阅读:1890回复:0
大虾帮忙看下winDbg打开Memery.dmp文件的信息,分析分析~
驱动一安装,系统立即重启。
如下为winDbg打开Memory.dmp文件后用!analyze -v看到的信息。 哪位大虾帮忙看看,分析分析~ DRIVER_VERIFIER_IO_VIOLATION_TYPE: 21f FAULTING_IP: MyDrv1!DriverEntry+0 [c:\code\driver\first1\init.c @ 10] f8a0b304 8b442404 mov eax,[esp+0x4] IRP_ADDRESS: 846f8e48 DEFAULT_BUCKET_ID: DRIVER_FAULT BUGCHECK_STR: 0xC9 LAST_CONTROL_TRANSFER: from 8067c258 to 8053738a STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. f88ea6d0 8067c258 0000004c 000000c9 f88ea6f0 nt!KeBugCheckEx+0x1b f88ea858 8067ca24 f88eab33 806a8090 00040000 nt!RtlCompressBuffer+0xd0b5 f88eaafc 8067cb10 806ac630 0000021f f88eab28 nt!RtlCompressBuffer+0xd881 f88eabec 8067d806 0000021f 00000009 f8a0b304 nt!RtlCompressBuffer+0xd96d f88eac0c 8067bb4a 00000000 846f8fb4 824cfa48 nt!RtlCompressBuffer+0xe663 f88eac38 80680620 00000000 846f8fb4 824cfa48 nt!RtlCompressBuffer+0xc9a7 f88eac98 80672133 00127fb0 c00000bb 846f8e48 nt!RtlCompressBuffer+0x1147d f88eacc0 805e890b f88ead44 846f8e48 82358000 nt!RtlCompressBuffer+0x2f90 f88eacec 805a14cd 846f8e48 0000000b 82205605 nt!RtlUnicodeStringToInteger+0x2fc f88ead18 805a5976 0000000b 822056e8 00000000 nt!RtlUpperChar+0x35c f88ead54 805a5a7c 8219f4d8 00000000 f88ead7c nt!RtlUpperChar+0x4805 f88ead64 805a5db2 8219f4d8 80568dc0 805694fc nt!RtlUpperChar+0x490b f88ead7c 804e23b5 00000000 00000000 82ada8b8 nt!RtlUpperChar+0x4c41 f88eadac 80574128 00000000 00000000 00000000 nt!KeRemoveQueue+0x221 f88eaddc 804ec781 804e22f1 00000001 00000000 nt!PsCreateSystemThread+0x70 00000000 00000000 00000000 00000000 00000000 nt!KeInitializeTimerEx+0x1e6 STACK_COMMAND: .bugcheck ; kb FOLLOWUP_IP: MyDrv1!DriverEntry+0 [c:\code\driver\first1\init.c @ 10] f8a0b304 8b442404 mov eax,[esp+0x4] FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: MyDrv1!DriverEntry+0 MODULE_NAME: MyDrv1 IMAGE_NAME: MyDrv1.sys DEBUG_FLR_IMAGE_TIMESTAMP: 476fa04e BUCKET_ID: WRONG_SYMBOLS Followup: MachineOwner --------- 感谢~ |
|
|