2021-04-17

Windows10 蓝屏修复

蓝屏提示
有关问题的详细信息和可能的解决方法，请访问
https://www.windows.com/stopcode

如致电支持人员，请向他们提供以下信息
中止代码：IRQL_NOT_LESS_OR_EQUAL

第一种方式
通过WinDbg软件打开dmp文件（C:\Windows\Minidump）

ADDITIONAL_DEBUG_TEXT:  
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

WRONG_SYMBOLS_TIMESTAMP: ea0877a

WRONG_SYMBOLS_SIZE: 1046000

FAULTING_MODULE: fffff80574a00000 nt

BUGCHECK_CODE:  a

BUGCHECK_P1: 1ee

BUGCHECK_P2: 2

BUGCHECK_P3: 1

BUGCHECK_P4: fffff805752daa9b

WRITE_ADDRESS: *************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_MMPFN                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that     ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_MMPTE                                     ***
***                                                                   ***
*************************************************************************
Unable to get size of nt!_MMPTE - probably bad symbols
 00000000000001ee 

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

STACK_TEXT:  
ffffb209`da3ed808 fffff805`74e07d69     : 00000000`0000000a 00000000`000001ee 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffb209`da3ed810 fffff805`74e04069     : 00000000`00000000 00000000`00000000 00000000`00000000 ffffb80d`a9186bb0 : nt!setjmpex+0x81d9
ffffb209`da3ed950 fffff805`752daa9b     : fffff805`82452fc3 00000000`00000000 00000000`00000000 ffffb80d`a344a4f0 : nt!setjmpex+0x44d9
ffffb209`da3edae8 ffffb80d`a344a500     : ffffb80d`a041b9e0 ffffb80d`a344a550 fffff805`824c0c16 ffffb80d`a9bcb000 : nt!ObUnRegisterCallbacks+0x17cb
ffffb209`da3edb28 ffffb80d`a041b9e0     : ffffb80d`a344a550 fffff805`824c0c16 ffffb80d`a9bcb000 00000000`00000000 : 0xffffb80d`a344a500
ffffb209`da3edb30 ffffb80d`a344a550     : fffff805`824c0c16 ffffb80d`a9bcb000 00000000`00000000 ffffb209`da3edc21 : 0xffffb80d`a041b9e0
ffffb209`da3edb38 fffff805`824c0c16     : ffffb80d`a9bcb000 00000000`00000000 ffffb209`da3edc21 fffff805`824a8224 : 0xffffb80d`a344a550
ffffb209`da3edb40 ffffb80d`a9bcb000     : 00000000`00000000 ffffb209`da3edc21 fffff805`824a8224 ffffb80d`a3bcf658 : dxgmms2+0x80c16
ffffb209`da3edb48 00000000`00000000     : ffffb209`da3edc21 fffff805`824a8224 ffffb80d`a3bcf658 ffffb80d`a3bcf658 : 0xffffb80d`a9bcb000


STACK_COMMAND:  .thread ; .cxr ; kb

EXCEPTION_CODE_STR:  0EA0877A

EXCEPTION_STR:  WRONG_SYMBOLS

PROCESS_NAME:  ntoskrnl.wrong.symbols.exe

IMAGE_NAME:  ntoskrnl.wrong.symbols.exe

MODULE_NAME: nt_wrong_symbols

SYMBOL_NAME:  nt_wrong_symbols!0EA0877A1046000

FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X64_19041.1.amd64fre.vb_release.191206-1406_TIMESTAMP_0EA0877A_nt_wrong_symbols!0EA0877A1046000

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {2e746e2f-4433-a840-a6bf-e66aec5707fb}

Followup:     MachineOwner
---------

特征库不匹配

.symfix; .reload

*[然后开始下载中…]

第二种方式

sfc / scannow

Microsoft (R) Windows (R) Resource Checker 6.0 版
版权所有 (C) Microsoft Corporation。保留所有权利。

扫描所有保护的系统文件的完整性，并使用正确的 Microsoft 版本替换
不正确的版本。

SFC [/SCANNOW] [/VERIFYONLY] [/SCANFILE=<file>] [/VERIFYFILE=<file>]
    [/OFFWINDIR=<offline windows directory> /OFFBOOTDIR=<offline boot directory> [/OFFLOGFILE=<log file path>]]

/SCANNOW        扫描所有保护的系统文件的完整性，并尽可能修复
                有问题的文件。
/VERIFYONLY     扫描所有保护的系统文件的完整性。不会执行修复
                操作。
/SCANFILE       扫描引用的文件的完整性，如果找到问题，则修复文件。
                指定完整路径 <file>
/VERIFYFILE     验证带有完整路径 <file> 的文件的完整性。
                不会执行修复操作。
/OFFBOOTDIR     对于脱机修复，指定脱机启动目录的位置
/OFFWINDIR      对于脱机修复，指定脱机 Windows 目录的位置
/OFFLOGFILE     对于脱机修复，通过指定日志文件路径选择性地启用记录

示例:

        sfc /SCANNOW
        sfc /VERIFYFILE=c:\windows\system32\kernel32.dll
        sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows
        sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows /OFFLOGFILE=c:\log.txt
        sfc /VERIFYONLY

C:\WINDOWS\system32>sfc /scannow

开始系统扫描。此过程将需要一些时间。

开始系统扫描的验证阶段。
验证 100% 已完成。

Windows 资源保护找到了损坏文件，但其中有一些文件无法修复。
对于联机修复，位于 windir\Logs\CBS\CBS.log 的 CBS 日志文件中
有详细信息。例如 C:\Windows\Logs\CBS\CBS.log。对于脱机修复，
/OFFLOGFILE 标记提供的日志文件中有详细信息。
``

findstr /C:"[SR] Cannot repair member file" %windir%\logs\cbs\cbs.log >"%userprofile%\Desktop\sfcdetails.txt"

结果是

2021-04-17 14:05:32, Info                  CSI    000000f5 [SR] Cannot repair member file [l:10]'img105.jpg' of Microsoft-Windows-ThemeUI-LockscreenBackgrounds-Client, version 10.0.19041.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2021-04-17 14:05:33, Info                  CSI    000000f8 [SR] Cannot repair member file [l:10]'img105.jpg' of Microsoft-Windows-ThemeUI-LockscreenBackgrounds-Client, version 10.0.19041.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2021-04-17 14:06:33, Info                  CSI    000001d6 [SR] Cannot repair member file [l:10]'img105.jpg' of Microsoft-Windows-ThemeUI-LockscreenBackgrounds-Client, version 10.0.19041.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2021-04-17 14:06:33, Info                  CSI    000001d8 [SR] Cannot repair member file [l:10]'img105.jpg' of Microsoft-Windows-ThemeUI-LockscreenBackgrounds-Client, version 10.0.19041.1, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch


原因找到了！