none
不定时蓝屏问题,请高手帮忙分析一下!QQQ RRS feed

  • 问题

  • xp系统,因为蓝屏重不久,问题依旧。蓝屏后winDbg有两种分别如下:

    1.

    Microsoft (R) Windows Debugger  Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini050409-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Invalid directory table base value 0x0
    Symbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols
    Executable search path is:


    "nt" was not found in the image list.
    Debugger will attempt to load "nt" at given base 00000000.

    Please provide the full image name, including the extension (i.e. kernel32.dll)
    for more reliable results. Base address and size overrides can be given as
    .reload <image.ext>=<base>,<size>.
    Unable to load image nt, Win32 error 2
    Unable to add module at 00000000
    Debugger can not determine kernel base address
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055c1c0
    Debug session time: Mon May  4 01:02:03.792 2009 (GMT+8)
    System Uptime: 0 days 0:49:38.207


    "nt" was not found in the image list.
    Debugger will attempt to load "nt" at given base 00000000.

    Please provide the full image name, including the extension (i.e. kernel32.dll)
    for more reliable results. Base address and size overrides can be given as
    .reload <image.ext>=<base>,<size>.
    Unable to load image nt, Win32 error 2
    Unable to add module at 00000000
    Debugger can not determine kernel base address
    Loading Kernel Symbols

    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 24, {1902fe, f795e374, f795e070, 826fbe76}

    ***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

    Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 001902fe
    Arg2: f795e374
    Arg3: f795e070
    Arg4: 826fbe76

    Debugging Details:
    ------------------

    ***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.


    EXCEPTION_RECORD:  f795e374 -- (.exr fffffffff795e374)
    ExceptionAddress: 00149eef
       ExceptionCode: 000d6302
      ExceptionFlags: 00149ee6
    NumberParameters: 877337
       Parameter[0]: 00149f36
       Parameter[1]: 000d6360
       Parameter[2]: 00149f40
       Parameter[3]: 000d636a
       Parameter[4]: 00149f49
       Parameter[5]: 000d6373
       Parameter[6]: 00149f74
       Parameter[7]: 000d639e
       Parameter[8]: 00149f7e
       Parameter[9]: 000d63a8
       Parameter[10]: 00149f87
       Parameter[11]: 000d63b1
       Parameter[12]: 00149f92
       Parameter[13]: 000d63bc
       Parameter[14]: 00149fc6

    CONTEXT:  f795e070 -- (.cxr fffffffff795e070)
    eax=00149bff ebx=00136378 ecx=00136386 edx=00149bf7 esi=00149be9 edi=00136370
    eip=00149c03 esp=000e70c6 ebp=0013638e iopl=1 vip     ov dn di pl nz na pe cy
    cs=70bc  ss=0010  ds=9be1  es=636b  fs=9bdc  gs=70b9             efl=00149c0d
    70bc:00149c03 ??              ???
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x24

    EXCEPTION_STR:  0x0

    LAST_CONTROL_TRANSFER:  from 0100009b to 80534806

    STACK_TEXT: 
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    f795de48 0100009b 0000bf00 c8052504 4d000b00 0x80534806
    f795de64 02010259 0b59090a 8d070800 4a0a9b03 0x100009b
    f795de68 0b59090a 8d070800 4a0a9b03 5a09040d 0x2010259
    f795de6c 8d070800 4a0a9b03 5a09040d 0c490001 0xb59090a
    f795de70 4a0a9b03 5a09040d 0c490001 6a01b80d 0x8d070800
    f795de74 5a09040d 0c490001 6a01b80d e96821b3 0x4a0a9b03
    f795de78 0c490001 6a01b80d e96821b3 4e2b2b18 0x5a09040d
    f795de7c 6a01b80d e96821b3 4e2b2b18 fd4d3cf4 0xc490001
    f795de80 e96821b3 4e2b2b18 fd4d3cf4 f6104e3c 0x6a01b80d
    f795de84 4e2b2b18 fd4d3cf4 f6104e3c 00e4f44d 0xe96821b3
    f795de88 fd4d3cf4 f6104e3c 00e4f44d 3cfd3c3f 0x4e2b2b18
    f795de8c f6104e3c 00e4f44d 3cfd3c3f 3cfd3c3f 0xfd4d3cf4
    f795de90 00e4f44d 3cfd3c3f 3cfd3c3f 3c2f3912 0xf6104e3c
    f795de94 3cfd3c3f 3cfd3c3f 3c2f3912 313cfd10 0xe4f44d
    f795de98 3cfd3c3f 3c2f3912 313cfd10 21113330 0x3cfd3c3f
    f795de9c 3c2f3912 313cfd10 21113330 21112115 0x3cfd3c3f
    f795dea0 313cfd10 21113330 21112115 21112115 0x3c2f3912
    f795dea4 21113330 21112115 21112115 3b03bf15 0x313cfd10
    f795dea8 21112115 21112115 3b03bf15 050297fd 0x21113330
    f795deac 21112115 3b03bf15 050297fd 9402fbfd 0x21112115
    f795deb0 3b03bf15 050297fd 9402fbfd fe9dc805 0x21112115
    f795deb4 050297fd 9402fbfd fe9dc805 e8fd9b25 0x3b03bf15
    f795deb8 9402fbfd fe9dc805 e8fd9b25 0100009d 0x50297fd
    f795debc fe9dc805 e8fd9b25 0100009d 0000bf00 0x9402fbfd
    f795dec0 e8fd9b25 0100009d 0000bf00 c805fa03 0xfe9dc805
    f795dec4 0100009d 0000bf00 c805fa03 4a000900 0xe8fd9b25
    f795dec8 00000000 c805fa03 4a000900 05062040 0x100009d


    STACK_COMMAND:  kb

    SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Unknown_Module

    IMAGE_NAME:  Unknown_Image

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    BUCKET_ID:  CORRUPT_MODULELIST

    Followup: MachineOwner
    ---------



    2.

    Microsoft (R) Windows Debugger  Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini050509-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt
    Built by: 2600.xpsp_sp3_qfe.090206-1316
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055c1c0
    Debug session time: Tue May  5 20:56:28.609 2009 (GMT+8)
    System Uptime: 0 days 0:30:11.180
    Loading Kernel Symbols
    ...................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck D1, {1800, 2, 1, 826b54db}

    Probably caused by : ntoskrnl.exe ( nt!KiTrap0E+233 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 00001800, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 826b54db, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS:  00001800

    CURRENT_IRQL:  2

    FAULTING_IP:
    +ffffffff826b54db
    826b54db ??              ???

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0xD1

    TRAP_FRAME:  f795e3c8 -- (.trap fffffffff795e3c8)
    ErrCode = 00000002
    eax=00001800 ebx=82f87f18 ecx=f74fe280 edx=00000000 esi=f74fe280 edi=826b54d8
    eip=826b54db esp=f795e43c ebp=f795e448 iopl=0         nv up ei pl nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
    826b54db ??              ???
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from 826b54db to 804e287f

    STACK_TEXT: 
    f795e3c8 826b54db badb0d00 00000000 00000000 nt!KiTrap0E+0x233
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    f795e438 00000000 826b54d8 826b5590 f795e47c 0x826b54db


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiTrap0E+233
    804e287f f7457000000200  test    dword ptr [ebp+70h],20000h

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!KiTrap0E+233

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  498c1969

    FAILURE_BUCKET_ID:  0xD1_W_nt!KiTrap0E+233

    BUCKET_ID:  0xD1_W_nt!KiTrap0E+233

    Followup: MachineOwner
    ---------

     

    2009年5月5日 13:30

全部回复