bd9bbfff : 00000000`00000000 fffff801`00000001 ffffa700`00000000 fffff801`18c1b000 : 0xfffff801`5eddfbae
ffffb78a`58ba95e8 00000000`00000000 : fffff801`00000001 ffffa700`00000000 fffff801`18c1b000 00000000`00000000 : 0x000024ed`bd9bbfff


THREAD_SHA1_HASH_MOD_FUNC:  bf99962f16aee8a6a536cfcc5454c0cd4db15ac9

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  2053c9cd60dcbe7f477419e6aee8664b1711298a

THREAD_SHA1_HASH_MOD:  2a7ca9d3ab5386d53fea7498e1d81b9c4a4c036b

FOLLOWUP_IP: 
nt!KiPageFault+44e
fffff801`18dd9c8e 33c0            xor     eax,eax

FAULT_INSTR_CODE:  ffb0c033

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+44e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

[q9339]

下雨 跳闸，win10 蓝屏 无法进入桌面。。 只能重装吗？

[xomix]

http://cnm.buhuibaidu.me/?s=windbg%20%E8%93%9D%E5%B1%8F

[kuichieh]

貌似 steam 和驱动的问题?
我的方法是设置 symbol search path 为 srv*d:\xxx*https://msdl.microsoft.com/download/symbols => open crash dump => !analyze -v


Debugging Details:
------------------


KEY_VALUES_STRING: 1


STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 17763.1.amd64fre.rs5_release.180914-1434

DUMP_TYPE: 2

BUGCHECK_P1: fffff8015eddfbae

BUGCHECK_P2: 2

BUGCHECK_P3: 8

BUGCHECK_P4: fffff8015eddfbae

READ_ADDRESS: fffff8011915e390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8015eddfbae

CURRENT_IRQL: 2

FAULTING_IP:
+0
fffff801`5eddfbae ?? ???

CPU_COUNT: c

CPU_MHZ: c78

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: a

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

BUGCHECK_STR: AV

PROCESS_NAME: Steam.exe

[ashong]

以前经历过类似问题， 看看是不是某个 usb 外设导致的， 另外就是磁盘损坏导致 pagefile 受损， 试试检查磁盘并修复，禁用 pagefile 试试

[yksoft1ex]

记得如果是第三方驱动挂了，用 BlueScreenView 这个小工具就能看到 stack 里面的模块名。

[gakuen]

@kuichieh 应该不是 steam 问题，其它几次蓝屏，触发程序都不是同一个。