help debugging errors
- From: "Iain Robinson" <craphereplease@xxxxxxxxxxx>
- Date: 16 Dec 2005 02:25:50 -0800
Hello all
I posted a couple of weeks ago ("recent surge of XP blue screens")
about a rash of BSOD's we suddenly started having with our XP Pro PCs.
I was recommended amongst other things to analyse the degugging
information. I downloaded and installed the latest 'Debugging Tools for
Windows', set the debugging information to teh recommended 'Kernel
Memory Dump' and waited for a crash. After a couple of near misses
(crashed but didn't have time to wait for it to finsih the memory dump)
I finally got a memory.dmp file that I could analyse. Problem is, the
debugging tools gave me quite a bit of info but I'm not sure what it
all means. I'm posting it below hoping that some kind knowledgable
person will give me some pointers. NB since my last post Windows Error
Reporting said, after a crash, that an Iomega driver was probably
responsible and I downloaded and installed the suggested replacement
driver. But it hasn't stopped the crashes....
__________________________________
Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is:
srv*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Dec 15 17:57:09.451 2005 (GMT+0)
System Uptime: 0 days 8:46:18.549
Loading Kernel Symbols
.......................................................................................................Unable
to add module at bf9d4000
................
Loading unloaded module list
.....................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for
details
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {80eec4d2, 0, bf820d67, 0}
Probably caused by : win32k.sys ( win32k!GetDesktopView+10 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by
try-except,
it must be protected by a Probe. Typically the address is just plain
bad or it
is pointing at freed memory.
Arguments:
Arg1: 80eec4d2, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf820d67, If non-zero, the instruction address which referenced
the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
READ_ADDRESS: 80eec4d2
FAULTING_IP:
win32k!GetDesktopView+10
bf820d67 8b4804 mov ecx,[eax+0x4]
MM_INTERNAL_CODE: 0
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58
MODULE_NAME: win32k
FAULTING_MODULE: bf800000 win32k
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from bf8bf81b to bf820d67
TRAP_FRAME: f0136a78 -- (.trap fffffffff0136a78)
ErrCode = 00000000
eax=80eec4ce ebx=ffa827d8 ecx=80eec4ce edx=00000001 esi=f0136b88
edi=00000001
eip=bf820d67 esp=f0136aec ebp=f0136aec iopl=0 nv up ei ng nz na
pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010282
win32k!GetDesktopView+0x10:
bf820d67 8b4804 mov ecx,[eax+0x4]
ds:0023:80eec4d2=????????
Resetting default scope
STACK_TEXT:
f0136aec bf8bf81b e1a024f8 ffa827d8 ffa827c0 win32k!GetDesktopView+0x10
f0136b44 80580605 00000000 ffa827c0 ffa827c4 win32k!MapDesktop+0x9d
f0136b70 8058067e bf8bf8b2 f0136b88 00000000
nt!ExpWin32SessionCallout+0x3c
f0136b9c 80580405 00000001 ff9c81e0 c0000001
nt!ExpWin32OpenProcedure+0x67
f0136c4c 805640ad 00000001 ff9c81e0 ffa827d8
nt!ObpIncrementHandleCount+0x2cf
f0136cb4 80567327 00000001 ffa827d8 81b42ad0 nt!ObpCreateHandle+0x17d
f0136d04 bf85da8f 00000000 81b42ad0 00000001
nt!ObOpenObjectByName+0x28c
f0136d2c bf85db93 0099fc80 00000001 00000000 win32k!_OpenDesktop+0x2a
f0136d50 804de7ec 0099fc80 00000000 00000001
win32k!NtUserOpenDesktop+0x20
f0136d50 7c90eb94 0099fc80 00000000 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be
wrong.
0099fc98 00000000 00000000 00000000 00000000 0x7c90eb94
FOLLOWUP_IP:
win32k!GetDesktopView+10
bf820d67 8b4804 mov ecx,[eax+0x4]
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: win32k!GetDesktopView+10
STACK_COMMAND: .trap fffffffff0136a78 ; kb
FAILURE_BUCKET_ID: 0x50_win32k!GetDesktopView+10
BUCKET_ID: 0x50_win32k!GetDesktopView+10
Followup: MachineOwner
---------
Would be great if someone could help as almost all the XP PCs in the
company are crashing at some point these days.
TIA
Iain
.
- Prev by Date: Re: Harddrive has autorun option in properties
- Next by Date: Re: keeping windows always on the top
- Previous by thread: Winfix
- Next by thread: How do I merge WinXP
- Index(es):
Relevant Pages
|
|
