以下是用windbg调试的代码
代码1
Loading Dump File [C:\Users\li\Desktop\新建文件夹 (3)\Mini050317-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (16 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.101019-0340
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Wed May 3 15:08:19.808 2017 (UTC + 8:00)
System Uptime: 161 days 23:27:00.365
Loading Kernel Symbols
...............................................................
..................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C5, {0, d0000002, 1, 808921dd}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1d7 )
Followup: Pool_corruption
---------
2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000000, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 808921dd, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_D0000002
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExDeferredFreePool+1d7
808921dd 8937 mov dword ptr [edi],esi
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
PROCESS_NAME: MDaemon.exe
TRAP_FRAME: b68ee8f0 -- (.trap 0xffffffffb68ee8f0)
ErrCode = 00000002
eax=8b9bb610 ebx=00000000 ecx=000001ff edx=8b9bb000 esi=8b9ce9f8 edi=00000000
eip=808921dd esp=b68ee964 ebp=b68ee99c iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExDeferredFreePool+0x1d7:
808921dd 8937 mov dword ptr [edi],esi ds:0023:00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 808921dd to 8088c9eb
STACK_TEXT:
b68ee8f0 808921dd badb0d00 8b9bb000 b68ee760 nt!KiTrap0E+0x2a7
b68ee99c 808928c3 905df000 00000000 8ce4a228 nt!ExDeferredFreePool+0x1d7
b68ee9f4 8081c403 8ce4a228 00000000 00000000 nt!ExFreePoolWithTag+0x57f
b68eea10 808f8f93 8ce4a228 b68eebbc 8fd22018 nt!IopFreeIrp+0xe9
b68eeafc 80937a40 8fd22030 00000000 8c11e590 nt!IopParseDevice+0x97b
b68eeb7c 80933b74 00000000 b68eebbc 00000040 nt!ObpLookupObjectName+0x5b0
b68eebd0 808ec82d 00000000 00000000 e56c6901 nt!ObOpenObjectByName+0xea
b68eed54 808897ec 045ffcc8 045ffca0 045ffce8 nt!NtQueryAttributesFile+0x11d
b68eed54 7c95847c 045ffcc8 045ffca0 045ffce8 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
045ffce8 00000000 00000000 00000000 00000000 0x7c95847c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+1d7
808921dd 8937 mov dword ptr [edi],esi
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExDeferredFreePool+1d7
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: 0xC5_D0000002_nt!ExDeferredFreePool+1d7
BUCKET_ID: 0xC5_D0000002_nt!ExDeferredFreePool+1d7
Followup: Pool_corruption
---------
代码2
Loading Dump File [C:\Users\li\Desktop\新建文件夹 (3)\Mini050617-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (16 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_gdr.101019-0340
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Sat May 6 04:17:38.394 2017 (UTC + 8:00)
System Uptime: 2 days 12:02:08.646
Loading Kernel Symbols
...............................................................
..................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C5, {ffff, d0000002, 0, 80892115}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+10f )
Followup: Pool_corruption
---------
2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000ffff, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80892115, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_D0000002
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExDeferredFreePool+10f
80892115 8b10 mov edx,dword ptr [eax]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP
PROCESS_NAME: wmiprvse.exe
IRP_ADDRESS: 8dbe5628
TRAP_FRAME: b5539930 -- (.trap 0xffffffffb5539930)
ErrCode = 00000000
eax=0000ffff ebx=00000000 ecx=000001ff edx=00000000 esi=905df000 edi=8dbe8000
eip=80892115 esp=b55399a4 ebp=b55399dc iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExDeferredFreePool+0x10f:
80892115 8b10 mov edx,dword ptr [eax] ds:0023:0000ffff=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 80892115 to 8088c9eb
STACK_TEXT:
b5539930 80892115 badb0d00 00000000 8dbe5628 nt!KiTrap0E+0x2a7
b55399dc 808928c3 905df000 8e9ec4b0 8dc158b0 nt!ExDeferredFreePool+0x10f
b5539a34 80821695 8dc15760 00000000 8dbe5668 nt!ExFreePoolWithTag+0x57f
b5539a88 8082dfe3 8dbe5668 b5539ad4 b5539ac8 nt!IopCompleteRequest+0xf9
b5539ad8 80a60199 00000000 00000000 00000000 nt!KiDeliverApc+0xbb
b5539af8 80a603d9 8df00b01 00000000 00000000 hal!HalpDispatchSoftwareInterrupt+0x49
b5539b14 80a60456 00000001 8df00b00 b5539b40 hal!HalpCheckForSoftwareInterrupt+0x81
b5539b24 808312ca 8df00b10 8dbe5668 b5539b58 hal!KfLowerIrql+0x62
b5539b40 8082ab9b 8dbe5668 8dbe5628 00000000 nt!KiExitDispatcher+0x130
b5539b60 8081e257 8dbe5668 8e9ec4b0 00000000 nt!KeInsertQueueApc+0x57
b5539b94 80981c62 8dbe5628 904d2f38 8dbe5628 nt!IopfCompleteRequest+0x201
b5539c3c 8081df85 904d2c50 8dbe5628 8df00d18 nt!WmipIoControl+0x71a
b5539c50 808f54f9 8dbe57dc 8e9ec4b0 8dbe5628 nt!IofCallDriver+0x45
b5539c64 808f629b 904d2c50 8dbe5628 8e9ec4b0 nt!IopSynchronousServiceTail+0x10b
b5539d00 808eedca 000002b0 000002a4 00000000 nt!IopXxxControlFile+0x5e5
b5539d34 808897ec 000002b0 000002a4 00000000 nt!NtDeviceIoControlFile+0x2a
b5539d34 7c95847c 000002b0 000002a4 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0198e85c 00000000 00000000 00000000 00000000 0x7c95847c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+10f
80892115 8b10 mov edx,dword ptr [eax]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExDeferredFreePool+10f
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: Pool_Corruption
FAILURE_BUCKET_ID: 0xC5_D0000002_nt!ExDeferredFreePool+10f
BUCKET_ID: 0xC5_D0000002_nt!ExDeferredFreePool+10f
Followup: Pool_corruption
请教具体问题出在哪里
