eetrust_wf
驱动牛犊
驱动牛犊
  • 注册日期2007-12-06
  • 最后登录2016-01-09
  • 粉丝0
  • 关注0
  • 积分23分
  • 威望186点
  • 贡献值1点
  • 好评度0点
  • 原创分0分
  • 专家分0分
阅读:1527回复:2

大家帮我看下DUMP信息,谢谢

楼主#
更多 发布于:2008-12-03 16:56
kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD (d4)
A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc.
The broken driver's name is displayed on the screen.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
An attempt was made to access the driver at raised IRQL after it unloaded.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: edf98350, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804e73a1, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  edf98350

CURRENT_IRQL:  2

FAULTING_IP:
nt!ExpScanGeneralLookasideList+1b
804e73a1 8b56e0           mov     edx,[esi-0x20]

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD4

LAST_CONTROL_TRANSFER:  from 804e73ef to 804e73a1

TRAP_FRAME:  f7a3dca8 -- (.trap fffffffff7a3dca8)
ErrCode = 00000000
eax=00000000 ebx=00000004 ecx=00000100 edx=00000000 esi=edf98370 edi=00000000
eip=804e73a1 esp=f7a3dd1c ebp=f7a3dd2c iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
nt!ExpScanGeneralLookasideList+0x1b:
804e73a1 8b56e0           mov     edx,[esi-0x20]    ds:0023:edf98350=????????
Resetting default scope

STACK_TEXT:  
f7a3dd2c 804e73ef 80562af0 80562ae8 804e65fc nt!ExpScanGeneralLookasideList+0x1b
f7a3dd38 804e65fc 00000000 863b0da8 00000000 nt!ExAdjustLookasideDepth+0x32
f7a3ddac 8057e17b 00000000 00000000 00000000 nt!KeBalanceSetManager+0x88
f7a3dddc 804f927a 804e657a 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
nt!ExpScanGeneralLookasideList+1b
804e73a1 8b56e0           mov     edx,[esi-0x20]

SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!ExpScanGeneralLookasideList+1b

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  48a4023c

STACK_COMMAND:  .trap fffffffff7a3dca8 ; kb

FAILURE_BUCKET_ID:  0xD4_nt!ExpScanGeneralLookasideList+1b

BUCKET_ID:  0xD4_nt!ExpScanGeneralLookasideList+1b

Followup: MachineOwner
---------
x-star
驱动小牛
驱动小牛
  • 注册日期2007-04-26
  • 最后登录2018-11-17
  • 粉丝0
  • 关注0
  • 积分65分
  • 威望664点
  • 贡献值1点
  • 好评度39点
  • 原创分1分
  • 专家分1分
  • 社区居民
沙发#
发布于:2008-12-04 17:38
dump信息不是都已经说的很清楚了吗
eetrust_wf
驱动牛犊
驱动牛犊
  • 注册日期2007-12-06
  • 最后登录2016-01-09
  • 粉丝0
  • 关注0
  • 积分23分
  • 威望186点
  • 贡献值1点
  • 好评度0点
  • 原创分0分
  • 专家分0分
板凳#
发布于:2008-12-04 18:48
你是指A driver unloaded without cancelling lookaside lists, DPCs, worker threads, etc这段吗,可能我没说清楚,只有一台机器上才会出现DUMP,而且是我运行fltmc load 时出的错,我没有UNLOAD呀,怎么会有这种提示呢
游客

返回顶部