Fatal System Error: 0x0000003b

[kouzhudong]

[kouzhudong]

当天拉的代码，当天编译，当天测试的。启动不久出现来，微软杀毒拦截来好几次。

[kouzhudong]

0: kd> g
KDTARGET: Refreshing KD connection

*** Fatal System Error: 0x0000003b
                       (0x00000000C0000005,0xFFFFF80537DED11E,0xFFFF9386CE746C30,0x0000000000000000)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

For analysis of this file, run !analyze -v
nt!DbgBreakPointWithStatus:
fffff805`a1d02a50 cc              int     3
0: kd> !analyze -v
Connected to Windows 10 26100 x64 target at (Wed May 21 20:35:29.250 2025 (UTC + 8:00)), ptr64 TRUE
Loading Kernel Symbols
.........................................................

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

......
................................................................
............................................
Loading User Symbols
................................................................


Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..
Loading unloaded module list
...........

************* Symbol Loading Error Summary **************
Module name            Error
SharedUserData         No error - symbol load deferred

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80537ded11e, Address of the instruction which caused the bugcheck
Arg3: ffff9386ce746c30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

*** WARNING: Unable to verify checksum for WinArk.exe

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.Sec
    Value: 35

    Key  : Analysis.DebugAnalysisProvider.CPP
    Value: Create: 8007007e on CORREY

    Key  : Analysis.DebugData
    Value: CreateObject

    Key  : Analysis.DebugModel
    Value: CreateObject

    Key  : Analysis.Elapsed.Sec
    Value: 445

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 176

    Key  : Analysis.System
    Value: CreateObject


BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff80537ded11e

BUGCHECK_P3: ffff9386ce746c30

BUGCHECK_P4: 0

CONTEXT:  ffff9386ce746c30 -- (.cxr 0xffff9386ce746c30)
rax=0000000000000000 rbx=00000000c0000010 rcx=000000008000205c
rdx=ffff990481db0d50 rsi=ffff990481db0d50 rdi=ffff990481db0e28
rip=fffff80537ded11e rsp=ffff9386ce747680 rbp=ffff9386ce747a90
 r8=fffff80537deca20  r9=ffff990480d538b0 r10=0000000000000000
r11=0000000000000000 r12=ffff9904812e2600 r13=0000000000000000
r14=0000000000000000 r15=0000000000000010
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
AntiRootkit!AntiRootkitDeviceControl+0x6fe:
fffff805`37ded11e 488b38          mov     rdi,qword ptr [rax] ds:002b:00000000`00000000=????????????????
Resetting default scope

PROCESS_NAME:  WinArk.exe

STACK_TEXT:  
ffff9386`ce747680 fffff805`a1a4586d     : ffff9904`80d538b0 ffff9904`812e2600 ffff9904`81d2c7c0 00000000`00000000 : AntiRootkit!AntiRootkitDeviceControl+0x6fe [D:\Windows\ARK\WinArk\Anti-Rootkit\ARK.cpp @ 967] 
ffff9386`ce7479e0 fffff805`a20d3948     : ffff9904`81d2c7c0 ffff9386`ce747a90 ffff9904`80d538b0 00000000`00000001 : nt!IofCallDriver+0xcd
ffff9386`ce747a20 fffff805`a20d2792     : 00000000`00000005 00000000`00000001 ffff9904`81d2c7c0 00000000`00000001 : nt!IopSynchronousServiceTail+0x1c8
ffff9386`ce747ad0 fffff805`a20d1e1e     : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x962
ffff9386`ce747d40 fffff805`a1eb8655     : ffff9904`7b9fce30 fffff805`a21a268f 00000000`00000000 00000000`00000000 : nt!NtDeviceIoControlFile+0x5e
ffff9386`ce747db0 00007ff8`7bda2054     : 00007ff8`795ea253 00007ff6`4e353002 00000065`85af96b8 0000a7f4`e37f51f1 : nt!KiSystemServiceCopyEnd+0x25
00000065`85af8738 00007ff8`795ea253     : 00007ff6`4e353002 00000065`85af96b8 0000a7f4`e37f51f1 00000000`00000000 : ntdll!NtDeviceIoControlFile+0x14
00000065`85af8740 00007ff8`7abc32b5     : 00000000`80002054 00000000`00000000 0000018a`6d2e3d00 00000000`00000021 : KERNELBASE!DeviceIoControl+0x73
00000065`85af87b0 00007ff6`4dac3a32     : 00000000`80006010 cccccccc`cccccccc 00000065`85af8840 00000000`00000001 : KERNEL32!DeviceIoControlImplementation+0x75
00000065`85af8800 00000000`80006010     : cccccccc`cccccccc 00000065`85af8840 00000000`00000001 00000065`85af8864 : WinArk!DriverHelper::GetUnloadedDriverDataSize+0xa2 [D:\Windows\ARK\WinArk\WinSysCore\DriverHelper.cpp @ 469] 
00000065`85af8808 cccccccc`cccccccc     : 00000065`85af8840 00000000`00000001 00000065`85af8864 cccccccc`00000004 : 0x80006010
00000065`85af8810 00000065`85af8840     : 00000000`00000001 00000065`85af8864 cccccccc`00000004 00000065`85af8844 : 0xcccccccc`cccccccc
00000065`85af8818 00000000`00000001     : 00000065`85af8864 cccccccc`00000004 00000065`85af8844 00000000`00000000 : 0x00000065`85af8840
00000065`85af8820 00000065`85af8864     : cccccccc`00000004 00000065`85af8844 00000000`00000000 cccccccc`cccccccc : 0x1
00000065`85af8828 cccccccc`00000004     : 00000065`85af8844 00000000`00000000 cccccccc`cccccccc cccccccc`cccccccc : 0x00000065`85af8864
00000065`85af8830 00000065`85af8844     : 00000000`00000000 cccccccc`cccccccc cccccccc`cccccccc cccccccc`cccccccc : 0xcccccccc`00000004
00000065`85af8838 00000000`00000000     : cccccccc`cccccccc cccccccc`cccccccc cccccccc`cccccccc cccccccc`cccccccc : 0x00000065`85af8844


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff805a194c728-fffff805a194c72a  3 bytes - nt!_guard_check_icall_fptr
	[ 40 0a cb:60 e1 ea ]
    fffff805a194c730-fffff805a194c733  4 bytes - nt!_guard_dispatch_icall_fptr (+0x08)
	[ c0 fd e9 a1:80 07 3b a2 ]
    fffff805a1a009c3-fffff805a1a009c5  3 bytes - nt!PopQueryBootSessionStandbyActivationInfo+27
	[ e9 d7 4a:b9 fd 9a ]
    fffff805a1a00bbb-fffff805a1a00bbd  3 bytes - nt!PpmQueryPlatformStateResidency+97 (+0x1f8)
	[ f1 d5 4a:c1 fb 9a ]
    fffff805a1a013a0 - nt!PopCaptureSleepStudyStatistics+70 (+0x7e5)
	[ 8f:98 ]
    fffff805a1a01410-fffff805a1a01412  3 bytes - nt!PopCaptureSleepStudyStatistics+e0 (+0x70)
	[ 9c cd 4a:6c f3 9a ]
    fffff805a1a02735 - nt!PopFxStopDeviceAccounting+49 (+0x1325)
	[ 7b:84 ]
    fffff805a1a03c53-fffff805a1a03c55  3 bytes - nt!FsRtlpRemoveAndCompleteWaitingIrp+a3 (+0x151e)
	[ 59 a5 4a:29 cb 9a ]
    fffff805a1a0429a-fffff805a1a0429c  3 bytes - nt!IoCancelIrp+aa (+0x647)
	[ 12 9f 4a:e2 c4 9a ]
    fffff805a1a0518a - nt!PopPowerRequestCreateCommon+e6 (+0xef0)
	[ 51:5a ]
    fffff805a1a05761 - nt!PopUmpoSendPowerMessage+8d (+0x5d7)
	[ 4b:54 ]
    fffff805a1a05834 - nt!PopUmpoSendPowerMessage+160 (+0xd3)
	[ 4a:53 ]
    fffff805a1a0a0ae-fffff805a1a0a0b0  3 bytes - nt!KiProcessExpiredTimerList+4fe (+0x487a)
	[ fe 40 4a:ce 66 9a ]
    fffff805a1a0b889-fffff805a1a0b88b  3 bytes - nt!HalpPCIConfig+2d9 (+0x17db)
	[ 23 29 4a:f3 4e 9a ]
    fffff805a1a0b907 - nt!HalpPCIConfig+357 (+0x7e)
	[ e9:f2 ]
    fffff805a1a0b926-fffff805a1a0b928  3 bytes - nt!HalpPCIConfig+376 (+0x1f)
	[ 86 28 4a:56 4e 9a ]
    fffff805a1a0b9c7 - nt!HalpPCIConfig+417 (+0xa1)
	[ e9:f2 ]
    fffff805a1a0bf9f - nt!HalpPciMapMmConfigPhysicalAddress+2b (+0x5d8)
	[ f6:f3 ]
    fffff805a1a0cdb5-fffff805a1a0cdb7  3 bytes - nt!HalpPciAccessMmConfigSpace+121 (+0xe16)
	[ f7 13 4a:c7 39 9a ]
    fffff805a1a0d3d1 - nt!MmSetAddressRangeModifiedEx+51 (+0x61c)
	[ f6:f3 ]
    fffff805a1a0d450 - nt!MmSetAddressRangeModifiedEx+d0 (+0x7f)
	[ de:a9 ]
    fffff805a1a0d713 - nt!MmSetAddressRangeModifiedEx+393 (+0x2c3)
	[ de:a9 ]
    fffff805a1a0d843 - nt!MmSetAddressRangeModifiedEx+4c3 (+0x130)
	[ f6:f3 ]
    fffff805a1a0d859 - nt!MmSetAddressRangeModifiedEx+4d9 (+0x16)
	[ f6:f3 ]
    fffff805a1a0d8ad - nt!MmSetAddressRangeModifiedEx+52d (+0x54)
	[ f6:f3 ]
    fffff805a1a0df18-fffff805a1a0df1a  3 bytes - nt!MiGetMultiplexedVm+14 (+0x66b)
	[ 40 fb f6:c0 f9 f3 ]
    fffff805a1a0df41 - nt!MiGetMultiplexedVm+3d (+0x29)
	[ de:a9 ]
    fffff805a1a0e04c - nt!MiInitializePoolCommitPacket+54 (+0x10b)
	[ f6:f3 ]
    fffff805a1a0e22f - nt!RtlpHpEnvAllocVA+af (+0x1e3)
	[ c0:c9 ]
    fffff805a1a0e2a6 - nt!RtlpHpEnvAllocVA+126 (+0x77)
	[ f6:f3 ]
    fffff805a1a0e78e - nt!MiCommitPoolMemory+3e (+0x4e8)
	[ f6:f3 ]
    fffff805a1a0eb41 - nt!MiLockPoolCommitPageTable+31 (+0x3b3)
	[ f6:f3 ]
    fffff805a1a0ff40 - nt!MmMapViewInSystemCache+e4 (+0x13ff)
	[ f6:f3 ]
    fffff805a1a12e0c-fffff805a1a12e0e  3 bytes - nt!PfpPartitionIterate+30c (+0x2ecc)
	[ a0 b3 49:70 d9 99 ]
    fffff805a1a13992-fffff805a1a13994  3 bytes - nt!PfFileInfoNotify+972 (+0xb86)
	[ 1a a8 49:ea cd 99 ]
    fffff805a1a18ec9-fffff805a1a18ecb  3 bytes - nt!PopPepProcessEvent+11b9 (+0x5537)
	[ e3 52 49:b3 78 99 ]
    fffff805a1a18ed3-fffff805a1a18ed5  3 bytes - nt!PopPepProcessEvent+11c3 (+0x0a)
	[ d9 52 49:a9 78 99 ]
    fffff805a1a18edd-fffff805a1a18edf  3 bytes - nt!PopPepProcessEvent+11cd (+0x0a)
	[ cf 52 49:9f 78 99 ]
    fffff805a1a18ee7-fffff805a1a18ee9  3 bytes - nt!PopPepProcessEvent+11d7 (+0x0a)
	[ c5 52 49:95 78 99 ]
    fffff805a1a1942f-fffff805a1a19431  3 bytes - nt!PopPepTriggerActivity+30f (+0x548)
	[ 7d 4d 49:4d 73 99 ]
    fffff805a1a19a5b - nt!MiReleasePteMappings+3b (+0x62c)
	[ 08:11 ]
    fffff805a1a19cbc - nt!MiReleasePteMappings+29c (+0x261)
	[ f6:f3 ]
    fffff805a1a1a0e5 - nt!MiReleasePteMappings+6c5 (+0x429)
	[ f6:f3 ]
    fffff805a1a1a33b - nt!MiReturnSystemPtes+4b (+0x256)
	[ f6:f3 ]
    fffff805a1a1a723 - nt!MiObtainSystemCacheView+183 (+0x3e8)
	[ f6:f3 ]
    fffff805a1a1aa6a-fffff805a1a1aa6f  6 bytes - nt!MiUnlockWorkingSetOptimal+12 (+0x347)
	[ 68 df be 7d fb f6:38 7f fe fc f9 f3 ]
    fffff805a1a1aa84-fffff805a1a1aa88  5 bytes - nt!MiUnlockWorkingSetOptimal+2c (+0x1a)
	[ d0 be 7d fb f6:70 fe fc f9 f3 ]
    fffff805a1a1aa8e-fffff805a1a1aa92  5 bytes - nt!MiUnlockWorkingSetOptimal+36 (+0x0a)
	[ df be 7d fb f6:7f fe fc f9 f3 ]
    fffff805a1a1abc6-fffff805a1a1abc8  3 bytes - nt!MiSetSystemCacheReverseMap+16 (+0x138)
	[ 40 fb f6:c0 f9 f3 ]
    fffff805a1a1abef - nt!MiSetSystemCacheReverseMap+3f (+0x29)
	[ de:a9 ]
    fffff805a1a1ac46 - nt!MiLockWorkingSetOptimal+26 (+0x57)
	[ f6:f3 ]
    fffff805a1a1ad08-fffff805a1a1ad0d  6 bytes - nt!MiLockWorkingSetOptimal+e8 (+0xc2)
	[ 68 df be 7d fb f6:38 7f fe fc f9 f3 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
    fffff805a1ef1113 - nt!PopEtEnergyTrackerQueryProcessEnergyValues+10b
	[ 91:9a ]
    fffff805a1ef1172-fffff805a1ef1175  4 bytes - nt!PopEtEnergyTrackerQueryProcessEnergyValues+16a (+0x5f)
	[ 3a d0 fb ff:0a f6 4b 00 ]
    fffff805a1ef11b1-fffff805a1ef11b4  4 bytes - nt!PopEtEnergyTrackerQueryProcessEnergyValues+1a9 (+0x3f)
	[ fb cf fb ff:cb f5 4b 00 ]
    fffff805a1ef11da - nt!PopEtEnergyTrackerQueryProcessEnergyValues+1d2 (+0x29)
	[ 91:9a ]
    fffff805a1ef1215-fffff805a1ef1218  4 bytes - nt!PopEtEnergyTrackerQueryProcessEnergyValues+20d (+0x3b)
	[ 97 cf fb ff:67 f5 4b 00 ]
    fffff805a1ef124d - nt!PopEtEnergyTrackerQueryProcessEnergyValues+245 (+0x38)
	[ 90:99 ]
    fffff805a1ef1284-fffff805a1ef1287  4 bytes - nt!PopEtEnergyTrackerQueryProcessEnergyValues+27c (+0x37)
	[ 28 cf fb ff:f8 f4 4b 00 ]
    fffff805a1ef2292-fffff805a1ef2295  4 bytes - nt!PopPowerAggregatorDisengageAggressiveStandbyActions+102 (+0x100e)
	[ 1a bf fb ff:ea e4 4b 00 ]
    fffff805a1ef25bc-fffff805a1ef25bf  4 bytes - nt!CmpLockCallbackListExclusive+180 (+0x32a)
	[ f0 bb fb ff:c0 e1 4b 00 ]
    fffff805a1ef298c-fffff805a1ef298f  4 bytes - nt!CmpLockCallbackListExclusive+550 (+0x3d0)
	[ 20 b8 fb ff:f0 dd 4b 00 ]
    fffff805a1ef2dab - nt!KeInitializeProfileCallback+2f (+0x41f)
	[ 75:7e ]
    fffff805a1ef2ddc - nt!KeInitializeProfileCallback+60 (+0x31)
	[ 75:7e ]
    fffff805a1ef3763-fffff805a1ef3766  4 bytes - nt!ExpWatchProductTypeWork+323 (+0x987)
	[ 49 aa fb ff:19 d0 4b 00 ]
    fffff805a1ef49b7 - nt!MiScrubLargePageRegions+2f (+0x1254)
	[ de:a9 ]
    fffff805a1ef4f44 - nt!PfpRpCHashGrow+118 (+0x58d)
	[ 53:5c ]
    fffff805a1ef5cc0-fffff805a1ef5cc3  4 bytes - nt!NtOpenKeyTransactedEx_Stub+48 (+0xd7c)
	[ ec 84 fb ff:bc aa 4b 00 ]
    fffff805a1ef6284-fffff805a1ef6287  4 bytes - nt!IoCancelFileOpen+204 (+0x5c4)
	[ 28 7f fb ff:f8 a4 4b 00 ]
    fffff805a1ef6701 - nt!CmpReserveRollbackPacketSpace+79 (+0x47d)
	[ 3b:44 ]
    fffff805a1ef7706-fffff805a1ef7709  4 bytes - nt!HalpEnableSecondaryInterrupt+a6 (+0x1005)
	[ a6 6a fb ff:76 90 4b 00 ]
    fffff805a1ef7943 - nt!PiCMCaptureProblemInputData+f7 (+0x23d)
	[ 29:32 ]
    fffff805a1ef7a6e-fffff805a1ef7a71  4 bytes - nt!PopFreeHiberContext+116 (+0x12b)
	[ 3e 67 fb ff:0e 8d 4b 00 ]
    fffff805a1ef7b5d - nt!PopFreeHiberContext+205 (+0xef)
	[ 27:30 ]
    fffff805a1ef7be1-fffff805a1ef7be4  4 bytes - nt!PopPdcSnapDiagnosticContext+11 (+0x84)
	[ cb 65 fb ff:9b 8b 4b 00 ]
    fffff805a1ef7c9c - nt!SmKmFileInfoInit+c (+0xbb)
	[ 26:2f ]
    fffff805a1ef7fc9 - nt!PopSmartSuspendResetData+11 (+0x32d)
	[ 23:2c ]
    fffff805a1ef8023 - nt!PiDqSameUserHive+3b (+0x5a)
	[ 22:2b ]
    fffff805a1ef8032 - nt!PiDqSameUserHive+4a (+0x0f)
	[ 22:2b ]
    fffff805a1ef84b8-fffff805a1ef84bb  4 bytes - nt!CmFcpFeatureUsageProviderSubscriptionWrapper+38 (+0x486)
	[ f4 5c fb ff:c4 82 4b 00 ]
    fffff805a1ef8f23 - nt!HalpDmaAllocateChildAdapterV3+73 (+0xa6b)
	[ 13:1c ]
    fffff805a1ef8fd6-fffff805a1ef8fd9  4 bytes - nt!HalpDmaAllocateChildAdapterV3+126 (+0xb3)
	[ d6 51 fb ff:a6 77 4b 00 ]
    fffff805a1ef906b - nt!HalpDmaAllocateChildAdapterV3+1bb (+0x95)
	[ 12:1b ]
    fffff805a1ef916b-fffff805a1ef916e  4 bytes - nt!HalpDmaAllocateChildAdapterV3+2bb (+0x100)
	[ 41 50 fb ff:11 76 4b 00 ]
    fffff805a1ef92f4-fffff805a1ef92f7  4 bytes - nt!HalpDmaAllocateChildAdapterV3+444 (+0x189)
	[ b8 4e fb ff:88 74 4b 00 ]
    fffff805a1ef944a-fffff805a1ef944d  4 bytes - nt!HalpDmaAllocateChildAdapterV3+59a (+0x156)
	[ 62 4d fb ff:32 73 4b 00 ]
    fffff805a1ef94d4-fffff805a1ef94d7  4 bytes - nt!HalpDmaAllocateChildAdapterV3+624 (+0x8a)
	[ d8 4c fb ff:a8 72 4b 00 ]
    fffff805a1ef951d-fffff805a1ef9520  4 bytes - nt!HalpDmaAllocateChildAdapterV3+66d (+0x49)
	[ 8f 4c fb ff:5f 72 4b 00 ]
    fffff805a1ef968b-fffff805a1ef968e  4 bytes - nt!HalAssignSlotResources+4b (+0x16e)
	[ 21 4b fb ff:f1 70 4b 00 ]
    fffff805a1ef982c-fffff805a1ef982f  4 bytes - nt!HalpGetCacheCoherency+7c (+0x1a1)
	[ 80 49 fb ff:50 6f 4b 00 ]
    fffff805a1ef98a0 - nt!HalAllocateHardwareCounters+40 (+0x74)
	[ 0a:13 ]
    fffff805a1ef992a - nt!HalAllocateHardwareCounters+ca (+0x8a)
	[ 09:12 ]
    fffff805a1ef99a3-fffff805a1ef99a6  4 bytes - nt!HalAllocateHardwareCounters+143 (+0x79)
	[ 09 48 fb ff:d9 6d 4b 00 ]
    fffff805a1ef9a80-fffff805a1ef9a83  4 bytes - nt!HalFreeHardwareCounters+90 (+0xdd)
	[ 2c 47 fb ff:fc 6c 4b 00 ]
    fffff805a1efa382-fffff805a1efa385  4 bytes - nt!HalpPmuArbiterNotifyActor+1e (+0x902)
	[ 2a 3e fb ff:fa 63 4b 00 ]
    fffff805a1efa532-fffff805a1efa533  2 bytes - nt!HalpPmuArbiterQueryRegistryQuantum+1e (+0x1b0)
	[ fd fb:06 fc ]
    fffff805a1efa59d-fffff805a1efa5a0  4 bytes - nt!HalpPmuArbiterQueryRegistryQuantum+89 (+0x6b)
	[ 0f 3c fb ff:df 61 4b 00 ]
    fffff805a1efb2f4-fffff805a1efb2f7  4 bytes - nt!HalpIommuLocateFromDevice+54 (+0xd57)
	[ b8 2e fb ff:88 54 4b 00 ]
    fffff805a1efb331-fffff805a1efb334  4 bytes - nt!HalpIommuLocateFromDevice+91 (+0x3d)
	[ 7b 2e fb ff:4b 54 4b 00 ]
    fffff805a1efb3eb-fffff805a1efb3ee  4 bytes - nt!HalpQueryIommuReservedRegionInformation+77 (+0xba)
	[ c1 2d fb ff:91 53 4b 00 ]
    fffff805a1efb469-fffff805a1efb46c  4 bytes - nt!IommupDeviceDisablePasidTaggedDma+51 (+0x7e)
	[ 43 2d fb ff:13 53 4b 00 ]
    fffff805a1efb4f3-fffff805a1efb4f6  4 bytes - nt!IommupDeviceDisableSvm+5b (+0x8a)
	[ b9 2c fb ff:89 52 4b 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
    fffff805a233f1c7 - nt!PopTransitionSystemPowerState+33
	[ b1:ba ]
    fffff805a233f4e5-fffff805a233f4e6  2 bytes - nt!KiSystemStartup+145 (+0x31e)
	[ 47 2b:97 12 ]
    fffff805a233f76b-fffff805a233f76e  4 bytes - nt!HalpInitSystemHelper+53 (+0x286)
	[ 41 ea b6 ff:11 10 07 00 ]
    fffff805a233fe23 - nt!HalpMcaInitializePcrContext+73 (+0x6b8)
	[ a4:ad ]
    fffff805a2340076-fffff805a2340079  4 bytes - nt!HalpInterruptStartProcessor+1a6 (+0x253)
	[ 36 e1 b6 ff:06 07 07 00 ]
    fffff805a23400d6-fffff805a23400d9  4 bytes - nt!HalpRestoreDmaControllerState+2a (+0x60)
	[ d6 e0 b6 ff:a6 06 07 00 ]
    fffff805a23407c0-fffff805a23407c3  4 bytes - nt!HalpHvMapDeviceMsiRange+b8 (+0x6ea)
	[ ec d9 b6 ff:bc ff 06 00 ]
    fffff805a23408c6-fffff805a23408c9  4 bytes - nt!HalpHvMapIoApicDeviceInterrupt+8e (+0x106)
	[ e6 d8 b6 ff:b6 fe 06 00 ]
    fffff805a234098f-fffff805a2340992  4 bytes - nt!HalpHvUnmapDeviceMsiRange+7f (+0xc9)
	[ 1d d8 b6 ff:ed fd 06 00 ]
    fffff805a2340a02-fffff805a2340a05  4 bytes - nt!HalpHvUnmapIoApicDeviceInterrupt+4e (+0x73)
	[ aa d7 b6 ff:7a fd 06 00 ]
    fffff805a2340d4e - nt!InitCounterGroupBspEnhanced+a6 (+0x34c)
	[ 95:9e ]
    fffff805a2340e5f - nt!HalpBuildResumeStructures+37 (+0x111)
	[ 94:9d ]
    fffff805a234157f-fffff805a2341582  4 bytes - nt!HalpIommuInitSystem+2f (+0x720)
	[ 2d cc b6 ff:fd f1 06 00 ]
    fffff805a2341597-fffff805a234159a  4 bytes - nt!HalpIommuInitSystem+47 (+0x18)
	[ 15 cc b6 ff:e5 f1 06 00 ]
    fffff805a23419fa-fffff805a23419fd  4 bytes - nt!HalpIommuUpdateRemappingDestination+5a (+0x463)
	[ b2 c7 b6 ff:82 ed 06 00 ]
    fffff805a2341a80-fffff805a2341a83  4 bytes - nt!HalpIommuSetupMessageInterruptRouting+20 (+0x86)
	[ 2c c7 b6 ff:fc ec 06 00 ]
    fffff805a2341c19-fffff805a2341c1c  4 bytes - nt!HalpIommuProcessReservedDomains+7d (+0x199)
	[ 93 c5 b6 ff:63 eb 06 00 ]
    fffff805a234273c - nt!HalpMapCR3Ex+70 (+0xb23)
	[ 7b:84 ]
    fffff805a23427ef - nt!HalpMmBuildTiledMemoryMap+2f (+0xb3)
	[ 7b:84 ]
    fffff805a23429a4 - nt!HalpCheckLowMemoryPreSleep+ac (+0x1b5)
	[ 79:82 ]
    fffff805a2342aa8-fffff805a2342aab  4 bytes - nt!HalpCompleteInitializeProfiling+18 (+0x104)
	[ 04 b7 b6 ff:d4 dc 06 00 ]
    fffff805a2342b34 - nt!HalpInitializeProfiling+7c (+0x8c)
	[ 77:80 ]
    fffff805a2342c52-fffff805a2342c55  4 bytes - nt!HalpInitializeProfiling+19a (+0x11e)
	[ 5a b5 b6 ff:2a db 06 00 ]
    fffff805a2342d7a - nt!EmonCompleteInitializeProfiling+fa (+0x128)
	[ 75:7e ]
    fffff805a2342d9e - nt!EmonCompleteInitializeProfiling+11e (+0x24)
	[ 75:7e ]
    fffff805a2342dac - nt!EmonCompleteInitializeProfiling+12c (+0x0e)
	[ 75:7e ]
    fffff805a2343776-fffff805a2343779  4 bytes - nt!HalpDpGetInterruptReplayState+56 (+0x9ca)
	[ 36 aa b6 ff:06 d0 06 00 ]
    fffff805a23438bb-fffff805a23438be  4 bytes - nt!HalpDpPostReplace+3b (+0x145)
	[ f1 a8 b6 ff:c1 ce 06 00 ]
    fffff805a2343b6a-fffff805a2343b6d  4 bytes - nt!HalpDpPreReplace+2e (+0x2af)
	[ 42 a6 b6 ff:12 cc 06 00 ]
    fffff805a2343cd2-fffff805a2343cd5  4 bytes - nt!HalpDpReplaceControl+72 (+0x168)
	[ da a4 b6 ff:aa ca 06 00 ]
    fffff805a2343d02-fffff805a2343d05  4 bytes - nt!HalpDpReplaceControl+a2 (+0x30)
	[ aa a4 b6 ff:7a ca 06 00 ]
    fffff805a2343d5c-fffff805a2343d5f  4 bytes - nt!HalpDpReplaceControl+fc (+0x5a)
	[ 50 a4 b6 ff:20 ca 06 00 ]
    fffff805a2343df2-fffff805a2343df5  4 bytes - nt!HalpDpReplaceControl+192 (+0x96)
	[ ba a3 b6 ff:8a c9 06 00 ]
    fffff805a2343e6a-fffff805a2343e6d  4 bytes - nt!HalpDpReplaceTarget+3a (+0x78)
	[ 42 a3 b6 ff:12 c9 06 00 ]
    fffff805a2343ea9-fffff805a2343eac  4 bytes - nt!HalpDpReplaceTarget+79 (+0x3f)
	[ 03 a3 b6 ff:d3 c8 06 00 ]
    fffff805a2343eef-fffff805a2343ef2  4 bytes - nt!HalpDpReplayInterrupts+1f (+0x46)
	[ bd a2 b6 ff:8d c8 06 00 ]
    fffff805a234444b-fffff805a234444e  4 bytes - nt!HalpInterruptUpdateLocalUnitIdentifier+bf (+0x55c)
	[ 61 9d b6 ff:31 c3 06 00 ]
    fffff805a2344620 - nt!HalpStopLegacyUsbInterruptsInternal+30 (+0x1d5)
	[ 5c:65 ]
    fffff805a234466c-fffff805a234466f  4 bytes - nt!HalpStopLegacyUsbInterruptsInternal+7c (+0x4c)
	[ 40 9b b6 ff:10 c1 06 00 ]
    fffff805a2344704 - nt!HalpBlkInitializeIdt+20 (+0x98)
	[ 5b:64 ]
    fffff805a23447f2 - nt!HalpBlkInitializeProcessorState+32 (+0xee)
	[ 5b:64 ]
    fffff805a2344802 - nt!HalpBlkInitializeProcessorState+42 (+0x10)
	[ 5a:63 ]
    fffff805a23449e0 - nt!HalpBlkStartBlockedProcessor+20 (+0x1de)
	[ 59:62 ]
    fffff805a234511d - nt!Amd64InitializeProfilingEnhanced+255 (+0x73d)
	[ 51:5a ]
    fffff805a2345168 - nt!Amd64InitializeProfilingEnhanced+2a0 (+0x4b)
	[ 51:5a ]
    fffff805a23451ac - nt!Amd64InitializeProfilingEnhanced+2e4 (+0x44)
	[ 51:5a ]
    fffff805a2345242 - nt!Amd64InitializeProfilingEnhanced+37a (+0x96)
	[ 50:59 ]
    fffff805a2345e2d-fffff805a2345e30  4 bytes - nt!IvtInitializeIommu+29d (+0xbeb)
	[ 7f 83 b6 ff:4f a9 06 00 ]
    fffff805a2345e77 - nt!IvtInitializeIommu+2e7 (+0x4a)
	[ 44:4d ]
    fffff805a2345e91-fffff805a2345e94  4 bytes - nt!IvtInitializeIommu+301 (+0x1a)
	[ 1b 83 b6 ff:eb a8 06 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
    fffff805a236720b - nt!ExFreePoolWithTag+153b
	[ 30:39 ]
    fffff805a236722d - nt!ExFreePoolWithTag+155d (+0x22)
	[ 30:39 ]
    fffff805a236809a-fffff805a236809d  4 bytes - nt!KdExitDebugger+92
	[ 12 61 b4 ff:e2 86 04 00 ]
    fffff805a23689c9 - nt!HalpKdEnumerateDebuggingDevices+179 (+0x92f)
	[ 19:22 ]
    fffff805a2368d2f - nt!HalpRegisterDeviceInUse+9b (+0x366)
	[ 15:1e ]
    fffff805a236970c - nt!KdpCloseRemoteFile+3c (+0x9dd)
	[ 0b:14 ]
    fffff805a2369964 - nt!KdpCreateRemoteFile+44 (+0x258)
	[ 09:12 ]
    fffff805a2369c38-fffff805a2369c3b  4 bytes - nt!KdpPullRemoteFile+f0 (+0x2d4)
	[ 74 45 b4 ff:44 6b 04 00 ]
    fffff805a2369c9f-fffff805a2369ca2  4 bytes - nt!KdpPullRemoteFile+157 (+0x67)
	[ 0d 45 b4 ff:dd 6a 04 00 ]
    fffff805a2369cd8-fffff805a2369cdb  4 bytes - nt!KdpPullRemoteFile+190 (+0x39)
	[ d4 44 b4 ff:a4 6a 04 00 ]
    fffff805a2369d5b - nt!KdpReadRemoteFile+43 (+0x83)
	[ 05:0e ]
    fffff805a2369f9d - nt!KdSendTraceData+55 (+0x242)
	[ 03:0c ]
    fffff805a236aafc-fffff805a236aafd  2 bytes - nt!KdpReportCommandStringStateChange+50 (+0xb5f)
	[ f8 b4:01 b5 ]
    fffff805a236ab3a-fffff805a236ab3b  2 bytes - nt!KdpReportCommandStringStateChange+8e (+0x3e)
	[ f7 b4:00 b5 ]
    fffff805a236ac97 - nt!KdpReportLoadSymbolsStateChange+53 (+0x15d)
	[ f6:ff ]
    fffff805a236b56c-fffff805a236b56f  4 bytes - nt!KdpSysReadBusData+2c (+0x8d5)
	[ 40 2c b4 ff:10 52 04 00 ]
    fffff805a236b5d4-fffff805a236b5d7  4 bytes - nt!KdpSysWriteBusData+2c (+0x68)
	[ d8 2b b4 ff:a8 51 04 00 ]
    fffff805a236bd8a - nt!KdLogDbgPrint+16a (+0x7b6)
	[ e5:ee ]
    fffff805a236bde2 - nt!KdLogDbgPrint+1c2 (+0x58)
	[ e5:ee ]
    fffff805a236c408 - nt!KdpInitializeExtendedContext+6c (+0x626)
	[ de:e7 ]
    fffff805a236d238 - nt!KdpReportExceptionStateChange+58 (+0xe30)
	[ d0:d9 ]
    fffff805a236d5db-fffff805a236d5de  4 bytes - nt!KdpSendWaitContinue+2af (+0x3a3)
	[ d1 0b b4 ff:a1 31 04 00 ]
    fffff805a236d9e4-fffff805a236d9e7  4 bytes - nt!KdEnterDebugger+78 (+0x409)
	[ c8 07 b4 ff:98 2d 04 00 ]
    fffff805a23a32b1-fffff805a23a32b4  4 bytes - nt!BgkDisplayCharacter+71
	[ fb ae b0 ff:cb d4 00 00 ]
    fffff805a23a3398-fffff805a23a339b  4 bytes - nt!BgkGetConsoleState+28 (+0xe7)
	[ 14 ae b0 ff:e4 d3 00 00 ]
    fffff805a23a33fd-fffff805a23a3400  4 bytes - nt!BgkGetCursorState+3d (+0x65)
	[ af ad b0 ff:7f d3 00 00 ]
    fffff805a23a34c9-fffff805a23a34cc  4 bytes - nt!BgkSetCursor+39 (+0xcc)
	[ e3 ac b0 ff:b3 d2 00 00 ]
    fffff805a23a4174 - nt!BgpConsoleInitialize+c4 (+0xcab)
	[ 61:6a ]
    fffff805a23a59b7 - nt!BgpTxtCreateRegion+af (+0x1843)
	[ 49:52 ]
    fffff805a23a5f3c - nt!LogFwInitialize+cc (+0x585)
	[ 43:4c ]
    fffff805a23a6a68 - nt!AnFwDisplayFade+37c (+0xb2c)
	[ 38:41 ]
    fffff805a23a6aab - nt!AnFwDisplayFade+3bf (+0x43)
	[ 38:41 ]
    fffff805a23a89d9 - nt!BgpFwLibraryInitialize+5d9 (+0x1f2e)
	[ 19:22 ]
    fffff805a23a96e1 - nt!AnFwDisplayFade+2ff5 (+0xd08)
	[ 0c:15 ]
    fffff805a23b2011-fffff805a23b2012  2 bytes - nt!KeCopyPage$thunk$17553164197770287351+1
	[ bb b7:6b b8 ]
    fffff805a23b2021-fffff805a23b2023  3 bytes - nt!RtlFunctionOverrideSelfTest$thunk$6746816294339431247+1 (+0x10)
	[ ab bb ae:fb 57 99 ]
    fffff805a23b2031-fffff805a23b2033  3 bytes - nt!guard_dispatch_icall$thunk$10345483385596137414+1 (+0x10)
	[ 7b c1 af:4b e7 ff ]
    fffff805a23b2042 - nt!memset$thunk$772440563353939046+2 (+0x11)
	[ 82:8b ]
14985 errors : !nt (fffff805a194c728-fffff805a23b2042)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

MEMORY_CORRUPTOR:  LARGE

STACK_COMMAND:  .cxr 0xffff9386ce746c30 ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

OS_VERSION:  10.0.26100.1

BUILDLAB_STR:  ge_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}

Followup:     memory_corruption
---------

0: kd> .cxr 0xffff9386ce746c30
rax=0000000000000000 rbx=00000000c0000010 rcx=000000008000205c
rdx=ffff990481db0d50 rsi=ffff990481db0d50 rdi=ffff990481db0e28
rip=fffff80537ded11e rsp=ffff9386ce747680 rbp=ffff9386ce747a90
 r8=fffff80537deca20  r9=ffff990480d538b0 r10=0000000000000000
r11=0000000000000000 r12=ffff9904812e2600 r13=0000000000000000
r14=0000000000000000 r15=0000000000000010
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050246
AntiRootkit!AntiRootkitDeviceControl+0x6fe:
fffff805`37ded11e 488b38          mov     rdi,qword ptr [rax] ds:002b:00000000`00000000=????????????????
0: kd> t
nt!DbgBreakPointWithStatus+0x1:
fffff805`a1d02a51 c3              ret
0: kd> t
nt!KiBugCheckDebugBreak+0x12:
fffff805`a1db6eb2 e9a0000000      jmp     nt!KiBugCheckDebugBreak+0xb7 (fffff805`a1db6f57)
0: kd> lmvm AntiRootkit
Browse full module list
start             end                 module name
fffff805`37de0000 fffff805`37e79000   AntiRootkit   (private pdb symbols)  D:\Windows\ARK\WinArk\x64\Release\AntiRootkit.pdb
    Loaded symbol image file: AntiRootkit.sys
    Image path: \??\C:\WINDOWS\system32\Drivers\AntiRootkit.sys
    Image name: AntiRootkit.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed May 21 20:31:28 2025 (682DC7A0)
    CheckSum:         0009E598
    ImageSize:        00099000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

[BeneficialCode]

是符号获取有问题还是什么？

[kouzhudong]

蓝屏了。