NTSTATUS

Values are 32 bit and are laid out as follows. The following diagram is independent of endianness; that is, the diagram is shown in host byte order and merely shows the layout of the numbering space.

Any protocol that uses NTSTATUS values on the wire is responsible for stating the order that the bytes are placed on the wire.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Sev

C

N

Facility

Code

Sev (2 bits): Severity. Severity codes are as follows.

Value

Meaning

STATUS_SEVERITY_SUCCESS

0x0

Success

STATUS_SEVERITY_INFORMATIONAL

0x1

Informational

STATUS_SEVERITY_WARNING

0x2

Warning

STATUS_SEVERITY_ERROR

0x3

Error

C (1 bit): Customer. This specifies if the value is customer- or Microsoft-defined. This bit is set for customer-defined values and clear for Microsoft-defined values.<3>

N (1 bit): Reserved. MUST be set to 0 so that it is possible to map an NTSTATUS value to an equivalent HRESULT value, as specified in section 2.1, by setting this bit.

Facility (12 bits): A value that, together with the C bit, indicates the numbering space to use for the Code field.<4>

Code (2 bytes): The remainder of the error code. Vendors SHOULD reuse the values in the following table with their indicated meaning or define their own values with the C bit set. Choosing any other value with the C bit clear runs the risk of a collision in the future.

https://msdn.microsoft.com/en-us/library/cc231200.aspx 

发布了77 篇原创文章 · 获赞 5 · 访问量 11万+
展开阅读全文

请教dump文件分析问题

05-26

我的程序在客户电脑上偶尔会死机,保存了死机时的DUMP文件,但是看不出问题,哪位大神指导一下? 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* *** ERROR: Symbol file could not be found. Defaulted to export symbols for user32.dll - GetUrlPageData2 (WinHttp) failed: 12030. FAULTING_IP: +755fd8c74230000 00000000 ?? ??? EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 00000000 ExceptionCode: 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 0 CONTEXT: 00000000 -- (.cxr 0x0;r) eax=000000bc ebx=006a2130 ecx=00000064 edx=00008b6d esi=000001d0 edi=00000000 eip=7c92e514 esp=0012ed30 ebp=0012ed94 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!KiFastSystemCallRet: 7c92e514 c3 ret FAULTING_THREAD: 00000dd8 DEFAULT_BUCKET_ID: STATUS_BREAKPOINT PROCESS_NAME: MAWin.exe ERROR_CODE: (NTSTATUS) 0x80000003 - { EXCEPTION_CODE: (NTSTATUS) 0x80000003 (2147483651) - { NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 APP: mawin.exe ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre PRIMARY_PROBLEM_CLASS: STATUS_BREAKPOINT BUGCHECK_STR: APPLICATION_FAULT_STATUS_BREAKPOINT LAST_CONTROL_TRANSFER: from 7c92df5a to 7c92e514 STACK_TEXT: 0012ed2c 7c92df5a 7c8025db 000001d0 00000000 ntdll!KiFastSystemCallRet 0012ed30 7c8025db 000001d0 00000000 00000000 ntdll!NtWaitForSingleObject+0xc 0012ed94 7c802542 000001d0 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xa8 0012eda8 7c831fe0 000001d0 ffffffff 007ccea4 kernel32!WaitForSingleObject+0x12 0012edbc 0057abd7 000001d0 0012eddc 0012ee00 kernel32!GetOverlappedResult+0x30 0012ee10 00499f60 006a2130 00000000 00000001 MAWin!ThxComm32.WriteBuffer+0xdf 0012ee34 0049a36f 012c6a98 012c6ab2 000000ff MAWin!TPxComm32.SendComm+0x120 0012ee90 0049a858 00000000 00000000 ffffffff MAWin!TPxComm32.SendCommEx+0x353 0012eea8 00425302 0012fe38 0066f530 012cc004 MAWin!TPxComm32.GasOff+0x1c 0012fd78 00410fa4 012dd238 012dd238 012cc004 MAWin!TSampleForm.Start+0x390e 0012fd8c 0066f542 0012fdc0 0066f428 0012fe54 MAWin!TMainForm.AutoTimerTimer+0x54 0012fdb8 006c6372 00000113 00000001 00000000 MAWin!Extctrls.TTimer.Timer+0x12 0012fdd0 77d18734 000b0202 00000113 00000001 MAWin!Classes._17260+0x16 WARNING: Stack unwind information not available. Following frames may be wrong. 0012fdfc 77d18816 01190e0e 000b0202 00000113 user32!GetDC+0x6d 0012fe64 77d189cd 00000000 01190e0e 000b0202 user32!GetDC+0x14f 0012fec4 77d196c7 0012fef4 00000001 0012ff40 user32!GetWindowLongW+0x127 0012fed4 00669c20 0012fef4 0012ff00 00000000 user32!DispatchMessageA+0xf 0012ff40 00405b7b 00000000 00753034 00142442 MAWin!Forms.TApplication.ProcessMessage+0x88 0012ff88 006ef70b 00400000 00000000 00142442 MAWin!WinMain+0x113 0012ffc0 7c81776f 00091378 7c93005d 7ffd9000 MAWin!_startup+0x14f 0012fff0 00000000 004019f0 00000000 78746341 kernel32!BaseProcessStart+0x23 STACK_COMMAND: ~0s; .ecxr ; kb FOLLOWUP_IP: MAWin!ThxComm32.WriteBuffer+df 0057abd7 85c0 test eax,eax SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: mawin!ThxComm32.WriteBuffer+df FOLLOWUP_NAME: MachineOwner MODULE_NAME: MAWin IMAGE_NAME: MAWin.exe DEBUG_FLR_IMAGE_TIMESTAMP: 537ef3ed FAILURE_BUCKET_ID: STATUS_BREAKPOINT_80000003_MAWin.exe!ThxComm32.WriteBuffer BUCKET_ID: APPLICATION_FAULT_STATUS_BREAKPOINT_mawin!ThxComm32.WriteBuffer+df ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:status_breakpoint_80000003_mawin.exe!thxcomm32.writebuffer FAILURE_ID_HASH: {c0136087-fa5c-54f2-9419-a16689e0d97a} Followup: MachineOwner 可以看出来是死在WriteBuffer函数上,但是看不出为什么会死 分析了一下堆栈的状态 0:000> ~*kb . 0 Id: e38.dd8 Suspend: 0 Teb: 7ffdf000 Unfrozen ChildEBP RetAddr Args to Child 0012ed2c 7c92df5a 7c8025db 000001d0 00000000 ntdll!KiFastSystemCallRet 0012ed30 7c8025db 000001d0 00000000 00000000 ntdll!NtWaitForSingleObject+0xc 0012ed94 7c802542 000001d0 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xa8 0012eda8 7c831fe0 000001d0 ffffffff 007ccea4 kernel32!WaitForSingleObject+0x12 0012edbc 0057abd7 000001d0 0012eddc 0012ee00 kernel32!GetOverlappedResult+0x30 0012ee10 00499f60 006a2130 00000000 00000001 MAWin!ThxComm32.WriteBuffer+0xdf 0012ee34 0049a36f 012c6a98 012c6ab2 000000ff MAWin!TPxComm32.SendComm+0x120 0012ee90 0049a858 00000000 00000000 ffffffff MAWin!TPxComm32.SendCommEx+0x353 0012eea8 00425302 0012fe38 0066f530 012cc004 MAWin!TPxComm32.GasOff+0x1c 0012fd78 00410fa4 012dd238 012dd238 012cc004 MAWin!TSampleForm.Start+0x390e 0012fd8c 0066f542 0012fdc0 0066f428 0012fe54 MAWin!TMainForm.AutoTimerTimer+0x54 0012fdb8 006c6372 00000113 00000001 00000000 MAWin!Extctrls.TTimer.Timer+0x12 0012fdd0 77d18734 000b0202 00000113 00000001 MAWin!Classes._17260+0x16 WARNING: Stack unwind information not available. Following frames may be wrong. 0012fdfc 77d18816 01190e0e 000b0202 00000113 user32!GetDC+0x6d 0012fe64 77d189cd 00000000 01190e0e 000b0202 user32!GetDC+0x14f 0012fec4 77d196c7 0012fef4 00000001 0012ff40 user32!GetWindowLongW+0x127 0012fed4 00669c20 0012fef4 0012ff00 00000000 user32!DispatchMessageA+0xf 0012ff40 00405b7b 00000000 00753034 00142442 MAWin!Forms.TApplication.ProcessMessage+0x88 0012ff88 006ef70b 00400000 00000000 00142442 MAWin!WinMain+0x113 0012ffc0 7c81776f 00091378 7c93005d 7ffd9000 MAWin!_startup+0x14f 0012fff0 00000000 004019f0 00000000 78746341 kernel32!BaseProcessStart+0x23 1 Id: e38.69c Suspend: 0 Teb: 7ffdd000 Unfrozen ChildEBP RetAddr Args to Child 020ffe74 7c92d21a 7c8023f1 00000000 020ffea8 ntdll!KiFastSystemCallRet 020ffe78 7c8023f1 00000000 020ffea8 020fff6c ntdll!ZwDelayExecution+0xc 020ffed0 7c802455 00000001 00000000 020fff18 kernel32!SleepEx+0x61 020ffee0 0049ecdc 00000001 0613b2ff 1f1b611a kernel32!Sleep+0xf 020fff18 00574931 020fff78 0057493b 020fff70 MAWin!TCommThread.Execute+0xec 020fff70 006c4e67 020fff84 006c4e71 020fffa0 MAWin!Exceptionlog.HookedThreadExecute+0xd1 020fffa0 006e35be 020fffdc 006e31b8 020fffb4 MAWin!Classes._17119+0x37 020fffb4 7c80b729 01239fa0 00000208 0012fbd0 MAWin!System._16726+0x2a 020fffec 00000000 006e3594 01239fa0 00000000 kernel32!BaseThreadStart+0x37 更看不出问题了。。。 哪位大神指导一下??小女子不胜感激 问答

没有更多推荐了,返回首页

©️2019 CSDN 皮肤主题: 大白 设计师: CSDN官方博客

分享到微信朋友圈

×

扫一扫,手机浏览