一个蓝屏的分析-The caller is unlocking a pageable section that is not currently locked.

同事，给了一个蓝屏文件，说是不知道操作什么了引起了系统蓝屏，使用自定义分析可看到

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000001010, The caller is unlocking a pageable section that is not
	currently locked.  (This section was either never locked or
	is being unlocked twice.)
Arg2: fffff8073d4ff000
Arg3: fffff8073d4f02c0
Arg4: ffffffffffffffff

使用windbg查看系统调用栈:

 # RetAddr           : Args to Child                                                           : Call Site
00 fffff807`21284696 : 00000000`0000001a 00000000`00001010 fffff807`3d4ff000 fffff807`3d4f02c0 : nt!KeBugCheckEx
01 fffff807`210bffc3 : fffff807`3d4f02c0 00000000`00000000 ffffa200`00000000 00000000`00000001 : nt!MiUnlockImageSection+0x1c4c1e
02 fffff807`210bfa6b : fffff807`3d4f00f0 ffffe10b`feaa29a0 00000000`00030000 ffffe10b`feaa29a0 : nt!MiLockPagableImageSection+0x213
03 fffff807`3d4f2141 : ffffe10c`006e11c0 ffffe10c`006e1070 ffff8287`f7f6f660 00000000`00000002 : nt!MmUnlockPagableImageSection+0xb
04 fffff807`210de109 : 00000000`00000010 fffff807`210de2e4 ffffffff`fff0bdc0 ffffe10b`feaa29a0 : ftser2k+0x2141
05 fffff807`3bb01839 : ffffe10b`ff737660 ffffe10c`03864400 00000000`00000001 ffffe10c`022e2080 : nt!IofCallDriver+0x59
06 fffff807`210de109 : ffffe10c`038644a0 ffffe10b`feaa29a0 ffffe10b`feaa29a0 ffffe10b`ff737838 : serenum!Serenum_CreateClose+0xb9
07 fffff807`2165e214 : 00000000`00000001 ffffe10c`038644a0 ffffe10b`feaa29a0 00000000`00000000 : nt!IofCallDriver+0x59
08 fffff807`21670590 : 00000000`00000001 00000000`00000000 ffffe10b`f52fed20 00000000`00000001 : nt!IopDeleteFile+0x124
09 fffff807`210dba89 : 00000000`00000000 00000000`00000000 00000000`00000001 ffffe10c`038644a0 : nt!ObpRemoveObjectRoutine+0x80
0a fffff807`21667b40 : 00000000`00000000 ffffe10b`f52fed20 ffffcb09`00000000 00000000`00000000 : nt!ObfDereferenceObjectWithTag+0xc9
0b fffff807`2166daae : ffffe10c`0009a080 00000000`00000001 ffff606e`9c95e3ae fffff591`1f7657b0 : nt!ObCloseHandleTableEntry+0x270
0c fffff807`2126e605 : ffffe10c`0009a080 ffffe10c`0009a080 ffff8287`f7f6fa80 00000000`00000113 : nt!NtClose+0xde
0d 00000000`774c1cbc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0e 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774c1cbc

可以看到，从应用层的一个地址0x774c1cbc，进入系统调用KiSystemServiceCopyEnd，然后调用NtClose，然后可以基本确定 应用层回收系统资源引起的，而且是一个32位的进程引起的。

这里我们使用!thread命令查看线程信息

2: kd> !thread
THREAD ffffe10c0009a080  Cid 1aec.1a88  Teb: 0000000000284000 Win32Thread: ffffe10c030cf9f0 RUNNING on processor 2
IRP List:
    ffffe10bfeaa29a0: (0006,01f0) Flags: 00000404  Mdl: 00000000
Not impersonating
DeviceMap                 ffffcb093c43b8f0
Owning Process            ffffe10c022e2080       Image:         sscom5.13.1.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      3386583        Ticks: 8 (0:00:00:00.125)
Context Switch Count      1621           IdealProcessor: 2             
UserTime                  00:00:00.078
KernelTime                00:00:00.140
Win32 Start Address 0x0000000000547001
Stack Init ffff8287f7f6fb90 Current ffff8287f7f6f250
Base ffff8287f7f70000 Limit ffff8287f7f69000 Call 0000000000000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
ffff8287`f7f6f4e8 fffff807`21284696 : 00000000`0000001a 00000000`00001010 fffff807`3d4ff000 fffff807`3d4f02c0 : nt!KeBugCheckEx
ffff8287`f7f6f4f0 fffff807`210bffc3 : fffff807`3d4f02c0 00000000`00000000 ffffa200`00000000 00000000`00000001 : nt!MiUnlockImageSection+0x1c4c1e
ffff8287`f7f6f530 fffff807`210bfa6b : fffff807`3d4f00f0 ffffe10b`feaa29a0 00000000`00030000 ffffe10b`feaa29a0 : nt!MiLockPagableImageSection+0x213
ffff8287`f7f6f580 fffff807`3d4f2141 : ffffe10c`006e11c0 ffffe10c`006e1070 ffff8287`f7f6f660 00000000`00000002 : nt!MmUnlockPagableImageSection+0xb
ffff8287`f7f6f5b0 fffff807`210de109 : 00000000`00000010 fffff807`210de2e4 ffffffff`fff0bdc0 ffffe10b`feaa29a0 : ftser2k+0x2141
ffff8287`f7f6f650 fffff807`3bb01839 : ffffe10b`ff737660 ffffe10c`03864400 00000000`00000001 ffffe10c`022e2080 : nt!IofCallDriver+0x59
ffff8287`f7f6f690 fffff807`210de109 : ffffe10c`038644a0 ffffe10b`feaa29a0 ffffe10b`feaa29a0 ffffe10b`ff737838 : serenum!Serenum_CreateClose+0xb9
ffff8287`f7f6f6f0 fffff807`2165e214 : 00000000`00000001 ffffe10c`038644a0 ffffe10b`feaa29a0 00000000`00000000 : nt!IofCallDriver+0x59
ffff8287`f7f6f730 fffff807`21670590 : 00000000`00000001 00000000`00000000 ffffe10b`f52fed20 00000000`00000001 : nt!IopDeleteFile+0x124
ffff8287`f7f6f7b0 fffff807`210dba89 : 00000000`00000000 00000000`00000000 00000000`00000001 ffffe10c`038644a0 : nt!ObpRemoveObjectRoutine+0x80
ffff8287`f7f6f810 fffff807`21667b40 : 00000000`00000000 ffffe10b`f52fed20 ffffcb09`00000000 00000000`00000000 : nt!ObfDereferenceObjectWithTag+0xc9
ffff8287`f7f6f850 fffff807`2166daae : ffffe10c`0009a080 00000000`00000001 ffff606e`9c95e3ae fffff591`1f7657b0 : nt!ObCloseHandleTableEntry+0x270
ffff8287`f7f6f990 fffff807`2126e605 : ffffe10c`0009a080 ffffe10c`0009a080 ffff8287`f7f6fa80 00000000`00000113 : nt!NtClose+0xde
ffff8287`f7f6fa00 00000000`774c1cbc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25 (TrapFrame @ ffff8287`f7f6fa00)
00000000`0009eec8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774c1cbc

可以看到，完全和内核调用栈完全对的上。
所以这个锅就只能甩给sscom5.13.1.exe，这个串口调用工具了。