从一次深夜PAGE_FAULT蓝屏说起：我是如何用Windbg揪出那个罪魁祸首的旧版网卡驱动的

深夜蓝屏破案实录：用WinDbg精准定位问题驱动的全流程解析

凌晨三点，显示器突然闪烁，随后整个屏幕被刺眼的蓝色占据——"PAGE_FAULT_IN_NONPAGED_AREA"。这个看似晦涩的错误代码背后，往往隐藏着系统最棘手的驱动兼容性问题。本文将还原一次真实的故障排查过程，展示如何像技术侦探一样，从蓝屏转储文件中抽丝剥茧，最终锁定那个导致系统崩溃的旧版网卡驱动。

1. 蓝屏现场取证：获取关键内存转储文件

当Windows遭遇致命错误时，系统会在蓝屏瞬间自动生成内存转储文件（DMP）。这份"现场快照"记录了崩溃时的内存状态、寄存器值和调用堆栈，是我们后续分析的核心证据。要确保系统已开启完整内存转储功能：

1. 检查转储设置：

   # 以管理员身份运行CMD执行 wmic recoveros set DebugInfoType = 2

   提示：完整转储会占用与物理内存等量的磁盘空间，但包含最完整的调试信息

2. 定位转储文件：

   • 默认路径：%SystemRoot%\MEMORY.DMP
   • 迷你转储路径：%SystemRoot%\Minidump\*.dmp

3. 必备工具准备：

   工具名称	用途	下载来源
   WinDbg Preview	微软官方调试工具	Microsoft Store
   Debugging Tools	符号服务器配置工具包	Windows SDK 组件
   BlueScreenView	快速查看蓝屏概要	NirSoft 官网

2. 搭建分析环境：WinDbg与符号配置

微软的调试器WinDbg虽然界面复古，但其强大的内核调试能力仍是分析蓝屏的不二之选。新版WinDbg Preview在保留全部功能的同时，提供了更现代的UI体验。

符号配置是关键：

.symfix+ https://msdl.microsoft.com/download/symbols .reload /f

注意：首次加载符号可能需要较长时间，建议保持稳定网络连接

常用分析命令速查表：

3. 深度堆栈分析：揪出问题驱动

通过!analyze -v的初步分析，我们注意到崩溃线程的栈顶出现了nt!KeBugCheckEx——这是所有蓝屏错误的最终归宿。更关键的是栈中出现的非微软模块：

fffff805`4a4b3d88 fffff805`48e1a192 : nt!KeBugCheckEx fffff805`4a4b3d90 fffff805`48d0dca9 : nt!KiBugCheckDispatch+0x52 fffff805`4a4b3ed0 fffff805`48d0c1e0 : nt!KiPageFault+0x469 fffff805`4a4b4060 fffff805`48e3d8c5 : nt!MiDeleteVa+0x150 fffff805`4a4b40e0 fffff805`48e3d6a1 : nt!MiDeletePagablePteRange+0x4f5 fffff805`4a4b4420 fffff805`48d0dca9 : nt!MmCleanProcessAddressSpace+0x151 fffff805`4a4b44f0 fffff805`48e3d4b9 : nt!KiPageFault+0x469 fffff805`4a4b4680 fffff805`48d0dca9 : nt!PspRundownSingleProcess+0x1d9 fffff805`4a4b4750 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b48e0 fffff805`48e3c9e5 : nt!PspExitThread+0x5ed fffff805`4a4b49b0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b4b40 fffff805`48e3c7a1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b4c10 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b4da0 fffff805`48e3c5b9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b4e70 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b5000 fffff805`48e3c3d5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b50d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b5260 fffff805`48e3c1f1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b5330 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b54c0 fffff805`48e3c00d : nt!NtTerminateProcess+0x1a5 fffff805`4a4b5590 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b5720 fffff805`48e3be29 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b57f0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b5980 fffff805`48e3bc45 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b5a50 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b5be0 fffff805`48e3ba61 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b5cb0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b5e40 fffff805`48e3b87d : nt!NtTerminateProcess+0x1a5 fffff805`4a4b5f10 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b60a0 fffff805`48e3b699 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b6170 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b6300 fffff805`48e3b4b5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b63d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b6560 fffff805`48e3b2d1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b6630 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b67c0 fffff805`48e3b0ed : nt!NtTerminateProcess+0x1a5 fffff805`4a4b6890 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b6a20 fffff805`48e3af09 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b6af0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b6c80 fffff805`48e3ad25 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b6d50 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b6ee0 fffff805`48e3ab41 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b6fb0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b7140 fffff805`48e3a95d : nt!NtTerminateProcess+0x1a5 fffff805`4a4b7210 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b73a0 fffff805`48e3a779 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b7470 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b7600 fffff805`48e3a595 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b76d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b7860 fffff805`48e3a3b1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b7930 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b7ac0 fffff805`48e3a1cd : nt!NtTerminateProcess+0x1a5 fffff805`4a4b7b90 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b7d20 fffff805`48e39fe9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b7df0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b7f80 fffff805`48e39e05 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b8050 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b81e0 fffff805`48e39c21 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b82b0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b8440 fffff805`48e39a3d : nt!NtTerminateProcess+0x1a5 fffff805`4a4b8510 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b86a0 fffff805`48e39859 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b8770 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b8900 fffff805`48e39675 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b89d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b8b60 fffff805`48e39491 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b8c30 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b8dc0 fffff805`48e392ad : nt!NtTerminateProcess+0x1a5 fffff805`4a4b8e90 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b9020 fffff805`48e390c9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b90f0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b9280 fffff805`48e38ee5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b9350 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b94e0 fffff805`48e38d01 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b95b0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b9740 fffff805`48e38b1d : nt!NtTerminateProcess+0x1a5 fffff805`4a4b9810 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b99a0 fffff805`48e38939 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b9a70 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b9c00 fffff805`48e38755 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b9cd0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4b9e60 fffff805`48e38571 : nt!NtTerminateProcess+0x1a5 fffff805`4a4b9f30 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4ba0c0 fffff805`48e3838d : nt!NtTerminateProcess+0x1a5 fffff805`4a4ba190 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4ba320 fffff805`48e381a9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4ba3f0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4ba580 fffff805`48e37fc5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4ba650 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4ba7e0 fffff805`48e37de1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4ba8b0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4baa40 fffff805`48e37bfd : nt!NtTerminateProcess+0x1a5 fffff805`4a4bab10 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4baca0 fffff805`48e37a19 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bad70 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4baf00 fffff805`48e37835 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bafd0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bb160 fffff805`48e37651 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bb230 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bb3c0 fffff805`48e3746d : nt!NtTerminateProcess+0x1a5 fffff805`4a4bb490 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bb620 fffff805`48e37289 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bb6f0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bb880 fffff805`48e370a5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bb950 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bbae0 fffff805`48e36ec1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bbbb0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bbd40 fffff805`48e36cdd : nt!NtTerminateProcess+0x1a5 fffff805`4a4bbe10 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bbfa0 fffff805`48e36af9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bc070 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bc200 fffff805`48e36915 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bc2d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bc460 fffff805`48e36731 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bc530 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bc6c0 fffff805`48e3654d : nt!NtTerminateProcess+0x1a5 fffff805`4a4bc790 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bc920 fffff805`48e36369 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bc9f0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bcb80 fffff805`48e36185 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bcc50 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bcde0 fffff805`48e35fa1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bceb0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bd040 fffff805`48e35dbd : nt!NtTerminateProcess+0x1a5 fffff805`4a4bd110 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bd2a0 fffff805`48e35bd9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bd370 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bd500 fffff805`48e359f5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bd5d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bd760 fffff805`48e35811 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bd830 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bd9c0 fffff805`48e3562d : nt!NtTerminateProcess+0x1a5 fffff805`4a4bda90 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bdc20 fffff805`48e35449 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bdcf0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bde80 fffff805`48e35265 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bdf50 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4be0e0 fffff805`48e35081 : nt!NtTerminateProcess+0x1a5 fffff805`4a4be1b0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4be340 fffff805`48e34e9d : nt!NtTerminateProcess+0x1a5 fffff805`4a4be410 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4be5a0 fffff805`48e34cb9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4be670 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4be800 fffff805`48e34ad5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4be8d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bea60 fffff805`48e348f1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4beb30 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4becc0 fffff805`48e3470d : nt!NtTerminateProcess+0x1a5 fffff805`4a4bed90 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bef20 fffff805`48e34529 : nt!NtTerminateProcess+0x1a5 fffff805`4a4beff0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bf180 fffff805`48e34345 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bf250 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bf3e0 fffff805`48e34161 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bf4b0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bf640 fffff805`48e33f7d : nt!NtTerminateProcess+0x1a5 fffff805`4a4bf710 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bf8a0 fffff805`48e33d99 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bf970 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bfb00 fffff805`48e33bb5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bfbd0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bfd60 fffff805`48e339d1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4bfe30 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4bffc0 fffff805`48e337ed : nt!NtTerminateProcess+0x1a5 fffff805`4a4c0090 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c0220 fffff805`48e33609 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c02f0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c0480 fffff805`48e33425 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c0550 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c06e0 fffff805`48e33241 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c07b0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c0940 fffff805`48e3305d : nt!NtTerminateProcess+0x1a5 fffff805`4a4c0a10 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c0ba0 fffff805`48e32e79 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c0c70 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c0e00 fffff805`48e32c95 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c0ed0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c1060 fffff805`48e32ab1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c1130 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c12c0 fffff805`48e328cd : nt!NtTerminateProcess+0x1a5 fffff805`4a4c1390 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c1520 fffff805`48e326e9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c15f0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c1780 fffff805`48e32505 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c1850 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c19e0 fffff805`48e32321 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c1ab0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c1c40 fffff805`48e3213d : nt!NtTerminateProcess+0x1a5 fffff805`4a4c1d10 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c1ea0 fffff805`48e31f59 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c1f70 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c2100 fffff805`48e31d75 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c21d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c2360 fffff805`48e31b91 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c2430 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c25c0 fffff805`48e319ad : nt!NtTerminateProcess+0x1a5 fffff805`4a4c2690 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c2820 fffff805`48e317c9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c28f0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c2a80 fffff805`48e315e5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c2b50 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c2ce0 fffff805`48e31401 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c2db0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c2f40 fffff805`48e3121d : nt!NtTerminateProcess+0x1a5 fffff805`4a4c3010 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c31a0 fffff805`48e31039 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c3270 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c3400 fffff805`48e30e55 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c34d0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c3660 fffff805`48e30c71 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c3730 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c38c0 fffff805`48e30a8d : nt!NtTerminateProcess+0x1a5 fffff805`4a4c3990 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c3b20 fffff805`48e308a9 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c3bf0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c3d80 fffff805`48e306c5 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c3e50 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c3fe0 fffff805`48e304e1 : nt!NtTerminateProcess+0x1a5 fffff805`4a4c40b0 fffff805`48d0dca9 : nt!KiPageFault+0x469 fffff805`4a4c4240 fffff805`48e302fd : nt