rammap 问题 - 没有显示任何内容（win10 pro build 17120）

Question

我在使用 Windows rammap 工具时遇到一些问题。它曾经工作正常，但到最近的版本 17115/17120 它停止工作 - 当我启动它时，它没有显示任何内容。刷新它会导致它崩溃。我尝试重新安装它，但没有成功。除了一些陈旧的论坛之外，通过网络搜索也没有显示任何有用的内容。
我想知道是否有人遇到过类似的问题或可以向我指出解决此问题的方法。我使用的是 win10 pro build 17120 rs4 180309-1616。

编辑- 正如@Epoxy 在评论中指出的，这里是事件错误日志。

1. Application Error event -----

* 1.1 General *

Faulting application name: RAMMap64.exe, version: 1.50.0.0, time stamp: 0x56a9c074
Faulting module name: ntdll.dll, version: 10.0.17120.1, time stamp: 0xe5136909
Exception code: 0xc0000374
Fault offset: 0x00000000000f50cb
Faulting process id: 0x1954
Faulting application start time: 0x01d3c1083d80f478
Faulting application path: C:\Program Files\RAMMap\RAMMap64.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 8002f6e8-ca88-49d2-a4d7-07aeda4dceed
Faulting package full name: 
Faulting package-relative application ID:  

* 1.2 Details * 

- System 
- Provider 
  [ Name]  Application Error 
- EventID 1000 
  [ Qualifiers]  0 
Level 2 
Task 100 
Keywords 0x80000000000000 
- TimeCreated 
  [ SystemTime]  2018-03-21T11:32:45.093706100Z 
EventRecordID 1843 
Channel Application 
Computer David-Desktop 
Security 
- EventData 
   RAMMap64.exe 
   1.50.0.0 
   56a9c074 
   ntdll.dll 
   10.0.17120.1 
   e5136909 
   c0000374 
   00000000000f50cb 
   1954 
   01d3c1083d80f478 
   C:\Program Files\RAMMap\RAMMap64.exe 
   C:\WINDOWS\SYSTEM32\ntdll.dll 
   8002f6e8-ca88-49d2-a4d7-07aeda4dceed

2. Windows Error Reporting event -----

* 2.1 General * 

Fault bucket 1880635345925225307, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
  P1: RAMMap64.exe
P2: 1.50.0.0
P3: 56a9c074
P4: StackHash_cbfa
P5: 10.0.17120.1
P6: e5136909
P7: c0000374
P8: PCH_20_FROM_ntdll+0x000000000009ABC4
P9: 
  P10: 

  Attached files:
  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER123B.tmp.mdmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER127A.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER128B.tmp.xml
WPR_initiated_DiagTrackMiniLogger_One Trace User Logger_20180319 Event Collector_0_inject.etl
\\?\C:\Users\David_Jankoski\AppData\Local\Temp\WER1309.tmp.etl
WPR_initiated_DiagTrackMiniLogger_WPR System Collector_inject.etl
\\?\C:\Users\David_Jankoski\AppData\Local\Temp\WER130A.tmp.etl
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1308.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1318.tmp.txt

These files may be available here:
  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_RAMMap64.exe_1c39d666fb7c699d861d89961ee7a4e57d783d7d_92e8a64a_236b1911

Analysis symbol: 
  Rechecking for solution: 0
Report Id: 8002f6e8-ca88-49d2-a4d7-07aeda4dceed
Report Status: 268435456
Hashed bucket: 21e4a91eb4cb40a98a195be211eabb5b
Cab Guid: 0

* 2.2 Details *

+ System 

- Provider 

[ Name]  Windows Error Reporting 

- EventID 1001 

[ Qualifiers]  0 

Level 4 

Task 0 

Keywords 0x80000000000000 

- TimeCreated 

[ SystemTime]  2018-03-21T11:32:46.920970900Z 

EventRecordID 1844 

Channel Application 

Computer David-Desktop 

Security 


- EventData 

1880635345925225307 
4 
APPCRASH 
Not available 
0 
RAMMap64.exe 
1.50.0.0 
56a9c074 
StackHash_cbfa 
10.0.17120.1 
e5136909 
c0000374 
PCH_20_FROM_ntdll+0x000000000009ABC4 


\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER123B.tmp.mdmp \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER127A.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER128B.tmp.xml WPR_initiated_DiagTrackMiniLogger_One Trace User Logger_20180319 Event Collector_0_inject.etl \\?\C:\Users\David_Jankoski\AppData\Local\Temp\WER1309.tmp.etl WPR_initiated_DiagTrackMiniLogger_WPR System Collector_inject.etl \\?\C:\Users\David_Jankoski\AppData\Local\Temp\WER130A.tmp.etl \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1308.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1318.tmp.txt 
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_RAMMap64.exe_1c39d666fb7c699d861d89961ee7a4e57d783d7d_92e8a64a_236b1911 

0 
8002f6e8-ca88-49d2-a4d7-07aeda4dceed 
268435456 
21e4a91eb4cb40a98a195be211eabb5b 
0 

Answer 1

RAMMap使用内部API来查询内存数据。新的 Windows 10 版本中此类 API 发生了变化。看起来微软在最新的 RS4 预览版中做了一些更改，导致该工具失败。

所以回到Windows 10 v1709或者等到下个月Windows 10 v1803正式发布时。我认为马克会更新所有工具以使其兼容。