求助:对于自己编写的造成系统突然重启的驱动,如何快速找到问题所在？

  如题。哪位大哥指点一下？

用WinDbg分析memory dump或者直接连接target

感谢管理员大哥的指点，我现在安装好了windbg,好像用windbg分析dump文件或调试本机内核必须要将将windows用调试模式启动,是这样的吗？

我用windbg加载dump时如下显示：

Microsoft (R) Windows Debugger  Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: E:\XpSp2Symbols;symsrv*symsrv.dll*E:\XpSp2Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055bb20
Debug session time: Thu Jan 11 03:28:10.031 2007 (GMT+8)
System Uptime: 0 days 0:49:50.628
Loading Kernel Symbols
..........................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdc00c).  Type ".hh dbgerr001" for details
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {20038, 2, 0, 805a4c61}

*** ERROR: Module load completed but symbols could not be loaded for MyDriver.sys
*** ERROR: Module load completed but symbols could not be loaded for BaseTDI.SYS
Probably caused by : MyDriver.sys ( MyDriver+38f2 )

Followup: MachineOwner
---------

kd> u MyDriver
SkyEye:
f4783000 4d               dec     ebp
f4783001 5a               pop     edx
f4783002 90               nop
f4783003 0003             add     [ebx],al
f4783005 0000             add     [eax],al
f4783007 000400           add     [eax+eax],al
f478300a 0000             add     [eax],al
f478300c ffff             ???
kd> u MyDriver+38f2
SkyEye+0x38f2:
f47868f2 8b450c           mov     eax,[ebp+0xc]
f47868f5 0fb74df8         movzx   ecx,word ptr [ebp-0x8]


f47868f9 48               dec     eax
f47868fa 3bc1             cmp     eax,ecx
f47868fc 7202             jb      SkyEye+0x3900 (f4786900)
f47868fe 8bc1             mov     eax,ecx
f4786900 50               push    eax
f4786901 ff75fc           push    dword ptr [ebp-0x4]

上面的 Probably caused by : MyDriver.sys ( MyDriver+38f2 )， 这个MyDriver+38f2就是MyDriver入口地址+38F2偏移处吗？但我用ida打开MyDriver.sys，MyDriver入口地址是00014180，+38F2=00017A72处却不是驱动的代码段，而是data段，请教大哥，我该如何定位这个出错的地址？

Module load completed but symbols could not be loaded for MyDriver.sys

MyDriver.sys的pdb文件没有在你的symbol路径吗？
加载symbol后，!analyze -v命令

感谢楼上大哥指点，终于找到答案了~~