| julizen |  |
|
2010-08-19 12:14 - Respuestas: 1 - Tema nº: 2708839
.
amigos necesito ayuda profesional. he conseguido recolectar esta información sobre los crash, ¿alguna idea sobre cual puede ser la causa?
dump file : mini081910-01.dmp
crash time : 19/08/2010 11:38:43
bug check string : reference_by_pointer
bug check code : 0x00000018
parameter 1 : 0x84ac3750
parameter 2 : 0x8524d088
parameter 3 : 0x00000001
parameter 4 : 0x00000001
caused by driver : ntkrnlpa.exe
caused by address : ntkrnlpa.exe+44de1
file des-c-r-i-p-tion : nt kernel & system
product name : microsoft® windows® operating system
company : microsoft corporation
file version : 6.0.6002.18267 (vistasp2_gdr.100608-0458)
processor : 32-bit
computer name :
full path : c:\windows\minidump\mini081910-01.dmp
processors count : 4
major version : 15
minor version : 6002
=======================
=======================
dump file : mini081610-04.dmp
crash time : 16/08/2010 16:58:22
bug check string : bugcode_usb_driver
bug check code : 0x000000fe
parameter 1 : 0x00000008
parameter 2 : 0x00000004
parameter 3 : 0x868d3028
parameter 4 : 0x00000000
caused by driver : usbhub.sys
caused by address : usbhub.sys+13984
file des-c-r-i-p-tion : default hub driver for usb
product name : microsoft® windows® operating system
company : microsoft corporation
file version : 6.0.6002.18005 (lh_sp2rtm.090410-1830)
processor : 32-bit
computer name :
full path : c:\windows\minidump\mini081610-04.dmp
processors count : 4
major version : 15
minor version : 6002
=======================
=======================
dump file : mini081610-03.dmp
crash time : 16/08/2010 11:38:20
bug check string : bad_pool_header
bug check code : 0x00000019
parameter 1 : 0x00000020
parameter 2 : 0x855293f8
parameter 3 : 0x85529710
parameter 4 : 0x08630023
caused by driver : hal.dll
caused by address : hal.dll+770c
file des-c-r-i-p-tion : hardware abstraction layer dll
product name : microsoft® windows® operating system
company : microsoft corporation
file version : 6.0.6002.18005 (lh_sp2rtm.090410-1830)
processor : 32-bit
computer name :
full path : c:\windows\minidump\mini081610-03.dmp
processors count : 4
major version : 15
minor version : 6002
=======================
=======================
dump file : mini081610-02.dmp
crash time : 16/08/2010 10:21:13
bug check string : page_fault_in_nonpaged_area
bug check code : 0x00000050
parameter 1 : 0xbad0b124
parameter 2 : 0x00000000
parameter 3 : 0x82c84245
parameter 4 : 0x00000002
caused by driver : ntkrnlpa.exe
caused by address : ntkrnlpa.exe+9838d
file des-c-r-i-p-tion : nt kernel & system
product name : microsoft® windows® operating system
company : microsoft corporation
file version : 6.0.6002.18267 (vistasp2_gdr.100608-0458)
processor : 32-bit
computer name :
full path : c:\windows\minidump\mini081610-02.dmp
processors count : 4
major version : 15
minor version : 6002
=======================
=======================
dump file : mini081610-01.dmp
crash time : 16/08/2010 10:18:49
bug check string : memory_management
bug check code : 0x0000001a
parameter 1 : 0x00005003
parameter 2 : 0x88400000
parameter 3 : 0x0000aff7
parameter 4 : 0x0b144fef
caused by driver : hal.dll
caused by address : hal.dll+770c
file des-c-r-i-p-tion : hardware abstraction layer dll
product name : microsoft® windows® operating system
company : microsoft corporation
file version : 6.0.6002.18005 (lh_sp2rtm.090410-1830)
processor : 32-bit
computer name :
full path : c:\windows\minidump\mini081610-01.dmp
processors count : 4
major version : 15
minor version : 6002
=======================
=======================
dump file : mini081510-01.dmp
crash time : 15/08/2010 8:19:40
bug check string : kernel_mode_exception_not_handled
bug check code : 0x1000008e
parameter 1 : 0xc0000005
parameter 2 : 0x82a4a285
parameter 3 : 0x8a794268
parameter 4 : 0x00000000
caused by driver : ci.dll
caused by address : ci.dll+cc0fe
file des-c-r-i-p-tion : módulo de integridad de código
product name : sistema operativo microsoft® windows®
company : microsoft corporation
file version : 6.0.6000.16386 (vista_rtm.061101-2205)
processor : 32-bit
computer name :
full path : c:\windows\minidump\mini081510-01.dmp
processors count : 4
major version : 15
minor version : 6002
=======================
=======================
dump file : mini080810-01.dmp
crash time : 08/08/2010 22:33:21
bug check string : page_fault_in_nonpaged_area
bug check code : 0x00000050
parameter 1 : 0xcb3f7cc9
parameter 2 : 0x00000000
parameter 3 : 0x82a33e34
parameter 4 : 0x00000002
caused by driver : ntkrnlpa.exe
caused by address : ntkrnlpa.exe+9838d
file des-c-r-i-p-tion : nt kernel & system
product name : microsoft® windows® operating system
company : microsoft corporation
file version : 6.0.6002.18267 (vistasp2_gdr.100608-0458)
processor : 32-bit
computer name :
full path : c:\windows\minidump\mini080810-01.dmp
processors count : 4
major version : 15
minor version : 6002
=======================
=======================
dump file : mini080610-01.dmp
crash time : 06/08/2010 17:21:35
bug check string : driver_irql_not_less_or_equal
bug check code : 0x000000d1
parameter 1 : 0x3885a5a8
parameter 2 : 0x00000002
parameter 3 : 0x00000000
parameter 4 : 0x83bb7f17
caused by driver : netio.sys
caused by address : netio.sys+2f17
file des-c-r-i-p-tion : network i/o subsystem
product name : microsoft® windows® operating system
company : microsoft corporation
file version : 6.0.6002.18005 (lh_sp2rtm.090410-1830)
processor : 32-bit
computer name :
full path : c:\windows\minidump\mini080610-01.dmp
processors count : 4
major version : 15
minor version : 6002
=======================
| |
|
|
| Dragon_gt |  |
|
Re: Pantallazos azules en windows Vista - 2011-01-04 12:05 - Respuesta 2
amigo, tengo el mismo problema que tu,me aparecen continuamente las dichosos pantallazos azules...yo tambien necesito ayudaaaa!!!!yo tambien e recopilado informacion sobre los 4 crash que me aparecian,y necesito a algun experto que me ayude a entender que es lo ke le pasas a mi computadora....espero su ayuda urgentemente...muchas gracias por adelatado.aqui tienen la informacion de los crash que obtube con el programa microsoft debugging tools:
crash 1 "mini010211-01.dmp"
microsoft (r) windows debugger version 6.9.0003.113 x86
copyright (c) microsoft corporation. all rights reserved.
loading dump file [c:\windows\minidump\mini010211-01.dmp]
mini kernel dump file: only registers and stack trace are available
symbol search path is: *** invalid ***
****************************************************************************
* symbol loading may be unreliable without a symbol search path. *
* use .symfix to have the debugger choose a symbol path. *
* after setting your symbol path, use .reload tosymbol locations. *
****************************************************************************
executable search path is:
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
unable to load image \systemroot\system32\ntkrnlpa.exe, win32 error 0n2
*** warning: unable to verify timestamp for ntkrnlpa.exe
*** error: module load completed but symbols could not be loaded for ntkrnlpa.exe
windows vista kernel version 6000 mp (2 procs) free x86 compatible
product: winnt, suite: terminalserver singleuserts personal
kernel base = 0x81c00000 psloadedmodulelist = 0x81d11d90
debug session time: sun jan 2 17:59:04.518 2011 (gmt+1)
system uptime: 0 days 0:02:40.205
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
unable to load image \systemroot\system32\ntkrnlpa.exe, win32 error 0n2
*** warning: unable to verify timestamp for ntkrnlpa.exe
*** error: module load completed but symbols could not be loaded for ntkrnlpa.exe
loading kernel symbols
......................
loading user symbols
loading unloaded module list
....
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
use !analyze -v to get detailed debugging information.
bugcheck fc, {98ab90a8, 8a51f963, 98ab9024, 2}
***** kernel symbols are wrong. please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
probably caused by : ntkrnlpa.exe ( nt+a9bf2 )
followup: machineowner
-
0: kd> !analyze -v
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
attempted_execute_of_noexecute_memory (fc)
an attempt was made to execute non-executable memory. the guilty driver
is on the stack trace (and is typically the current instruction pointer).
when possible, the guilty driver's name (unicode string) is printed on
the bugcheck screen and saved in kibugcheckdriver.
arguments:
arg1: 98ab90a8, virtual address for the attempted execute.
arg2: 8a51f963, pte contents.
arg3: 98ab9024, (reserved)
arg4: 00000002, (reserved)
debugging details:
***** kernel symbols are wrong. please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
module_name: nt
faulting_module: 81c00000 nt
debug_flr_image_timestamp: 463a8d95
customer_crash_count: 1
default_bucket_id: wrong_symbols
bugcheck_str: 0xfc
last_control_transfer: from 81c8f874 to 81ca9bf2
stack_text:
warning: stack unwind information not available. following frames may be wrong.
98ab900c 81c8f874 00000008 98ab90a8 00000000 nt+0xa9bf2
98ab9024 98ab90a8 badb0d00 00000000 00000000 nt+0x8f874
98ab906c ffffffff 00000030 849034b8 98ab90c0 0x98ab90a8
98ab9088 98ab90a8 00000008 00010246 00000002 0xffffffff
98ab908c 00000000 00010246 00000002 86305d98 0x98ab90a8
stack_command: kb
followup_ip:
nt+a9bf2
81ca9bf2 8b07 mov eax,dword ptr [edi]
symbol_stack_index: 0
symbol_name: nt+a9bf2
followup_name: machineowner
image_name: ntkrnlpa.exe
bucket_id: wrong_symbols
followup: machineowner
-
crash 2 "mini010211-02.dmp"
microsoft (r) windows debugger version 6.9.0003.113 x86
copyright (c) microsoft corporation. all rights reserved.
loading dump file [c:\windows\minidump\mini010211-02.dmp]
mini kernel dump file: only registers and stack trace are available
symbol search path is: *** invalid ***
****************************************************************************
* symbol loading may be unreliable without a symbol search path. *
* use .symfix to have the debugger choose a symbol path. *
* after setting your symbol path, use .reload tosymbol locations. *
****************************************************************************
executable search path is:
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
unable to load image \systemroot\system32\ntkrnlpa.exe, win32 error 0n2
*** warning: unable to verify timestamp for ntkrnlpa.exe
*** error: module load completed but symbols could not be loaded for ntkrnlpa.exe
windows vista kernel version 6000 mp (2 procs) free x86 compatible
product: winnt, suite: terminalserver singleuserts personal
kernel base = 0x81c00000 psloadedmodulelist = 0x81d11d90
debug session time: sun jan 2 18:01:10.851 2011 (gmt+1)
system uptime: 0 days 0:01:24.567
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
unable to load image \systemroot\system32\ntkrnlpa.exe, win32 error 0n2
*** warning: unable to verify timestamp for ntkrnlpa.exe
*** error: module load completed but symbols could not be loaded for ntkrnlpa.exe
loading kernel symbols
......................
loading user symbols
loading unloaded module list
....
*** warning: unable to verify timestamp for hal.dll
*** error: module load completed but symbols could not be loaded for hal.dll
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
use !analyze -v to get detailed debugging information.
bugcheck a, {4aae4da, ff, 1, 81fa76c8}
*** warning: unable to verify timestamp for ecache.sys
*** error: module load completed but symbols could not be loaded for ecache.sys
***** kernel symbols are wrong. please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
probably caused by : ecache.sys ( ecache+c623 )
followup: machineowner
-
1: kd> !analyze -v
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
irql_not_less_or_equal (a)
an attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (irql) that is too high. this is usually
caused by drivers using improper addresses.
if a kernel debugger is available get the stack backtrace.
arguments:
arg1: 04aae4da, memory referenced
arg2: 000000ff, irql
arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
arg4: 81fa76c8, address which referenced memory
debugging details:
***** kernel symbols are wrong. please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
module_name: ecache
faulting_module: 81c00000 nt
debug_flr_image_timestamp: 4549b1da
write_address: unable to get nt!mmspecialpoolstart
unable to get nt!mmspecialpoolend
unable to get nt!mmpoolcodestart
unable to get nt!mmpoolcodeend
04aae4da
current_irql: ff
faulting_ip:
hal+66c8
81fa76c8 ?? ???
customer_crash_count: 2
default_bucket_id: wrong_symbols
bugcheck_str: 0xa
last_control_transfer: from 81fa76c8 to 81c8fa44
stack_text:
warning: stack unwind information not available. following frames may be wrong.
8b13fb08 81fa76c8 badb0d00 00000000 89e1e002 nt+0x8fa44
8b13fb80 81fb5abd 00000000 000000e1 8b13fc0c hal+0x66c8
8b13fb90 81c832c3 badb0d00 00000000 81d32100 hal+0x14abd
8b13fc0c 89ec5623 8717a000 98381c00 0000fc00 nt+0x832c3
8b13fc94 89ec6349 844995e0 8711cc80 89ecb4a0 ecache+0xc623
8b13fd7c 81e25466 89ecb360 8b134680 00000000 ecache+0xd349
8b13fdc0 81c9125e 89ec56fa 89ecb360 00000000 nt+0x225466
00000000 00000000 00000000 00000000 00000000 nt+0x9125e
stack_command: kb
followup_ip:
ecache+c623
89ec5623 ?? ???
symbol_stack_index: 4
symbol_name: ecache+c623
followup_name: machineowner
image_name: ecache.sys
bucket_id: wrong_symbols
followup: machineowner
-
crash 3 "mini010211-03.dmp"
microsoft (r) windows debugger version 6.9.0003.113 x86
copyright (c) microsoft corporation. all rights reserved.
loading dump file [c:\windows\minidump\mini010211-03.dmp]
mini kernel dump file: only registers and stack trace are available
symbol search path is: *** invalid ***
****************************************************************************
* symbol loading may be unreliable without a symbol search path. *
* use .symfix to have the debugger choose a symbol path. *
* after setting your symbol path, use .reload tosymbol locations. *
****************************************************************************
executable search path is:
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
unable to load image \systemroot\system32\ntkrnlpa.exe, win32 error 0n2
*** warning: unable to verify timestamp for ntkrnlpa.exe
*** error: module load completed but symbols could not be loaded for ntkrnlpa.exe
windows vista kernel version 6000 mp (2 procs) free x86 compatible
product: winnt, suite: terminalserver singleuserts personal
kernel base = 0x81c00000 psloadedmodulelist = 0x81d11d90
debug session time: sun jan 2 18:07:28.737 2011 (gmt+1)
system uptime: 0 days 0:05:33.424
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
unable to load image \systemroot\system32\ntkrnlpa.exe, win32 error 0n2
*** warning: unable to verify timestamp for ntkrnlpa.exe
*** error: module load completed but symbols could not be loaded for ntkrnlpa.exe
loading kernel symbols
......................
loading user symbols
loading unloaded module list
....
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
use !analyze -v to get detailed debugging information.
bugcheck 50, {986f2608, 8, 986f2608, 0}
***** kernel symbols are wrong. please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
probably caused by : ntkrnlpa.exe ( nt+a9bf2 )
followup: machineowner
-
0: kd> !analyze -v
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
page_fault_in_nonpaged_area (50)
invalid system memory was referenced. this cannot be protected by try-except,
it must be protected by a probe. typically the address is just plain bad or it
is pointing at freed memory.
arguments:
arg1: 986f2608, memory referenced.
arg2: 00000008, value 0 = read operation, 1 = write operation.
arg3: 986f2608, if non-zero, the instruction address which referenced the bad memory
address.
arg4: 00000000, (reserved)
debugging details:
***** kernel symbols are wrong. please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
module_name: nt
faulting_module: 81c00000 nt
debug_flr_image_timestamp: 463a8d95
write_address: unable to get nt!mmspecialpoolstart
unable to get nt!mmspecialpoolend
unable to get nt!mmpoolcodestart
unable to get nt!mmpoolcodeend
986f2608
faulting_ip:
+ffffffff986f2608
986f2608 ?? ???
mm_internal_code: 0
customer_crash_count: 3
default_bucket_id: wrong_symbols
bugcheck_str: 0x50
last_control_transfer: from 81c8f874 to 81ca9bf2
stack_text:
warning: stack unwind information not available. following frames may be wrong.
986f9b0c 81c8f874 00000008 986f2608 00000000 nt+0xa9bf2
986f9b24 986f2608 badb0d00 00000000 85742450 nt+0x8f874
986f9b28 badb0d00 00000000 85742450 85745600 0x986f2608
986f9b2c 00000000 85742450 85745600 000bed30 0xbadb0d00
stack_command: kb
followup_ip:
nt+a9bf2
81ca9bf2 8b07 mov eax,dword ptr [edi]
symbol_stack_index: 0
symbol_name: nt+a9bf2
followup_name: machineowner
image_name: ntkrnlpa.exe
bucket_id: wrong_symbols
followup: machineowner
-
crash 4 "mini010311-01.dmp"
microsoft (r) windows debugger version 6.9.0003.113 x86
copyright (c) microsoft corporation. all rights reserved.
loading dump file [c:\windows\minidump\mini010311-01.dmp]
mini kernel dump file: only registers and stack trace are available
symbol search path is: *** invalid ***
****************************************************************************
* symbol loading may be unreliable without a symbol search path. *
* use .symfix to have the debugger choose a symbol path. *
* after setting your symbol path, use .reload tosymbol locations. *
****************************************************************************
executable search path is:
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
unable to load image \systemroot\system32\ntkrnlpa.exe, win32 error 0n2
*** warning: unable to verify timestamp for ntkrnlpa.exe
*** error: module load completed but symbols could not be loaded for ntkrnlpa.exe
windows vista kernel version 6000 mp (2 procs) free x86 compatible
product: winnt, suite: terminalserver singleuserts personal
kernel base = 0x82000000 psloadedmodulelist = 0x82112e10
debug session time: mon jan 3 10:18:44.930 2011 (gmt+1)
system uptime: 0 days 0:11:01.617
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
unable to load image \systemroot\system32\ntkrnlpa.exe, win32 error 0n2
*** warning: unable to verify timestamp for ntkrnlpa.exe
*** error: module load completed but symbols could not be loaded for ntkrnlpa.exe
loading kernel symbols
......................
loading user symbols
loading unloaded module list
....
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
use !analyze -v to get detailed debugging information.
bugcheck 19, {20, b7581369, b7581bb9, b0a0808}
***** kernel symbols are wrong. please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!pvoid ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
unable to get nt!mmspecialpoolstart
unable to get nt!mmspecialpoolend
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_pool_header ***
*** ***
*************************************************************************
unable to get nt!mmpoolcodestart
unable to get nt!mmpoolcodeend
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_pool_header ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_pool_tracker_big_pages ***
*** ***
*************************************************************************
cannot get _pool_tracker_big_pages type size
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* symbols can not be loaded because symbol path is not initialized. *
* *
* the symbol path can be set by: *
* using the _nt_symbol_path environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
probably caused by : ntkrnlpa.exe ( nt+d8dd1 )
followup: machineowner
-
1: kd> !analyze -v
*******************************************************************************
* *
* bugcheck analysis *
* *
*******************************************************************************
bad_pool_header (19)
the pool is already corrupt at the time of the current request.
this may or may not be due to the caller.
the internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
arguments:
arg1: 00000020, a pool block header size is corrupt.
arg2: b7581369, the pool entry we were looking for within the page.
arg3: b7581bb9, the next pool entry.
arg4: 0b0a0808, (reserved)
debugging details:
***** kernel symbols are wrong. please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** type referenced: nt!_kprcb ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** your debugger is not using the correct symbols ***
*** ***
*** in order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** certain .pdb files (such as the public os symbols) do not ***
*** contain the required information. contact the gr | |
|
|
|
