XP系统蓝屏:KERNEL_MODE_EXCEPTION_NOT_HANDLED_M

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address
pinpoints the driver/function that caused the problem. Always note
this address as well as the link date of the driver/image that
contains this address. Some common problems are exception code
0x80000003. This means a hard coded breakpoint or assertion was hit,
but this system was booted /NODEBUG. This is not supposed to happen
as developers should never have hardcoded breakpoints in retail code,
but … If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening. Arguments: Arg1: c0000005, The exception code that was not
handled Arg2: f7439cf1, The address that the exception occurred at
Arg3: ee9ec6e4, Trap Frame Arg4: 00000000

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%p

FAULTING_IP: SecCheck!SfFsControlMountVolumeComplete+19
[d:\work\isg_svn\code\002.code\master-local\kernel\cyseccheck\sfilter.c
@ 6627] f7439cf1 8b7924 mov edi,dword ptr [ecx+24h]

TRAP_FRAME: ee9ec6e4 – (.trap 0xffffffffee9ec6e4) ErrCode = 00000000
eax=84ae4308 ebx=84950e28 ecx=0000001f edx=00000000 esi=84950bc8
edi=84950fd4 eip=f7439cf1 esp=ee9ec758 ebp=ee9ec768 iopl=0 nv
up ei ng nz ac po cy cs=0008 ss=0010 ds=0023 es=0023 fs=0030
gs=0000 efl=00010293
CYSecCheck!SfFsControlMountVolumeComplete+0x19: f7439cf1 8b7924
mov edi,dword ptr [ecx+24h] ds:0023:00000043=??? Resetting
default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: svchost.exe

LAST_CONTROL_TRANSFER: from f743a84f to f7439cf1

STACK_TEXT: ee9ec768 f743a84f 84964870 84950e28 84950b10
CYSecCheck!SfFsControlMountVolumeComplete+0x19
seccheck\sfilter.c
@ 6627] ee9ec9a4 f743aa8c 84964870 00950e28 84ab3030
CYSecCheck!SfFsControlMountVolume+0x191
[seccheck\sfilter.c
@ 6378] ee9ec9bc 804ef119 84964870 84950e28 84950e28
CYSecCheck!SfFsControl+0x76
[seccheck\sfilter.c
@ 6013] ee9ec9cc 80577fd7 ee9ecb1c 806d3298 84ab3030
nt!IopfCallDriver+0x31 ee9eca1c 804f5345 c000014f 85453f01 00000000
nt!IopMountVolume+0x1b9 ee9eca4c 80578fdc 85453f08 84ab3030 ee9ecb80
nt!IopCheckVpbMounted+0x5b ee9ecb3c 805b5cbc 84ab3030 00000000
8497d008 nt!IopParseDevice+0x3d8 ee9ecbc4 805b2065 00000000 ee9ecc04
00000040 nt!ObpLookupObjectName+0x56a ee9ecc18 8056c223 00000000
00000000 9ecc8401 nt!ObOpenObjectByName+0xeb ee9ecc94 8056cb9a
00e7fbf4 80100080 00e7fb94 nt!IopCreateFile+0x407 ee9eccf0 8056f2ac
00e7fbf4 80100080 00e7fb94 nt!IoCreateFile+0x8e ee9ecd30 8053e638
00e7fbf4 80100080 00e7fb94 nt!NtCreateFile+0x30 ee9ecd30 7c92e4f4
00e7fbf4 80100080 00e7fb94 nt!KiFastCallEntry+0xf8 WARNING: Frame IP
not in any known module. Following frames may be wrong. 00e7fbec
00000000 00000000 00000000 00000000 0x7c92e4f4

STACK_COMMAND: kb

FOLLOWUP_IP: SecCheck!SfFsControlMountVolumeComplete+19
[d:\work\isg_svn\code\002.code\master-local\kernel\cyseccheck\sfilter.c
@ 6627] f7439cf1 8b7924 mov edi,dword ptr [ecx+24h]

FAULTING_SOURCE_CODE: 6623: // Display a message when we
detect that the VPB for the given 6624: // device object has
changed. 6625: // 6626:

6627: if (vpb != irpSp->Parameters.MountVolume.Vpb) 6628: { 6629: 6630: SF_LOG_PRINT( SFDEBUG_DISPLAY_ATTACHMENT_NAMES,
6631: (“SFilter!SfFsControlMountVolume:
VPB in IRP stack changed %p IRPVPB=%p VPB=%p\n”, 6632:
vpb->DeviceObject,

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: SecCheck!SfFsControlMountVolumeComplete+19

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SecCheck

IMAGE_NAME: SecCheck.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5ee8825d

FAILURE_BUCKET_ID: 0x8E_SecCheck!SfFsControlMountVolumeComplete+19

BUCKET_ID: 0x8E_SecCheck!SfFsControlMountVolumeComplete+19

Followup: MachineOwner

分析步骤:

1. dump里已显示出出问题的模块和位置, 看dump猜测是数据为空导致
2. 查看寄存器内容 kd> r

eax=84ae4308 ebx=84950e28 ecx=0000001f edx=00000000 esi=84950bc8 edi=84950fd4
eip=f7439cf1 esp=ee9ec758 ebp=ee9ec768 iopl=0         nv up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010293
SecCheck!SfFsControlMountVolumeComplete+0x19:
f7439cf1 8b7924          mov     edi,dword ptr [ecx+24h] ds:0023:00000043=????????

3. 查看反汇编,确定数据状态 kd> u f7439cd1 L30, **包裹的数据为报错数据

SecCheck!SfIsAttachedToDevice+0x17d:
f7439cd1 653a25775a00cc  cmp     ah,byte ptr gs:[0CC005A77h]
CYSecCheck!SfFsControlMountVolumeComplete [d:\work\isg_svn\code\002.code\master-local\kernel\cyseccheck\sfilter.c @ 6598]:
f7439cd8 55              push    ebp
f7439cd9 8bec            mov     ebp,esp
f7439cdb 51              push    ecx
f7439cdc 8b4510          mov     eax,dword ptr [ebp+10h]
f7439cdf 53              push    ebx
f7439ce0 8b5d0c          mov     ebx,dword ptr [ebp+0Ch]
f7439ce3 56              push    esi
f7439ce4 8b7028          mov     esi,dword ptr [eax+28h]
f7439ce7 8b4360          mov     eax,dword ptr [ebx+60h]
f7439cea 8b4e10          mov     ecx,dword ptr [esi+10h]
f7439ced 8b4004          mov     eax,dword ptr [eax+4]
f7439cf0 57              push    edi
f7439cf1 8b7924          mov     edi,dword ptr [ecx+24h]
**f7439cf4 3bf8            cmp     edi,eax**
f7439cf6 c645ff00        mov     byte ptr [ebp-1],0
f7439cfa 741b            je      CYSecCheck!SfFsControlMountVolumeComplete+0x3f (f7439d17)
f7439cfc f605d41442f701  test    byte ptr [CYSecCheck!SfDebug (f74214d4)],1
f7439d03 7412            je      CYSecCheck!SfFsControlMountVolumeComplete+0x3f (f7439d17)

4. 查看第一个数据kd> dt PVPB 84950fd4

SecCheck!PVPB
0xf73fb976 
   +0x000 Type             : -16223
   +0x002 Size             : 16916
   +0x004 Flags            : 0x83f7
   +0x006 VolumeLabelLength : 0x5f8
   +0x008 DeviceObject     : 0x3d830b75 _DEVICE_OBJECT
   +0x00c RealDevice       : 0xf74214c4 _DEVICE_OBJECT
   +0x010 SerialNumber     : 0x3b047301
   +0x014 ReferenceCount   : 0x6a1076c0
   +0x018 VolumeLabel      : [32] 0x6a00

5. 查看第二个数据kd> dt PVPB 84ae4308

SecCheck!PVPB
0x0058000a 
   +0x000 Type             : ??
   +0x002 Size             : ??
   +0x004 Flags            : ??
   +0x006 VolumeLabelLength : ??
   +0x008 DeviceObject     : ???? 
   +0x00c RealDevice       : ???? 
   +0x010 SerialNumber     : ??
   +0x014 ReferenceCount   : ??
   +0x018 VolumeLabel      : [32] ??

6. 待处理

分析如有问题,请各位指教