Dan ga je debuggen
Windows Crash/Memory dumps FAQ
http://blogs.msdn.com/ntdebugging
Het onderstaande voorbeeld is een kernel memory dump waarbij de VMware drivers niet netjes samen wilden werken met de ingebouwde netwerkkaart.
Bleek een oudere versie te zijn die niet lekker met Vista SP2 wilde samenwerken, upgrade van VMware en probleem weg.
Op regel 62 zie je dat die driver de boel corrupt maakt, waarna de normale netwerkdriver klapt.
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
| 0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 82ad477c, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 0000000c
CURRENT_IRQL: 2
FAULTING_IP:
ndis!ndisSendCompleteWithPause+68
82ad477c 83600c00 and dword ptr [eax+0Ch],0
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: 81cfad44 -- (.trap 0xffffffff81cfad44)
ErrCode = 00000002
eax=00000000 ebx=871530e8 ecx=fffffffe edx=00000000 esi=8743c720 edi=8743d6d8
eip=82ad477c esp=81cfadb8 ebp=81cfadc4 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
ndis!ndisSendCompleteWithPause+0x68:
82ad477c 83600c00 and dword ptr [eax+0Ch],0 ds:0023:0000000c=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 82ad477c to 81c53fb9
STACK_TEXT:
81cfad44 82ad477c badb0d00 00000000 81cfafbc nt!KiTrap0E+0x2e1
81cfadc4 82ad4624 0043c720 8743d6d8 00000000 ndis!ndisSendCompleteWithPause+0x68
81cfade8 82ad358d 8743c720 00000000 00000001 ndis!ndisMSendNetBufferListsCompleteToNdisPackets+0x7c
81cfae1c 82ad364c 871530e8 86209d50 00000001 ndis!ndisMSendCompleteNetBufferListsInternal+0xb8
81cfae3c 90310175 871530e8 86209d50 00000001 ndis!NdisMSendNetBufferListsComplete+0x70
81cfae70 9030bbf5 00000000 00000000 00000000 Rtlh86!MiniportSendNetBufferList+0x18d
81cfae98 9030c6e4 022de9e0 00000000 00000000 Rtlh86!MPSendNetBufferListsNPQ+0x183
81cfaeb4 82ad349e 872de9e0 86209d50 00000000 Rtlh86!MPSendNetBufferLists+0x3e
81cfaedc 82a30ce0 871530e8 86209d50 00000000 ndis!ndisMSendNBLToMiniport+0xb4
81cfaf1c 82a30c0c 871530e8 00cfaf80 00000001 ndis!ndisMSendPacketsToNetBufferLists+0x92
81cfaf58 82ad46db 8743c720 81cfaf80 00000001 ndis!ndisSendPacketsWithPause+0x236
81cfaf74 9035d66e 8743c720 8743d6d8 85c292c8 ndis!ndisSendWithPause+0x48
WARNING: Stack unwind information not available. Following frames may be wrong.
81cfaf90 9035f925 81cfafbc 00000000 00000082 VMNetSrv+0x366e
81cfafb4 82ad6883 8743c1a4 85c292c8 00000082 VMNetSrv+0x5925
81cfafe0 82ad6707 81cfb000 81cfb000 00000000 ndis!ndisMSendPacketsXToMiniport+0xe3
81cfb048 82a087d7 871e2438 86fc44d0 00000000 ndis!ndisMSendNetBufferListsToPackets+0x84
81cfb068 82a08720 86fc44d0 86fc44d0 00000000 ndis!ndisFilterSendNetBufferLists+0x8b
81cfb080 91bc94a3 87631168 86fc44d0 00000000 ndis!NdisFSendNetBufferLists+0x18
81cfb0fc 82a08869 87607808 86fc44d0 00000000 pacer!PcFilterSendNetBufferLists+0x233 |
Verdachten bij jou kunnen bijvoorbeeld antivirus netwerkscan modules zijn ism je wireless driver.
Debuggen is in dit geval de beste manier, want dan kun je tenminste zien wat er precies misgaat.