locked
2008r2 0x1000007e RRS feed

  • 問題

  • 2008r2 用於 file server , 今天突然自動重啟,查看後發現藍屏dump ,透過winbdg 取得以下資訊,還請協助分析應該如修復

    DUMP_CLASS: 1

    DUMP_QUALIFIER: 400

    BUILD_VERSION_STRING:  7601.23392.amd64fre.win7sp1_ldr.160317-0600

    SYSTEM_MANUFACTURER:  HP

    SYSTEM_PRODUCT_NAME:  ProLiant DL380p Gen8

    SYSTEM_SKU:  653200-B21     

    BIOS_VENDOR:  HP

    BIOS_VERSION:  P70

    BIOS_DATE:  02/25/2012

    ADDITIONAL_DEBUG_TEXT: 
    You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

    WRONG_SYMBOLS_TIMESTAMP: 56eb24e6

    WRONG_SYMBOLS_SIZE: 5e7000

    FAULTING_MODULE: fffff80001a1f000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  56eb24e6

    DUMP_TYPE:  2

    BUGCHECK_P1: ffffffffc0000005

    BUGCHECK_P2: fffff8800809b145

    BUGCHECK_P3: fffff8800838b7c8

    BUGCHECK_P4: fffff8800838b020

    EXCEPTION_CODE: (NTSTATUS) 0x56eb24e6 - <Unable to get error code text>

    FAULTING_IP:
    srv2+1a145
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8]

    EXCEPTION_RECORD:  fffff8800838b7c8 -- (.exr 0xfffff8800838b7c8)
    ExceptionAddress: fffff8800809b145 (srv2+0x000000000001a145)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000008
    Attempt to read from address 0000000000000008

    CONTEXT:  fffff8800838b020 -- (.cxr 0xfffff8800838b020)
    rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8027064fcc
    rdx=fffffa8027064f6c rsi=fffffa8027064f60 rdi=00000000c000020c
    rip=fffff8800809b145 rsp=fffff8800838ba00 rbp=fffffa80223ba2c0
     r8=fffffa8027064f78  r9=fffffa8027064f70 r10=fffffa8027064fb8
    r11=fffffa8027064fbc r12=0000000001548300 r13=0000000000000000
    r14=0000000000000000 r15=fffff78000000300
    iopl=0         nv up ei ng nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
    srv2+0x1a145:
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8] ds:002b:00000000`00000008=????????
    Resetting default scope

    CPU_COUNT: c

    CPU_MHZ: 7cb

    CPU_VENDOR:  GenuineIntel

    CPU_FAMILY: 6

    CPU_MODEL: 2d

    CPU_STEPPING: 7

    CPU_MICROCODE: 0,0,0,0 (F,M,S,R)  SIG: 708'00000000 (cache) 0'00000000 (init)

    CUSTOMER_CRASH_COUNT:  1

    CURRENT_IRQL:  0

    ANALYSIS_SESSION_HOST:  NB-PARKER-SSD

    ANALYSIS_SESSION_TIME:  05-09-2016 14:33:12.0844

    ANALYSIS_VERSION: 10.0.10586.567 amd64fre

    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8800809b145

    STACK_TEXT: 
    fffff880`0838ba00 00000000`00000000 : fffff880`0838bb80 fffffa80`18eb8040 fffff880`0838bad0 00000000`001fffff : srv2+0x1a145


    THREAD_SHA1_HASH_MOD_FUNC:  f08cac272d86da0dd3328f6247270019aeca1837

    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  d4a8f16e5cf9a08fccc44b9055dabdfe250244de

    THREAD_SHA1_HASH_MOD:  f08cac272d86da0dd3328f6247270019aeca1837

    FOLLOWUP_IP:
    srv2+1a145
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8]

    FAULT_INSTR_CODE:  2108488b

    SYMBOL_STACK_INDEX:  0

    FOLLOWUP_NAME:  MachineOwner

    STACK_COMMAND:  .cxr 0xfffff8800838b020 ; kb

    BUGCHECK_STR:  56EB24E6

    EXCEPTION_CODE_STR:  56EB24E6

    FAILURE_EXCEPTION_CODE:  56EB24E6

    EXCEPTION_STR:  WRONG_SYMBOLS

    PROCESS_NAME:  ntoskrnl.wrong.symbols.exe

    IMAGE_NAME:  ntoskrnl.wrong.symbols.exe

    MODULE_NAME: nt_wrong_symbols

    SYMBOL_NAME:  nt_wrong_symbols!56EB24E65E7000

    BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302

    DEFAULT_BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302

    PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS

    FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302_56EB24E6_nt_wrong_symbols!56EB24E65E7000

    TARGET_TIME:  2016-05-09T05:42:16.000Z

    OSBUILD:  7601

    OSSERVICEPACK:  1000

    SERVICEPACK_NUMBER: 0

    OS_REVISION: 0

    SUITE_MASK:  272

    PRODUCT_TYPE:  3

    OSPLATFORM_TYPE:  x64

    OSNAME:  Windows 7

    OSEDITION:  Windows 7 Server (Service Pack 1) TerminalServer SingleUserTS

    OS_LOCALE: 

    USER_LCID:  0

    OSBUILD_TIMESTAMP:  2016-03-18 05:43:02

    BUILDDATESTAMP_STR:  160317-0600

    BUILDLAB_STR:  win7sp1_ldr

    BUILDOSVER_STR:  6.1.7601.23392.amd64fre.win7sp1_ldr.160317-0600

    ANALYSIS_SESSION_ELAPSED_TIME: 2050

    ANALYSIS_SOURCE:  KM

    FAILURE_ID_HASH_STRING:  km:wrong_symbols_x64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_timestamp_160317-214302_56eb24e6_nt_wrong_symbols!56eb24e65e7000

    FAILURE_ID_HASH:  {b90a6f02-106d-75eb-3182-62e865b13e1f}

    Followup:     MachineOwner

    2016年5月9日 上午 06:52

所有回覆

  • DUMP_CLASS: 1
    
    DUMP_QUALIFIER: 400
    
    BUILD_VERSION_STRING:  7601.23392.amd64fre.win7sp1_ldr.160317-0600
    
    SYSTEM_MANUFACTURER:  HP
    
    SYSTEM_PRODUCT_NAME:  ProLiant DL380p Gen8
    
    SYSTEM_SKU:  653200-B21      
    
    BIOS_VENDOR:  HP
    
    BIOS_VERSION:  P70
    
    BIOS_DATE:  02/25/2012
    
    ADDITIONAL_DEBUG_TEXT:  
    You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
    
    WRONG_SYMBOLS_TIMESTAMP: 56eb24e6
    
    WRONG_SYMBOLS_SIZE: 5e7000
    
    FAULTING_MODULE: fffff80001a1f000 nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  56eb24e6
    
    DUMP_TYPE:  2
    
    BUGCHECK_P1: ffffffffc0000005
    
    BUGCHECK_P2: fffff8800809b145
    
    BUGCHECK_P3: fffff8800838b7c8
    
    BUGCHECK_P4: fffff8800838b020
    
    EXCEPTION_CODE: (NTSTATUS) 0x56eb24e6 - <Unable to get error code text>
    
    FAULTING_IP: 
    srv2+1a145
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8]
    
    EXCEPTION_RECORD:  fffff8800838b7c8 -- (.exr 0xfffff8800838b7c8)
    ExceptionAddress: fffff8800809b145 (srv2+0x000000000001a145)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000008
    Attempt to read from address 0000000000000008
    
    CONTEXT:  fffff8800838b020 -- (.cxr 0xfffff8800838b020)
    rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8027064fcc
    rdx=fffffa8027064f6c rsi=fffffa8027064f60 rdi=00000000c000020c
    rip=fffff8800809b145 rsp=fffff8800838ba00 rbp=fffffa80223ba2c0
     r8=fffffa8027064f78  r9=fffffa8027064f70 r10=fffffa8027064fb8
    r11=fffffa8027064fbc r12=0000000001548300 r13=0000000000000000
    r14=0000000000000000 r15=fffff78000000300
    iopl=0         nv up ei ng nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
    srv2+0x1a145:
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8] ds:002b:00000000`00000008=????????
    Resetting default scope
    
    CPU_COUNT: c
    
    CPU_MHZ: 7cb
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 2d
    
    CPU_STEPPING: 7
    
    CPU_MICROCODE: 0,0,0,0 (F,M,S,R)  SIG: 708'00000000 (cache) 0'00000000 (init)
    
    CUSTOMER_CRASH_COUNT:  1
    
    CURRENT_IRQL:  0
    
    ANALYSIS_SESSION_HOST:  NB-PARKER-SSD
    
    ANALYSIS_SESSION_TIME:  05-09-2016 14:21:35.0978
    
    ANALYSIS_VERSION: 10.0.10586.567 amd64fre
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8800809b145
    
    STACK_TEXT:  
    fffff880`0838ba00 00000000`00000000 : fffff880`0838bb80 fffffa80`18eb8040 fffff880`0838bad0 00000000`001fffff : srv2+0x1a145
    
    
    THREAD_SHA1_HASH_MOD_FUNC:  f08cac272d86da0dd3328f6247270019aeca1837
    
    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  d4a8f16e5cf9a08fccc44b9055dabdfe250244de
    
    THREAD_SHA1_HASH_MOD:  f08cac272d86da0dd3328f6247270019aeca1837
    
    FOLLOWUP_IP: 
    srv2+1a145
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8]
    
    FAULT_INSTR_CODE:  2108488b
    
    SYMBOL_STACK_INDEX:  0
    
    FOLLOWUP_NAME:  MachineOwner
    
    STACK_COMMAND:  .cxr 0xfffff8800838b020 ; kb
    
    BUGCHECK_STR:  56EB24E6
    
    EXCEPTION_CODE_STR:  56EB24E6
    
    FAILURE_EXCEPTION_CODE:  56EB24E6
    
    EXCEPTION_STR:  WRONG_SYMBOLS
    
    PROCESS_NAME:  ntoskrnl.wrong.symbols.exe
    
    IMAGE_NAME:  ntoskrnl.wrong.symbols.exe
    
    MODULE_NAME: nt_wrong_symbols
    
    SYMBOL_NAME:  nt_wrong_symbols!56EB24E65E7000
    
    BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302
    
    DEFAULT_BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302
    
    PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS
    
    FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302_56EB24E6_nt_wrong_symbols!56EB24E65E7000
    
    TARGET_TIME:  2016-05-09T05:42:16.000Z
    
    OSBUILD:  7601
    
    OSSERVICEPACK:  1000
    
    SERVICEPACK_NUMBER: 0
    
    OS_REVISION: 0
    
    SUITE_MASK:  272
    
    PRODUCT_TYPE:  3
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 7
    
    OSEDITION:  Windows 7 Server (Service Pack 1) TerminalServer SingleUserTS
    
    OS_LOCALE:  
    
    USER_LCID:  0
    
    OSBUILD_TIMESTAMP:  2016-03-18 05:43:02
    
    BUILDDATESTAMP_STR:  160317-0600
    
    BUILDLAB_STR:  win7sp1_ldr
    
    BUILDOSVER_STR:  6.1.7601.23392.amd64fre.win7sp1_ldr.160317-0600
    
    ANALYSIS_SESSION_ELAPSED_TIME: 2a
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:wrong_symbols_x64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_timestamp_160317-214302_56eb24e6_nt_wrong_symbols!56eb24e65e7000
    
    FAILURE_ID_HASH:  {b90a6f02-106d-75eb-3182-62e865b13e1f}
    
    Followup:     MachineOwner
    ---------
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*c:\\dumptemp*http://msdl.microsoft.com/download/symbols
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    OK                                             D:
    5: kd> ntoskrnl.wrong.symbols.exe
           ^ Syntax error in 'ntoskrnl.wrong.symbols.exe'
    5: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff8800809b145, The address that the exception occurred at
    Arg3: fffff8800838b7c8, Exception Record Address
    Arg4: fffff8800838b020, Context Record Address
    
    Debugging Details:
    ------------------
    
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
    
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_EPROCESS                                  ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KTHREAD                                   ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KTHREAD                                   ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_MMPTE                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_MMPTE                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Either you specified an unqualified symbol, or your debugger   ***
    ***    doesn't have full symbol information.  Unqualified symbol      ***
    ***    resolution is turned off by default. Please either specify a   ***
    ***    fully qualified symbol module!symbolname, or enable resolution ***
    ***    of unqualified symbols by typing ".symopt- 100". Note that   ***
    ***    enabling unqualified symbol resolution with network symbol     ***
    ***    server shares in the symbol path may cause the debugger to     ***
    ***    appear to hang for long periods of time when an incorrect      ***
    ***    symbol name is typed or the network symbol server is down.     ***
    ***                                                                   ***
    ***    For some commands to work properly, your symbol path           ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    
    DUMP_CLASS: 1
    
    DUMP_QUALIFIER: 400
    
    BUILD_VERSION_STRING:  7601.23392.amd64fre.win7sp1_ldr.160317-0600
    
    SYSTEM_MANUFACTURER:  HP
    
    SYSTEM_PRODUCT_NAME:  ProLiant DL380p Gen8
    
    SYSTEM_SKU:  653200-B21      
    
    BIOS_VENDOR:  HP
    
    BIOS_VERSION:  P70
    
    BIOS_DATE:  02/25/2012
    
    ADDITIONAL_DEBUG_TEXT:  
    You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
    
    WRONG_SYMBOLS_TIMESTAMP: 56eb24e6
    
    WRONG_SYMBOLS_SIZE: 5e7000
    
    FAULTING_MODULE: fffff80001a1f000 nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  56eb24e6
    
    DUMP_TYPE:  2
    
    BUGCHECK_P1: ffffffffc0000005
    
    BUGCHECK_P2: fffff8800809b145
    
    BUGCHECK_P3: fffff8800838b7c8
    
    BUGCHECK_P4: fffff8800838b020
    
    EXCEPTION_CODE: (NTSTATUS) 0x56eb24e6 - <Unable to get error code text>
    
    FAULTING_IP: 
    srv2+1a145
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8]
    
    EXCEPTION_RECORD:  fffff8800838b7c8 -- (.exr 0xfffff8800838b7c8)
    ExceptionAddress: fffff8800809b145 (srv2+0x000000000001a145)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000008
    Attempt to read from address 0000000000000008
    
    CONTEXT:  fffff8800838b020 -- (.cxr 0xfffff8800838b020)
    rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8027064fcc
    rdx=fffffa8027064f6c rsi=fffffa8027064f60 rdi=00000000c000020c
    rip=fffff8800809b145 rsp=fffff8800838ba00 rbp=fffffa80223ba2c0
     r8=fffffa8027064f78  r9=fffffa8027064f70 r10=fffffa8027064fb8
    r11=fffffa8027064fbc r12=0000000001548300 r13=0000000000000000
    r14=0000000000000000 r15=fffff78000000300
    iopl=0         nv up ei ng nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
    srv2+0x1a145:
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8] ds:002b:00000000`00000008=????????
    Resetting default scope
    
    CPU_COUNT: c
    
    CPU_MHZ: 7cb
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 2d
    
    CPU_STEPPING: 7
    
    CPU_MICROCODE: 0,0,0,0 (F,M,S,R)  SIG: 708'00000000 (cache) 0'00000000 (init)
    
    CUSTOMER_CRASH_COUNT:  1
    
    CURRENT_IRQL:  0
    
    ANALYSIS_SESSION_HOST:  NB-PARKER-SSD
    
    ANALYSIS_SESSION_TIME:  05-09-2016 14:33:12.0844
    
    ANALYSIS_VERSION: 10.0.10586.567 amd64fre
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8800809b145
    
    STACK_TEXT:  
    fffff880`0838ba00 00000000`00000000 : fffff880`0838bb80 fffffa80`18eb8040 fffff880`0838bad0 00000000`001fffff : srv2+0x1a145
    
    
    THREAD_SHA1_HASH_MOD_FUNC:  f08cac272d86da0dd3328f6247270019aeca1837
    
    THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  d4a8f16e5cf9a08fccc44b9055dabdfe250244de
    
    THREAD_SHA1_HASH_MOD:  f08cac272d86da0dd3328f6247270019aeca1837
    
    FOLLOWUP_IP: 
    srv2+1a145
    fffff880`0809b145 8b4808          mov     ecx,dword ptr [rax+8]
    
    FAULT_INSTR_CODE:  2108488b
    
    SYMBOL_STACK_INDEX:  0
    
    FOLLOWUP_NAME:  MachineOwner
    
    STACK_COMMAND:  .cxr 0xfffff8800838b020 ; kb
    
    BUGCHECK_STR:  56EB24E6
    
    EXCEPTION_CODE_STR:  56EB24E6
    
    FAILURE_EXCEPTION_CODE:  56EB24E6
    
    EXCEPTION_STR:  WRONG_SYMBOLS
    
    PROCESS_NAME:  ntoskrnl.wrong.symbols.exe
    
    IMAGE_NAME:  ntoskrnl.wrong.symbols.exe
    
    MODULE_NAME: nt_wrong_symbols
    
    SYMBOL_NAME:  nt_wrong_symbols!56EB24E65E7000
    
    BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302
    
    DEFAULT_BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302
    
    PRIMARY_PROBLEM_CLASS:  WRONG_SYMBOLS
    
    FAILURE_BUCKET_ID:  WRONG_SYMBOLS_X64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_TIMESTAMP_160317-214302_56EB24E6_nt_wrong_symbols!56EB24E65E7000
    
    TARGET_TIME:  2016-05-09T05:42:16.000Z
    
    OSBUILD:  7601
    
    OSSERVICEPACK:  1000
    
    SERVICEPACK_NUMBER: 0
    
    OS_REVISION: 0
    
    SUITE_MASK:  272
    
    PRODUCT_TYPE:  3
    
    OSPLATFORM_TYPE:  x64
    
    OSNAME:  Windows 7
    
    OSEDITION:  Windows 7 Server (Service Pack 1) TerminalServer SingleUserTS
    
    OS_LOCALE:  
    
    USER_LCID:  0
    
    OSBUILD_TIMESTAMP:  2016-03-18 05:43:02
    
    BUILDDATESTAMP_STR:  160317-0600
    
    BUILDLAB_STR:  win7sp1_ldr
    
    BUILDOSVER_STR:  6.1.7601.23392.amd64fre.win7sp1_ldr.160317-0600
    
    ANALYSIS_SESSION_ELAPSED_TIME: 2050
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:wrong_symbols_x64_7601.23392.amd64fre.win7sp1_ldr.160317-0600_timestamp_160317-214302_56eb24e6_nt_wrong_symbols!56eb24e65e7000
    
    FAILURE_ID_HASH:  {b90a6f02-106d-75eb-3182-62e865b13e1f}
    
    Followup:     MachineOwner
    ---------
    
    
    
    
    
    

    2016年5月9日 上午 06:51