none
请教windows server 2003 异常重启错误代码000000c5,参数1 0000ffff,参数2 d0000002,参数3 00000000,参数4 80892115。 RRS feed

  • 问题

  • 以下是用windbg调试的代码

    代码1

    Loading Dump File [C:\Users\li\Desktop\新建文件夹 (3)\Mini050317-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (16 procs) Free x86 compatible
    Product: Server, suite: Enterprise TerminalServer SingleUserTS
    Built by: 3790.srv03_sp2_gdr.101019-0340
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Wed May  3 15:08:19.808 2017 (UTC + 8:00)
    System Uptime: 161 days 23:27:00.365
    Loading Kernel Symbols
    ...............................................................
    ..................................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C5, {0, d0000002, 1, 808921dd}

    Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1d7 )

    Followup: Pool_corruption
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    DRIVER_CORRUPTED_EXPOOL (c5)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is
    caused by drivers that have corrupted the system pool.  Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: d0000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 808921dd, address which referenced memory

    Debugging Details:
    ------------------


    BUGCHECK_STR:  0xC5_D0000002

    CURRENT_IRQL:  2

    FAULTING_IP:
    nt!ExDeferredFreePool+1d7
    808921dd 8937            mov     dword ptr [edi],esi

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    PROCESS_NAME:  MDaemon.exe

    TRAP_FRAME:  b68ee8f0 -- (.trap 0xffffffffb68ee8f0)
    ErrCode = 00000002
    eax=8b9bb610 ebx=00000000 ecx=000001ff edx=8b9bb000 esi=8b9ce9f8 edi=00000000
    eip=808921dd esp=b68ee964 ebp=b68ee99c iopl=0         nv up ei ng nz ac pe cy
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
    nt!ExDeferredFreePool+0x1d7:
    808921dd 8937            mov     dword ptr [edi],esi  ds:0023:00000000=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from 808921dd to 8088c9eb

    STACK_TEXT: 
    b68ee8f0 808921dd badb0d00 8b9bb000 b68ee760 nt!KiTrap0E+0x2a7
    b68ee99c 808928c3 905df000 00000000 8ce4a228 nt!ExDeferredFreePool+0x1d7
    b68ee9f4 8081c403 8ce4a228 00000000 00000000 nt!ExFreePoolWithTag+0x57f
    b68eea10 808f8f93 8ce4a228 b68eebbc 8fd22018 nt!IopFreeIrp+0xe9
    b68eeafc 80937a40 8fd22030 00000000 8c11e590 nt!IopParseDevice+0x97b
    b68eeb7c 80933b74 00000000 b68eebbc 00000040 nt!ObpLookupObjectName+0x5b0
    b68eebd0 808ec82d 00000000 00000000 e56c6901 nt!ObOpenObjectByName+0xea
    b68eed54 808897ec 045ffcc8 045ffca0 045ffce8 nt!NtQueryAttributesFile+0x11d
    b68eed54 7c95847c 045ffcc8 045ffca0 045ffce8 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    045ffce8 00000000 00000000 00000000 00000000 0x7c95847c


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!ExDeferredFreePool+1d7
    808921dd 8937            mov     dword ptr [edi],esi

    SYMBOL_STACK_INDEX:  1

    SYMBOL_NAME:  nt!ExDeferredFreePool+1d7

    FOLLOWUP_NAME:  Pool_corruption

    IMAGE_NAME:  Pool_Corruption

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    MODULE_NAME: Pool_Corruption

    FAILURE_BUCKET_ID:  0xC5_D0000002_nt!ExDeferredFreePool+1d7

    BUCKET_ID:  0xC5_D0000002_nt!ExDeferredFreePool+1d7

    Followup: Pool_corruption
    ---------

    代码2

    Loading Dump File [C:\Users\li\Desktop\新建文件夹 (3)\Mini050617-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (16 procs) Free x86 compatible
    Product: Server, suite: Enterprise TerminalServer SingleUserTS
    Built by: 3790.srv03_sp2_gdr.101019-0340
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Sat May  6 04:17:38.394 2017 (UTC + 8:00)
    System Uptime: 2 days 12:02:08.646
    Loading Kernel Symbols
    ...............................................................
    ..................................................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C5, {ffff, d0000002, 0, 80892115}

    Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+10f )

    Followup: Pool_corruption
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    DRIVER_CORRUPTED_EXPOOL (c5)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is
    caused by drivers that have corrupted the system pool.  Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.
    Arguments:
    Arg1: 0000ffff, memory referenced
    Arg2: d0000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 80892115, address which referenced memory

    Debugging Details:
    ------------------


    BUGCHECK_STR:  0xC5_D0000002

    CURRENT_IRQL:  2

    FAULTING_IP:
    nt!ExDeferredFreePool+10f
    80892115 8b10            mov     edx,dword ptr [eax]

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

    PROCESS_NAME:  wmiprvse.exe

    IRP_ADDRESS:  8dbe5628

    TRAP_FRAME:  b5539930 -- (.trap 0xffffffffb5539930)
    ErrCode = 00000000
    eax=0000ffff ebx=00000000 ecx=000001ff edx=00000000 esi=905df000 edi=8dbe8000
    eip=80892115 esp=b55399a4 ebp=b55399dc iopl=0         nv up ei pl nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
    nt!ExDeferredFreePool+0x10f:
    80892115 8b10            mov     edx,dword ptr [eax]  ds:0023:0000ffff=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from 80892115 to 8088c9eb

    STACK_TEXT: 
    b5539930 80892115 badb0d00 00000000 8dbe5628 nt!KiTrap0E+0x2a7
    b55399dc 808928c3 905df000 8e9ec4b0 8dc158b0 nt!ExDeferredFreePool+0x10f
    b5539a34 80821695 8dc15760 00000000 8dbe5668 nt!ExFreePoolWithTag+0x57f
    b5539a88 8082dfe3 8dbe5668 b5539ad4 b5539ac8 nt!IopCompleteRequest+0xf9
    b5539ad8 80a60199 00000000 00000000 00000000 nt!KiDeliverApc+0xbb
    b5539af8 80a603d9 8df00b01 00000000 00000000 hal!HalpDispatchSoftwareInterrupt+0x49
    b5539b14 80a60456 00000001 8df00b00 b5539b40 hal!HalpCheckForSoftwareInterrupt+0x81
    b5539b24 808312ca 8df00b10 8dbe5668 b5539b58 hal!KfLowerIrql+0x62
    b5539b40 8082ab9b 8dbe5668 8dbe5628 00000000 nt!KiExitDispatcher+0x130
    b5539b60 8081e257 8dbe5668 8e9ec4b0 00000000 nt!KeInsertQueueApc+0x57
    b5539b94 80981c62 8dbe5628 904d2f38 8dbe5628 nt!IopfCompleteRequest+0x201
    b5539c3c 8081df85 904d2c50 8dbe5628 8df00d18 nt!WmipIoControl+0x71a
    b5539c50 808f54f9 8dbe57dc 8e9ec4b0 8dbe5628 nt!IofCallDriver+0x45
    b5539c64 808f629b 904d2c50 8dbe5628 8e9ec4b0 nt!IopSynchronousServiceTail+0x10b
    b5539d00 808eedca 000002b0 000002a4 00000000 nt!IopXxxControlFile+0x5e5
    b5539d34 808897ec 000002b0 000002a4 00000000 nt!NtDeviceIoControlFile+0x2a
    b5539d34 7c95847c 000002b0 000002a4 00000000 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0198e85c 00000000 00000000 00000000 00000000 0x7c95847c


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!ExDeferredFreePool+10f
    80892115 8b10            mov     edx,dword ptr [eax]

    SYMBOL_STACK_INDEX:  1

    SYMBOL_NAME:  nt!ExDeferredFreePool+10f

    FOLLOWUP_NAME:  Pool_corruption

    IMAGE_NAME:  Pool_Corruption

    DEBUG_FLR_IMAGE_TIMESTAMP:  0

    MODULE_NAME: Pool_Corruption

    FAILURE_BUCKET_ID:  0xC5_D0000002_nt!ExDeferredFreePool+10f

    BUCKET_ID:  0xC5_D0000002_nt!ExDeferredFreePool+10f

    Followup: Pool_corruption

    请教具体问题出在哪里

    2017年5月10日 5:38

全部回复