21,597
社区成员
发帖
与我相关
我的任务
分享dump文件分析 求助
寻思好久都没解决，又来麻烦大家了。（关键对内核驱动和汇编不熟）
我们自己设计的pci9052采集板子，驱动基于开发板（只修改了总线位数）。
驱动安装使用都正常，有点小毛病
打开电脑马上（如开机2，3分钟即进行）频繁读取数据会出现电脑自动重启（少量数据读写没问题），但若打开电脑5分钟后再频繁读取会没有问题。 windbg分析dmp结果如下
Symbol search path is: SRV*c:/temp*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.100216-1441
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
Debug session time: Wed Apr 28 15:17:37.312 2010 (GMT+8)
System Uptime: 0 days 0:02:11.984
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F4, {3, 89a64548, 89a646bc, 805d220a}
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : hardware_disk
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 89a64548, Terminating object
Arg3: 89a646bc, Process image file name
Arg4: 805d220a, Explanatory message (ascii)
Debugging Details:
------------------
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
PROCESS_OBJECT: 89a64548
IMAGE_NAME: hardware_disk
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAULTING_MODULE: 00000000
PROCESS_NAME: csrss.exe
EXCEPTION_RECORD: ba2079d8 -- (.exr 0xffffffffba2079d8)
ExceptionAddress: 764fb3b9
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000008
Parameter[1]: 764fb3b9
Parameter[2]: c000009a
Inpage operation failed at 764fb3b9, due to I/O error c000009a
EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - "0x%08lx"
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
ERROR_CODE: (NTSTATUS) 0xc0000006 - "0x%08lx"
EXCEPTION_PARAMETER1: 00000008
EXCEPTION_PARAMETER2: 764fb3b9
EXCEPTION_PARAMETER3: c000009a
IO_ERROR: (NTSTATUS) 0xc000009a - <Unable to get error code text>
EXCEPTION_STR: 0xc0000006_c000009a
FAULTING_IP:
+1b4952f0112dfdc
764fb3b9 ?? ???
BUGCHECK_STR: 0xF4_IOERR_C000009A
STACK_TEXT:
ba207520 805d13b1 000000f4 00000003 89a64548 nt!KeBugCheckEx+0x1b
ba207544 805d22b5 805d220a 89a64548 89a646bc nt!PspCatchCriticalBreak+0x75
ba207574 8054189c 89a64790 c0000006 ba2079b0 nt!NtTerminateProcess+0x7d
ba207574 80501699 89a64790 c0000006 ba2079b0 nt!KiFastCallEntry+0xfc
ba2075f4 804ff6ca ffffffff c0000006 ba2079f8 nt!ZwTerminateProcess+0x11
ba2079b0 80502de1 ba2079d8 00000000 ba207d64 nt!KiDispatchException+0x3a0
ba207d34 8054517f 005afbe8 005afc08 00000000 nt!KiRaiseException+0x175
ba207d50 8054189c 005afbe8 005afc08 00000000 nt!NtRaiseException+0x33
ba207d50 764fb3b9 005afbe8 005afc08 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
005afff4 00000000 00000000 00000000 00000000 0x764fb3b9
STACK_COMMAND: kb
FOLLOWUP_IP:
+1b4952f0112dfdc
764fb3b9 ?? ???
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware_disk
FAILURE_BUCKET_ID: 0xF4_IOERR_C000009A_IMAGE_hardware_disk
BUCKET_ID: 0xF4_IOERR_C000009A_IMAGE_hardware_disk
Followup: MachineOwner
---------
我们自己设计的pci9052采集板子，驱动基于开发板（只修改了总线位数）。
驱动安装使用都正常，有点小毛病
打开电脑马上（如开机2，3分钟即进行）频繁读取数据会出现电脑自动重启（少量数据读写没问题），但若打开电脑5分钟后再频繁读取会没有问题。 windbg分析dmp结果如下
Symbol search path is: SRV*c:/temp*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.100216-1441
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
Debug session time: Wed Apr 28 15:17:37.312 2010 (GMT+8)
System Uptime: 0 days 0:02:11.984
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F4, {3, 89a64548, 89a646bc, 805d220a}
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : hardware_disk
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 89a64548, Terminating object
Arg3: 89a646bc, Process image file name
Arg4: 805d220a, Explanatory message (ascii)
Debugging Details:
------------------
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
PROCESS_OBJECT: 89a64548
IMAGE_NAME: hardware_disk
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAULTING_MODULE: 00000000
PROCESS_NAME: csrss.exe
EXCEPTION_RECORD: ba2079d8 -- (.exr 0xffffffffba2079d8)
ExceptionAddress: 764fb3b9
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000008
Parameter[1]: 764fb3b9
Parameter[2]: c000009a
Inpage operation failed at 764fb3b9, due to I/O error c000009a
EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - "0x%08lx"
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
ERROR_CODE: (NTSTATUS) 0xc0000006 - "0x%08lx"
EXCEPTION_PARAMETER1: 00000008
EXCEPTION_PARAMETER2: 764fb3b9
EXCEPTION_PARAMETER3: c000009a
IO_ERROR: (NTSTATUS) 0xc000009a - <Unable to get error code text>
EXCEPTION_STR: 0xc0000006_c000009a
FAULTING_IP:
+1b4952f0112dfdc
764fb3b9 ?? ???
BUGCHECK_STR: 0xF4_IOERR_C000009A
STACK_TEXT:
ba207520 805d13b1 000000f4 00000003 89a64548 nt!KeBugCheckEx+0x1b
ba207544 805d22b5 805d220a 89a64548 89a646bc nt!PspCatchCriticalBreak+0x75
ba207574 8054189c 89a64790 c0000006 ba2079b0 nt!NtTerminateProcess+0x7d
ba207574 80501699 89a64790 c0000006 ba2079b0 nt!KiFastCallEntry+0xfc
ba2075f4 804ff6ca ffffffff c0000006 ba2079f8 nt!ZwTerminateProcess+0x11
ba2079b0 80502de1 ba2079d8 00000000 ba207d64 nt!KiDispatchException+0x3a0
ba207d34 8054517f 005afbe8 005afc08 00000000 nt!KiRaiseException+0x175
ba207d50 8054189c 005afbe8 005afc08 00000000 nt!NtRaiseException+0x33
ba207d50 764fb3b9 005afbe8 005afc08 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
005afff4 00000000 00000000 00000000 00000000 0x764fb3b9
STACK_COMMAND: kb
FOLLOWUP_IP:
+1b4952f0112dfdc
764fb3b9 ?? ???
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware_disk
FAILURE_BUCKET_ID: 0xF4_IOERR_C000009A_IMAGE_hardware_disk
BUCKET_ID: 0xF4_IOERR_C000009A_IMAGE_hardware_disk
Followup: MachineOwner
---------
...全文
请发表友善的回复…
发表回复
曹大夯 2010-06-29
- 打赏
- 举报
[Quote=引用 4 楼 kongzhongxx 的回复:]
我把windbg结果贴出来，希望有人帮我分析下bsod前后驱动具体在干吗？在执行哪一块代码出问题了。
[/Quote]
你有PCI驱动的源码吧？用WinDBG联机，看看BSOD前驱动在干什么。你贴出来的Dump信息都是系统代码，是CRSS程序出错了，都看不出和你的驱动有啥关系。
我把windbg结果贴出来，希望有人帮我分析下bsod前后驱动具体在干吗？在执行哪一块代码出问题了。
[/Quote]
你有PCI驱动的源码吧？用WinDBG联机，看看BSOD前驱动在干什么。你贴出来的Dump信息都是系统代码，是CRSS程序出错了，都看不出和你的驱动有啥关系。
kongzhongxx 2010-06-29
- 打赏
- 举报
谢谢 Huntercao!
我把windbg结果贴出来，希望有人帮我分析下bsod前后驱动具体在干吗？在执行哪一块代码出问题了。
我说，申请的非分页都释放了（是指ExAllocatepool函数申请的都free了）
我曾经在一台新电脑上（2G内存，只装了office,VC++）上试过，问题依然一样。
所以我感觉是自己驱动哪一块有缺陷，我又不会汇编。
所以把windbg结果贴出来，希望有人帮我分析下bsod前后驱动具体在干吗？在执行哪一块代码出问题了。
我机器内存2G（感觉够大了！），另外我电脑上windbg不知道为啥!vm 2 !poolused用不了，以前试过。
kd> !vm 2
*** Virtual Memory Usage ***
GetUlongFromAddress: unable to read from 80562108
Physical Memory: 0 ( 0 Kb)
GetUlongFromAddress: unable to read from 80561c40
************ NO PAGING FILE *********************
80561b60: Unable to get paged pool info
GetUlongPtrFromAddress: unable to read from 80551990
GetUlongPtrFromAddress: unable to read from 80561f2c
GetPointerFromAddress: unable to read from 80561c04
GetPointerFromAddress: unable to read from 80555c48
GetUlongFromAddress: unable to read from 8055d780
GetPointerFromAddress: unable to read from 8055d6f4
GetUlongFromAddress: unable to read from 8055d4d4
GetUlongFromAddress: unable to read from 80551918
GetUlongFromAddress: unable to read from 80551928
GetUlongFromAddress: unable to read from 805620fc
GetUlongFromAddress: unable to read from 805620bc
GetUlongFromAddress: unable to read from 8055d330
GetUlongFromAddress: unable to read from 8055d180
GetUlongFromAddress: unable to read from 8055d17c
GetUlongFromAddress: unable to read from 8055d184
GetUlongFromAddress: unable to read from 8055d180
GetUlongFromAddress: unable to read from 8055d17c
GetUlongFromAddress: unable to read from 8055d3dc
GetUlongPtrFromAddress: unable to read from 80554280
GetUlongPtrFromAddress: unable to read from 80555cc0
GetUlongFromAddress: unable to read from 8055d398
GetUlongFromAddress: unable to read from 8055d380
Error reading free nonpaged PTEs 8055d334
GetUlongFromAddress: unable to read from 8055d390
Available Pages: 0 ( 0 Kb)
ResAvail Pages: 0 ( 0 Kb)
********** Running out of physical memory **********
Locked IO Pages: 0 ( 0 Kb)
Free System PTEs: 0 ( 0 Kb)
********** Running out of system PTEs **************
GetUlongFromAddress: unable to read from 8055d318
GetUlongFromAddress: unable to read from 8055d530
Free NP PTEs: 0 ( 0 Kb)
Free Special NP: 0 ( 0 Kb)
Modified Pages: 0 ( 0 Kb)
Modified PF Pages: 0 ( 0 Kb)
80564c20: Unable to get pool descriptor
GetUlongFromAddress: unable to read from 805522b8
NonPagedPool Usage: 0 ( 0 Kb)
NonPagedPool Max: 0 ( 0 Kb)
GetUlongFromAddress: unable to read from 805522b4
PagedPool Usage: 0 ( 0 Kb)
PagedPool Maximum: 0 ( 0 Kb)
GetUlongFromAddress: unable to read from 80565c48
Unable to read _LIST_ENTRY @ 80561b38
Session Commit: 0 ( 0 Kb)
Shared Commit: 0 ( 0 Kb)
Special Pool: 0 ( 0 Kb)
Shared Process: 0 ( 0 Kb)
PagedPool Commit: 0 ( 0 Kb)
Driver Commit: 0 ( 0 Kb)
Committed pages: 75624 ( 302496 Kb)
Commit limit: 0 ( 0 Kb)
********** Number of committed pages is near limit ********
GetUlongFromAddress: unable to read from 8055d3f8
GetUlongFromAddress: unable to read from 8055d3fc
Unable to read/NULL value _LIST_ENTRY @ 805637b8
ProcessCommitUsage could not be calculated
Memory Management Thread Stacks:
Unable to read nt!_LIST_ENTRY @ 805637b8
我把windbg结果贴出来，希望有人帮我分析下bsod前后驱动具体在干吗？在执行哪一块代码出问题了。
我说，申请的非分页都释放了（是指ExAllocatepool函数申请的都free了）
我曾经在一台新电脑上（2G内存，只装了office,VC++）上试过，问题依然一样。
所以我感觉是自己驱动哪一块有缺陷，我又不会汇编。
所以把windbg结果贴出来，希望有人帮我分析下bsod前后驱动具体在干吗？在执行哪一块代码出问题了。
我机器内存2G（感觉够大了！），另外我电脑上windbg不知道为啥!vm 2 !poolused用不了，以前试过。
kd> !vm 2
*** Virtual Memory Usage ***
GetUlongFromAddress: unable to read from 80562108
Physical Memory: 0 ( 0 Kb)
GetUlongFromAddress: unable to read from 80561c40
************ NO PAGING FILE *********************
80561b60: Unable to get paged pool info
GetUlongPtrFromAddress: unable to read from 80551990
GetUlongPtrFromAddress: unable to read from 80561f2c
GetPointerFromAddress: unable to read from 80561c04
GetPointerFromAddress: unable to read from 80555c48
GetUlongFromAddress: unable to read from 8055d780
GetPointerFromAddress: unable to read from 8055d6f4
GetUlongFromAddress: unable to read from 8055d4d4
GetUlongFromAddress: unable to read from 80551918
GetUlongFromAddress: unable to read from 80551928
GetUlongFromAddress: unable to read from 805620fc
GetUlongFromAddress: unable to read from 805620bc
GetUlongFromAddress: unable to read from 8055d330
GetUlongFromAddress: unable to read from 8055d180
GetUlongFromAddress: unable to read from 8055d17c
GetUlongFromAddress: unable to read from 8055d184
GetUlongFromAddress: unable to read from 8055d180
GetUlongFromAddress: unable to read from 8055d17c
GetUlongFromAddress: unable to read from 8055d3dc
GetUlongPtrFromAddress: unable to read from 80554280
GetUlongPtrFromAddress: unable to read from 80555cc0
GetUlongFromAddress: unable to read from 8055d398
GetUlongFromAddress: unable to read from 8055d380
Error reading free nonpaged PTEs 8055d334
GetUlongFromAddress: unable to read from 8055d390
Available Pages: 0 ( 0 Kb)
ResAvail Pages: 0 ( 0 Kb)
********** Running out of physical memory **********
Locked IO Pages: 0 ( 0 Kb)
Free System PTEs: 0 ( 0 Kb)
********** Running out of system PTEs **************
GetUlongFromAddress: unable to read from 8055d318
GetUlongFromAddress: unable to read from 8055d530
Free NP PTEs: 0 ( 0 Kb)
Free Special NP: 0 ( 0 Kb)
Modified Pages: 0 ( 0 Kb)
Modified PF Pages: 0 ( 0 Kb)
80564c20: Unable to get pool descriptor
GetUlongFromAddress: unable to read from 805522b8
NonPagedPool Usage: 0 ( 0 Kb)
NonPagedPool Max: 0 ( 0 Kb)
GetUlongFromAddress: unable to read from 805522b4
PagedPool Usage: 0 ( 0 Kb)
PagedPool Maximum: 0 ( 0 Kb)
GetUlongFromAddress: unable to read from 80565c48
Unable to read _LIST_ENTRY @ 80561b38
Session Commit: 0 ( 0 Kb)
Shared Commit: 0 ( 0 Kb)
Special Pool: 0 ( 0 Kb)
Shared Process: 0 ( 0 Kb)
PagedPool Commit: 0 ( 0 Kb)
Driver Commit: 0 ( 0 Kb)
Committed pages: 75624 ( 302496 Kb)
Commit limit: 0 ( 0 Kb)
********** Number of committed pages is near limit ********
GetUlongFromAddress: unable to read from 8055d3f8
GetUlongFromAddress: unable to read from 8055d3fc
Unable to read/NULL value _LIST_ENTRY @ 805637b8
ProcessCommitUsage could not be calculated
Memory Management Thread Stacks:
Unable to read nt!_LIST_ENTRY @ 805637b8
曹大夯 2010-06-29
- 打赏
- 举报
这里有一个更完整的错误分析过程：
http://blogs.msdn.com/b/ntdebugging/archive/2009/07/27/debugging-a-bugcheck-0xf4.aspx
你可以用0: kd> !vm 2来分析一下*** Virtual Memory Usage ***。
你可以用0: kd> !poolused来分析更具体的内存使用情况。
http://blogs.msdn.com/b/ntdebugging/archive/2009/07/27/debugging-a-bugcheck-0xf4.aspx
你可以用0: kd> !vm 2来分析一下*** Virtual Memory Usage ***。
你可以用0: kd> !poolused来分析更具体的内存使用情况。
曹大夯 2010-06-29
- 打赏
- 举报
粗糙地分析，你说的“网上搜了下，说是可能：This system bugchecked when the critical process csrss.exe failed an I/O operation due to insufficient non-paged pool. ”是真正的原因。因为：
IO_ERROR: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API.
STATUS_INSUFFICIENT_RESOURCES = 0xC000009AL
参考另外一个哥们的错误：
http://www.msfn.org/board/topic/99489-xp-bsods-overnight-with-0xf4-error/
好像在另外一个帖子里面，我们讨论过这个问题：你知道蓝屏前后，你的驱动在做什么事么？
另外，“我查看了下，申请的非分页都释放了。”有什么依据？你分析过DUMP文件，看过non-paged memory的消耗情况么。把分析过程跟大家分享一下。
按照你的问题描述，像是在系统启动过程中，系统需要大量的non-paged内存，同时，你的PCI卡也在大量使用non-paged内存。于是，系统就BSOD了。
换一台内存大一点的机器试一下？或者给系统增加内存条看看。
ERROR_CODE: (NTSTATUS) 0xc0000006 - "0x%08lx"
EXCEPTION_PARAMETER1: 00000008
EXCEPTION_PARAMETER2: 764fb3b9
EXCEPTION_PARAMETER3: c000009a
IO_ERROR: (NTSTATUS) 0xc000009a - <Unable to get error code text>
EXCEPTION_STR: 0xc0000006_c000009a
IO_ERROR: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API.
STATUS_INSUFFICIENT_RESOURCES = 0xC000009AL
参考另外一个哥们的错误：
http://www.msfn.org/board/topic/99489-xp-bsods-overnight-with-0xf4-error/
好像在另外一个帖子里面，我们讨论过这个问题：你知道蓝屏前后，你的驱动在做什么事么？
另外，“我查看了下，申请的非分页都释放了。”有什么依据？你分析过DUMP文件，看过non-paged memory的消耗情况么。把分析过程跟大家分享一下。
按照你的问题描述，像是在系统启动过程中，系统需要大量的non-paged内存，同时，你的PCI卡也在大量使用non-paged内存。于是，系统就BSOD了。
换一台内存大一点的机器试一下？或者给系统增加内存条看看。
kongzhongxx 2010-06-29
- 打赏
- 举报
网上搜了下，说是可能：
This system bugchecked when the critical process csrss.exe failed an I/O operation due to insufficient non-paged pool.
我查看了下，申请的非分页都释放了。
BugCheck F4, {3, 89a64548, 89a646bc, 805d220a}
一些分析如下：
1: kd> u 89a64548
89a64548 0300 add eax,dword ptr [eax]
89a6454a 1b00 sbb eax,dword ptr [eax]
89a6454c 0000 add byte ptr [eax],al
89a6454e 0000 add byte ptr [eax],al
89a64550 90 nop
89a64551 30a2899030a2 xor byte ptr [edx-5DCF6F77h],ah
89a64557 895845 mov dword ptr [eax+45h],ebx
89a6455a a6 cmps byte ptr [esi],byte ptr es:[edi]
1: kd> u 89a646bc
89a646bc 637372 arpl word ptr [ebx+72h],si
89a646bf 7373 jae 89a64734
89a646c1 2e ???
89a646c2 657865 js 89a6472a
89a646c5 0000 add byte ptr [eax],al
89a646c7 0000 add byte ptr [eax],al
89a646c9 0000 add byte ptr [eax],al
89a646cb 0000 add byte ptr [eax],al
1: kd> dt _EXCEPTION_RECORD 89a646bc
nt!_EXCEPTION_RECORD
+0x000 ExceptionCode : 1936880483
+0x004 ExceptionFlags : 0x78652e73
+0x008 ExceptionRecord : 0x00000065 _EXCEPTION_RECORD
+0x00c ExceptionAddress : (null)
+0x010 NumberParameters : 0
+0x014 ExceptionInformation : [15] 0
1: kd> dt _EXCEPTION_RECORD 89a64548
nt!_EXCEPTION_RECORD
+0x000 ExceptionCode : 1769475
+0x004 ExceptionFlags : 0
+0x008 ExceptionRecord : 0x89a23090 _EXCEPTION_RECORD
+0x00c ExceptionAddress : 0x89a23090
+0x010 NumberParameters : 0x89a64558
+0x014 ExceptionInformation : [15] 0x89a64558
1: kd> dt _CONTEXT 805d220a
nt!_CONTEXT
+0x000 ContextFlags : 0x6d726554
+0x004 Dr0 : 0x74616e69
+0x008 Dr1 : 0x20676e69
+0x00c Dr2 : 0x74697263
+0x010 Dr3 : 0x6c616369
+0x014 Dr6 : 0x6f727020
+0x018 Dr7 : 0x73736563
+0x01c FloatSave : _FLOATING_SAVE_AREA
+0x08c SegGs : 0x248
+0x090 SegFs : 0x200140f6
+0x094 SegEs : 0x74084589
+0x098 SegDs : 0x74868d12
+0x09c Edi : 0x50000001
+0x0a0 Esi : 0x220a6856
+0x0a4 Ebx : 0x87e8805d
+0x0a8 Edx : 0x8dfffff0
+0x0ac Ecx : 0x808e
+0x0b0 Eax : 0xf44d8900
+0x0b4 Ebp : 0x3994be8
+0x0b8 Eip : 0x75c08400
+0x0bc SegCs : 0xe8ce8b11
+0x0c0 EFlags : 0xfff546b8
+0x0c4 Esp : 0x10ab8
+0x0c8 SegSs : 0xa4e9c0
+0x0cc ExtendedRegisters : [512] ""
大侠们帮看看。
This system bugchecked when the critical process csrss.exe failed an I/O operation due to insufficient non-paged pool.
我查看了下，申请的非分页都释放了。
BugCheck F4, {3, 89a64548, 89a646bc, 805d220a}
一些分析如下：
1: kd> u 89a64548
89a64548 0300 add eax,dword ptr [eax]
89a6454a 1b00 sbb eax,dword ptr [eax]
89a6454c 0000 add byte ptr [eax],al
89a6454e 0000 add byte ptr [eax],al
89a64550 90 nop
89a64551 30a2899030a2 xor byte ptr [edx-5DCF6F77h],ah
89a64557 895845 mov dword ptr [eax+45h],ebx
89a6455a a6 cmps byte ptr [esi],byte ptr es:[edi]
1: kd> u 89a646bc
89a646bc 637372 arpl word ptr [ebx+72h],si
89a646bf 7373 jae 89a64734
89a646c1 2e ???
89a646c2 657865 js 89a6472a
89a646c5 0000 add byte ptr [eax],al
89a646c7 0000 add byte ptr [eax],al
89a646c9 0000 add byte ptr [eax],al
89a646cb 0000 add byte ptr [eax],al
1: kd> dt _EXCEPTION_RECORD 89a646bc
nt!_EXCEPTION_RECORD
+0x000 ExceptionCode : 1936880483
+0x004 ExceptionFlags : 0x78652e73
+0x008 ExceptionRecord : 0x00000065 _EXCEPTION_RECORD
+0x00c ExceptionAddress : (null)
+0x010 NumberParameters : 0
+0x014 ExceptionInformation : [15] 0
1: kd> dt _EXCEPTION_RECORD 89a64548
nt!_EXCEPTION_RECORD
+0x000 ExceptionCode : 1769475
+0x004 ExceptionFlags : 0
+0x008 ExceptionRecord : 0x89a23090 _EXCEPTION_RECORD
+0x00c ExceptionAddress : 0x89a23090
+0x010 NumberParameters : 0x89a64558
+0x014 ExceptionInformation : [15] 0x89a64558
1: kd> dt _CONTEXT 805d220a
nt!_CONTEXT
+0x000 ContextFlags : 0x6d726554
+0x004 Dr0 : 0x74616e69
+0x008 Dr1 : 0x20676e69
+0x00c Dr2 : 0x74697263
+0x010 Dr3 : 0x6c616369
+0x014 Dr6 : 0x6f727020
+0x018 Dr7 : 0x73736563
+0x01c FloatSave : _FLOATING_SAVE_AREA
+0x08c SegGs : 0x248
+0x090 SegFs : 0x200140f6
+0x094 SegEs : 0x74084589
+0x098 SegDs : 0x74868d12
+0x09c Edi : 0x50000001
+0x0a0 Esi : 0x220a6856
+0x0a4 Ebx : 0x87e8805d
+0x0a8 Edx : 0x8dfffff0
+0x0ac Ecx : 0x808e
+0x0b0 Eax : 0xf44d8900
+0x0b4 Ebp : 0x3994be8
+0x0b8 Eip : 0x75c08400
+0x0bc SegCs : 0xe8ce8b11
+0x0c0 EFlags : 0xfff546b8
+0x0c4 Esp : 0x10ab8
+0x0c8 SegSs : 0xa4e9c0
+0x0cc ExtendedRegisters : [512] ""
大侠们帮看看。
