|
阅读：6861回复：28
急急急，求助！请高人帮忙看看，拜托！(已经自己解决，多谢各位)
这是我写一个虚拟打印机的驱动程序；是参照DDK中的列子写的，
在使用的过程中发现一下问题： 在有些windows机器打印会蓝屏，而有些windows机器就不会蓝屏； 有些机器一开始不会蓝屏，过一段时间就又会打印蓝屏了；不知道是什么原因？？？？ 经过使用WinDBG调试，是在调用EngBitBlt函数的时候导致了蓝屏，不知道是什么原因。 蓝屏显示错误：0x00000007 UNEXPECTED_KERNEL_MODE_TRAP 自己调试了很长时间没有找到原因， 请高人帮忙看看！急急急 附件中是虚拟打印驱动程序源码!! （已经解决了，是DEVINFO结构参数设置不对，cxDither cyDither成员不能为0） |
|
|
沙发#
发布于：2007-07-11 20:50
用windbg分析蓝屏文件,把!analyze -v结果贴上来.
|
|
|
板凳#
发布于：2007-07-12 08:41
用windbg分析蓝屏文件,!analyze -v结果如下
******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* UNEXPECTED_KERNEL_MODE_TRAP (7f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate use .tss on the part before the colon, then kv. Else if kv shows a trapframe use .trap on that value Else .trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap) Endif kb will then show the corrected stack. Arguments: Arg1: 00000000, EXCEPTION_DIVIDED_BY_ZERO Arg2: 00000000 Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ BUGCHECK_STR: 0x7f_0 DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO PROCESS_NAME: spoolsv.exe LAST_CONTROL_TRANSFER: from 80465ca5 to 8042a86d STACK_TEXT: f3376f04 80465ca5 f3376f10 f33772b4 e4a43a48 nt!KeGetBugMessageText+0x5 f3376f10 e4a43a48 00000001 00010101 f3377270 nt!Dr_kit1_a+0x69 WARNING: Frame IP not in any known module. Following frames may be wrong. f33772f0 80449c44 80482480 00010101 f33775c8 0xe4a43a48 f3377394 8046af99 00000001 00000102 f33778f4 nt!MmAccessFault+0x686 f33773e0 a0043c20 f3377980 f33778f4 e30729e8 nt!MiAllocatePoolPages+0x99 f33773f0 f33774bc 00000000 0000007d 0000010c win32k!_ScrollDC+0x6 f3377410 ffffffff 00000001 f33773f4 00000000 0xf33774bc f3377414 00000000 f33773f4 00000000 0000007d 0xffffffff STACK_COMMAND: kb FOLLOWUP_IP: win32k!_ScrollDC+6 a0043c20 e9de010000 jmp win32k!GrePolyPolylineInternal+0x5a (a0043e03) SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: win32k!_ScrollDC+6 FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 45ed063d FAILURE_BUCKET_ID: 0x7f_0_win32k!_ScrollDC+6 BUCKET_ID: 0x7f_0_win32k!_ScrollDC+6 Followup: MachineOwner --------- |
|
|
地板#
发布于：2007-07-12 10:42
用户被禁言,该主题自动屏蔽! |
|
|
地下室#
发布于：2007-07-12 12:08
不好意思；我对WinDBG不熟悉，不知道该如何使用WinDBG分析。请告诉怎么做？我再把代码位置铁出来。
我下面是我使用winDBG调试出现蓝屏的代码调用，不知道是不是你所说的意思。 BOOL APIENTRY DrvBitBlt( SURFOBJ *psoDst, SURFOBJ *psoSrc, SURFOBJ *psoMask, CLIPOBJ *pco, XLATEOBJ *pxlo, PRECTL prclDst, PPOINTL pptlSrc, PPOINTL pptlMask, BRUSHOBJ *pbo, PPOINTL pptlBrushOrg, ROP4 Rop4 ) { return EngBitBlt(psoDst, psoSrc, psoMask, pco, pxlo, prclDst, pptlSrc, pptlMask, pbo, pptlBrushOrg, Rop4); } 这个是我驱动中的一个DDI函数；是直接调用的GDI 支持的函数。 |
|
|
5楼#
发布于：2007-07-12 12:28
1.可以设置完全转储,然后用windbg打开,!analyze -v.
或者2.在双机调试状态下,异常后,就会被host的windbg拦住,!analyze -v, 看你的蓝屏文件,看不出你说的调用EngBitBlt引起的,你是如何确定是EngBitblt导致的? |
|
|
6楼#
发布于：2007-07-12 13:31
我是在那台机器上使用WInDBG attach process spoolsv.exe进程；然后进行源码级别调试，在EngBitblt设置断点；再打印测试页的时候，当程序执行到断点停下来；执行下一步调用EngBitBlt就会蓝屏。
帮帮我吧，快被老板逼疯了；以前没有做过驱动方面的开发！ |
|
|
7楼#
发布于：2007-07-12 14:34
看了一下你的驱动,是用户模式的驱动,即使有错误,也不会使系统蓝屏.
不要在单机上调试. 按照我介绍的第一种方法,生成蓝屏文件,用windbg打开,把!analyze -v结果再贴上来 |
|
|
8楼#
发布于：2007-07-12 14:49
我的驱动是用户模式的！
好的，我今天再研究一下WinDBG，明天晚上我把结果贴出来；因为出现蓝屏问题的机器是我同事的机器，所以只能等他晚上下班后，我才能去调试。 |
|
|
9楼#
发布于：2007-07-12 14:52
按理说,如果你的是用户模式驱动,蓝屏和你的驱动,无关
|
|
|
10楼#
发布于：2007-07-12 15:10
不好意思；刚才去查看了一下我同事的机器；他的机器就是“完全内存转储”的，转储文件为：%SystemRoot%\MEMORY.DMP；
蓝屏后我把他的文件拷贝到我的机器上后，然后使用winDBG中的File->Open Crash Dump... 打开； 然后再输入命令：!analyze -v, 结果就是我上面帖子贴出来的那些内容。 我的代码中： BOOL APIENTRY DrvQueryDriverInfo( DWORD dwMode, PVOID pBuffer, DWORD cbBuf, PDWORD pcbNeeded ) { switch (dwMode) { case DRVQUERY_USERMODE: *pcbNeeded = sizeof(DWORD); if (pBuffer == NULL || cbBuf < sizeof(DWORD)) { SetLastError(ERROR_INSUFFICIENT_BUFFER); return FALSE; } *((PDWORD) pBuffer) = TRUE; return TRUE; default: SetLastError(ERROR_INVALID_PARAMETER); return FALSE; } } 我的代码是用户模式的，至于为什么蓝屏，确实在使用这个虚拟打印机打印的时候蓝屏的，其它时候没有这样的现象；用户模式驱动导致蓝屏，我也很疑惑。 如果你不介意的话，你可以用build编译一下；然后安装一下试试。 我也真的是无计可施了，只好劳驾您了！ |
|
|
11楼#
发布于：2007-07-12 15:25
我明天再试一下双机模式调试吧。
|
|
|
12楼#
发布于：2007-07-13 12:05
最近发现的现象；我的虚拟打印机是支持彩色打印输出的，在inc目录下的mfconfig.h文件中添加宏定义#define MFFUN_COLOR就可以了，重新编译后发现如下现象：
1。在有些机器上无论是彩色打印还是黑白打印都没有问题；而在有些机器上一开始打印没有问题，过一段时间后打印就会蓝屏。 2。在打印蓝屏的机器上，彩色打印不会有问题，而选择黑白打印就会蓝屏。 附件中的代码我更新了，现在支持彩色打印。 |
|
|
13楼#
发布于：2007-07-16 08:48
zhaock:
由于我没有能实现双机调试；所以我按照你的第一种方法调试了；调试结果同前面的是一样的。 各位帮我看看吧；实在是没有办法了，拜托了。 |
|
|
14楼#
发布于：2007-07-17 07:52
......
|
|
|
|
15楼#
发布于：2007-07-17 10:10
从你的!analyze -v的结果,看不出什么线索.你再生成几个dump文件,看看!analyze -v 是不是一样.
|
|
|
16楼#
发布于：2007-07-17 12:08
好的，我今天晚上多测试几次；多收集几个DUMP文件分析一下。
|
|
|
17楼#
发布于：2007-07-18 08:59
昨天晚上调试结果如下：
测试机器一共有两台机器会打印蓝屏，我分别标识为机器A和机器B，机器的OS为：windows 2000 Advance Server Service Pack4；重新安装了符号表，符号表安装包有以下几个： Windows_2000_RTM_Symbols.exe SP1SYM.exe sp2sym.exe sp2srp1sym_cn.exe w2ksp3sym_cn.exe w2ksp4sym_cn.exe Windows2000-KB891861-x86-Symbols-CHS.EXE 由于不确定Windows2000-KB891861-x86-Symbols-CHS.EXE符号表安装表是否要安装；因此我做了两种情况的测试： 1。安装Windows2000-KB891861-x86-Symbols-CHS.EXE符号表安装包，结果如下： 机器A: Microsoft (R) Windows Debugger Version 6.6.0007.5 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINNT\MEMORY.DMP] Kernel Complete Dump File: Full address space is available ************************************************************ WARNING: Dump file has been truncated. Data may be missing. ************************************************************ Symbol search path is: C:\WINNT\Symbols Executable search path is: *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x427b58bb for ntoskrnl.exe Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible Product: Server Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580 Debug session time: Tue Jul 17 19:46:19.734 2007 (GMT+8) System Uptime: 0 days 0:42:51.500 *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x427b58bb for ntoskrnl.exe Loading Kernel Symbols ....................................................................................................................... Loading User Symbols ..................................................................................... Loading unloaded module list ............... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7F, {0, 0, 0, 0} Probably caused by : ntoskrnl.exe ( nt!KeGetBugMessageText+5 ) Followup: MachineOwner --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* UNEXPECTED_KERNEL_MODE_TRAP (7f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate use .tss on the part before the colon, then kv. Else if kv shows a trapframe use .trap on that value Else .trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap) Endif kb will then show the corrected stack. Arguments: Arg1: 00000000, EXCEPTION_DIVIDED_BY_ZERO Arg2: 00000000 Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ BUGCHECK_STR: 0x7f_0 DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO PROCESS_NAME: spoolsv.exe LAST_CONTROL_TRANSFER: from 00000000 to 8042a86d STACK_TEXT: f30a3f04 00000000 00000000 00000000 00000000 nt!KeGetBugMessageText+0x5 STACK_COMMAND: kb FOLLOWUP_IP: nt!KeGetBugMessageText+5 8042a86d c20400 ret 4 SYMBOL_STACK_INDEX: 0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntoskrnl.exe DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c8f SYMBOL_NAME: nt!KeGetBugMessageText+5 FAILURE_BUCKET_ID: 0x7f_0_nt!KeGetBugMessageText+5 BUCKET_ID: 0x7f_0_nt!KeGetBugMessageText+5 Followup: MachineOwner --------- 机器B： Microsoft (R) Windows Debugger Version 6.6.0007.5 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINNT\MEMORY.DMP] Kernel Complete Dump File: Full address space is available Symbol search path is: C:\WINNT\Symbols Executable search path is: *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x427b58bb for ntkrnlmp.exe Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible Product: Server, suite: Enterprise Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80 Debug session time: Tue Jul 17 20:46:33.421 2007 (GMT+8) System Uptime: 0 days 0:20:25.343 *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x427b58bb for ntkrnlmp.exe Loading Kernel Symbols ....................................................................................................................... Loading User Symbols ............................................................... Loading unloaded module list ......... ERROR: FindPlugIns 80070005 ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7F, {0, 0, 0, 0} *** WARNING: symbols timestamp is wrong 0x45ed4dbc 0x425670f4 for GDI32.dll *** WARNING: symbols timestamp is wrong 0x46236f7e 0x42a0669b for KERNEL32.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for mfprinter.DLL - Probably caused by : win32k.sys ( win32k!BltLnkSrcCopyMsk8+74 ) Followup: MachineOwner --------- kd> !analyze -v ERROR: FindPlugIns 80070005 ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* UNEXPECTED_KERNEL_MODE_TRAP (7f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate use .tss on the part before the colon, then kv. Else if kv shows a trapframe use .trap on that value Else .trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap) Endif kb will then show the corrected stack. Arguments: Arg1: 00000000, EXCEPTION_DIVIDED_BY_ZERO Arg2: 00000000 Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ BUGCHECK_STR: 0x7f_0 DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO PROCESS_NAME: spoolsv.exe TRAP_FRAME: f3bd4f10 -- (.trap fffffffff3bd4f10) ErrCode = 00000000 eax=ffffffff ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000020 eip=a01355e4 esp=f3bd4f84 ebp=f3bd5064 iopl=0 nv up ei pl zr na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246 win32k!BltLnkSrcCopyMsk8+0x74: a01355e4 f7f6 div eax,esi Resetting default scope LAST_CONTROL_TRANSFER: from 804c9149 to 8042be01 STACK_TEXT: f3bd5064 a00243c6 e4771008 00000002 002b59ff win32k!BltLnkSrcCopyMsk8+0x74 f3bd50f0 a00641fa 00000000 e471fe04 a0064715 win32k!bGetRealizedBrush+0x38a f3bd5280 80468389 e2dc96b8 00000000 00000000 win32k!EngRealizeBrush+0x513 f3bd5280 77f72477 e2dc96b8 00000000 00000000 nt!KiServiceExit+0x6e 00dce5b4 77f672f9 01010000 00000000 00000000 GDI32!MRBB::bInit+0xef 00dce648 77e764f9 0000020c 00000000 00000000 GDI32!IcmSaveDC+0x42 00dce6b4 78012d3d 0000020c 00dce6dc 0000003b KERNEL32!WriteFile+0x15d 00dceaf4 77e67ef0 00000000 00000004 78013026 MSVCRT!_write_lk+0xce 00dceb04 78013409 00281fb4 780130f8 00000004 KERNEL32!BaseDllInitializeMemoryManager+0x1f 00dceb0c 780130f8 00000004 780130cc 00000000 MSVCRT!_unlock_fhandle+0x21 00dceb44 78001199 00287098 00dceb90 7800f025 MSVCRT!_close+0x94 00dceb50 7800f025 0000001f 7800fe0e 7803a6f0 MSVCRT!_unlock+0x13 00dceb58 7800fe0e 7803a6f0 7800fe03 00dd8d3c MSVCRT!_unlock_file+0x22 00dceb90 00dd2fdd 7803a6f0 00dd8d24 00000001 MSVCRT!fclose+0x6f 00dceca0 00dd2219 00dd141c 00000001 00dcecfc mfprinter!DrvQueryDriverInfo+0x1410 00dcecb8 77f6720a 01010000 01010034 00000002 mfprinter!DrvQueryDriverInfo+0x64c 00dcef1c 00000000 000013a4 00000b54 00001371 GDI32!IcmSetSourceColorSpace+0x1ee STACK_COMMAND: .trap 0xfffffffff3bd4f10 ; kb FOLLOWUP_IP: win32k!BltLnkSrcCopyMsk8+74 a01355e4 f7f6 div eax,esi SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: win32k!BltLnkSrcCopyMsk8+74 FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 45ed063d FAILURE_BUCKET_ID: 0x7f_0_win32k!BltLnkSrcCopyMsk8+74 BUCKET_ID: 0x7f_0_win32k!BltLnkSrcCopyMsk8+74 Followup: MachineOwner --------- |
|
|
18楼#
发布于：2007-07-18 09:00
2。不安装Windows2000-KB891861-x86-Symbols-CHS.EXE符号表安装包，结果如下：
机器A： Microsoft (R) Windows Debugger Version 6.6.0007.5 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINNT\MEMORY.DMP] Kernel Complete Dump File: Full address space is available ************************************************************ WARNING: Dump file has been truncated. Data may be missing. ************************************************************ Symbol search path is: C:\WINNT\Symbols Executable search path is: *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x3ee6c002 for ntoskrnl.exe Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible Product: Server Kernel base = 0x80400000 PsLoadedModuleList = 0x80481580 Debug session time: Tue Jul 17 19:46:19.734 2007 (GMT+8) System Uptime: 0 days 0:42:51.500 *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x3ee6c002 for ntoskrnl.exe Loading Kernel Symbols ....................................................................................................................... Loading User Symbols ..................................................................................... Loading unloaded module list ...............*** WARNING: symbols timestamp is wrong 0x41e648e0 0x3ef31d0f for ntdll.dll ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7F, {0, 0, 0, 0} Probably caused by : ntoskrnl.exe ( nt!IopInvalidateRelationsInList+65 ) Followup: MachineOwner --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* UNEXPECTED_KERNEL_MODE_TRAP (7f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate use .tss on the part before the colon, then kv. Else if kv shows a trapframe use .trap on that value Else .trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap) Endif kb will then show the corrected stack. Arguments: Arg1: 00000000, EXCEPTION_DIVIDED_BY_ZERO Arg2: 00000000 Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ BUGCHECK_STR: 0x7f_0 DEFAULT_BUCKET_ID: DRIVER_FAULT LAST_CONTROL_TRANSFER: from 00000000 to 8042a86d STACK_TEXT: f30a3f04 00000000 00000000 00000000 00000000 nt!IopInvalidateRelationsInList+0x65 STACK_COMMAND: kb FOLLOWUP_IP: nt!IopInvalidateRelationsInList+65 8042a86d c20400 ret 4 SYMBOL_STACK_INDEX: 0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntoskrnl.exe DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c8f SYMBOL_NAME: nt!IopInvalidateRelationsInList+65 FAILURE_BUCKET_ID: 0x7f_0_nt!IopInvalidateRelationsInList+65 BUCKET_ID: 0x7f_0_nt!IopInvalidateRelationsInList+65 Followup: MachineOwner --------- 机器B： Microsoft (R) Windows Debugger Version 6.6.0007.5 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINNT\MEMORY.DMP] Kernel Complete Dump File: Full address space is available Symbol search path is: C:\WINNT\Symbols Executable search path is: *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x3ee650b3 for ntkrnlmp.exe Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible Product: Server, suite: Enterprise Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80 Debug session time: Tue Jul 17 19:19:19.361 2007 (GMT+8) System Uptime: 0 days 1:32:41.171 *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x3ee650b3 for ntkrnlmp.exe Loading Kernel Symbols ....................................................................................................................... Loading User Symbols ................................................................ Loading unloaded module list ...........*** WARNING: symbols timestamp is wrong 0x41e648e0 0x3ef31d0f for ntdll.dll ERROR: FindPlugIns 80070005 ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 7F, {0, 0, 0, 0} Probably caused by : ntkrnlmp.exe ( nt!KeDelayExecutionThread+1b5 ) Followup: MachineOwner --------- kd> .reload *** WARNING: symbols timestamp is wrong 0x45ec3c8f 0x3ee650b3 for ntkrnlmp.exe Loading Kernel Symbols ....................................................................................................................... Loading User Symbols ................................................................ Loading unloaded module list ...........*** WARNING: symbols timestamp is wrong 0x41e648e0 0x3ef31d0f for ntdll.dll kd> !analyze -v ERROR: FindPlugIns 80070005 ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* UNEXPECTED_KERNEL_MODE_TRAP (7f) This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel isn't allowed to have/catch (bound trap) or that is always instant death (double fault). The first number in the bugcheck params is the number of the trap (8 = double fault, etc) Consult an Intel x86 family manual to learn more about what these traps are. Here is a *portion* of those codes: If kv shows a taskGate use .tss on the part before the colon, then kv. Else if kv shows a trapframe use .trap on that value Else .trap on the appropriate frame will show where the trap was taken (on x86, this will be the ebp that goes with the procedure KiTrap) Endif kb will then show the corrected stack. Arguments: Arg1: 00000000, EXCEPTION_DIVIDED_BY_ZERO Arg2: 00000000 Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ BUGCHECK_STR: 0x7f_0 DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO PROCESS_NAME: spoolsv.exe LAST_CONTROL_TRANSFER: from 8046902a to 8042be01 STACK_TEXT: f306df04 8046902a f306df10 f306e2b4 00000000 nt!KeDelayExecutionThread+0x1b5 f306df10 00000000 00000001 00010101 f306e270 nt!KiTrap0D+0x49e STACK_COMMAND: kb FOLLOWUP_IP: nt!KeDelayExecutionThread+1b5 8042be01 c20400 ret 4 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!KeDelayExecutionThread+1b5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c8f FAILURE_BUCKET_ID: 0x7f_0_VRFK_nt!KeDelayExecutionThread+1b5 BUCKET_ID: 0x7f_0_VRFK_nt!KeDelayExecutionThread+1b5 Followup: MachineOwner --------- |
|
|
19楼#
发布于：2007-07-18 09:01
每种情况我都测试了多次；同一台机器结果一样；不同的机器!analyze -v分析的结果的都不一样；很奇怪；拜托，请大家看看。
|
|
上一页
下一页