Форум программистов [Powered by Invision Power Board]

Код


kd> !analyze -v 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 804e172a, The address that the exception occurred at
Arg3: b3d2b590, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


OVERLAPPED_MODULE:  

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang  "%s" konnte nicht auf dem Speicher durchgefьhrt werden.

FAULTING_IP: 
nt!KiTrap0E+de
804e172a 0085c07c2b80     add     [ebp+0x802b7cc0],al

TRAP_FRAME:  b3d2b590 -- (.trap ffffffffb3d2b590)
ErrCode = 00000002
eax=00000114 ebx=017bf190 ecx=00000000 edx=f7fc0007 esi=7c885780 edi=04833b88
eip=804e172a esp=b3d2b604 ebp=b3d2b604 iopl=0         nv up ei pl zr na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!KiTrap0E+0xde:
804e172a 0085c07c2b80     add     [ebp+0x802b7cc0],al     ss:0010:33fe32c4=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

MISALIGNED_IP: 
nt!KiTrap0E+de
804e172a 0085c07c2b80     add     [ebp+0x802b7cc0],al

LAST_CONTROL_TRANSFER:  from 04833b88 to 804e172a

STACK_TEXT:  
b3d2b604 04833b88 badb0d00 7c885780 e17a1a90 nt!KiTrap0E+0xde
WARNING: Frame IP not in any known module. Following frames may be wrong.
017bf190 7c83ab50 017bf1b8 7c839b39 017bf1c0 0x4833b88
017bf190 7c83ab50 017bf1b8 7c839b39 017bf1c0 0x7c83ab50
017bffec 00000000 77f56f13 0007fdbc 00000000 0x7c83ab50


FOLLOWUP_IP: 
nt!KiTrap0E+de
804e172a 0085c07c2b80     add     [ebp+0x802b7cc0],al

SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!KiTrap0E+de

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .trap ffffffffb3d2b590 ; kb

MODULE_NAME:  hardware

FAILURE_BUCKET_ID:  IP_MISALIGNED

BUCKET_ID:  IP_MISALIGNED

Followup: MachineOwner
---------

Код


kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804e662f, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

MODULE_NAME:  nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b1ea8ac

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
 00000004 

CURRENT_IRQL:  2

FAULTING_IP: 
nt+f62f
804e662f 8b4804           mov     ecx,[eax+0x4]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 804eb88a to 804e662f

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
b4314d14 804eb88a 02d58000 05a17fa0 00a2de94 nt+0xf62f
b4314d4c 804e172b 00000001 02d58000 01000001 nt+0x1488a
b4314d64 010e9c7e badb0d00 00000000 b4314d98 nt+0xa72b
00a2de94 00000000 00000000 00000000 00000000 0x10e9c7e


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_NAME:  MachineOwner

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------