xp系统，因为蓝屏重不久，问题依旧。蓝屏后winDbg有两种分别如下：
1.
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini050409-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Invalid directory table base value 0x0
Symbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols
Executable search path is:
"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000.
Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results. Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt, Win32 error 2
Unable to add module at 00000000
Debugger can not determine kernel base address
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055c1c0
Debug session time: Mon May 4 01:02:03.792 2009 (GMT+8)
System Uptime: 0 days 0:49:38.207
"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000.
Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results. Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt, Win32 error 2
Unable to add module at 00000000
Debugger can not determine kernel base address
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1902fe, f795e374, f795e070, 826fbe76}
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: f795e374
Arg3: f795e070
Arg4: 826fbe76
Debugging Details:
------------------
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.
EXCEPTION_RECORD: f795e374 -- (.exr fffffffff795e374)
ExceptionAddress: 00149eef
ExceptionCode: 000d6302
ExceptionFlags: 00149ee6
NumberParameters: 877337
Parameter[0]: 00149f36
Parameter[1]: 000d6360
Parameter[2]: 00149f40
Parameter[3]: 000d636a
Parameter[4]: 00149f49
Parameter[5]: 000d6373
Parameter[6]: 00149f74
Parameter[7]: 000d639e
Parameter[8]: 00149f7e
Parameter[9]: 000d63a8
Parameter[10]: 00149f87
Parameter[11]: 000d63b1
Parameter[12]: 00149f92
Parameter[13]: 000d63bc
Parameter[14]: 00149fc6
CONTEXT: f795e070 -- (.cxr fffffffff795e070)
eax=00149bff ebx=00136378 ecx=00136386 edx=00149bf7 esi=00149be9 edi=00136370
eip=00149c03 esp=000e70c6 ebp=0013638e iopl=1 vip ov dn di pl nz na pe cy
cs=70bc ss=0010 ds=9be1 es=636b fs=9bdc gs=70b9 efl=00149c0d
70bc:00149c03 ?? ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x24
EXCEPTION_STR: 0x0
LAST_CONTROL_TRANSFER: from 0100009b to 80534806
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f795de48 0100009b 0000bf00 c8052504 4d000b00 0x80534806
f795de64 02010259 0b59090a 8d070800 4a0a9b03 0x100009b
f795de68 0b59090a 8d070800 4a0a9b03 5a09040d 0x2010259
f795de6c 8d070800 4a0a9b03 5a09040d 0c490001 0xb59090a
f795de70 4a0a9b03 5a09040d 0c490001 6a01b80d 0x8d070800
f795de74 5a09040d 0c490001 6a01b80d e96821b3 0x4a0a9b03
f795de78 0c490001 6a01b80d e96821b3 4e2b2b18 0x5a09040d
f795de7c 6a01b80d e96821b3 4e2b2b18 fd4d3cf4 0xc490001
f795de80 e96821b3 4e2b2b18 fd4d3cf4 f6104e3c 0x6a01b80d
f795de84 4e2b2b18 fd4d3cf4 f6104e3c 00e4f44d 0xe96821b3
f795de88 fd4d3cf4 f6104e3c 00e4f44d 3cfd3c3f 0x4e2b2b18
f795de8c f6104e3c 00e4f44d 3cfd3c3f 3cfd3c3f 0xfd4d3cf4
f795de90 00e4f44d 3cfd3c3f 3cfd3c3f 3c2f3912 0xf6104e3c
f795de94 3cfd3c3f 3cfd3c3f 3c2f3912 313cfd10 0xe4f44d
f795de98 3cfd3c3f 3c2f3912 313cfd10 21113330 0x3cfd3c3f
f795de9c 3c2f3912 313cfd10 21113330 21112115 0x3cfd3c3f
f795dea0 313cfd10 21113330 21112115 21112115 0x3c2f3912
f795dea4 21113330 21112115 21112115 3b03bf15 0x313cfd10
f795dea8 21112115 21112115 3b03bf15 050297fd 0x21113330
f795deac 21112115 3b03bf15 050297fd 9402fbfd 0x21112115
f795deb0 3b03bf15 050297fd 9402fbfd fe9dc805 0x21112115
f795deb4 050297fd 9402fbfd fe9dc805 e8fd9b25 0x3b03bf15
f795deb8 9402fbfd fe9dc805 e8fd9b25 0100009d 0x50297fd
f795debc fe9dc805 e8fd9b25 0100009d 0000bf00 0x9402fbfd
f795dec0 e8fd9b25 0100009d 0000bf00 c805fa03 0xfe9dc805
f795dec4 0100009d 0000bf00 c805fa03 4a000900 0xe8fd9b25
f795dec8 00000000 c805fa03 4a000900 05062040 0x100009d
STACK_COMMAND: kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: CORRUPT_MODULELIST
Followup: MachineOwner
---------
2.
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini050509-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp3_qfe.090206-1316
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055c1c0
Debug session time: Tue May 5 20:56:28.609 2009 (GMT+8)
System Uptime: 0 days 0:30:11.180
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {1800, 2, 1, 826b54db}
Probably caused by : ntoskrnl.exe ( nt!KiTrap0E+233 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00001800, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 826b54db, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 00001800
CURRENT_IRQL: 2
FAULTING_IP:
+ffffffff826b54db
826b54db ?? ???
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
TRAP_FRAME: f795e3c8 -- (.trap fffffffff795e3c8)
ErrCode = 00000002
eax=00001800 ebx=82f87f18 ecx=f74fe280 edx=00000000 esi=f74fe280 edi=826b54d8
eip=826b54db esp=f795e43c ebp=f795e448 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
826b54db ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from 826b54db to 804e287f
STACK_TEXT:
f795e3c8 826b54db badb0d00 00000000 00000000 nt!KiTrap0E+0x233
WARNING: Frame IP not in any known module. Following frames may be wrong.
f795e438 00000000 826b54d8 826b5590 f795e47c 0x826b54db
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap0E+233
804e287f f7457000000200 test dword ptr [ebp+70h],20000h
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiTrap0E+233
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 498c1969
FAILURE_BUCKET_ID: 0xD1_W_nt!KiTrap0E+233
BUCKET_ID: 0xD1_W_nt!KiTrap0E+233
Followup: MachineOwner
---------
