Bug 检查0x1E: _ _ 未处理 KMODE _ 异常Bug Check 0x1E: KMODE_EXCEPTION_NOT_HANDLED

_未处理的 KMODE 异常 _ _ bug 检查的值为0x0000001e。The KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E. 这表示内核模式程序生成了错误处理程序未捕获的异常。This indicates that a kernel-mode program generated an exception that the error handler did not catch.

重要

本主题面向程序员。This topic is for programmers. 如果您是在使用计算机时收到蓝屏错误代码的客户,请参阅蓝屏错误疑难解答If you are a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.

KMODE _ 异常 _ 未 _ 处理的参数KMODE_EXCEPTION_NOT_HANDLED parameters

参数Parameter 描述Description

11

未处理的异常代码。The exception code that was not handled.

22

发生异常的地址。The address at which the exception occurred.

33

异常的参数0。Parameter 0 of the exception.

44

异常的参数1。Parameter 1 of the exception.

原因Cause

若要解释此 bug 检查,必须确定生成的异常。To interpret this bug check, you must identify which exception was generated.

常见的异常代码包括:Common exception codes include:

  • 数0x80000002:状态 _ 数据类型不 _ 一致0x80000002: STATUS_DATATYPE_MISALIGNMENT

    遇到未对齐的数据引用。An unaligned data reference was encountered.

  • 0x80000003:状态 _ 断点0x80000003: STATUS_BREAKPOINT

    当没有内核调试器附加到系统时遇到断点或断言。A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system.

  • 0xC0000005:状态 _ 访问 _ 冲突0xC0000005: STATUS_ACCESS_VIOLATION

    发生了内存访问冲突。A memory access violation occurred. Bug 检查 (参数4是驱动程序尝试访问的地址。 ) (Parameter 4 of the bug check is the address that the driver attempted to access.)

有关异常代码的完整列表,请参阅 NTSTATUS 值For a complete list of exception codes, see NTSTATUS values. 异常代码在 ntstatus 中定义,该文件是 Windows 驱动程序工具包提供的标头文件。The exception codes are defined in ntstatus.h, a header file provided by the Windows Driver Kit. (有关详细信息,请参阅 Windows 驱动程序工具包中的头文件) 。(For more info, see Header files in the Windows Driver Kit).

备注Remarks

如果你不打算调试此问题,则可以使用 蓝色屏幕数据中所述的一些基本故障排除技术。If you are not equipped to debug this problem, you can use some basic troubleshooting techniques described in Blue screen data. 如果驱动程序标识在错误检查消息中,禁用该驱动程序或咨询驱动程序更新的制造商。If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.

硬件不兼容Hardware incompatibility

确认安装的任何新硬件都与安装的 Windows 版本兼容。Confirm that any new hardware that is installed is compatible with the installed version of Windows. 例如,可以在 Windows 10 规范中获取有关所需硬件的信息。For example, you can get information about required hardware at Windows 10 Specifications.

设备驱动程序或系统服务错误Faulty device driver or system service

此外,错误的设备驱动程序或系统服务可能会导致此错误。In addition, a faulty device driver or system service might be responsible for this error. 硬件问题(例如 BIOS 不兼容、内存冲突和 IRQ 冲突)也可能生成此错误。Hardware issues, such as BIOS incompatibilities, memory conflicts, and IRQ conflicts can also generate this error.

如果在 bug 检查消息中按名称列出了驱动程序,请禁用或删除该驱动程序。If a driver is listed by name within the bug check message, disable or remove that driver. 禁用或删除最近添加的任何驱动程序或服务。Disable or remove any drivers or services that were recently added. 如果在启动序列过程中出现错误,并且使用 NTFS 文件系统格式化系统分区,则可以使用安全模式禁用设备管理器中的驱动程序。If the error occurs during the startup sequence, and the system partition is formatted with NTFS file system, you might be able to use Safe Mode to disable the driver in Device Manager.

检查中的系统日志事件查看器是否有其他错误消息,这些错误消息可能有助于找出导致 bug 检查0x1E 的设备或驱动程序。Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing bug check 0x1E. 还应运行硬件诊断,尤其是系统制造商提供的内存扫描器。Also run hardware diagnostics, especially the memory scanner, supplied by the system manufacturer. 有关这些过程的详细信息,请参阅计算机的用户手册。For details on these procedures, see the owner's manual for your computer.

在 Windows 安装程序期间或安装完成后,可能会在首次重新启动之后出现生成此消息的错误。The error that generates this message can occur after the first restart during Windows Setup, or after Setup is finished. 此错误的可能原因是系统 BIOS 不兼容。A possible cause of the error is a system BIOS incompatibility. 可以通过升级系统 BIOS 版本来解决 BIOS 问题。BIOS problems can be resolved by upgrading the system BIOS version.

解决方法Resolution

如果打算调试此问题,您可能会发现很难获得堆栈跟踪。If you plan to debug this problem, you may find it difficult to obtain a stack trace. 参数 2) 的异常地址 (应查明导致此问题的驱动程序或函数。The exception address (parameter 2) should pinpoint the driver or function that caused this problem.

异常代码0x80000003 指示命中了硬编码断点或断言,但系统是使用 /NODEBUG 开关启动的。Exception code 0x80000003 indicates that a hard-coded breakpoint or assertion was hit, but the system was started with the /NODEBUG switch. 此问题很少发生。This problem should rarely occur. 如果它反复发生,请确保已连接内核调试器,并且系统是使用 /debug 开关启动的。If it occurs repeatedly, make sure that a kernel debugger is connected and that the system is started with the /DEBUG switch.

如果发生异常代码数0x80000002,陷阱帧会提供其他信息。If exception code 0x80000002 occurs, the trap frame will supply additional information.

未知原因Unknown cause

如果异常的特定原因未知,请考虑使用以下过程获取堆栈跟踪。If the specific cause of the exception is unknown, consider using the following procedure to obtain a stack trace.

备注

此过程假定您可以找到 NT!PspUnhandledExceptionInSystemThreadThis procedure assumes that you can locate NT!PspUnhandledExceptionInSystemThread. 但是,在某些情况下 (如访问冲突崩溃) 你将无法执行此操作。However, in some cases (such as an access violation crash) you will not be able to do this. 在这种情况下,请查找 ntoskrnl.exe!KiDispatchExceptionIn that case, look for ntoskrnl!KiDispatchException. 传递给此函数的第三个参数是一个陷阱帧地址。The third parameter passed to this function is a trap frame address. 使用 " 陷井 (显示 带有此地址的捕获帧) 命令,将注册上下文设置为合适的值。Use the .trap (display trap frame) command with this address to set the Register Context to the proper value. 然后,你可以执行堆栈跟踪并发出其他命令。You can then perform stack traces and issue other commands.

如果正常堆栈跟踪过程失败,则获取堆栈跟踪To get a stack trace if the normal stack tracing procedures fail

  1. 使用 kb (显示 stack backtrace)命令在堆栈跟踪中显示参数。Use the kb (display stack backtrace) command to display parameters in the stack trace. 查找对 NT!PspUnhandledExceptionInSystemThreadLook for the call to NT!PspUnhandledExceptionInSystemThread. (如果未列出此函数,请参阅下面的说明。 ) (If this function is not listed, see the note below.)

  2. NT!的第一个参数 PspUnhandledExceptionInSystemThread 是指向结构的指针,该结构包含指向 except 语句的指针:The first parameter to NT!PspUnhandledExceptionInSystemThread is a pointer to a structure, which contains pointers to an except statement:

    typedef struct _EXCEPTION_POINTERS {
        PEXCEPTION_RECORD ExceptionRecord;
        PCONTEXT ContextRecord;
        } EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;
    
    ULONG PspUnhandledExceptionInSystemThread(
        IN PEXCEPTION_POINTERS ExceptionPointers
        )
    

    使用 dd (显示内存)命令,以显示所需数据。Use the dd (display memory) command on that address to display the necessary data.

  3. 第一个检索到的值是异常记录,第二个值是上下文记录。The first retrieved value is an exception record and the second is a context record. 使用 .exr (显示 "异常记录")命令,然后使用这两个值作为其参数,分别为 .cxr (显示上下文) 记录Use the .exr (display exception record) command and the .cxr (display context record) command with these two values as their arguments, respectively.

  4. 执行 .cxr 命令后,使用 kb 命令显示基于上下文记录信息的堆栈跟踪。After the .cxr command executes, use the kb command to display a stack trace that is based on the context record information. 此堆栈跟踪指示出现未处理异常的调用堆栈。This stack trace indicates the calling stack where the unhandled exception occurred.

示例 bug 检查Example bug check

以下是 x86 处理器上 bug 检查0x1E 的示例:Following is an example of bug check 0x1E on an x86 processor:

kd> .bugcheck                 get the bug check data
Bugcheck code 0000001e
Arguments c0000005 8013cd0a 00000000 0362cffff

kd> kb                        start with a stack trace 
FramePtr  RetAddr   Param1   Param2   Param3   Function Name 
8013ed5c  801263ba  00000000 00000000 fe40cb00 NT!_DbgBreakPoint 
8013eecc  8013313c  0000001e c0000005 8013cd0a NT!_KeBugCheckEx+0x194
fe40cad0  8013318e  fe40caf8 801359ff fe40cb00 NT!PspUnhandledExceptionInSystemThread+0x18
fe40cad8  801359ff  fe40cb00 00000000 fe40cb00 NT!PspSystemThreadStartup+0x4a
fe40cf7c  8013cb8e  fe43a44c ff6ce388 00000000 NT!_except_handler3+0x47
00000000  00000000  00000000 00000000 00000000 NT!KiThreadStartup+0xe

kd> dd fe40caf8 L2            dump EXCEPTION_POINTERS structure
0xFE40CAF8  fe40cd88 fe40cbc4                   ..@...@.

kd> .exr fe40cd88             first DWORD is the exception record
Exception Record @ FE40CD88:
   ExceptionCode: c0000005
  ExceptionFlags: 00000000
  Chained Record: 00000000
ExceptionAddress: 8013cd0a
NumberParameters: 00000002
   Parameter[0]: 00000000
   Parameter[1]: 0362cfff

kd> .cxr fe40cbc4             second DWORD is the context record
CtxFlags: 00010017
eax=00087000 ebx=00000000 ecx=03ff0000 edx=ff63d000 esi=0362cfff edi=036b3fff
eip=8013cd0a esp=fe40ce50 ebp=fe40cef8 iopl=0         nv dn ei pl nz ac po cy
vip=0    vif=0
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010617
0x8013cd0a  f3a4             rep movsb

kd> kb                        kb gives stack for context record
ChildEBP RetAddr  Args to Child
fe40ce54 80402e09 ff6c4000 ff63d000 03ff0000 NT!_RtlMoveMemory@12+0x3e
fe40ce68 80403c18 ffbc0c28 ff6ce008 ff6c4000 HAL!_HalpCopyBufferMap@20+0x49
fe40ce9c fe43b1e4 ff6cef90 ffbc0c28 ff6ce009 HAL!_IoFlushAdapterBuffers@24+0x148
fe40ceb8 fe4385b4 ff6ce388 6cd00800 ffbc0c28 QIC117!_kdi_FlushDMABuffers@20+0x28
fe40cef8 fe439894 ff6cd008 ffb6c820 fe40cf4c QIC117!_cqd_CmdReadWrite@8+0x26e
fe40cf18 fe437d92 ff6cd008 ffb6c820 ff6e4e50 QIC117!_cqd_DispatchFRB@8+0x210
fe40cf30 fe43a4f5 ff6cd008 ffb6c820 00000000 QIC117!_cqd_ProcessFRB@8+0x134
fe40cf4c 80133184 ff6ce388 00000000 00000000 QIC117!_kdi_ThreadRun@4+0xa9
fe40cf7c 8013cb8e fe43a44c ff6ce388 00000000 NT!_PspSystemThreadStartup@8+0x40