Bug Check

最新推荐文章于 2022-11-27 14:30:18 发布

cosmoslife

最新推荐文章于 2022-11-27 14:30:18 发布

阅读量1.9k

点赞数

分类专栏：驱动开发学习

驱动开发学习专栏收录该内容

467 篇文章 32 订阅

订阅专栏

STOP 0x0000001E (0xC0000005,0xFDE38AF9,0x0000001,0x7E8B0EB4) KMODE_EXCEPTION_NOT_HANDLED

其中错误的第一部分是停机码(Stop Code)也就是STOP 0x0000001E, 用于识别已发生错误的类型.

错误第二部分是被括号括起来的四个数字集, 表示随机的开发人员定义的参数(这个参数对于普通用户根本无法理解, 只有驱动程序编写者或者微软操作系统的开发人员才懂).

第三部分是错误名. 信息第一行通常用来识别生产错误的驱动程序或者设备. 这种信息多数很简洁, 但停机码可以作为搜索项在微软知识库和其他技术资料中使用.

当系统检测到引发崩溃的致命错误时，Windows自己执行崩溃函数“KeBugCheckEx”。

该函数接受一个停止代码(STOP Code，也称为错误检查码“Bug Check Code”），以及四个根据停止代码来解释的参数(下文中会有图例)。在调用KeBugCheckEx之后，首先该系统所有处理器上的所有中断将被屏蔽，然后系统将显示器切换到低分辨率的VGA图形模式（因为这是所有Windows平台显卡均支持的通用模式），绘制一个蓝色背景，然后显示此停止代码，并且后面紧跟一些对用户诊断错误有帮助的关键信息。最后，KeBugCheckEx调用所有已注册的设备驱动程序错误检查回调函数(这种回调函数通过调用KeRegisterBugCheckCallback函数来注册)，从而让这些驱动程序停止运行它们所支配的设备(有系统数据结构已经被破坏得太严重以至于蓝屏都显示不出来的可能性）

KeBugCheck

KeBugCheckEx

KiBugCheckDriver:

KiBugCheckDriver is not a function; it is a global variable which points to
UNICODE_STRING containing the driver name:

lkd> x /v nt!KiBugCheckDriver
prv global 808a6530 4 nt!KiBugCheckDriver = 0x00000000

"db" command is used to display the ASCII string. UNICODE_STRING is a data
structure which contains a pointer to the unicode string. Here is its
definition:
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;

} UNICODE_STRING;

There is a"!ustr" extension command can be used to parse and display the
UNICODE_STRING. Please refer to the windbg help document for the details.

使用用例：

0: kd> dd nt!KiBugCheckDriver l1
8055c060 864a315c

0: kd> db 864a315c
864a315c 18 00 18 00 7c 31 4a 86-00 40 10 09 06 00 00 00 ....|1J..@......
864a316c ff ff ff ff 4c b8 01 00-fe ff ff ff 00 00 00 00 ....L...........
864a317c 56 00 49 00 44 00 45 00-4f 00 50 00 52 00 54 00 V.I.D.E.O.P.R.T.
864a318c 2e 00 53 00 59 00 53 00-00 00 00 00 0e 00 01 00 ..S.Y.S.........
864a319c 4d 6d 49 6e 01 00 03 0a-49 6f 20 20 52 00 61 00 MmIn....Io R.a.
864a31ac 73 00 6c 00 32 00 74 00-70 00 00 00 03 00 08 0a s.l.2.t.p.......
864a31bc 4e 74 66 72 70 2a 4a 86-00 32 4a 86 68 bf 1c 85 Ntfrp*J..2J.h...
864a31cc 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................

0: kd> !ustr 864a315c
String(24,24) at 864a315c: VIDEOPRT.SYS

0: kd> lmvm VIDEOPRT
start end module name
f71cb000 f71de780 VIDEOPRT (deferred)
Mapped memory image file:
C:\symcache\VIDEOPRT.SYS\41107D0813780\VIDEOPRT.SYS
Image path: VIDEOPRT.SYS
Image name: VIDEOPRT.SYS
Timestamp: Wed Aug 04 01:07:04 2004 (41107D08)
CheckSum: 0001B84C
ImageSize: 00013780
File version: 5.1.2600.2180
Product version: 5.1.2600.2180
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.4 Driver
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: videoprt.sys
OriginalFilename: videoprt.sys
ProductVersion: 5.1.2600.2180
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
FileDescription: Video Port Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.

I’m not familiar with intricate details of interface between video port
driver and video miniport driver, but the data that you helped me pull from
the dump is valuable. We’ll proceed with upgrading video driver to see if it
resolves the issue.