阅读:5299回复:3
各位前辈 关于PAGE_FAULT_IN_NONPAGED_AREA (50)蓝屏的问题
各位前辈,大家好。
我写的一个驱动,出现 PAGE_FAULT_IN_NONPAGED_AREA (50)蓝屏,但是在其他人的机器上(至少六七台测试机包括xp,2003,vista)都没这个问题,只是在一台机器上有这个问题,该机器内存是4G。 网上有人说是驱动没有签名导致的 具体dump如下: ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 10000050, {94720202, 0, 8053de32, 0} Unable to load image DenyAccess.sys, Win32 error 2 *** WARNING: Unable to verify timestamp for DenyAccess.sys *** ERROR: Module load completed but symbols could not be loaded for DenyAccess.sys Could not read faulting driver name Probably caused by : DenyAccess.sys ( DenyAccess+1614 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: 94720202, memory referenced. Arg2: 00000000, value 0 = read operation, 1 = write operation. Arg3: 8053de32, If non-zero, the instruction address which referenced the bad memory address. Arg4: 00000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: 94720202 FAULTING_IP: nt!PopFindPowerDependencies+93 8053de32 668b03 mov ax,word ptr [ebx] MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: DenyAccessUI.ex LAST_CONTROL_TRANSFER: from 8053aee1 to 8053de32 STACK_TEXT: aa8a6648 8053aee1 aa8a6664 aaa302ac aa8a6904 nt!PopFindPowerDependencies+0x93 aa8a6684 8052c687 aa8a66c0 00000200 aaa302ac nt!MiProtectFreeNonPagedPool+0x49 aa8a68dc 8052c88c 8052c86c ffffffff 00000000 nt!CcPrepareMdlWrite+0x194 aa8a68f8 aaa30614 aaa302ac 00380036 e49dd010 nt!CcWaitForCurrentLazyWriterActivity+0x71 WARNING: Stack unwind information not available. Following frames may be wrong. aa8a6a70 804f019e 88a88b08 88ac4680 88ac4680 DenyAccess+0x1614 aa8a6b60 805c047c 8a4579f0 00000000 88b7cca8 nt!IopUpdateReadOperationCount+0x2d aa8a6bd8 805bca08 00000000 aa8a6c18 00000040 nt!IopMountVolume+0xcf aa8a6c2c 80577033 00000000 00000000 00000001 nt!CmpSetVersionData+0xeb aa8a6ca8 805779aa 0013ec3c 00100001 0013ebec nt!RtlAllocateHeap+0x2d7 aa8a6d04 8057b1a9 0013ec3c 00100001 0013ebec nt!ExAcquireRundownProtection+0x3d aa8a6d44 8054262c 0013ec3c 00100001 0013ebec nt!NtWriteFile+0x82 aa8a6d64 7c92e514 badb0d00 0013ebc8 00000000 nt!RtlpTraceDatabaseInternalAdd+0x24 aa8a6d78 00000000 00000000 00000000 00000000 0x7c92e514 STACK_COMMAND: kb FOLLOWUP_IP: DenyAccess+1614 aaa30614 ?? ??? SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: DenyAccess+1614 FOLLOWUP_NAME: MachineOwner MODULE_NAME: DenyAccess IMAGE_NAME: DenyAccess.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a88b00c FAILURE_BUCKET_ID: 0x50_DenyAccess+1614 BUCKET_ID: 0x50_DenyAccess+1614 Followup: MachineOwner --------- |
|
沙发#
发布于:2009-08-18 17:07
这个问题,一般是分页和非分页内存的问题,建议用windbg设置你的符号路径的方法,一般能追到源码中看原因。
|
|
板凳#
发布于:2009-08-20 10:55
首先感谢扫地僧的提示!
现在问题又变成 IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. 哎 真是的 |
|
地板#
发布于:2009-08-20 10:58
我个人认为是在拦截IRP_MJ_CREATE的时IRQL级别太高,导致我的驱动中的全局变量的地址无法访问了。不知道对不对!
|
|