分析代码如下：
系统为windows server 2012R2
Microsoft (R) Windows Debugger Version 10.0.21306.1007 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [*.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS
Edition build lab: 9200.23297.amd64fre.win8_ldr_escrow.210217-1947
Machine Name:
Kernel base = 0xfffff801`b661a000 PsLoadedModuleList = 0xfffff801`b68ad920
Debug session time: Thu Apr 1 08:55:33.233 2021 (UTC + 8:00)
System Uptime: 0 days 0:03:27.907
Loading Kernel Symbols
...............................................................
................................................................
Loading User Symbols
Loading unloaded module list
.....
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff801`b67c7240 48894c2408 mov qword ptr [rsp+8],rcx ss:fffff880`056deb80=0000000000000050
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen and saved in
KiBugCheckDriver.
Arguments:
Arg1: fffff88018685888, memory referenced
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation
Arg3: fffff88018685888, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, Mm internal code.
Debugging Details:
------------------
Could not read faulting driver name
GetUlongPtrFromAddress: unable to read from fffff801b692f318
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2061
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 16523
Key : Analysis.Init.CPU.mSec
Value: 734
Key : Analysis.Init.Elapsed.mSec
Value: 2704
Key : Analysis.Memory.CommitPeak.Mb
Value: 64
Key : WER.OS.Branch
Value: win8_ldr_escrow
Key : WER.OS.Timestamp
Value: 2021-02-17T19:47:00Z
Key : WER.OS.Version
Value: 8.0.9200.23297
BUGCHECK_CODE: ce
BUGCHECK_P1: fffff88018685888
BUGCHECK_P2: 8
BUGCHECK_P3: fffff88018685888
BUGCHECK_P4: 0
WRITE_ADDRESS: Unable to get MmSystemRangeStart
GetUlongPtrFromAddress: unable to read from fffff801b692f380
GetUlongPtrFromAddress: unable to read from fffff801b692f4a8
fffff88018685888
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: QQPCRTP.exe
TRAP_FRAME: fffff880056ded10 -- (.trap 0xfffff880056ded10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88018685888 rsp=fffff880056deea0 rbp=fffff880056defa0
r8=0000000000000001 r9=0000000000000000 r10=fffff8800188da00
r11=fffffa8013992010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
<Unloaded_dump_CONDRV.>+0x8888:
fffff880`18685888 ?? ???
Resetting default scope
IP_MODULE_UNLOADED:
dump_CONDRV.+8888
fffff880`18685888 ?? ???
STACK_TEXT:
fffff880`056deb78 fffff801`b677979a : 00000000`00000050 fffff880`18685888 00000000`00000008 fffff880`056ded10 : nt!KeBugCheckEx
fffff880`056deb80 fffff801`b677ab66 : 00000000`00000008 fffff880`18685888 00000000`00001000 fffff880`18685888 : nt!MiSystemFault+0xeba
fffff880`056dec10 fffff801`b67d49dc : fffffa80`0d6ee030 fffffa80`13992000 fffffa80`15362600 fffff880`056ded60 : nt!MmAccessFault+0x206
fffff880`056ded10 fffff880`18685888 : fffffa80`0d6ee030 fffffa80`15362610 00000000`00000100 fffffa80`0daeb9b0 : nt!KiPageFault+0x35c
fffff880`056deea0 fffffa80`0d6ee030 : fffffa80`15362610 00000000`00000100 fffffa80`0daeb9b0 fffff880`00000001 : <Unloaded_dump_CONDRV.>+0x8888
fffff880`056deea8 fffffa80`15362610 : 00000000`00000100 fffffa80`0daeb9b0 fffff880`00000001 00000000`020000c6 : 0xfffffa80`0d6ee030
fffff880`056deeb0 00000000`00000100 : fffffa80`0daeb9b0 fffff880`00000001 00000000`020000c6 fffff880`056def20 : 0xfffffa80`15362610
fffff880`056deeb8 fffffa80`0daeb9b0 : fffff880`00000001 00000000`020000c6 fffff880`056def20 fffffa80`0d6ee030 : 0x100
fffff880`056deec0 fffff880`00000001 : 00000000`020000c6 fffff880`056def20 fffffa80`0d6ee030 fffff880`02000000 : 0xfffffa80`0daeb9b0
fffff880`056deec8 00000000`020000c6 : fffff880`056def20 fffffa80`0d6ee030 fffff880`02000000 fffff880`056df120 : 0xfffff880`00000001
fffff880`056deed0 fffff880`056def20 : fffffa80`0d6ee030 fffff880`02000000 fffff880`056df120 00000000`000003ec : 0x20000c6
fffff880`056deed8 fffffa80`0d6ee030 : fffff880`02000000 fffff880`056df120 00000000`000003ec fffffa80`154b2118 : 0xfffff880`056def20
fffff880`056deee0 fffff880`02000000 : fffff880`056df120 00000000`000003ec fffffa80`154b2118 fffff880`056df2c0 : 0xfffffa80`0d6ee030
fffff880`056deee8 fffff880`056df120 : 00000000`000003ec fffffa80`154b2118 fffff880`056df2c0 00000000`00000000 : 0xfffff880`02000000
fffff880`056deef0 00000000`000003ec : fffffa80`154b2118 fffff880`056df2c0 00000000`00000000 fffff880`056df270 : 0xfffff880`056df120
fffff880`056deef8 fffffa80`154b2118 : fffff880`056df2c0 00000000`00000000 fffff880`056df270 fffff880`056df408 : 0x3ec
fffff880`056def00 fffff880`056df2c0 : 00000000`00000000 fffff880`056df270 fffff880`056df408 00760065`0044005c : 0xfffffa80`154b2118
fffff880`056def08 00000000`00000000 : fffff880`056df270 fffff880`056df408 00760065`0044005c 005c0065`00630069 : 0xfffff880`056df2c0
SYMBOL_NAME: dump_CONDRV.+8888
MODULE_NAME: dump_CONDRV
IMAGE_NAME: dump_CONDRV.
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 8888
FAILURE_BUCKET_ID: 0xCE_dump_CONDRV.!unknown_function
OS_VERSION: 8.0.9200.23297
BUILDLAB_STR: win8_ldr_escrow
OSPLATFORM_TYPE: x64
OSNAME: Windows 8
FAILURE_ID_HASH: {29254597-03ce-89a8-9860-aac70b6412b8}
Followup: MachineOwner
---------