devbox
AllinToyou
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

windbg抓一个windows蓝屏分析_windbg分析蓝屏教程

作者：AllinToyou | 2024-02-22 13:10:00

赞

踩

windbg分析蓝屏教程

前言

一直以来挺稳定，但还是小概率事件意外出现某machine突然蓝屏了。查看windows事件查看器提示计算机已经从检测错误后重新启动。检测错误: 0x0000009f (0x0000000000000003, 0xffffad0f4edc7570, 0xfffff8046a09ec20, 0xffffad0f4ef318a0)。已将转储的数据保存在: C:\Windows\MEMORY.DMP。

(注：纯知识总结分享，内容已脱敏。)

分析过程

蓝屏错误代码解释

首先查看微软csdn中关于蓝屏错误代码的解释：Bug 检查 0x9F：DRIVER_POWER_STATE_FAILUR，此 bug 检查表明驱动程序处于不一致或处于无效状态。

Bug 检查 0x9F DRIVER_POWER_STATE_FAILURE - Windows drivers | Microsoft Learn

 WinDbg工具使用

Windbg是在windows平台下，强大的用户态和内核态调试工具。相比较于Visual Studio，它是一个轻量级的调试工具，它的另外一个用途是可以用来分析dump数据。

Windbg的symbol file path设置：

srv*C:\symbols*http://msdl.microsoft.com/download/symbols

1.先使用!analyze -v 命令查看基础bug信息报告。 

  1. 0: kd> !analyze -v
  2. *******************************************************************************
  3. *                                                                             *
  4. *                        Bugcheck Analysis                                    *
  5. *                                                                             *
  6. *******************************************************************************
  7.  
  8. DRIVER_POWER_STATE_FAILURE (9f)
  9. A driver has failed to complete a power IRP within a specific time.
  10. Arguments:
  11. Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
  12. Arg2: ffffad0f4edc7570, Physical Device Object of the stack
  13. Arg3: fffff8046a09ec20, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
  14. Arg4: ffffad0f4ef318a0, The blocked IRP
  15.  
  16. Debugging Details:
  17. ------------------
  18.  
  19. Implicit thread is now ffffad0f`4e521040

查看线程的堆栈信息：

0: kd> .thread 0xffffad0f4e521040 ; kb

 从线程堆栈中看到，像是usb驱动层出了问题，通过调用 PoRequestPowerIrp 发送设备电源请求以响应系统电源请求。管理设备电源策略 - Windows drivers | Microsoft Learn

USBXHCI!Controller_WdfEvtPreprocessSetPowerIrp+0x14a

 2.使用 ！ irp 命令检查已阻止的 irp。 此 IRP 的地址位于 Arg4 中。 

3.使用带有 Arg2 地址的 ！ devstack 命令来显示与错误驱动程序关联的信息。

  

从以上过程看到，暴露出来了设备树ID,但是从这一长串中如何更进一步看到具体的设备？尤其是usb设备的vid和pid等信息。 

4.使用！devnode 扩展显示有关设备树中节点的信息。

注意图中红色标注的child地址，接下来继续展开节点查看信息： 

 再接着展开：

接着展开查看： 

最终显示如下，是一个hid类型的输入设备，设备硬件ID是"HID\VID_03EB&PID_8A6E&MI_00\8&5bc49fe&0&0000"。

 那么最终大致确定出问题的可能是这个hid设备驱动异常导致的，如何在设备上找到具体是哪个硬件设备？在电脑设备管理器中能找一找，但是相要看到更全面的usb设备信息，推荐使用UsbTreeView工具。

 UsbTreeView工具使用

UsbTreeView是Windows下的一款关于USB描述符分析的工具，可以显示USB设备的一系列属性值。其中包括驱动路径，和inf配置文件路径。总共几百k大小，免安装解压可以直接使用，非常小巧。该工具有以下特点：

  • 实时显示USB设备的连接状态。
  • 以树状的形式显示连接到PC机中的所有USB设备，集线器和控制器。
  • 可完美的分析连接到PC机中USB设备的各类USB描述符信息。
  • 支持USB1.0/USB2.0/USB3.x规范协议分析。
  • 支持对UVC,UAC，HID设备的描述符信息分析。

UsbTreeView的下载地址：Uwe Sieber's Homepage 

使用UsbTreeView可以看到电脑中的USB设备树，左边为设备的树状状系，右边为设备的详细信息。 

 最后附上完整的windbg日志：

  1. Microsoft (R) Windows Debugger Version 10.0.14321.1024 X86
  2. Copyright (c) Microsoft Corporation. All rights reserved.
  3.  
  4.  
  5. Loading Dump File [D:\Users\Administrator\Desktop\test\log\MEMORY.DMP]
  6. Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
  7.  
  8.  
  9. ************* Symbol Path validation summary **************
  10. Response                         Time (ms)     Location
  11. Deferred                                       srv*C:\symbols*http://msdl.microsoft.com/download/symbols
  12. Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols
  13. Executable search path is: 
  14. Windows 10 Kernel Version 17763 MP (4 procs) Free x64
  15. Product: WinNt, suite: TerminalServer SingleUserTS
  16. Built by: 17763.1.amd64fre.rs5_release.180914-1434
  17. Machine Name:
  18. Kernel base = 0xfffff804`678b6000 PsLoadedModuleList = 0xfffff804`67ccc490
  19. Debug session time: Wed Jan 11 04:20:50.968 2023 (UTC + 8:00)
  20. System Uptime: 8 days 19:36:27.847
  21. Loading Kernel Symbols
  22. ...............................................................
  23. ................................................................
  24. ..........................................................
  25. Loading User Symbols
  26. PEB is paged out (Peb.Ldr = 00000000`00216018).  Type ".hh dbgerr001" for details
  27. Loading unloaded module list
  28. ........
  29. *******************************************************************************
  30. *                                                                             *
  31. *                        Bugcheck Analysis                                    *
  32. *                                                                             *
  33. *******************************************************************************
  34.  
  35. Use !analyze -v to get detailed debugging information.
  36.  
  37. BugCheck 9F, {3, ffffad0f4edc7570, fffff8046a09ec20, ffffad0f4ef318a0}
  38.  
  39. Implicit thread is now ffffad0f`4e521040
  40. Page 40100 not present in the dump file. Type ".hh dbgerr004" for details
  41. Page 40100 not present in the dump file. Type ".hh dbgerr004" for details
  42. Page 40100 not present in the dump file. Type ".hh dbgerr004" for details
  43. Probably caused by : memory_corruption
  44.  
  45. Followup:     memory_corruption
  46. ---------
  47.  
  48. 0: kd> !analyze -v
  49. *******************************************************************************
  50. *                                                                             *
  51. *                        Bugcheck Analysis                                    *
  52. *                                                                             *
  53. *******************************************************************************
  54.  
  55. DRIVER_POWER_STATE_FAILURE (9f)
  56. A driver has failed to complete a power IRP within a specific time.
  57. Arguments:
  58. Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
  59. Arg2: ffffad0f4edc7570, Physical Device Object of the stack
  60. Arg3: fffff8046a09ec20, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
  61. Arg4: ffffad0f4ef318a0, The blocked IRP
  62.  
  63. Debugging Details:
  64. ------------------
  65.  
  66. Implicit thread is now ffffad0f`4e521040
  67. Page 40100 not present in the dump file. Type ".hh dbgerr004" for details
  68. Page 40100 not present in the dump file. Type ".hh dbgerr004" for details
  69. Page 40100 not present in the dump file. Type ".hh dbgerr004" for details
  70.  
  71. DUMP_CLASS: 1
  72.  
  73. DUMP_QUALIFIER: 401
  74.  
  75. BUILD_VERSION_STRING:  17763.1.amd64fre.rs5_release.180914-1434
  76.  
  77. SYSTEM_MANUFACTURER:  To be filled by O.E.M.
  78.  
  79. SYSTEM_PRODUCT_NAME:  To be filled by O.E.M.
  80.  
  81. SYSTEM_SKU:  To be filled by O.E.M.
  82.  
  83. SYSTEM_VERSION:  To be filled by O.E.M.
  84.  
  85. BIOS_VENDOR:  American Megatrends Inc.
  86.  
  87. BIOS_VERSION:  4.6.5
  88.  
  89. BIOS_DATE:  01/19/2021
  90.  
  91. BASEBOARD_MANUFACTURER:  INTEL Corporation
  92.  
  93. BASEBOARD_PRODUCT:  MAHOBAY
  94.  
  95. BASEBOARD_VERSION:  To be filled by O.E.M.
  96.  
  97. DUMP_TYPE:  1
  98.  
  99. BUGCHECK_P1: 3
  100.  
  101. BUGCHECK_P2: ffffad0f4edc7570
  102.  
  103. BUGCHECK_P3: fffff8046a09ec20
  104.  
  105. BUGCHECK_P4: ffffad0f4ef318a0
  106.  
  107. DRVPOWERSTATE_SUBCODE:  3
  108.  
  109. FAULTING_THREAD:  4e521040
  110.  
  111. CPU_COUNT: 4
  112.  
  113. CPU_MHZ: c15
  114.  
  115. CPU_VENDOR:  GenuineIntel
  116.  
  117. CPU_FAMILY: 6
  118.  
  119. CPU_MODEL: 3a
  120.  
  121. CPU_STEPPING: 9
  122.  
  123. CPU_MICROCODE: 6,3a,9,0 (F,M,S,R)  SIG: 21'00000000 (cache) 21'00000000 (init)
  124.  
  125. DEFAULT_BUCKET_ID:  CODE_CORRUPTION
  126.  
  127. BUGCHECK_STR:  0x9F
  128.  
  129. PROCESS_NAME:  LoadPointUI.exe
  130.  
  131. CURRENT_IRQL:  2
  132.  
  133. ANALYSIS_SESSION_HOST:  DESKTOP-3GQMSDN
  134.  
  135. ANALYSIS_SESSION_TIME:  01-29-2023 09:36:00.0108
  136.  
  137. ANALYSIS_VERSION: 10.0.14321.1024 x86fre
  138.  
  139. DPC_STACK_BASE:  FFFFF8046A09EFB0
  140.  
  141. LAST_CONTROL_TRANSFER:  from fffff804679e23a8 to fffff80467a74ba6
  142.  
  143. STACK_TEXT:  
  144. ffff8b84`2a61ac60 fffff804`679e23a8 : ffffad0f`5d7d5080 ffff8b84`2a61add8 ffffad0f`4e521040 00000000`00000000 : nt!KiSwapContext+0x76
  145. ffff8b84`2a61ada0 fffff804`67a221ba : ffffad0f`00000000 ffff8b84`2a61ae90 00000000`00000000 00000000`00000000 : nt!KeSetSystemGroupAffinityThread+0x268
  146. ffff8b84`2a61ae20 fffff804`67a22085 : 00000000`6e696f49 ffff8b84`00000000 ffffad0f`4edc7570 00000000`00000000 : nt!KiAcquireInterruptConnectLock+0x42
  147. ffff8b84`2a61ae60 fffff804`67a21ed8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiConnectInterrupt+0x85
  148. ffff8b84`2a61aed0 fffff804`67fbc2b9 : ffff8b84`2a61b004 ffff8b84`2a61b030 ffffad0f`75dc7e10 00000000`00000004 : nt!KeConnectInterrupt+0x58
  149. ffff8b84`2a61af30 fffff804`67fbbf0a : ffff8b84`2a61b168 fffff804`6a3140a0 00000000`00000000 ffffad0f`51112bc0 : nt!IopConnectInterrupt+0x30d
  150. ffff8b84`2a61b080 fffff804`6a32356c : ffffad0f`4ef618b0 00000000`00000000 ffffad0f`51112bc0 ffffad0f`4ef038b0 : nt!IoConnectInterruptEx+0x1da
  151. ffff8b84`2a61b160 fffff804`6a3233fa : ffffad0f`51112bc0 ffffad0f`4ef4cc90 ffffad0f`4ef038b0 fffff804`6a3151ca : Wdf01000!FxInterrupt::ConnectInternal+0xd4 [minkernel\wdf\framework\shared\irphandlers\pnp\km\interruptobjectkm.cpp @ 173]
  152. ffff8b84`2a61b1e0 fffff804`6a323623 : ffffad0f`51112d78 00000000`00000000 ffffad0f`51112bc0 ffff8b84`2a61b308 : Wdf01000!FxInterrupt::Connect+0x62 [minkernel\wdf\framework\shared\irphandlers\pnp\interruptobject.cpp @ 1263]
  153. ffff8b84`2a61b270 fffff804`6a3218a6 : ffffad0f`4ef038b0 ffff8b84`2a61b3e0 00000000`00000000 fffff804`6a3aa518 : Wdf01000!FxPkgPnp::PowerWakingConnectInterrupt+0x93 [minkernel\wdf\framework\shared\irphandlers\pnp\powerstatemachine.cpp @ 3614]
  154. ffff8b84`2a61b2e0 fffff804`6a320c6c : ffffad0f`4ef03ab0 ffffad0f`00000000 ffffad0f`4ef03a88 ffffad0f`4ed59a00 : Wdf01000!FxPkgPnp::PowerProcessEventInner+0x1f6 [minkernel\wdf\framework\shared\irphandlers\pnp\powerstatemachine.cpp @ 1557]
  155. ffff8b84`2a61b450 fffff804`6a31ffb9 : 00000000`00000000 ffffad0f`5102cd80 ffffad0f`4ef318a0 00000000`00000000 : Wdf01000!FxPkgPnp::PowerProcessEvent+0x15c [minkernel\wdf\framework\shared\irphandlers\pnp\powerstatemachine.cpp @ 1338]
  156. ffff8b84`2a61b4f0 fffff804`679d4f06 : ffffad0f`5102cd80 ffffad0f`5e1c7670 ffffad0f`4ef31a4b ffffad0f`5102cd80 : Wdf01000!FxPkgFdo::RaiseDevicePowerCompletion+0x39 [minkernel\wdf\framework\shared\irphandlers\pnp\fdopower.cpp @ 396]
  157. ffff8b84`2a61b520 fffff804`67938b3d : ffffad0f`4ef31a4b ffff8b84`2a61b5f9 00000000`00000002 ffffad0f`5102cd80 : nt!IopUnloadSafeCompletion+0x56
  158. ffff8b84`2a61b550 fffff804`67938957 : ffffad0f`4ef318a0 00000000`00000000 00000000`00000000 ffffad0f`4edc76c0 : nt!IopfCompleteRequest+0x1cd
  159. ffff8b84`2a61b660 fffff804`6ab4b826 : 00000000`00000103 ffffad0f`4edc7be8 00000000`00000103 fffff804`6a412053 : nt!IofCompleteRequest+0x17
  160. ffff8b84`2a61b690 fffff804`6ab41d1e : 00000000`00000000 ffffad0f`4ef31801 ffffad0f`4ef31801 00000000`00000103 : pci!PciPowerUpDeviceTimerCallback+0x426
  161. ffff8b84`2a61b790 fffff804`6ab42577 : ffffad0f`4edc76c0 ffffad0f`4edc76c0 00000000`00000002 fffff804`6a31faa4 : pci!PciDevice_RetireD0Irp+0xe2
  162. ffff8b84`2a61b7f0 fffff804`6ab4371d : ffffad0f`4ef318a0 00000000`00000000 ffffad0f`4ef31a48 00000000`00000000 : pci!PciDevice_SetPower+0x177
  163. ffff8b84`2a61b850 fffff804`67a260e2 : ffffad0f`4ef318a0 ffffad0f`4ef4ce40 fffff804`6a31ff80 00000000`00000000 : pci!PciDispatchPnpPower+0xad
  164. ffff8b84`2a61b8c0 fffff804`67930d90 : ffffad0f`4ef318a0 fffff804`6a31ff80 00000000`00000000 ffffad0f`5102cd80 : nt!IopPoHandleIrp+0x36
  165. ffff8b84`2a61b8f0 fffff804`67a2a879 : ffffad0f`4ef03801 ffff8b84`2a61b9f0 00000000`00000000 ffffad0f`4ef61a20 : nt!IofCallDriver+0x70
  166. ffff8b84`2a61b930 fffff804`6a31fbf4 : ffff8b84`2a61ba70 ffffad0f`4ef4ce40 fffff804`6a31ff80 ffffad0f`4ef038b0 : nt!IoCallDriver+0x9
  167. ffff8b84`2a61b960 fffff804`6a31fc81 : ffff8b84`2a61ba70 00000000`00000000 00000000`00000001 ffff8b84`2a61ba40 : Wdf01000!FxPkgFdo::RaiseDevicePower+0xb4 [minkernel\wdf\framework\shared\irphandlers\pnp\fdopower.cpp @ 367]
  168. ffff8b84`2a61b9b0 fffff804`6a312ef3 : ffffad0f`4ef038b0 fffff804`67a26442 ffffad0f`5117d001 fffff804`67a2a879 : Wdf01000!FxPkgFdo::_DispatchSetPower+0x71 [minkernel\wdf\framework\shared\irphandlers\pnp\fdopower.cpp @ 122]
  169. ffff8b84`2a61ba00 fffff804`6a3114cf : ffffad0f`4ef318a0 ffffad0f`4ef318a0 ffffad0f`4ef4cc90 fffff804`67922ed0 : Wdf01000!FxPkgPnp::Dispatch+0xb3 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 745]
  170. ffff8b84`2a61ba70 fffff804`6c6b12ca : ffffad0f`51017960 ffffad0f`4ef618b0 ffffad0f`4ef61ba0 ffffad0f`510e7c50 : Wdf01000!imp_WdfDeviceWdmDispatchPreprocessedIrp+0x10f [minkernel\wdf\framework\shared\core\km\fxdeviceapikm.cpp @ 255]
  171. ffff8b84`2a61bac0 fffff804`6a311c4d : ffffad0f`4ef318a0 00000000`00000016 00000000`00000210 ffffad0f`4ef618b0 : USBXHCI!Controller_WdfEvtPreprocessSetPowerIrp+0x14a
  172. ffff8b84`2a61bb00 fffff804`67a25ec6 : ffff8b84`2a61bbe0 ffffad0f`4ef318a0 00000000`00000000 ffffad0f`5102cd80 : Wdf01000!FxDevice::DispatchWithLock+0x1ed [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1430]
  173. ffff8b84`2a61bb60 fffff804`679d43a5 : ffffad0f`4e521040 fffff804`67a25ca0 00000000`00000000 002d0064`00610070 : nt!PopIrpWorker+0x226
  174. ffff8b84`2a61bc10 fffff804`67a7545c : ffffbd00`deb40180 ffffad0f`4e521040 fffff804`679d4350 00200020`0020000a : nt!PspSystemThreadStartup+0x55
  175. ffff8b84`2a61bc60 00000000`00000000 : ffff8b84`2a61c000 ffff8b84`2a616000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x1c
  176.  
  177.  
  178. STACK_COMMAND:  .thread 0xffffad0f4e521040 ; kb
  179.  
  180. CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
  181.     fffff804678b7071-fffff804678b7072  2 bytes - nt!MmFreeIndependentPages+61
  182. 	[ 80 f6:00 8e ]
  183.     fffff804678b707f - nt!MmFreeIndependentPages+6f (+0x0e)
  184. 	[ fa:f2 ]
  185.     fffff804678b8c61-fffff804678b8c62  2 bytes - nt!RtlGetMultiTimePrecise+101 (+0x1be2)
  186. 	[ 48 ff:4c 8b ]
  187.     fffff804678b8c68-fffff804678b8c6c  5 bytes - nt!RtlGetMultiTimePrecise+108 (+0x07)
  188. 	[ 0f 1f 44 00 00:e8 63 09 f6 ff ]
  189.     fffff804678c5423-fffff804678c5424  2 bytes - nt!PfFileInfoNotify+2d3 (+0xc7bb)
  190. 	[ ff e1:e8 98 ]
  191.     fffff804678c5426-fffff804678c5427  2 bytes - nt!PfFileInfoNotify+2d6 (+0x03)
  192. 	[ cc cc:31 00 ]
  193.     fffff804678c6aec - nt!MiMakeSystemCachePteValid+44 (+0x16c6)
  194. 	[ fa:f2 ]
  195.     fffff804678c6b19-fffff804678c6b1a  2 bytes - nt!MiMakeSystemCachePteValid+71 (+0x2d)
  196. 	[ 80 f6:00 8e ]
  197.     fffff804678c73b9-fffff804678c73ba  2 bytes - nt!MmProtectPool+a5 (+0x8a0)
  198. 	[ 80 f6:00 8e ]
  199.     fffff804678c7408-fffff804678c7409  2 bytes - nt!MmProtectPool+f4 (+0x4f)
  200. 	[ 80 f6:00 8e ]
  201.     fffff804678c7475 - nt!MmProtectPool+161 (+0x6d)
  202. 	[ fa:f2 ]
  203.     fffff804678c74a5-fffff804678c74a6  2 bytes - nt!MmProtectPool+191 (+0x30)
  204. 	[ 80 f6:00 8e ]
  205.     fffff804678c74d3 - nt!MmProtectPool+1bf (+0x2e)
  206. 	[ fa:f2 ]
  207.     fffff804678c75bc-fffff804678c75bd  2 bytes - nt!MmProtectPool+2a8 (+0xe9)
  208. 	[ 80 f6:00 8e ]
  209.     fffff804678c765a - nt!MmProtectPool+346 (+0x9e)
  210. 	[ fa:f2 ]
  211.     fffff804678c799a - nt!MiCopyHeaderIfResident+15e (+0x340)
  212. 	[ fa:f2 ]
  213.     fffff804678c7d82 - nt!MiInitializeImageProtos+21e (+0x3e8)
  214. 	[ fa:f2 ]
  215.     fffff804678c7e35 - nt!MiInitializeImageProtos+2d1 (+0xb3)
  216. 	[ fa:f2 ]
  217.     fffff804678c7efe - nt!MiGetPageForHeader+7a (+0xc9)
  218. 	[ fa:f2 ]
  219.     fffff804678c7fff - nt!MiGetSystemPage+4f (+0x101)
  220. 	[ fa:f2 ]
  221.     fffff804678c8570 - nt!MiSectionCreated+14c (+0x571)
  222. 	[ fa:f2 ]
  223.     fffff804678c94f5-fffff804678c94f6  2 bytes - nt!MiEncodeProtoFill+25 (+0xf85)
  224. 	[ 80 f6:00 8e ]
  225.     fffff804678c9e70 - nt!MiCoalesceFreeLargePages+90 (+0x97b)
  226. 	[ fa:f2 ]
  227.     fffff804678c9eb7 - nt!MiCoalesceFreeLargePages+d7 (+0x47)
  228. 	[ fa:f2 ]
  229.     fffff804678ca7d1 - nt!MiConstructNewLargeFreePage+51 (+0x91a)
  230. 	[ fa:f2 ]
  231.     fffff804678ca861 - nt!MiConstructNewLargeFreePage+e1 (+0x90)
  232. 	[ fa:f2 ]
  233.     fffff804678cab8e - nt!MiDeleteFinalPageTables+56 (+0x32d)
  234. 	[ fa:f2 ]
  235.     fffff804678cabc7-fffff804678cabcb  5 bytes - nt!MiDeleteFinalPageTables+8f (+0x39)
  236. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  237.     fffff804678cacbe - nt!MiDeleteTopLevelPage+1e (+0xf7)
  238. 	[ fa:f2 ]
  239.     fffff804678cad69-fffff804678cad6a  2 bytes - nt!MiClearContainingMapping+35 (+0xab)
  240. 	[ 80 f6:00 8e ]
  241.     fffff804678cad7e - nt!MiClearContainingMapping+4a (+0x15)
  242. 	[ fa:f2 ]
  243.     fffff804678cce5d - nt!MiChangePageAttribute+45 (+0x20df)
  244. 	[ fa:f2 ]
  245.     fffff804678cd345-fffff804678cd349  5 bytes - nt!MiReplenishBitMap+65 (+0x4e8)
  246. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  247.     fffff804678cd34f-fffff804678cd353  5 bytes - nt!MiReplenishBitMap+6f (+0x0a)
  248. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  249.     fffff804678cd590-fffff804678cd594  5 bytes - nt!MiReplenishBitMap+2b0 (+0x241)
  250. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  251.     fffff804678cd59c-fffff804678cd5a0  5 bytes - nt!MiReplenishBitMap+2bc (+0x0c)
  252. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  253.     fffff804678cd613-fffff804678cd617  5 bytes - nt!MiReplenishBitMap+333 (+0x77)
  254. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  255.     fffff804678cd76b-fffff804678cd76f  5 bytes - nt!MiReplenishBitMap+48b (+0x158)
  256. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  257.     fffff804678cd823-fffff804678cd824  2 bytes - nt!MiReplenishBitMap+543 (+0xb8)
  258. 	[ 80 f6:00 8e ]
  259.     fffff804678cda6f - nt!MiFreePageFileHashPfns+87 (+0x24c)
  260. 	[ fa:f2 ]
  261.     fffff804678cdf04-fffff804678cdf05  2 bytes - nt!MiDeleteCachedKernelStack+3c (+0x495)
  262. 	[ 80 f6:00 8e ]
  263.     fffff804678ceb89 - nt!MiEmptyDecayClusterTimers+a9 (+0xc85)
  264. 	[ fa:f2 ]
  265.     fffff804678cf284-fffff804678cf288  5 bytes - nt!MiAttachSession+44 (+0x6fb)
  266. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  267.     fffff804678cf549-fffff804678cf54a  2 bytes - nt!MiStealPage+a1 (+0x2c5)
  268. 	[ 80 f6:00 8e ]
  269.     fffff804678cf59b - nt!MiStealPage+f3 (+0x52)
  270. 	[ fa:f2 ]
  271.     fffff804678cf71e - nt!MiStealPage+276 (+0x183)
  272. 	[ fa:f2 ]
  273.     fffff804678cfc83-fffff804678cfc84  2 bytes - nt!MiStealPage+7db (+0x565)
  274. 	[ ff f6:7f 8e ]
  275.     fffff804678d0246-fffff804678d0247  2 bytes - nt!MiStealPage+d9e (+0x5c3)
  276. 	[ 80 f6:00 8e ]
  277.     fffff804678d08c6-fffff804678d08c7  2 bytes - nt!MiMoveDirtyBitsToPfns+66 (+0x680)
  278. 	[ 80 f6:00 8e ]
  279.     fffff804678d09e5-fffff804678d09e6  2 bytes - nt!MiMoveDirtyBitsToPfns+185 (+0x11f)
  280. 	[ 80 f6:00 8e ]
  281. WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
  282. Page 40100 not present in the dump file. Type ".hh dbgerr004" for details
  283.     fffff80467bfdd0e-fffff80467bfdd10  3 bytes - nt!ExFreePoolWithTag+10ae
  284. 	[ 40 fb f6:00 47 8e ]
  285.     fffff80467bfdd19-fffff80467bfdd1d  5 bytes - nt!ExFreePoolWithTag+10b9 (+0x0b)
  286. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  287.     fffff80467bfdd29-fffff80467bfdd2d  5 bytes - nt!ExFreePoolWithTag+10c9 (+0x10)
  288. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  289.     fffff80467bfddbe-fffff80467bfddbf  2 bytes - nt!ExFreePoolWithTag+115e (+0x95)
  290. 	[ 80 f6:00 8e ]
  291.     fffff80467df0788-fffff80467df078a  3 bytes - nt!_guard_check_icall_fptr
  292. 	[ 60 ad a2:90 67 a7 ]
  293.     fffff80467df0790-fffff80467df0792  3 bytes - nt!_guard_dispatch_icall_fptr (+0x08)
  294. 	[ b0 a2 a6:e0 67 a7 ]
  295.     fffff80467e19b8f-fffff80467e19b90  2 bytes - nt!ExUpdateSystemTimeFromCmos+33
  296. 	[ 48 ff:4c 8b ]
  297.     fffff80467e19b96-fffff80467e19b9a  5 bytes - nt!ExUpdateSystemTimeFromCmos+3a (+0x07)
  298. 	[ 0f 1f 44 00 00:e8 c5 77 a0 ff ]
  299.     fffff80467e1a8d8-fffff80467e1a8d9  2 bytes - nt!PopTransitionSystemPowerStateEx+b74 (+0xd42)
  300. 	[ 48 ff:4c 8b ]
  301.     fffff80467e1a8df-fffff80467e1a8e3  5 bytes - nt!PopTransitionSystemPowerStateEx+b7b (+0x07)
  302. 	[ 0f 1f 44 00 00:e8 ec ec 9f ff ]
  303.     fffff80467e1ab05-fffff80467e1ab06  2 bytes - nt!PopTransitionSystemPowerStateEx+da1 (+0x226)
  304. 	[ 48 ff:4c 8b ]
  305.     fffff80467e1ab0c-fffff80467e1ab10  5 bytes - nt!PopTransitionSystemPowerStateEx+da8 (+0x07)
  306. 	[ 0f 1f 44 00 00:e8 bf ea 9f ff ]
  307.     fffff80467e1ab89-fffff80467e1ab8a  2 bytes - nt!PopTransitionSystemPowerStateEx+e25 (+0x7d)
  308. 	[ 48 ff:4c 8b ]
  309.     fffff80467e1ab90-fffff80467e1ab94  5 bytes - nt!PopTransitionSystemPowerStateEx+e2c (+0x07)
  310. 	[ 0f 1f 44 00 00:e8 3b ea 9f ff ]
  311.     fffff80467e1b5a7-fffff80467e1b5a8  2 bytes - nt!PoBroadcastSystemState+3e3 (+0xa17)
  312. 	[ 48 ff:4c 8b ]
  313.     fffff80467e1b5ae-fffff80467e1b5b2  5 bytes - nt!PoBroadcastSystemState+3ea (+0x07)
  314. 	[ 0f 1f 44 00 00:e8 1d e0 9f ff ]
  315.     fffff80467e1b5eb-fffff80467e1b5ec  2 bytes - nt!PoBroadcastSystemState+427 (+0x3d)
  316. 	[ 48 ff:4c 8b ]
  317.     fffff80467e1b5f2-fffff80467e1b5f6  5 bytes - nt!PoBroadcastSystemState+42e (+0x07)
  318. 	[ 0f 1f 44 00 00:e8 d9 df 9f ff ]
  319.     fffff80467e1b729-fffff80467e1b72a  2 bytes - nt!PoBroadcastSystemState+565 (+0x137)
  320. 	[ 48 ff:4c 8b ]
  321.     fffff80467e1b730-fffff80467e1b734  5 bytes - nt!PoBroadcastSystemState+56c (+0x07)
  322. 	[ 0f 1f 44 00 00:e8 9b de 9f ff ]
  323.     fffff80467e1bf58-fffff80467e1bf59  2 bytes - nt!PopInvokeSystemStateHandler+1bc (+0x828)
  324. 	[ 48 ff:4c 8b ]
  325.     fffff80467e1bf5f-fffff80467e1bf63  5 bytes - nt!PopInvokeSystemStateHandler+1c3 (+0x07)
  326. 	[ 0f 1f 44 00 00:e8 6c d6 9f ff ]
  327.     fffff80467e1c242-fffff80467e1c243  2 bytes - nt!PopInvokeSystemStateHandler+4a6 (+0x2e3)
  328. 	[ 48 ff:4c 8b ]
  329.     fffff80467e1c249-fffff80467e1c24d  5 bytes - nt!PopInvokeSystemStateHandler+4ad (+0x07)
  330. 	[ 0f 1f 44 00 00:e8 82 d3 9f ff ]
  331.     fffff80467e1c461-fffff80467e1c465  5 bytes - nt!PopHandleNextState+71 (+0x218)
  332. 	[ ff e2 cc cc cc:e8 7a 5c dc ff ]
  333.     fffff80467e1cf3d-fffff80467e1cf3e  2 bytes - nt!PopDecompressHiberBlocks+fd (+0xadc)
  334. 	[ 48 ff:4c 8b ]
  335.     fffff80467e1cf44-fffff80467e1cf48  5 bytes - nt!PopDecompressHiberBlocks+104 (+0x07)
  336. 	[ 0f 1f 44 00 00:e8 87 c6 9f ff ]
  337.     fffff80467e1d111-fffff80467e1d112  2 bytes - nt!PopSaveHiberContext+d1 (+0x1cd)
  338. 	[ 48 ff:4c 8b ]
  339.     fffff80467e1d118-fffff80467e1d11b  4 bytes - nt!PopSaveHiberContext+d8 (+0x07)
  340. 	[ 0f 1f 44 00:e8 13 37 ab ]
  341.     fffff80467e1e009-fffff80467e1e00a  2 bytes - nt!PopHiberCheckForDebugBreak+31 (+0xef1)
  342. 	[ 48 ff:4c 8b ]
  343.     fffff80467e1e010-fffff80467e1e014  5 bytes - nt!PopHiberCheckForDebugBreak+38 (+0x07)
  344. 	[ 0f 1f 44 00 00:e8 bb b5 9f ff ]
  345.     fffff80467e1e0ba-fffff80467e1e0bb  2 bytes - nt!KiCalibrateTimeAdjustment+9a (+0xaa)
  346. 	[ 48 ff:4c 8b ]
  347.     fffff80467e1e0c1-fffff80467e1e0c5  5 bytes - nt!KiCalibrateTimeAdjustment+a1 (+0x07)
  348. 	[ 0f 1f 44 00 00:e8 6a f6 9f ff ]
  349.     fffff80467e1e151-fffff80467e1e152  2 bytes - nt!KiCalibrateTimeAdjustment+131 (+0x90)
  350. 	[ 48 ff:4c 8b ]
  351.     fffff80467e1e158-fffff80467e1e15c  5 bytes - nt!KiCalibrateTimeAdjustment+138 (+0x07)
  352. 	[ 0f 1f 44 00 00:e8 73 b4 9f ff ]
  353.     fffff80467e1e3f7-fffff80467e1e3f8  2 bytes - nt!PopHiberCheckResume+f7 (+0x29f)
  354. 	[ 48 ff:4c 8b ]
  355.     fffff80467e1e3fe-fffff80467e1e402  5 bytes - nt!PopHiberCheckResume+fe (+0x07)
  356. 	[ 0f 1f 44 00 00:e8 dd fb 9f ff ]
  357.     fffff80467e1ef60-fffff80467e1ef61  2 bytes - nt!PopGetHwConfigurationSignature+d4 (+0xb62)
  358. 	[ 48 ff:4c 8b ]
  359.     fffff80467e1ef67-fffff80467e1ef6b  5 bytes - nt!PopGetHwConfigurationSignature+db (+0x07)
  360. 	[ 0f 1f 44 00 00:e8 24 23 a0 ff ]
  361.     fffff80467e1f5c5-fffff80467e1f5c9  5 bytes - nt!MiConvertHiberPhasePte+15 (+0x65e)
  362. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  363.     fffff80467e1f5d4-fffff80467e1f5d8  5 bytes - nt!MiConvertHiberPhasePte+24 (+0x0f)
  364. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  365.     fffff80467e20f91-fffff80467e20f95  5 bytes - nt!MiUpdateUserMappings+9 (+0x19bd)
  366. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  367.     fffff80467e20fbc-fffff80467e20fc0  5 bytes - nt!MiUpdateUserMappings+34 (+0x2b)
  368. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  369.     fffff80467e22f8d-fffff80467e22f8e  2 bytes - nt!KiInitializeBootStructures+23d (+0x1fd1)
  370. 	[ 48 ff:4c 8b ]
  371.     fffff80467e22f94-fffff80467e22f98  5 bytes - nt!KiInitializeBootStructures+244 (+0x07)
  372. 	[ 0f 1f 44 00 00:e8 b7 8d a0 ff ]
  373.     fffff80467e2301d-fffff80467e2301e  2 bytes - nt!KiInitializeBootStructures+2cd (+0x89)
  374. 	[ 48 ff:4c 8b ]
  375.     fffff80467e23024-fffff80467e23028  5 bytes - nt!KiInitializeBootStructures+2d4 (+0x07)
  376. 	[ 0f 1f 44 00 00:e8 c7 ae a0 ff ]
  377.     fffff80467e23d1e-fffff80467e23d1f  2 bytes - nt!KiSetFeatureBits+5f2 (+0xcfa)
  378. 	[ 48 ff:4c 8b ]
  379.     fffff80467e23d25-fffff80467e23d29  5 bytes - nt!KiSetFeatureBits+5f9 (+0x07)
  380. 	[ 0f 1f 44 00 00:e8 16 c1 a0 ff ]
  381.     fffff80467e247c6-fffff80467e247c7  2 bytes - nt!KiInitializeKernel+4f6 (+0xaa1)
  382. 	[ 48 ff:4c 8b ]
  383.     fffff80467e247cd-fffff80467e247d1  5 bytes - nt!KiInitializeKernel+4fd (+0x07)
  384. 	[ 0f 1f 44 00 00:e8 be 79 a7 ff ]
  385.     fffff80467e25a87-fffff80467e25a88  2 bytes - nt!MmInitializeProcessor+47 (+0x12ba)
  386. 	[ 80 f6:00 8e ]
  387.     fffff80467e274c7-fffff80467e274c8  2 bytes - nt!ExpSetSystemTime+dc93 (+0x1a40)
  388. 	[ 48 ff:4c 8b ]
  389.     fffff80467e274ce-fffff80467e274d2  5 bytes - nt!ExpSetSystemTime+dc9a (+0x07)
  390. 	[ 0f 1f 44 00 00:e8 6d 22 a2 ff ]
  391.     fffff80467e2792c-fffff80467e2792d  2 bytes - nt!PopInvokeSystemStateHandler+bb90 (+0x45e)
  392. 	[ 48 ff:4c 8b ]
  393.     fffff80467e27933-fffff80467e27937  5 bytes - nt!PopInvokeSystemStateHandler+bb97 (+0x07)
  394. 	[ 0f 1f 44 00 00:e8 48 10 a2 ff ]
  395. WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
  396.     fffff80467e394af-fffff80467e394b0  2 bytes - nt!EtwpAddLogHeader+17f
  397. 	[ 48 ff:4c 8b ]
  398.     fffff80467e394b6-fffff80467e394ba  5 bytes - nt!EtwpAddLogHeader+186 (+0x07)
  399. 	[ 0f 1f 44 00 00:e8 15 01 9e ff ]
  400.     fffff80467e45522-fffff80467e45526  5 bytes - nt!NtPowerInformation+452 (+0xc06c)
  401. 	[ ff e0 cc cc cc:e8 79 cb d9 ff ]
  402.     fffff80467e4552a-fffff80467e4552b  2 bytes - nt!NtPowerInformation+45a (+0x08)
  403. 	[ 48 ff:4c 8b ]
  404.     fffff80467e45531-fffff80467e45535  5 bytes - nt!NtPowerInformation+461 (+0x07)
  405. 	[ 0f 1f 44 00 00:e8 9a 40 9d ff ]
  406.     fffff80467e4c35e-fffff80467e4c35f  2 bytes - nt!PiDqQueryRelease+4a (+0x6e2d)
  407. 	[ 48 ff:4c 8b ]
  408.     fffff80467e4c365-fffff80467e4c368  4 bytes - nt!PiDqQueryRelease+51 (+0x07)
  409. 	[ 0f 1f 44 00:e8 06 29 9e ]
  410.     fffff80467e4ce7d-fffff80467e4ce7e  2 bytes - nt!PiDqIrpQueryCreate+115 (+0xb18)
  411. 	[ 48 ff:4c 8b ]
  412.     fffff80467e4ce84-fffff80467e4ce87  4 bytes - nt!PiDqIrpQueryCreate+11c (+0x07)
  413. 	[ 0f 1f 44 00:e8 17 1a 9e ]
  414.     fffff80467e4ceb8-fffff80467e4ceb9  2 bytes - nt!PiDqIrpQueryCreate+150 (+0x34)
  415. 	[ 48 ff:4c 8b ]
  416.     fffff80467e4cebf-fffff80467e4cec2  4 bytes - nt!PiDqIrpQueryCreate+157 (+0x07)
  417. 	[ 0f 1f 44 00:e8 0c e5 9d ]
  418.     fffff80467e4d367-fffff80467e4d368  2 bytes - nt!PiDqQuerySerializeActionQueue+c3 (+0x4a8)
  419. 	[ 48 ff:4c 8b ]
  420.     fffff80467e4d36e-fffff80467e4d371  4 bytes - nt!PiDqQuerySerializeActionQueue+ca (+0x07)
  421. 	[ 0f 1f 44 00:e8 6d 12 9e ]
  422.     fffff80467e4d3a0-fffff80467e4d3a1  2 bytes - nt!PiDqQuerySerializeActionQueue+fc (+0x32)
  423. 	[ 48 ff:4c 8b ]
  424.     fffff80467e4d3a7-fffff80467e4d3aa  4 bytes - nt!PiDqQuerySerializeActionQueue+103 (+0x07)
  425. 	[ 0f 1f 44 00:e8 b4 13 9e ]
  426.     fffff80467e4d44d-fffff80467e4d44e  2 bytes - nt!PiDqQuerySerializeActionQueue+1a9 (+0xa6)
  427. 	[ 48 ff:4c 8b ]
  428.     fffff80467e4d454-fffff80467e4d457  4 bytes - nt!PiDqQuerySerializeActionQueue+1b0 (+0x07)
  429. 	[ 0f 1f 44 00:e8 37 65 9d ]
  430.     fffff80467e4d599-fffff80467e4d59a  2 bytes - nt!PiDqQuerySerializeActionQueue+2f5 (+0x145)
  431. 	[ 48 ff:4c 8b ]
  432.     fffff80467e4d5a0-fffff80467e4d5a3  4 bytes - nt!PiDqQuerySerializeActionQueue+2fc (+0x07)
  433. 	[ 0f 1f 44 00:e8 cb 16 9e ]
  434.     fffff80467e5facb-fffff80467e5facc  2 bytes - nt!KGetUnlockSetting+6f (+0x1252b)
  435. 	[ 48 ff:4c 8b ]
  436.     fffff80467e5fad2-fffff80467e5fad6  5 bytes - nt!KGetUnlockSetting+76 (+0x07)
  437. 	[ 0f 1f 44 00 00:e8 49 29 d8 ff ]
  438.     fffff80467e5faff-fffff80467e5fb00  2 bytes - nt!KGetUnlockSetting+a3 (+0x2d)
  439. 	[ 48 ff:4c 8b ]
  440.     fffff80467e5fb06-fffff80467e5fb0a  5 bytes - nt!KGetUnlockSetting+aa (+0x07)
  441. 	[ 0f 1f 44 00 00:e8 15 29 d8 ff ]
  442.     fffff80467e5fb38-fffff80467e5fb39  2 bytes - nt!KGetUnlockSetting+dc (+0x32)
  443. 	[ 48 ff:4c 8b ]
  444.     fffff80467e5fb3f-fffff80467e5fb43  5 bytes - nt!KGetUnlockSetting+e3 (+0x07)
  445. 	[ 0f 1f 44 00 00:e8 dc 28 d8 ff ]
  446.     fffff80467e69a39-fffff80467e69a3d  5 bytes - nt!BuildQueryDirectoryIrp+1c9 (+0x9efa)
  447. 	[ ff e1 cc cc cc:e8 82 86 d7 ff ]
  448.     fffff80467e6a852-fffff80467e6a856  5 bytes - nt!FsRtlpOplockFsctrlInternal+4c2 (+0xe19)
  449. 	[ ff e1 cc cc cc:e8 69 78 d7 ff ]
  450.     fffff80467e6eaff - nt!MiCreateImageFileMap+12b (+0x42ad)
  451. 	[ fa:f2 ]
  452.     fffff80467e71908-fffff80467e7190c  5 bytes - nt!MiChargeSegmentCommit+a8 (+0x2e09)
  453. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  454.     fffff80467e71912-fffff80467e71916  5 bytes - nt!MiChargeSegmentCommit+b2 (+0x0a)
  455. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  456.     fffff80467e71dff-fffff80467e71e03  5 bytes - nt!MiParseImageSectionHeaders+36f (+0x4ed)
  457. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  458.     fffff80467e71e11-fffff80467e71e15  5 bytes - nt!MiParseImageSectionHeaders+381 (+0x12)
  459. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  460.     fffff80467e77ebb-fffff80467e77ebf  5 bytes - nt!MiAddMappedPtes+5b (+0x60aa)
  461. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  462.     fffff80467e77ec5-fffff80467e77ec9  5 bytes - nt!MiAddMappedPtes+65 (+0x0a)
  463. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  464.     fffff80467e7df9f-fffff80467e7dfa3  5 bytes - nt!RtlpCombineAcls+5af (+0x60da)
  465. 	[ ff e1 cc cc cc:e8 1c 41 d6 ff ]
  466.     fffff80467e7dff3-fffff80467e7dff7  5 bytes - nt!RtlpCombineAcls+603 (+0x54)
  467. 	[ ff e1 cc cc cc:e8 c8 40 d6 ff ]
  468.     fffff80467e7f5ef-fffff80467e7f5f3  5 bytes - nt!NtSetInformationThread+cf (+0x15fc)
  469. 	[ ff e1 cc cc cc:e8 cc 2a d6 ff ]
  470.     fffff80467e7f83d-fffff80467e7f841  5 bytes - nt!NtSetInformationThread+31d (+0x24e)
  471. 	[ ff e1 cc cc cc:e8 7e 28 d6 ff ]
  472.     fffff80467e81c85-fffff80467e81c89  5 bytes - nt!NtWaitForAlertByThreadId+14a5 (+0x2448)
  473. 	[ ff e1 cc cc cc:e8 36 04 d6 ff ]
  474.     fffff80467e8242b-fffff80467e8242c  2 bytes - nt!NtWaitForAlertByThreadId+1c4b (+0x7a6)
  475. 	[ 48 ff:4c 8b ]
  476.     fffff80467e82432-fffff80467e82436  5 bytes - nt!NtWaitForAlertByThreadId+1c52 (+0x07)
  477. 	[ 0f 1f 44 00 00:e8 69 02 b7 ff ]
  478.     fffff80467e8fad9-fffff80467e8fada  2 bytes - nt!SeQuerySigningPolicy+9d (+0xd6a7)
  479. 	[ 48 ff:4c 8b ]
  480.     fffff80467e8fae0-fffff80467e8fae4  5 bytes - nt!SeQuerySigningPolicy+a4 (+0x07)
  481. 	[ 0f 1f 44 00 00:e8 bb 2b b6 ff ]
  482.     fffff80467eaf4fc-fffff80467eaf500  5 bytes - nt!NtTraceControl+1ec (+0x1fa1c)
  483. 	[ ff e0 cc cc cc:e8 9f 2b d3 ff ]
  484.     fffff80467eaf54e-fffff80467eaf552  5 bytes - nt!NtTraceControl+23e (+0x52)
  485. 	[ ff e2 cc cc cc:e8 8d 2b d3 ff ]
  486.     fffff80467eb2643-fffff80467eb2647  5 bytes - nt!NtQueryInformationToken+e3 (+0x30f5)
  487. 	[ ff e1 cc cc cc:e8 78 fa d2 ff ]
  488.     fffff80467eb7085-fffff80467eb7086  2 bytes - nt!MiPrefetchDriverPages+45 (+0x4a42)
  489. 	[ 80 f6:00 8e ]
  490.     fffff80467eb708c-fffff80467eb7090  5 bytes - nt!MiPrefetchDriverPages+4c (+0x07)
  491. 	[ d0 be 7d fb f6:c0 91 23 47 8e ]
  492.     fffff80467eb7096-fffff80467eb709a  5 bytes - nt!MiPrefetchDriverPages+56 (+0x0a)
  493. 	[ d7 be 7d fb f6:c7 91 23 47 8e ]
  494.     fffff80467eb7381 - nt!MiProcessCrcList+e1 (+0x2eb)
  495. 	[ fa:f2 ]
  496. WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
  497.     fffff804681c818d-fffff804681c818e  2 bytes - nt!KdInitSystem+4d
  498. 	[ 48 ff:4c 8b ]
  499.     fffff804681c8194-fffff804681c8198  5 bytes - nt!KdInitSystem+54 (+0x07)
  500. 	[ 0f 1f 44 00 00:e8 37 14 65 ff ]
  501.     fffff804681c8a44-fffff804681c8a45  2 bytes - nt!KdInitSystem+904 (+0x8b0)
  502. 	[ 48 ff:4c 8b ]
  503.     fffff804681c8a4b-fffff804681c8a4e  4 bytes - nt!KdInitSystem+90b (+0x07)
  504. 	[ 0f 1f 44 00:e8 d0 85 23 ]
  505.     fffff804681c90a2-fffff804681c90a3  2 bytes - nt!KdSendTraceData+ee (+0x657)
  506. 	[ 48 ff:4c 8b ]
  507.     fffff804681c90a9-fffff804681c90ac  4 bytes - nt!KdSendTraceData+f5 (+0x07)
  508. 	[ 0f 1f 44 00:e8 b2 7f 23 ]
  509.     fffff804681c91fa-fffff804681c91fb  2 bytes - nt!KdpFillMemory+fa (+0x151)
  510. 	[ 48 ff:4c 8b ]
  511.     fffff804681c9201-fffff804681c9204  4 bytes - nt!KdpFillMemory+101 (+0x07)
  512. 	[ 0f 1f 44 00:e8 5a 7e 23 ]
  513.     fffff804681c92c1-fffff804681c92c2  2 bytes - nt!KdpGetBusData+9d (+0xc0)
  514. 	[ 48 ff:4c 8b ]
  515.     fffff804681c92c8-fffff804681c92cb  4 bytes - nt!KdpGetBusData+a4 (+0x07)
  516. 	[ 0f 1f 44 00:e8 93 7d 23 ]
  517.     fffff804681c943e-fffff804681c943f  2 bytes - nt!KdpQueryMemory+72 (+0x176)
  518. 	[ 48 ff:4c 8b ]
  519.     fffff804681c9445-fffff804681c9448  4 bytes - nt!KdpQueryMemory+79 (+0x07)
  520. 	[ 0f 1f 44 00:e8 16 7c 23 ]
  521.     fffff804681c94ed-fffff804681c94ee  2 bytes - nt!KdpReadControlSpace+91 (+0xa8)
  522. 	[ 48 ff:4c 8b ]
  523.     fffff804681c94f4-fffff804681c94f7  4 bytes - nt!KdpReadControlSpace+98 (+0x07)
  524. 	[ 0f 1f 44 00:e8 67 7b 23 ]
  525.     fffff804681c9630-fffff804681c9631  2 bytes - nt!KdpReadPhysicalMemory+120 (+0x13c)
  526. 	[ 48 ff:4c 8b ]
  527.     fffff804681c9637-fffff804681c963a  4 bytes - nt!KdpReadPhysicalMemory+127 (+0x07)
  528. 	[ 0f 1f 44 00:e8 24 7a 23 ]
  529.     fffff804681c97b5-fffff804681c97b6  2 bytes - nt!KdpReadVirtualMemory+99 (+0x17e)
  530. 	[ 48 ff:4c 8b ]
  531.     fffff804681c97bc-fffff804681c97bf  4 bytes - nt!KdpReadVirtualMemory+a0 (+0x07)
  532. 	[ 0f 1f 44 00:e8 9f 78 23 ]
  533.     fffff804681c9c08-fffff804681c9c09  2 bytes - nt!KdpRestoreBreakPointEx+cc (+0x44c)
  534. 	[ 48 ff:4c 8b ]
  535.     fffff804681c9c0f-fffff804681c9c12  4 bytes - nt!KdpRestoreBreakPointEx+d3 (+0x07)
  536. 	[ 0f 1f 44 00:e8 4c 74 23 ]
  537.     fffff804681c9e0a-fffff804681c9e0b  2 bytes - nt!KdpSearchMemory+1ca (+0x1fb)
  538. 	[ 48 ff:4c 8b ]
  539.     fffff804681c9e11-fffff804681c9e14  4 bytes - nt!KdpSearchMemory+1d1 (+0x07)
  540. 	[ 0f 1f 44 00:e8 4a 72 23 ]
  541.     fffff804681ca194-fffff804681ca195  2 bytes - nt!KdpSendWaitContinue+94 (+0x383)
  542. 	[ 48 ff:4c 8b ]
  543.     fffff804681ca19b-fffff804681ca19e  4 bytes - nt!KdpSendWaitContinue+9b (+0x07)
  544. 	[ 0f 1f 44 00:e8 c0 6e 23 ]
  545.     fffff804681ca1be-fffff804681ca1bf  2 bytes - nt!KdpSendWaitContinue+be (+0x23)
  546. 	[ 48 ff:4c 8b ]
  547.     fffff804681ca1c5-fffff804681ca1c9  5 bytes - nt!KdpSendWaitContinue+c5 (+0x07)
  548. 	[ 0f 1f 44 00 00:e8 06 f4 64 ff ]
  549.     fffff804681ca1e0-fffff804681ca1e1  2 bytes - nt!KdpSendWaitContinue+e0 (+0x1b)
  550. 	[ 48 ff:4c 8b ]
  551.     fffff804681ca1e7-fffff804681ca1ea  4 bytes - nt!KdpSendWaitContinue+e7 (+0x07)
  552. 	[ 0f 1f 44 00:e8 84 6e 23 ]
  553.     fffff804681ca21f-fffff804681ca223  5 bytes - nt!KdpSendWaitContinue+11f (+0x38)
  554. 	[ ff e1 cc cc cc:e8 9c 7e a1 ff ]
  555.     fffff804681ca733-fffff804681ca734  2 bytes - nt!KdpSendWaitContinue+633 (+0x514)
  556. 	[ 48 ff:4c 8b ]
  557.     fffff804681ca73a-fffff804681ca73e  5 bytes - nt!KdpSendWaitContinue+63a (+0x07)
  558. 	[ 0f 1f 44 00 00:e8 41 e2 67 ff ]
  559.     fffff804681ca855-fffff804681ca856  2 bytes - nt!KdpSendWaitContinue+755 (+0x11b)
  560. 	[ 48 ff:4c 8b ]
  561.     fffff804681ca85c-fffff804681ca85f  4 bytes - nt!KdpSendWaitContinue+75c (+0x07)
  562. 	[ 0f 1f 44 00:e8 ff 67 23 ]
  563.     fffff804681ca874-fffff804681ca875  2 bytes - nt!KdpSendWaitContinue+774 (+0x18)
  564. 	[ 48 ff:4c 8b ]
  565.     fffff804681ca87b-fffff804681ca87e  4 bytes - nt!KdpSendWaitContinue+77b (+0x07)
  566. 	[ 0f 1f 44 00:e8 e0 67 23 ]
  567.     fffff804681caa92-fffff804681caa93  2 bytes - nt!KdpSetContext+a2 (+0x217)
  568. 	[ 48 ff:4c 8b ]
  569.     fffff804681caa99-fffff804681caa9c  4 bytes - nt!KdpSetContext+a9 (+0x07)
  570. 	[ 0f 1f 44 00:e8 c2 65 23 ]
  571.     fffff804681cab3c-fffff804681cab3d  2 bytes - nt!KdpSysReadBusData+40 (+0xa3)
  572. 	[ 48 ff:4c 8b ]
  573.     fffff804681cab43-fffff804681cab47  5 bytes - nt!KdpSysReadBusData+47 (+0x07)
  574. 	[ 0f 1f 44 00 00:e8 18 40 65 ff ]
  575.     fffff804681caba8-fffff804681caba9  2 bytes - nt!KdpSysWriteBusData+40 (+0x65)
  576. 	[ 48 ff:4c 8b ]
  577.     fffff804681cabaf-fffff804681cabb3  5 bytes - nt!KdpSysWriteBusData+47 (+0x07)
  578. 	[ 0f 1f 44 00 00:e8 8c 3e 65 ff ]
  579.     fffff804681cae11-fffff804681cae12  2 bytes - nt!KdpWriteBreakPointEx+141 (+0x262)
  580. 	[ 48 ff:4c 8b ]
  581.     fffff804681cae18-fffff804681cae1b  4 bytes - nt!KdpWriteBreakPointEx+148 (+0x07)
  582. 	[ 0f 1f 44 00:e8 43 62 23 ]
  583.     fffff804681cae46-fffff804681cae47  2 bytes - nt!KdpWriteBreakPointEx+176 (+0x2e)
  584. 	[ 48 ff:4c 8b ]
  585.     fffff804681cae4d-fffff804681cae50  4 bytes - nt!KdpWriteBreakPointEx+17d (+0x07)
  586. 	[ 0f 1f 44 00:e8 0e 62 23 ]
  587.     fffff804681caf05-fffff804681caf06  2 bytes - nt!KdpWritePhysicalMemory+7d (+0xb8)
  588. 	[ 48 ff:4c 8b ]
  589.     fffff804681caf0c-fffff804681caf0f  4 bytes - nt!KdpWritePhysicalMemory+84 (+0x07)
  590. 	[ 0f 1f 44 00:e8 4f 61 23 ]
  591.     fffff804681cc374-fffff804681cc375  2 bytes - nt!KdpPrintString+b0 (+0x1468)
  592. 	[ 48 ff:4c 8b ]
  593.     fffff804681cc37b-fffff804681cc37e  4 bytes - nt!KdpPrintString+b7 (+0x07)
  594. 	[ 0f 1f 44 00:e8 e0 4c 23 ]
  595.     fffff804681cc46b-fffff804681cc46c  2 bytes - nt!KdpPromptString+c3 (+0xf0)
  596. 	[ 48 ff:4c 8b ]
  597. WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
  598.     fffff804681fedb3-fffff804681fedb4  2 bytes - nt!HdlspBugCheckProcessing+97
  599. 	[ 48 ff:4c 8b ]
  600.     fffff804681fedba-fffff804681fedbe  5 bytes - nt!HdlspBugCheckProcessing+9e (+0x07)
  601. 	[ 0f 1f 44 00 00:e8 81 a6 61 ff ]
  602.     fffff804681fedc8-fffff804681fedc9  2 bytes - nt!HdlspBugCheckProcessing+ac (+0x0e)
  603. 	[ 48 ff:4c 8b ]
  604.     fffff804681fedcf-fffff804681fedd3  5 bytes - nt!HdlspBugCheckProcessing+b3 (+0x07)
  605. 	[ 0f 1f 44 00 00:e8 ac 9b 64 ff ]
  606. 10310 errors : !nt (fffff804678b7071-fffff804681fedd3)
  607.  
  608. MODULE_NAME: memory_corruption
  609.  
  610. IMAGE_NAME:  memory_corruption
  611.  
  612. FOLLOWUP_NAME:  memory_corruption
  613.  
  614. DEBUG_FLR_IMAGE_TIMESTAMP:  0
  615.  
  616. MEMORY_CORRUPTOR:  LARGE
  617.  
  618. FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE
  619.  
  620. BUCKET_ID:  MEMORY_CORRUPTION_LARGE
  621.  
  622. PRIMARY_PROBLEM_CLASS:  MEMORY_CORRUPTION_LARGE
  623.  
  624. TARGET_TIME:  2023-01-10T20:20:50.000Z
  625.  
  626. OSBUILD:  17763
  627.  
  628. OSSERVICEPACK:  0
  629.  
  630. SERVICEPACK_NUMBER: 0
  631.  
  632. OS_REVISION: 0
  633.  
  634. SUITE_MASK:  272
  635.  
  636. PRODUCT_TYPE:  1
  637.  
  638. OSPLATFORM_TYPE:  x64
  639.  
  640. OSNAME:  Windows 10
  641.  
  642. OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS
  643.  
  644. OS_LOCALE:  
  645.  
  646. USER_LCID:  0
  647.  
  648. OSBUILD_TIMESTAMP:  1995-05-09 16:52:36
  649.  
  650. BUILDDATESTAMP_STR:  180914-1434
  651.  
  652. BUILDLAB_STR:  rs5_release
  653.  
  654. BUILDOSVER_STR:  10.0.17763.1.amd64fre.rs5_release.180914-1434
  655.  
  656. ANALYSIS_SESSION_ELAPSED_TIME: 18a7
  657.  
  658. ANALYSIS_SOURCE:  KM
  659.  
  660. FAILURE_ID_HASH_STRING:  km:memory_corruption_large
  661.  
  662. FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
  663.  
  664. Followup:     memory_corruption
  665. ---------
  666.  
  667. 0: kd> !irp ffffad0f4ef318a0
  668. Irp is active with 6 stacks 5 is current (= 0xffffad0f4ef31a90)
  669.  No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  Pending has been returned
  670.      cmd  flg cl Device   File     Completion-Context
  671.  [N/A(0), N/A(0)]
  672.             0  0 00000000 00000000 00000000-00000000    
  673.  
  674. 			Args: 00000000 00000000 00000000 00000000
  675.  [N/A(0), N/A(0)]
  676.             0  0 00000000 00000000 00000000-00000000    
  677.  
  678. 			Args: 00000000 00000000 00000000 00000000
  679.  [N/A(0), N/A(0)]
  680.             0  0 00000000 00000000 00000000-00000000    
  681.  
  682. 			Args: 00000000 00000000 00000000 00000000
  683.  [IRP_MJ_POWER(16), IRP_MN_WAIT_WAKE(0)]
  684.             0  0 ffffad0f4edc7570 00000000 00000000-00000000    
  685. 	       \Driver\pci
  686. 			Args: 00000000 00000000 00000000 00000000
  687. >[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
  688.             0 e1 ffffad0f5102cd80 00000000 fffff80467a253b0-ffffad0f5130d200 Success Error Cancel pending
  689. 	       \Driver\USBXHCI	nt!PopRequestCompletion
  690. 			Args: 00000000 00000001 00000001 00000000
  691.  [N/A(0), N/A(0)]
  692.             0  0 00000000 00000000 00000000-ffffad0f5130d200    
  693.  
  694. 			Args: 00000000 00000000 00000000 00000000
  695. 0: kd> !devstack ffffad0f4edc7570
  696.   !DevObj           !DrvObj            !DevExt           ObjectName
  697.   ffffad0f5102cd80  \Driver\USBXHCI    ffffad0f4ef61ba0  USBFDO-0
  698. > ffffad0f4edc7570  \Driver\pci        ffffad0f4edc76c0  NTPNP_PCI0017
  699. !DevNode ffffad0f4ee156e0 :
  700.   DeviceInst is "PCI\VEN_1912&DEV_0014&SUBSYS_00000000&REV_03\4&382692a7&0&0008"
  701.   ServiceName is "USBXHCI"
  702. 0: kd> !drvobj \Driver\USBXHCI
  703. Driver object (ffffad0f4ef4dd00) is for:
  704.  \Driver\USBXHCI
  705. Driver Extension List: (id , addr)
  706. (fffff8046a367960 ffffad0f510e7ad0)  
  707. Device Object list:
  708. ffffad0f5102bd80  ffffad0f5102cd80  
  709. 0: kd> !devobj ffffad0f5102bd80
  710. Device object (ffffad0f5102bd80) is for:
  711.  USBPDO-0 \Driver\USBXHCI DriverObject ffffad0f4ef4dd00
  712. Current Irp 00000000 RefCount 0 Type 00000022 Flags 00003044
  713. SecurityDescriptor ffffde89f63741a0 DevExt ffffad0f4efbcba0 DevObjExt ffffad0f5102bef8 DevNode ffffad0f59579c40 
  714. ExtensionFlags (0000000000)  
  715. Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
  716. AttachedDevice (Upper) ffffad0f4ef738d0 \Driver\USBHUB3
  717. Device queue is not busy.
  718. 0: kd> !devobj ffffad0f5102cd80
  719. Device object (ffffad0f5102cd80) is for:
  720.  USBFDO-0 \Driver\USBXHCI DriverObject ffffad0f4ef4dd00
  721. Current Irp 00000000 RefCount 0 Type 00000022 Flags 00002044
  722. SecurityDescriptor ffffde89f63741a0 DevExt ffffad0f4ef61ba0 DevObjExt ffffad0f5102cef8 
  723. ExtensionFlags (0000000000)  
  724. Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
  725. AttachedTo (Lower) ffffad0f4edc7570 \Driver\pci
  726. Device queue is not busy.
  727. 0: kd> !devobj ffffad0f4edc7570
  728. Device object (ffffad0f4edc7570) is for:
  729.  NTPNP_PCI0017 \Driver\pci DriverObject ffffad0f4e4e4cf0
  730. Current Irp 00000000 RefCount 0 Type 00000022 Flags 00001040
  731. SecurityDescriptor ffffde89f62029a0 DevExt ffffad0f4edc76c0 DevObjExt ffffad0f4edc7d80 DevNode ffffad0f4ee156e0 
  732. ExtensionFlags (0x00000800)  DOE_DEFAULT_SD_PRESENT
  733. Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
  734. AttachedDevice (Upper) ffffad0f5102cd80 \Driver\USBXHCI
  735. Device queue is not busy.
  736. 0: kd> !devnode ffffad0f4ee156e0
  737. DevNode 0xffffad0f4ee156e0 for PDO 0xffffad0f4edc7570
  738.   Parent 0xffffad0f4ee0a9a0   Sibling 0000000000   Child 0xffffad0f59579c40   
  739.   InstancePath is "PCI\VEN_1912&DEV_0014&SUBSYS_00000000&REV_03\4&382692a7&0&0008"
  740.   ServiceName is "USBXHCI"
  741.   State = DeviceNodeStarted (0x308)
  742.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  743.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  744.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  745.   StateHistory[10] = DeviceNodeStarted (0x308)
  746.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  747.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  748.   StateHistory[07] = DeviceNodeStarted (0x308)
  749.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  750.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  751.   StateHistory[04] = DeviceNodeStartPending (0x305)
  752.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  753.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  754.   StateHistory[01] = DeviceNodeInitialized (0x302)
  755.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  756.   StateHistory[19] = Unknown State (0x0)
  757.   StateHistory[18] = Unknown State (0x0)
  758.   StateHistory[17] = Unknown State (0x0)
  759.   StateHistory[16] = Unknown State (0x0)
  760.   StateHistory[15] = Unknown State (0x0)
  761.   StateHistory[14] = Unknown State (0x0)
  762.   StateHistory[13] = Unknown State (0x0)
  763.   Flags (0x6c0000f0)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  764.                       DNF_HAS_BOOT_CONFIG, DNF_BOOT_CONFIG_RESERVED, 
  765.                       DNF_NO_LOWER_DEVICE_FILTERS, DNF_NO_LOWER_CLASS_FILTERS, 
  766.                       DNF_NO_UPPER_DEVICE_FILTERS, DNF_NO_UPPER_CLASS_FILTERS
  767.   CapabilityFlags (0x00002400)  WakeFromD0, WakeFromD3
  768. 0: kd> !drvobj \Driver\USBXHCI
  769. Driver object (ffffad0f4ef4dd00) is for:
  770.  \Driver\USBXHCI
  771. Driver Extension List: (id , addr)
  772. (fffff8046a367960 ffffad0f510e7ad0)  
  773. Device Object list:
  774. ffffad0f5102bd80  ffffad0f5102cd80  
  775. 0: kd> !devobj ffffad0f5102bd80
  776. Device object (ffffad0f5102bd80) is for:
  777.  USBPDO-0 \Driver\USBXHCI DriverObject ffffad0f4ef4dd00
  778. Current Irp 00000000 RefCount 0 Type 00000022 Flags 00003044
  779. SecurityDescriptor ffffde89f63741a0 DevExt ffffad0f4efbcba0 DevObjExt ffffad0f5102bef8 DevNode ffffad0f59579c40 
  780. ExtensionFlags (0000000000)  
  781. Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
  782. AttachedDevice (Upper) ffffad0f4ef738d0 \Driver\USBHUB3
  783. Device queue is not busy.
  784. 0: kd> !devobj ffffad0f5102cd80
  785. Device object (ffffad0f5102cd80) is for:
  786.  USBFDO-0 \Driver\USBXHCI DriverObject ffffad0f4ef4dd00
  787. Current Irp 00000000 RefCount 0 Type 00000022 Flags 00002044
  788. SecurityDescriptor ffffde89f63741a0 DevExt ffffad0f4ef61ba0 DevObjExt ffffad0f5102cef8 
  789. ExtensionFlags (0000000000)  
  790. Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
  791. AttachedTo (Lower) ffffad0f4edc7570 \Driver\pci
  792. Device queue is not busy.
  793. 0: kd> !sd ffffde89f63741a0 0x1
  794. ->Revision: 0x1
  795. ->Sbz1    : 0x0
  796. ->Control : 0x9814
  797.             SE_DACL_PRESENT
  798.             SE_SACL_PRESENT
  799.             SE_SACL_AUTO_INHERITED
  800.             SE_DACL_PROTECTED
  801.             SE_SELF_RELATIVE
  802. ->Owner   : S-1-5-32-544 (Alias: BUILTIN\Administrators)
  803. ->Group   : S-1-5-18 (Well Known Group: NT AUTHORITY\SYSTEM)
  804. ->Dacl    : 
  805. ->Dacl    : ->AclRevision: 0x2
  806. ->Dacl    : ->Sbz1       : 0x0
  807. ->Dacl    : ->AclSize    : 0x5c
  808. ->Dacl    : ->AceCount   : 0x4
  809. ->Dacl    : ->Sbz2       : 0x0
  810. ->Dacl    : ->Ace[0]: ->AceType: ACCESS_ALLOWED_ACE_TYPE
  811. ->Dacl    : ->Ace[0]: ->AceFlags: 0x0
  812. ->Dacl    : ->Ace[0]: ->AceSize: 0x14
  813. ->Dacl    : ->Ace[0]: ->Mask : 0x001f01ff
  814. ->Dacl    : ->Ace[0]: ->SID: S-1-5-18 (Well Known Group: NT AUTHORITY\SYSTEM)
  815.  
  816. ->Dacl    : ->Ace[1]: ->AceType: ACCESS_ALLOWED_ACE_TYPE
  817. ->Dacl    : ->Ace[1]: ->AceFlags: 0x0
  818. ->Dacl    : ->Ace[1]: ->AceSize: 0x18
  819. ->Dacl    : ->Ace[1]: ->Mask : 0x001201bf
  820. ->Dacl    : ->Ace[1]: ->SID: S-1-5-32-544 (Alias: BUILTIN\Administrators)
  821.  
  822. ->Dacl    : ->Ace[2]: ->AceType: ACCESS_ALLOWED_ACE_TYPE
  823. ->Dacl    : ->Ace[2]: ->AceFlags: 0x0
  824. ->Dacl    : ->Ace[2]: ->AceSize: 0x14
  825. ->Dacl    : ->Ace[2]: ->Mask : 0x0012019f
  826. ->Dacl    : ->Ace[2]: ->SID: S-1-1-0 (Well Known Group: localhost\Everyone)
  827.  
  828. ->Dacl    : ->Ace[3]: ->AceType: ACCESS_ALLOWED_ACE_TYPE
  829. ->Dacl    : ->Ace[3]: ->AceFlags: 0x0
  830. ->Dacl    : ->Ace[3]: ->AceSize: 0x14
  831. ->Dacl    : ->Ace[3]: ->Mask : 0x00120089
  832. ->Dacl    : ->Ace[3]: ->SID: S-1-5-12 (Well Known Group: NT AUTHORITY\RESTRICTED)
  833.  
  834. ->Sacl    : 
  835. ->Sacl    : ->AclRevision: 0x2
  836. ->Sacl    : ->Sbz1       : 0x0
  837. ->Sacl    : ->AclSize    : 0x1c
  838. ->Sacl    : ->AceCount   : 0x1
  839. ->Sacl    : ->Sbz2       : 0x0
  840. ->Sacl    : ->Ace[0]: ->AceType: SYSTEM_MANDATORY_LABEL_ACE_TYPE
  841. ->Sacl    : ->Ace[0]: ->AceFlags: 0x0
  842. ->Sacl    : ->Ace[0]: ->AceSize: 0x14
  843. ->Sacl    : ->Ace[0]: ->Mask : 0x00000001
  844. ->Sacl    : ->Ace[0]: ->SID: S-1-16-4096 (Label: Mandatory Label\Low Mandatory Level)
  845.  
  846. 0: kd> !drvobj \Driver\USBHUB3
  847. Driver object (ffffad0f4ef9d8f0) is for:
  848.  \Driver\USBHUB3
  849. Driver Extension List: (id , addr)
  850. (fffff8046a367960 ffffad0f512d5fc0)  
  851. Device Object list:
  852. ffffad0f51019d80  ffffad0f4ef738d0  
  853. 0: kd> !devnode ffffad0f59579c40
  854. DevNode 0xffffad0f59579c40 for PDO 0xffffad0f5102bd80
  855.   Parent 0xffffad0f4ee156e0   Sibling 0000000000   Child 0xffffad0f511639a0   
  856.   InstancePath is "USB\ROOT_HUB30\5&23341d40&0&0"
  857.   ServiceName is "USBHUB3"
  858.   State = DeviceNodeStarted (0x308)
  859.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  860.   StateHistory[15] = DeviceNodeEnumerateCompletion (0x30d)
  861.   StateHistory[14] = DeviceNodeEnumeratePending (0x30c)
  862.   StateHistory[13] = DeviceNodeStarted (0x308)
  863.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  864.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  865.   StateHistory[10] = DeviceNodeStarted (0x308)
  866.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  867.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  868.   StateHistory[07] = DeviceNodeStarted (0x308)
  869.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  870.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  871.   StateHistory[04] = DeviceNodeStartPending (0x305)
  872.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  873.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  874.   StateHistory[01] = DeviceNodeInitialized (0x302)
  875.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  876.   StateHistory[19] = Unknown State (0x0)
  877.   StateHistory[18] = Unknown State (0x0)
  878.   StateHistory[17] = Unknown State (0x0)
  879.   StateHistory[16] = Unknown State (0x0)
  880.   Flags (0x6c000130)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  881.                       DNF_NO_RESOURCE_REQUIRED, DNF_NO_LOWER_DEVICE_FILTERS, 
  882.                       DNF_NO_LOWER_CLASS_FILTERS, DNF_NO_UPPER_DEVICE_FILTERS, 
  883.                       DNF_NO_UPPER_CLASS_FILTERS
  884.   CapabilityFlags (0x00001602)  DeviceD2, SurpriseRemovalOK, 
  885.                                 WakeFromD0, WakeFromD2
  886. 0: kd> !devnode ffffad0f511639a0
  887. DevNode 0xffffad0f511639a0 for PDO 0xffffad0f51019d80
  888.   Parent 0xffffad0f59579c40   Sibling 0000000000   Child 0xffffad0f5129bcb0   
  889.   InstancePath is "USB\VID_03EB&PID_8A6E\L20R019413"
  890.   ServiceName is "usbccgp"
  891.   State = DeviceNodeStarted (0x308)
  892.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  893.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  894.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  895.   StateHistory[10] = DeviceNodeStarted (0x308)
  896.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  897.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  898.   StateHistory[07] = DeviceNodeStarted (0x308)
  899.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  900.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  901.   StateHistory[04] = DeviceNodeStartPending (0x305)
  902.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  903.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  904.   StateHistory[01] = DeviceNodeInitialized (0x302)
  905.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  906.   StateHistory[19] = Unknown State (0x0)
  907.   StateHistory[18] = Unknown State (0x0)
  908.   StateHistory[17] = Unknown State (0x0)
  909.   StateHistory[16] = Unknown State (0x0)
  910.   StateHistory[15] = Unknown State (0x0)
  911.   StateHistory[14] = Unknown State (0x0)
  912.   StateHistory[13] = Unknown State (0x0)
  913.   Flags (0x6c000130)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  914.                       DNF_NO_RESOURCE_REQUIRED, DNF_NO_LOWER_DEVICE_FILTERS, 
  915.                       DNF_NO_LOWER_CLASS_FILTERS, DNF_NO_UPPER_DEVICE_FILTERS, 
  916.                       DNF_NO_UPPER_CLASS_FILTERS
  917.   CapabilityFlags (0x00001e53)  DeviceD1, DeviceD2, 
  918.                                 Removable, UniqueID, 
  919.                                 SurpriseRemovalOK, WakeFromD0, 
  920.                                 WakeFromD1, WakeFromD2
  921. 0: kd> !devnode ffffad0f511639a0
  922. DevNode 0xffffad0f511639a0 for PDO 0xffffad0f51019d80
  923.   Parent 0xffffad0f59579c40   Sibling 0000000000   Child 0xffffad0f5129bcb0   
  924.   InstancePath is "USB\VID_03EB&PID_8A6E\L20R019413"
  925.   ServiceName is "usbccgp"
  926.   State = DeviceNodeStarted (0x308)
  927.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  928.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  929.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  930.   StateHistory[10] = DeviceNodeStarted (0x308)
  931.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  932.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  933.   StateHistory[07] = DeviceNodeStarted (0x308)
  934.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  935.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  936.   StateHistory[04] = DeviceNodeStartPending (0x305)
  937.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  938.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  939.   StateHistory[01] = DeviceNodeInitialized (0x302)
  940.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  941.   StateHistory[19] = Unknown State (0x0)
  942.   StateHistory[18] = Unknown State (0x0)
  943.   StateHistory[17] = Unknown State (0x0)
  944.   StateHistory[16] = Unknown State (0x0)
  945.   StateHistory[15] = Unknown State (0x0)
  946.   StateHistory[14] = Unknown State (0x0)
  947.   StateHistory[13] = Unknown State (0x0)
  948.   Flags (0x6c000130)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  949.                       DNF_NO_RESOURCE_REQUIRED, DNF_NO_LOWER_DEVICE_FILTERS, 
  950.                       DNF_NO_LOWER_CLASS_FILTERS, DNF_NO_UPPER_DEVICE_FILTERS, 
  951.                       DNF_NO_UPPER_CLASS_FILTERS
  952.   CapabilityFlags (0x00001e53)  DeviceD1, DeviceD2, 
  953.                                 Removable, UniqueID, 
  954.                                 SurpriseRemovalOK, WakeFromD0, 
  955.                                 WakeFromD1, WakeFromD2
  956. 0: kd> !devnode ffffad0f5129bcb0
  957. DevNode 0xffffad0f5129bcb0 for PDO 0xffffad0f5117c110
  958.   Parent 0xffffad0f511639a0   Sibling 0xffffad0f5129ccb0   Child 0xffffad0f5960d0c0   
  959.   InstancePath is "USB\VID_03EB&PID_8A6E&MI_00\7&3a8f0aba&0&0000"
  960.   ServiceName is "HidUsb"
  961.   State = DeviceNodeStarted (0x308)
  962.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  963.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  964.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  965.   StateHistory[10] = DeviceNodeStarted (0x308)
  966.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  967.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  968.   StateHistory[07] = DeviceNodeStarted (0x308)
  969.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  970.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  971.   StateHistory[04] = DeviceNodeStartPending (0x305)
  972.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  973.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  974.   StateHistory[01] = DeviceNodeInitialized (0x302)
  975.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  976.   StateHistory[19] = Unknown State (0x0)
  977.   StateHistory[18] = Unknown State (0x0)
  978.   StateHistory[17] = Unknown State (0x0)
  979.   StateHistory[16] = Unknown State (0x0)
  980.   StateHistory[15] = Unknown State (0x0)
  981.   StateHistory[14] = Unknown State (0x0)
  982.   StateHistory[13] = Unknown State (0x0)
  983.   Flags (0x6c000130)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  984.                       DNF_NO_RESOURCE_REQUIRED, DNF_NO_LOWER_DEVICE_FILTERS, 
  985.                       DNF_NO_LOWER_CLASS_FILTERS, DNF_NO_UPPER_DEVICE_FILTERS, 
  986.                       DNF_NO_UPPER_CLASS_FILTERS
  987.   CapabilityFlags (0x00001e03)  DeviceD1, DeviceD2, 
  988.                                 SurpriseRemovalOK, WakeFromD0, 
  989.                                 WakeFromD1, WakeFromD2
  990. 0: kd> !devnode ffffad0f59579c40
  991. DevNode 0xffffad0f59579c40 for PDO 0xffffad0f5102bd80
  992.   Parent 0xffffad0f4ee156e0   Sibling 0000000000   Child 0xffffad0f511639a0   
  993.   InstancePath is "USB\ROOT_HUB30\5&23341d40&0&0"
  994.   ServiceName is "USBHUB3"
  995.   State = DeviceNodeStarted (0x308)
  996.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  997.   StateHistory[15] = DeviceNodeEnumerateCompletion (0x30d)
  998.   StateHistory[14] = DeviceNodeEnumeratePending (0x30c)
  999.   StateHistory[13] = DeviceNodeStarted (0x308)
  1000.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  1001.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  1002.   StateHistory[10] = DeviceNodeStarted (0x308)
  1003.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  1004.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  1005.   StateHistory[07] = DeviceNodeStarted (0x308)
  1006.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  1007.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  1008.   StateHistory[04] = DeviceNodeStartPending (0x305)
  1009.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  1010.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  1011.   StateHistory[01] = DeviceNodeInitialized (0x302)
  1012.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  1013.   StateHistory[19] = Unknown State (0x0)
  1014.   StateHistory[18] = Unknown State (0x0)
  1015.   StateHistory[17] = Unknown State (0x0)
  1016.   StateHistory[16] = Unknown State (0x0)
  1017.   Flags (0x6c000130)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  1018.                       DNF_NO_RESOURCE_REQUIRED, DNF_NO_LOWER_DEVICE_FILTERS, 
  1019.                       DNF_NO_LOWER_CLASS_FILTERS, DNF_NO_UPPER_DEVICE_FILTERS, 
  1020.                       DNF_NO_UPPER_CLASS_FILTERS
  1021.   CapabilityFlags (0x00001602)  DeviceD2, SurpriseRemovalOK, 
  1022.                                 WakeFromD0, WakeFromD2
  1023. 0: kd> !devnode ffffad0f511639a0
  1024. DevNode 0xffffad0f511639a0 for PDO 0xffffad0f51019d80
  1025.   Parent 0xffffad0f59579c40   Sibling 0000000000   Child 0xffffad0f5129bcb0   
  1026.   InstancePath is "USB\VID_03EB&PID_8A6E\L20R019413"
  1027.   ServiceName is "usbccgp"
  1028.   State = DeviceNodeStarted (0x308)
  1029.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  1030.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  1031.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  1032.   StateHistory[10] = DeviceNodeStarted (0x308)
  1033.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  1034.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  1035.   StateHistory[07] = DeviceNodeStarted (0x308)
  1036.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  1037.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  1038.   StateHistory[04] = DeviceNodeStartPending (0x305)
  1039.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  1040.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  1041.   StateHistory[01] = DeviceNodeInitialized (0x302)
  1042.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  1043.   StateHistory[19] = Unknown State (0x0)
  1044.   StateHistory[18] = Unknown State (0x0)
  1045.   StateHistory[17] = Unknown State (0x0)
  1046.   StateHistory[16] = Unknown State (0x0)
  1047.   StateHistory[15] = Unknown State (0x0)
  1048.   StateHistory[14] = Unknown State (0x0)
  1049.   StateHistory[13] = Unknown State (0x0)
  1050.   Flags (0x6c000130)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  1051.                       DNF_NO_RESOURCE_REQUIRED, DNF_NO_LOWER_DEVICE_FILTERS, 
  1052.                       DNF_NO_LOWER_CLASS_FILTERS, DNF_NO_UPPER_DEVICE_FILTERS, 
  1053.                       DNF_NO_UPPER_CLASS_FILTERS
  1054.   CapabilityFlags (0x00001e53)  DeviceD1, DeviceD2, 
  1055.                                 Removable, UniqueID, 
  1056.                                 SurpriseRemovalOK, WakeFromD0, 
  1057.                                 WakeFromD1, WakeFromD2
  1058. 0: kd> !devnode ffffad0f511639a0
  1059. DevNode 0xffffad0f511639a0 for PDO 0xffffad0f51019d80
  1060.   Parent 0xffffad0f59579c40   Sibling 0000000000   Child 0xffffad0f5129bcb0   
  1061.   InstancePath is "USB\VID_03EB&PID_8A6E\L20R019413"
  1062.   ServiceName is "usbccgp"
  1063.   State = DeviceNodeStarted (0x308)
  1064.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  1065.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  1066.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  1067.   StateHistory[10] = DeviceNodeStarted (0x308)
  1068.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  1069.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  1070.   StateHistory[07] = DeviceNodeStarted (0x308)
  1071.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  1072.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  1073.   StateHistory[04] = DeviceNodeStartPending (0x305)
  1074.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  1075.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  1076.   StateHistory[01] = DeviceNodeInitialized (0x302)
  1077.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  1078.   StateHistory[19] = Unknown State (0x0)
  1079.   StateHistory[18] = Unknown State (0x0)
  1080.   StateHistory[17] = Unknown State (0x0)
  1081.   StateHistory[16] = Unknown State (0x0)
  1082.   StateHistory[15] = Unknown State (0x0)
  1083.   StateHistory[14] = Unknown State (0x0)
  1084.   StateHistory[13] = Unknown State (0x0)
  1085.   Flags (0x6c000130)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  1086.                       DNF_NO_RESOURCE_REQUIRED, DNF_NO_LOWER_DEVICE_FILTERS, 
  1087.                       DNF_NO_LOWER_CLASS_FILTERS, DNF_NO_UPPER_DEVICE_FILTERS, 
  1088.                       DNF_NO_UPPER_CLASS_FILTERS
  1089.   CapabilityFlags (0x00001e53)  DeviceD1, DeviceD2, 
  1090.                                 Removable, UniqueID, 
  1091.                                 SurpriseRemovalOK, WakeFromD0, 
  1092.                                 WakeFromD1, WakeFromD2
  1093. 0: kd> !devstack ffffad0f5102cd80
  1094.   !DevObj           !DrvObj            !DevExt           ObjectName
  1095. > ffffad0f5102cd80  \Driver\USBXHCI    ffffad0f4ef61ba0  USBFDO-0
  1096.   ffffad0f4edc7570  \Driver\pci        ffffad0f4edc76c0  NTPNP_PCI0017
  1097. !DevNode ffffad0f4ee156e0 :
  1098.   DeviceInst is "PCI\VEN_1912&DEV_0014&SUBSYS_00000000&REV_03\4&382692a7&0&0008"
  1099.   ServiceName is "USBXHCI"
  1100. 0: kd> !devstack ffffad0f4edc7570
  1101.   !DevObj           !DrvObj            !DevExt           ObjectName
  1102.   ffffad0f5102cd80  \Driver\USBXHCI    ffffad0f4ef61ba0  USBFDO-0
  1103. > ffffad0f4edc7570  \Driver\pci        ffffad0f4edc76c0  NTPNP_PCI0017
  1104. !DevNode ffffad0f4ee156e0 :
  1105.   DeviceInst is "PCI\VEN_1912&DEV_0014&SUBSYS_00000000&REV_03\4&382692a7&0&0008"
  1106.   ServiceName is "USBXHCI"
  1107. 0: kd> !devobj ffffad0f4edc7570
  1108. Device object (ffffad0f4edc7570) is for:
  1109.  NTPNP_PCI0017 \Driver\pci DriverObject ffffad0f4e4e4cf0
  1110. Current Irp 00000000 RefCount 0 Type 00000022 Flags 00001040
  1111. SecurityDescriptor ffffde89f62029a0 DevExt ffffad0f4edc76c0 DevObjExt ffffad0f4edc7d80 DevNode ffffad0f4ee156e0 
  1112. ExtensionFlags (0x00000800)  DOE_DEFAULT_SD_PRESENT
  1113. Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
  1114. AttachedDevice (Upper) ffffad0f5102cd80 \Driver\USBXHCI
  1115. Device queue is not busy.
  1116. 0: kd> !drvobj \Driver\USBXHCI
  1117. Driver object (ffffad0f4ef4dd00) is for:
  1118.  \Driver\USBXHCI
  1119. Driver Extension List: (id , addr)
  1120. (fffff8046a367960 ffffad0f510e7ad0)  
  1121. Device Object list:
  1122. ffffad0f5102bd80  ffffad0f5102cd80  
  1123. 0: kd> !devobj ffffad0f5102bd80
  1124. Device object (ffffad0f5102bd80) is for:
  1125.  USBPDO-0 \Driver\USBXHCI DriverObject ffffad0f4ef4dd00
  1126. Current Irp 00000000 RefCount 0 Type 00000022 Flags 00003044
  1127. SecurityDescriptor ffffde89f63741a0 DevExt ffffad0f4efbcba0 DevObjExt ffffad0f5102bef8 DevNode ffffad0f59579c40 
  1128. ExtensionFlags (0000000000)  
  1129. Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
  1130. AttachedDevice (Upper) ffffad0f4ef738d0 \Driver\USBHUB3
  1131. Device queue is not busy.
  1132. 0: kd> !devnode ffffad0f59579c40
  1133. DevNode 0xffffad0f59579c40 for PDO 0xffffad0f5102bd80
  1134.   Parent 0xffffad0f4ee156e0   Sibling 0000000000   Child 0xffffad0f511639a0   
  1135.   InstancePath is "USB\ROOT_HUB30\5&23341d40&0&0"
  1136.   ServiceName is "USBHUB3"
  1137.   State = DeviceNodeStarted (0x308)
  1138.   Previous State = DeviceNodeEnumerateCompletion (0x30d)
  1139.   StateHistory[15] = DeviceNodeEnumerateCompletion (0x30d)
  1140.   StateHistory[14] = DeviceNodeEnumeratePending (0x30c)
  1141.   StateHistory[13] = DeviceNodeStarted (0x308)
  1142.   StateHistory[12] = DeviceNodeEnumerateCompletion (0x30d)
  1143.   StateHistory[11] = DeviceNodeEnumeratePending (0x30c)
  1144.   StateHistory[10] = DeviceNodeStarted (0x308)
  1145.   StateHistory[09] = DeviceNodeEnumerateCompletion (0x30d)
  1146.   StateHistory[08] = DeviceNodeEnumeratePending (0x30c)
  1147.   StateHistory[07] = DeviceNodeStarted (0x308)
  1148.   StateHistory[06] = DeviceNodeStartPostWork (0x307)
  1149.   StateHistory[05] = DeviceNodeStartCompletion (0x306)
  1150.   StateHistory[04] = DeviceNodeStartPending (0x305)
  1151.   StateHistory[03] = DeviceNodeResourcesAssigned (0x304)
  1152.   StateHistory[02] = DeviceNodeDriversAdded (0x303)
  1153.   StateHistory[01] = DeviceNodeInitialized (0x302)
  1154.   StateHistory[00] = DeviceNodeUninitialized (0x301)
  1155.   StateHistory[19] = Unknown State (0x0)
  1156.   StateHistory[18] = Unknown State (0x0)
  1157.   StateHistory[17] = Unknown State (0x0)
  1158.   StateHistory[16] = Unknown State (0x0)
  1159.   Flags (0x6c000130)  DNF_ENUMERATED, DNF_IDS_QUERIED, 
  1160.                       DNF_NO_RESOURCE_REQUIRED, DNF_NO_LOWER_DEVICE_FILTERS, 
  1161.                       DNF_NO_LOWER_CLASS_FILTERS, DNF_NO_UPPER_DEVICE_FILTERS, 
  1162.                       DNF_NO_UPPER_CLASS_FILTERS
  1163.   CapabilityFlags (0x00001602)  DeviceD2, SurpriseRemovalOK, 
  1164.                                 WakeFromD0, WakeFromD2
  1165. 0: kd>  !poaction
  1166. PopAction: fffff80467cc9660
  1167.   State..........: 0 - Idle
  1168.   Updates........: 0 
  1169.   Action.........: None
  1170.   Lightest State.: Unspecified
  1171.   Flags..........: 10000003 QueryApps|UIAllowed
  1172.   Irp minor......: ??
  1173.   System State...: Unspecified
  1174.   Hiber Context..: 0000000000000000
  1175.  
  1176. Allocated power irps (PopIrpList - fffff80467cc9d10)
  1177.   IRP: ffffad0f4e4d3ca0 (wait-wake/S4), PDO: ffffad0f4e6eddd0
  1178.   IRP: ffffad0f4ef408a0 (wait-wake/S4), PDO: ffffad0f4ee04060
  1179.   IRP: ffffad0f4ef108a0 (wait-wake/S4), PDO: ffffad0f4ee17060
  1180.   IRP: ffffad0f4ee688a0 (wait-wake/S4), PDO: ffffad0f4ee1a060
  1181.   IRP: ffffad0f4ef328a0 (wait-wake/S4), PDO: ffffad0f4ee1d060
  1182.   IRP: ffffad0f4ef3d8a0 (wait-wake/S4), PDO: ffffad0f4ee20060
  1183.   IRP: ffffad0f594f4a30 (wait-wake/S4), PDO: ffffad0f4eddf060
  1184.   IRP: ffffad0f6dd86b20 (wait-wake/S4), PDO: ffffad0f511710a0
  1185.   IRP: ffffad0f71db5010 (wait-wake/S4), PDO: ffffad0f513f1050
  1186.   IRP: ffffad0f5d3059e0 (wait-wake/S4), PDO: ffffad0f597130a0
  1187.   IRP: ffffad0f77feeaa0 (wait-wake/S4), PDO: ffffad0f5117e110
  1188.   IRP: ffffad0f6dd4ab20 (wait-wake/S4), PDO: ffffad0f51019d80
  1189.   IRP: ffffad0f75b0faa0 (wait-wake/S4), PDO: ffffad0f5117f060
  1190.   IRP: ffffad0f6a388b20 (wait-wake/S0), PDO: ffffad0f5102bd80
  1191.   IRP: ffffad0f4ef318a0 (set/D0,), PDO: ffffad0f4edc7570, CURRENT: ffffad0f5102cd80
  1192.  
  1193. Irp worker threads (PopIrpThreadList - fffff80467cc23f0)
  1194.   THREAD: ffffad0f4e521040 (static), IRP: ffffad0f4ef318a0, DEVICE: ffffad0f5102cd80
  1195.   THREAD: ffffad0f4e520040 (static)
  1196.  
  1197. Broadcast in progress: FALSE
  1198.  
  1199. No Device State present
  1200.  
  1201. 0: kd> !devstack ffffad0f4ef318a0
  1202.   !DevObj           !DrvObj            !DevExt           ObjectName
  1203. Invalid type for DeviceObject 0xffffad0f4ef318a0
  1204. 0: kd> !irp ffffad0f4ef318a0
  1205. Irp is active with 6 stacks 5 is current (= 0xffffad0f4ef31a90)
  1206.  No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  Pending has been returned
  1207.      cmd  flg cl Device   File     Completion-Context
  1208.  [N/A(0), N/A(0)]
  1209.             0  0 00000000 00000000 00000000-00000000    
  1210.  
  1211. 			Args: 00000000 00000000 00000000 00000000
  1212.  [N/A(0), N/A(0)]
  1213.             0  0 00000000 00000000 00000000-00000000    
  1214.  
  1215. 			Args: 00000000 00000000 00000000 00000000
  1216.  [N/A(0), N/A(0)]
  1217.             0  0 00000000 00000000 00000000-00000000    
  1218.  
  1219. 			Args: 00000000 00000000 00000000 00000000
  1220.  [IRP_MJ_POWER(16), IRP_MN_WAIT_WAKE(0)]
  1221.             0  0 ffffad0f4edc7570 00000000 00000000-00000000    
  1222. 	       \Driver\pci
  1223. 			Args: 00000000 00000000 00000000 00000000
  1224. >[IRP_MJ_POWER(16), IRP_MN_SET_POWER(2)]
  1225.             0 e1 ffffad0f5102cd80 00000000 fffff80467a253b0-ffffad0f5130d200 Success Error Cancel pending
  1226. 	       \Driver\USBXHCI	nt!PopRequestCompletion
  1227. 			Args: 00000000 00000001 00000001 00000000
  1228.  [N/A(0), N/A(0)]
  1229.             0  0 00000000 00000000 00000000-ffffad0f5130d200    
  1230.  
  1231. 			Args: 00000000 00000000 00000000 00000000
  1232. 0: kd> !devstack ffffad0f5102cd80
  1233.   !DevObj           !DrvObj            !DevExt           ObjectName
  1234. > ffffad0f5102cd80  \Driver\USBXHCI    ffffad0f4ef61ba0  USBFDO-0
  1235.   ffffad0f4edc7570  \Driver\pci        ffffad0f4edc76c0  NTPNP_PCI0017
  1236. !DevNode ffffad0f4ee156e0 :
  1237.   DeviceInst is "PCI\VEN_1912&DEV_0014&SUBSYS_00000000&REV_03\4&382692a7&0&0008"
  1238.   ServiceName is "USBXHCI"
  1239. 0: kd> !thread ffffad0f4e521040
  1240. THREAD ffffad0f4e521040  Cid 0004.0014  Teb: 0000000000000000 Win32Thread: 0000000000000000 READY on processor 2
  1241. Not impersonating
  1242. DeviceMap                 ffffde89f5015480
  1243. Owning Process            ffffad0f4e475200       Image:         System
  1244. Attached Process          N/A            Image:         N/A
  1245. Wait Start TickCount      48748800       Ticks: 5622 (0:00:01:27.843)
  1246. Context Switch Count      20389          IdealProcessor: 0             
  1247. UserTime                  00:00:00.000
  1248. KernelTime                00:00:00.281
  1249. Win32 Start Address nt!PopIrpWorker (0xfffff80467a25ca0)
  1250. Stack Init ffff8b842a61bc90 Current ffff8b842a61ac20
  1251. Base ffff8b842a61c000 Limit ffff8b842a616000 Call 0000000000000000
  1252. Priority 15 BasePriority 13 PriorityDecrement 32 IoPriority 2 PagePriority 5
  1253. Child-SP          RetAddr           : Args to Child                                                           : Call Site
  1254. ffff8b84`2a61ac60 fffff804`679e23a8 : ffffad0f`5d7d5080 ffff8b84`2a61add8 ffffad0f`4e521040 00000000`00000000 : nt!KiSwapContext+0x76
  1255. ffff8b84`2a61ada0 fffff804`67a221ba : ffffad0f`00000000 ffff8b84`2a61ae90 00000000`00000000 00000000`00000000 : nt!KeSetSystemGroupAffinityThread+0x268
  1256. ffff8b84`2a61ae20 fffff804`67a22085 : 00000000`6e696f49 ffff8b84`00000000 ffffad0f`4edc7570 00000000`00000000 : nt!KiAcquireInterruptConnectLock+0x42
  1257. ffff8b84`2a61ae60 fffff804`67a21ed8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiConnectInterrupt+0x85
  1258. ffff8b84`2a61aed0 fffff804`67fbc2b9 : ffff8b84`2a61b004 ffff8b84`2a61b030 ffffad0f`75dc7e10 00000000`00000004 : nt!KeConnectInterrupt+0x58
  1259. ffff8b84`2a61af30 fffff804`67fbbf0a : ffff8b84`2a61b168 fffff804`6a3140a0 00000000`00000000 ffffad0f`51112bc0 : nt!IopConnectInterrupt+0x30d
  1260. ffff8b84`2a61b080 fffff804`6a32356c : ffffad0f`4ef618b0 00000000`00000000 ffffad0f`51112bc0 ffffad0f`4ef038b0 : nt!IoConnectInterruptEx+0x1da
  1261. ffff8b84`2a61b160 fffff804`6a3233fa : ffffad0f`51112bc0 ffffad0f`4ef4cc90 ffffad0f`4ef038b0 fffff804`6a3151ca : Wdf01000!FxInterrupt::ConnectInternal+0xd4 [minkernel\wdf\framework\shared\irphandlers\pnp\km\interruptobjectkm.cpp @ 173]
  1262. ffff8b84`2a61b1e0 fffff804`6a323623 : ffffad0f`51112d78 00000000`00000000 ffffad0f`51112bc0 ffff8b84`2a61b308 : Wdf01000!FxInterrupt::Connect+0x62 [minkernel\wdf\framework\shared\irphandlers\pnp\interruptobject.cpp @ 1263]
  1263. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxPkgPnp::NotifyResourceObjectsD0+0x7b (Inline Function @ fffff804`6a323623)
  1264. ffff8b84`2a61b270 fffff804`6a3218a6 : ffffad0f`4ef038b0 ffff8b84`2a61b3e0 00000000`00000000 fffff804`6a3aa518 : Wdf01000!FxPkgPnp::PowerWakingConnectInterrupt+0x93 [minkernel\wdf\framework\shared\irphandlers\pnp\powerstatemachine.cpp @ 3614]
  1265. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxPkgPnp::PowerEnterNewState+0x100 (Inline Function @ fffff804`6a3218a6)
  1266. ffff8b84`2a61b2e0 fffff804`6a320c6c : ffffad0f`4ef03ab0 ffffad0f`00000000 ffffad0f`4ef03a88 ffffad0f`4ed59a00 : Wdf01000!FxPkgPnp::PowerProcessEventInner+0x1f6 [minkernel\wdf\framework\shared\irphandlers\pnp\powerstatemachine.cpp @ 1557]
  1267. ffff8b84`2a61b450 fffff804`6a31ffb9 : 00000000`00000000 ffffad0f`5102cd80 ffffad0f`4ef318a0 00000000`00000000 : Wdf01000!FxPkgPnp::PowerProcessEvent+0x15c [minkernel\wdf\framework\shared\irphandlers\pnp\powerstatemachine.cpp @ 1338]
  1268. ffff8b84`2a61b4f0 fffff804`679d4f06 : ffffad0f`5102cd80 ffffad0f`5e1c7670 ffffad0f`4ef31a4b ffffad0f`5102cd80 : Wdf01000!FxPkgFdo::RaiseDevicePowerCompletion+0x39 [minkernel\wdf\framework\shared\irphandlers\pnp\fdopower.cpp @ 396]
  1269. ffff8b84`2a61b520 fffff804`67938b3d : ffffad0f`4ef31a4b ffff8b84`2a61b5f9 00000000`00000002 ffffad0f`5102cd80 : nt!IopUnloadSafeCompletion+0x56
  1270. ffff8b84`2a61b550 fffff804`67938957 : ffffad0f`4ef318a0 00000000`00000000 00000000`00000000 ffffad0f`4edc76c0 : nt!IopfCompleteRequest+0x1cd
  1271. ffff8b84`2a61b660 fffff804`6ab4b826 : 00000000`00000103 ffffad0f`4edc7be8 00000000`00000103 fffff804`6a412053 : nt!IofCompleteRequest+0x17
  1272. ffff8b84`2a61b690 fffff804`6ab41d1e : 00000000`00000000 ffffad0f`4ef31801 ffffad0f`4ef31801 00000000`00000103 : pci!PciPowerUpDeviceTimerCallback+0x426
  1273. ffff8b84`2a61b790 fffff804`6ab42577 : ffffad0f`4edc76c0 ffffad0f`4edc76c0 00000000`00000002 fffff804`6a31faa4 : pci!PciDevice_RetireD0Irp+0xe2
  1274. ffff8b84`2a61b7f0 fffff804`6ab4371d : ffffad0f`4ef318a0 00000000`00000000 ffffad0f`4ef31a48 00000000`00000000 : pci!PciDevice_SetPower+0x177
  1275. ffff8b84`2a61b850 fffff804`67a260e2 : ffffad0f`4ef318a0 ffffad0f`4ef4ce40 fffff804`6a31ff80 00000000`00000000 : pci!PciDispatchPnpPower+0xad
  1276. ffff8b84`2a61b8c0 fffff804`67930d90 : ffffad0f`4ef318a0 fffff804`6a31ff80 00000000`00000000 ffffad0f`5102cd80 : nt!IopPoHandleIrp+0x36
  1277. ffff8b84`2a61b8f0 fffff804`67a2a879 : ffffad0f`4ef03801 ffff8b84`2a61b9f0 00000000`00000000 ffffad0f`4ef61a20 : nt!IofCallDriver+0x70
  1278. ffff8b84`2a61b930 fffff804`6a31fbf4 : ffff8b84`2a61ba70 ffffad0f`4ef4ce40 fffff804`6a31ff80 ffffad0f`4ef038b0 : nt!IoCallDriver+0x9
  1279. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxIrp::PoCallDriver+0x1a (Inline Function @ fffff804`6a31fbf4)
  1280. ffff8b84`2a61b960 fffff804`6a31fc81 : ffff8b84`2a61ba70 00000000`00000000 00000000`00000001 ffff8b84`2a61ba40 : Wdf01000!FxPkgFdo::RaiseDevicePower+0xb4 [minkernel\wdf\framework\shared\irphandlers\pnp\fdopower.cpp @ 367]
  1281. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxPkgFdo::DispatchDeviceSetPower+0x41 (Inline Function @ fffff804`6a31fc81)
  1282. ffff8b84`2a61b9b0 fffff804`6a312ef3 : ffffad0f`4ef038b0 fffff804`67a26442 ffffad0f`5117d001 fffff804`67a2a879 : Wdf01000!FxPkgFdo::_DispatchSetPower+0x71 [minkernel\wdf\framework\shared\irphandlers\pnp\fdopower.cpp @ 122]
  1283. ffff8b84`2a61ba00 fffff804`6a3114cf : ffffad0f`4ef318a0 ffffad0f`4ef318a0 ffffad0f`4ef4cc90 fffff804`67922ed0 : Wdf01000!FxPkgPnp::Dispatch+0xb3 [minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 745]
  1284. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!DispatchWorker+0x3a (Inline Function @ fffff804`6a3114cf)
  1285. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxDevice::DispatchPreprocessedIrp+0x93 (Inline Function @ fffff804`6a3114cf)
  1286. ffff8b84`2a61ba70 fffff804`6c6b12ca : ffffad0f`51017960 ffffad0f`4ef618b0 ffffad0f`4ef61ba0 ffffad0f`510e7c50 : Wdf01000!imp_WdfDeviceWdmDispatchPreprocessedIrp+0x10f [minkernel\wdf\framework\shared\core\km\fxdeviceapikm.cpp @ 255]
  1287. ffff8b84`2a61bac0 fffff804`6a311c4d : ffffad0f`4ef318a0 00000000`00000016 00000000`00000210 ffffad0f`4ef618b0 : USBXHCI!Controller_WdfEvtPreprocessSetPowerIrp+0x14a
  1288. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!PreprocessIrp+0x2d (Inline Function @ fffff804`6a311c4d)
  1289. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!DispatchWorker+0x178 (Inline Function @ fffff804`6a311c4d)
  1290. (Inline Function) --------`-------- : --------`-------- --------`-------- --------`-------- --------`-------- : Wdf01000!FxDevice::Dispatch+0x196 (Inline Function @ fffff804`6a311c4d)
  1291. ffff8b84`2a61bb00 fffff804`67a25ec6 : ffff8b84`2a61bbe0 ffffad0f`4ef318a0 00000000`00000000 ffffad0f`5102cd80 : Wdf01000!FxDevice::DispatchWithLock+0x1ed [minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1430]
  1292. ffff8b84`2a61bb60 fffff804`679d43a5 : ffffad0f`4e521040 fffff804`67a25ca0 00000000`00000000 002d0064`00610070 : nt!PopIrpWorker+0x226
  1293. ffff8b84`2a61bc10 fffff804`67a7545c : ffffbd00`deb40180 ffffad0f`4e521040 fffff804`679d4350 00200020`0020000a : nt!PspSystemThreadStartup+0x55
  1294.

其他资源

Bug 检查 0x9F DRIVER_POWER_STATE_FAILURE - Windows drivers | Microsoft Learn

虫趣：抓一个Intel显卡驱动的臭虫_张佩的博客-CSDN博客

联想中国(Lenovo China)联想知识库

Windows蓝屏分析-DRIVER_POWER_STATE_FAILURE键盘电源切换引起的蓝屏 - 内核开发

HID 体系结构 - USB中文网

windbg使用超详细教程(我是新手，大佬轻虐) - 知乎

Windows下的USB设备描述符分析工具-UsbTreeView - USB中文网

电脑主板原理图讲解（电脑主板构造图文详解）CPU和北桥芯片（随着发展有的北桥已经被设计到CPU内部了）南桥芯片_qq_25814297-npl的博客-CSDN博客_电脑主板原理图

Bushound数据分析及使用指南_Swell_Fish的博客-CSDN博客_bus hound数据分析

Linux驱动开发（十三）---USB驱动HID开发学习（鼠标）_linux hid 应用编程_胖哥王老师的博客-CSDN博客

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/AllinToyou/article/detail/130240
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号