这是WINDBG的一次输出。。
Loading Dump File [C:\Windows\Minidump\122110-43664-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x8420c000 PsLoadedModuleList = 0x84354810
Debug session time: Tue Dec 21 09:46:52.588 2010 (GMT+8)
System Uptime: 0 days 0:09:32.211
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
Loading unloaded module list
......
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0004cf87, page frame number
Arg3: 00000005, current page state
Arg4: bbb0ad34, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: hh.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 842f56dc to 842e8d10
STACK_TEXT:
8d5c3850 842f56dc 0000004e 00000099 0004cf87 nt!KeBugCheckEx+0x1e
8d5c3868 84281a84 c000e010 843344f0 c0804ff0 nt!MiBadShareCount+0x24
8d5c3a90 8427e8d7 86739708 8d5c3b40 86739708 nt!MiFreeWsleList+0x68a
8d5c3c10 8427f61b 86739708 00000001 00000001 nt!MiAgeWorkingSet+0x48b
8d5c3c5c 8427f2e0 00000002 00000001 00000000 nt!MiProcessWorkingSets+0x25b
8d5c3c88 8429521f 00000000 86603a70 00000000 nt!MmWorkingSetManager+0xa4
8d5c3d50 8441a6d3 00000000 915496ec 00000000 nt!KeBalanceSetManager+0x1af
8d5c3d90 842cc0f9 84295070 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiBadShareCount+24
842f56dc cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiBadShareCount+24
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c3fac
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24
BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24
Followup: MachineOwner
---------
这是另外一次。。
Loading Dump File [C:\Windows\Minidump\122110-49031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x8420c000 PsLoadedModuleList = 0x84354810
Debug session time: Tue Dec 21 08:27:17.830 2010 (GMT+8)
System Uptime: 0 days 0:17:44.079
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 9010d01f, be653a08, 0}
*** WARNING: Unable to verify timestamp for Hookport.sys
*** ERROR: Module load completed but symbols could not be loaded for Hookport.sys
*** WARNING: Unable to verify timestamp for halmacpi.dll
*** ERROR: Module load completed but symbols could not be loaded for halmacpi.dll
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9010d01f, The address that the exception occurred at
Arg3: be653a08, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx
FAULTING_IP:
Npfs!NpTranslateAlias+19
9010d01f 89485b mov dword ptr [eax+5Bh],ecx
TRAP_FRAME: be653a08 -- (.trap 0xffffffffbe653a08)
ErrCode = 00000002
eax=2e75fecf ebx=87534998 ecx=0000001c edx=00000000 esi=9b3aa8b6 edi=be653ac8
eip=9010d01f esp=be653a7c ebp=be653aa8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
Npfs!NpTranslateAlias+0x19:
9010d01f 89485b mov dword ptr [eax+5Bh],ecx ds:0023:2e75ff2a=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x8E
PROCESS_NAME: 360sd.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 9010faf1 to 9010d01f
STACK_TEXT:
be653aa8 9010faf1 be653ac8 872cb198 8792eed8 Npfs!NpTranslateAlias+0x19
be653ad0 90110758 8792eed8 872cb198 8792eed8 Npfs!NpWaitForNamedPipe+0xa9
be653af0 901108bf 8792eed8 872cb198 87534998 Npfs!NpCommonFileSystemControl+0x6c
be653b08 842484bc 8792eed8 872cb198 872cb198 Npfs!NpFsdFileSystemControl+0x19
be653b20 84449f6e 87534998 872cb198 872cb208 nt!IofCallDriver+0x63
be653b40 84466d5f 8792eed8 87534998 00000001 nt!IopSynchronousServiceTail+0x1f8
be653bdc 8446fd98 8792eed8 872cb198 00000000 nt!IopXxxControlFile+0x6aa
be653c10 89c5fb69 000003a8 00000000 00000000 nt!NtFsControlFile+0x2a
WARNING: Stack unwind information not available. Following frames may be wrong.
be653d04 8424f44a 000003a8 00000000 00000000 Hookport+0x1b69
be653d04 776764f4 000003a8 00000000 00000000 nt!KiFastCallEntry+0x12a
03deff38 00000000 00000000 00000000 00000000 0x776764f4
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !Npfs
9010d020-9010d05d 62 bytes - Npfs!NpTranslateAlias+1a
[ 4d e0 85 c9 75 07 33 c0:48 5b 39 65 62 ff 00 21 ]
9010d05f-9010d21b 445 bytes - Npfs!NpTranslateAlias+59 (+0x3f)
[ 83 f9 12 77 3e 6a 12 58:01 9f d9 b3 64 54 6d 16 ]
9010d21d-9010d21e 2 bytes - Npfs!NpCommonCleanup+d3 (+0x1be)
[ 73 06:20 47 ]
9010d220-9010d2c9 170 bytes - Npfs!NpCommonCleanup+d6 (+0x03)
[ 15 18 b0 10 90 f7 46 0c:ff f3 91 4c ca 8f 66 78 ]
9010d2cb-9010d397 205 bytes - Npfs!NpFsdCleanup+1 (+0xab)
[ ff 55 8b ec 56 57 ff 15:07 1e c5 dc ba 0a 28 a8 ]
9010d399-9010d472 218 bytes - Npfs!NpCommonClose+93 (+0xce)
[ e9 b4 00 00 00 8b 0d a8:00 03 93 9a e9 6e 28 03 ]
9010d474-9010d568 245 bytes - Npfs!NpFsdClose+6 (+0xdb)
[ ff 15 28 b0 10 90 ff 75:cb 79 69 4a f3 2a e6 80 ]
9010d56a-9010d607 158 bytes - Npfs!NpCreateClientEnd+74 (+0xf6)
[ 10 90 80 7d 18 00 74 10:fc 9a d0 d3 9e cb 75 bf ]
1505 errors : !Npfs (9010d020-9010d607)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
Followup: memory_corruption
---------
8426
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
