none
WinXP-SP3 死机 0x1000000A 查不出原因 RRS feed

  • 问题

  • WinXP-SP3 死机 0x1000000A 查不出原因

    两天已经死了两次,都是:IRQL_NOT_LESS_OR_EQUAL 0x1000000A 错误,检查硬件没有发现冲突,下面是调试信息,帮忙分析分析什么地方冲突了。

    =================================================================


    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [D:\Documents and Datas\My Documents\My DATA\Minidump\Mini082511-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Inaccessible path: 'C:\MyCodesSymbols'
    WARNING: Whitespace at start of path element
    Symbol search path is: C:\MyCodesSymbols; SRV*D:\Documents and Datas\LocalSymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_qfe.101209-1646
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
    Debug session time: Thu Aug 25 11:46:54.703 2011 (GMT+8)
    System Uptime: 0 days 18:42:10.400
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................................................
    Loading User Symbols
    Loading unloaded module list
    ...............................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {fffffff0, 2, 0, 804e3284}

    Probably caused by : ntkrpamp.exe ( nt!CcFindBcb+5c )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffffff0, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 804e3284, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS:  fffffff0

    CURRENT_IRQL:  2

    FAULTING_IP:
    nt!CcFindBcb+5c
    804e3284 668138fd02      cmp     word ptr [eax],2FDh

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 804e40fd to 804e3284

    STACK_TEXT: 
    ba4ef6f8 804e40fd 86c616a0 ba4ef7d8 ba4ef738 nt!CcFindBcb+0x5c
    ba4ef79c 804e548a 86c616a0 ba4ef7d8 0010d000 nt!CcAcquireByteRangeForWrite+0x361
    ba4ef828 b9c84007 00000000 ba4ef8c8 0011d000 nt!CcFlushCache+0x2d6
    ba4ef8f0 b9c84089 e17cb688 e4906d10 e3f3ca60 Ntfs!LfsFlushLfcb+0x227
    ba4ef914 b9c85505 e17cb688 e4906d10 86bc2858 Ntfs!LfsFlushLbcb+0x81
    ba4ef96c b9c84e98 e17cb688 000000e0 00000001 Ntfs!LfsWriteLfsRestart+0x16a
    ba4ef9b8 b9c8525e e17a7b08 00000068 ba4efa20 Ntfs!LfsWriteRestartArea+0x158
    ba4efbe8 b9c8515a ba4efc1c 86bc2648 00000000 Ntfs!NtfsCheckpointVolume+0xe0a
    ba4efd7c 805397cf 00000000 00000000 8a369420 Ntfs!NtfsCheckpointAllVolumes+0xd2
    ba4efdac 805d0fd8 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
    ba4efddc 8054715e 805396e0 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!CcFindBcb+5c
    804e3284 668138fd02      cmp     word ptr [eax],2FDh

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!CcFindBcb+5c

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  4d00d4fc

    FAILURE_BUCKET_ID:  0xA_nt!CcFindBcb+5c

    BUCKET_ID:  0xA_nt!CcFindBcb+5c

    Followup: MachineOwner
    ---------

    =====================================================


    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [D:\Documents and Datas\My Documents\My DATA\Minidump\Mini082611-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    WARNING: Inaccessible path: 'C:\MyCodesSymbols'
    WARNING: Whitespace at start of path element
    Symbol search path is: C:\MyCodesSymbols; SRV*D:\Documents and Datas\LocalSymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_qfe.101209-1646
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
    Debug session time: Fri Aug 26 16:05:36.925 2011 (GMT+8)
    System Uptime: 1 days 2:58:24.508
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................................................
    Loading User Symbols
    Loading unloaded module list
    ..........................................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {32000018, 2, 0, 804e8865}

    Probably caused by : ntkrpamp.exe ( nt!CcGetVirtualAddressIfMapped+7d )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 32000018, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 804e8865, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS:  32000018

    CURRENT_IRQL:  2

    FAULTING_IP:
    nt!CcGetVirtualAddressIfMapped+7d
    804e8865 6683780800      cmp     word ptr [eax+8],0

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 804e54b8 to 804e8865

    STACK_TEXT: 
    ba4efc68 804e54b8 86be16b8 101c3000 00000000 nt!CcGetVirtualAddressIfMapped+0x7d
    ba4efcf0 804e58c5 00001000 00000000 00000001 nt!CcFlushCache+0x304
    ba4efd34 804e80db 8a3661e0 80565820 8a369420 nt!CcWriteBehind+0x119
    ba4efd7c 805397cf 8a3661e0 00000000 8a369420 nt!CcWorkerThread+0x12f
    ba4efdac 805d0fd8 8a3661e0 00000000 00000000 nt!ExpWorkerThread+0xef
    ba4efddc 8054715e 805396e0 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!CcGetVirtualAddressIfMapped+7d
    804e8865 6683780800      cmp     word ptr [eax+8],0

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!CcGetVirtualAddressIfMapped+7d

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  4d00d4fc

    FAILURE_BUCKET_ID:  0xA_nt!CcGetVirtualAddressIfMapped+7d

    BUCKET_ID:  0xA_nt!CcGetVirtualAddressIfMapped+7d

    Followup: MachineOwner
    ---------

    2011年8月29日 3:19

全部回复

  • 这个错误标示在内核模式中存在以过高的进程内部请求级别(IRQL)访问其没有权限访问的内存地址。一般是因为有问题的设备驱动程序、有缺陷或兼容性问题的软硬件等引起的。
     
    你最近有没有更改过设备驱动程序或任何软件?通常在执行什么操作的时候最容易引起这个问题?
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "scwhcn"
     
    WinXP-SP3 死机 0x1000000A 查不出原因
    两天已经死了两次,都是:IRQL_NOT_LESS_OR_EQUAL 0x1000000A 错误,检查硬件没有发现冲突,
     
     
    2011年8月29日 3:53
    版主