ניתוח קבצי Minidump .

פתח דיון חדש

פורסם 2005 בינואר 920 שנים

קודם כל תודה רבה לRON26 אחד מעמודי התווך של הפורום שעזר לי ללמוד מעט על MINIDUMP ולהבין איך המערכת פועלת.

עכשיו אחרי שלמדתי כיצד לטעון קבצי Minidump והבנתי מה זה אומר יש לי שאלה אל כולם.

להלן קובץ Minidump של אחד המשתמשים פה(הורדתי בשביל ללמוד איך זה עובד) אני רוצה שחברי הפורום יסבירו איך לנתח את מה שכתוב פה ואיך לאתר מפה את הבעיות עד לנקיטת פעולות מעשיות. אני מעוניין בניתוח רציני של הקטע.

כל העוזרים תבוא עליהם הברכה ושוב תודה לRON26 (הוא עזר לי המוןןןן).

oading Dump File [C:\WINDOWS\Minidump\Mini122304-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp_sp2_rtm.040803-2158

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20

Debug session time: Thu Dec 23 20:14:38 2004

System Uptime: 0 days 21:06:32.169

Loading Kernel Symbols

........................................................................................................................................

Loading unloaded module list

..................................................

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {b8aeaffc, 0, f7303276, 0}

Unable to load image ati2mtag.sys, Win32 error 2

*** WARNING: Unable to verify timestamp for ati2mtag.sys

*** ERROR: Module load completed but symbols could not be loaded for ati2mtag.sys

Could not read faulting driver name

Probably caused by : ati2mtag.sys ( ati2mtag+6276 )

Followup: MachineOwner

---------

kd> .reload

Loading Kernel Symbols

.................................Unable to load image ati2mtag.sys, Win32 error 2

*** WARNING: Unable to verify timestamp for ati2mtag.sys

*** ERROR: Module load completed but symbols could not be loaded for ati2mtag.sys

.......................................................................................................

Loading unloaded module list

..................................................

Loading User Symbols

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.

Arguments:

Arg1: b8aeaffc, memory referenced.

Arg2: 00000000, value 0 = read operation, 1 = write operation.

Arg3: f7303276, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 00000000, (reserved)

Debugging Details:

------------------

Could not read faulting driver name

READ_ADDRESS: b8aeaffc

FAULTING_IP:

ati2mtag+6276

f7303276 8b0482 mov eax,[edx+eax*4]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from f7303aa2 to f7303276

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

babf79cc f7303aa2 00000000 b8aeb000 babf7a38 ati2mtag+0x6276

00000000 00000000 00000000 00000000 00000000 ati2mtag+0x6aa2

babf88c4 80566730 babf89b8 babf89ac babf899c nt!KiCallUserMode+0x4

babf8920 bf8888f9 00000000 e1f78008 00000400 nt!KeUserModeCallback+0x87

babf8bf4 bf813ea0 bc654c88 0000004a 000a0254 win32k!SfnCOPYDATA+0x1d3

babf8c3c bf83c607 00654c88 0000004a 000a0254 win32k!xxxSendMessageToClient+0x176

babf8cac bf801e58 e15f0b08 babf8d64 00000000 win32k!xxxReceiveMessage+0x2b5

babf8ce8 bf80365e babf8d14 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x1d7

babf8d48 804df06b 00ecff28 00000000 00000000 win32k!NtUserPeekMessage+0x40

babf8d48 7c90eb94 00ecff28 00000000 00000000 nt!KiFastCallEntry+0xf8

00ecfa98 00000000 00000000 00000000 00000000 0x7c90eb94

FOLLOWUP_IP:

ati2mtag+6276

f7303276 8b0482 mov eax,[edx+eax*4]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: ati2mtag+6276

MODULE_NAME: ati2mtag

IMAGE_NAME: ati2mtag.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 415aa8fc

STACK_COMMAND: kb

BUCKET_ID: 0x50_ati2mtag+6276

Followup: MachineOwner

---------

kd> lm t n

start end module name

804d7000 806eb780 nt ntoskrnl.exe Wed Aug 04 08:19:48 2004 (41108004)

806ec000 8070c380 hal halaacpi.dll Wed Aug 04 07:59:05 2004 (41107B29)

b6c6d000 b6c7d760 NAVENG NAVENG.Sys Fri Oct 01 03:59:17 2004 (415CB9F5)

b6c7e000 b6d16680 NavEx15 NavEx15.Sys Fri Oct 01 04:11:15 2004 (415CBCC3)

b7a3d000 b7a7d380 HTTP HTTP.sys Wed Aug 04 08:00:09 2004 (41107B69)

b7e20000 b7e71000 SAVRT SAVRT.SYS Sat Nov 01 13:26:37 2003 (3FA3986D)

b7fa9000 b7fb1780 NPDRIVER NPDRIVER.SYS Wed Sep 10 12:12:08 2003 (3F5EF8F8)

b85f6000 b860a400 wdmaud wdmaud.sys Wed Aug 04 08:15:03 2004 (41107EE7)

b8633000 b8685180 srv srv.sys Wed Aug 04 08:14:44 2004 (41107ED4)

b879e000 b87acd80 sysaudio sysaudio.sys Wed Aug 04 08:15:54 2004 (41107F1A)

b883e000 b886a400 mrxdav mrxdav.sys Wed Aug 04 08:00:49 2004 (41107B91)

baaeb000 bab02480 dump_atapi dump_atapi.sys Wed Aug 04 07:59:41 2004 (41107B4D)

bab2b000 bab4da00 gwausb gwausb.sys Fri Sep 19 21:46:12 2003 (3F6B5D04)

bab4e000 babbc380 mrxsmb mrxsmb.sys Wed Aug 04 08:15:14 2004 (41107EF2)

babbd000 babe8180 rdbss rdbss.sys Wed Aug 04 08:20:05 2004 (41108015)

bac89000 bacaad00 afd afd.sys Wed Aug 04 08:14:13 2004 (41107EB5)

bacab000 bacd2c00 netbt netbt.sys Wed Aug 04 08:14:36 2004 (41107ECC)

bacd3000 bad135a0 symidsco symidsco.sys Wed Nov 24 03:08:22 2004 (41A3DF06)

bad14000 bad3c8c0 SYMFW SYMFW.SYS Sat Oct 16 01:18:20 2004 (41705ABC)

bad3d000 bad4fc20 SYMEVENT SYMEVENT.SYS Thu Aug 07 03:32:39 2003 (3F31AC37)

bad50000 bad8fbe0 SYMTDI SYMTDI.SYS Sat Oct 16 01:18:05 2004 (41705AAD)

bad90000 bade7a80 tcpip tcpip.sys Wed Aug 04 08:14:39 2004 (41107ECF)

bade8000 badfa400 ipsec ipsec.sys Wed Aug 04 08:14:27 2004 (41107EC3)

bae43000 baee07e0 ctac32k ctac32k.sys Tue Oct 21 11:22:15 2003 (3F94FAC7)

baee1000 baf00be0 ctsfm2k ctsfm2k.sys Wed Oct 08 04:09:07 2003 (3F8371C3)

baf01000 baf22660 emupia2k emupia2k.sys Mon Oct 13 11:42:10 2003 (3F8A7372)

baf23000 bafffc20 ha10kx2k ha10kx2k.sys Tue Oct 21 11:26:04 2003 (3F94FBAC)

bf800000 bf9c0380 win32k win32k.sys Wed Aug 04 08:17:30 2004 (41107F7A)

bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 08:00:51 2004 (41107B93)

bf9d3000 bfa0c000 ati2dvag ati2dvag.dll Wed Sep 29 14:22:40 2004 (415AA910)

bfa0c000 bfa48000 ati2cqag ati2cqag.dll Wed Sep 29 13:28:58 2004 (415A9C7A)

bfa48000 bfc6e6e0 ati3duag ati3duag.dll Wed Sep 29 14:05:08 2004 (415AA4F4)

bfc6f000 bfce4260 ativvaxx ativvaxx.dll Wed Sep 29 13:45:14 2004 (415AA04A)

f7090000 f70c3200 update update.sys Wed Aug 04 07:58:32 2004 (41107B08)

f70c4000 f70f4100 rdpdr rdpdr.sys Wed Aug 04 08:01:10 2004 (41107BA6)

f7195000 f71a5e00 psched psched.sys Wed Aug 04 08:04:16 2004 (41107C60)

f71a6000 f71bc680 ndiswan ndiswan.sys Wed Aug 04 08:14:30 2004 (41107EC6)

f71c5000 f71c7900 Dxapi Dxapi.sys Fri Aug 17 22:53:19 2001 (3B7D843F)

f71d9000 f71dbf80 mouhid mouhid.sys Fri Aug 17 22:47:57 2001 (3B7D82FD)

f71e5000 f71f8900 parport parport.sys Wed Aug 04 07:59:04 2004 (41107B28)

f71f9000 f72248e0 ctoss2k ctoss2k.sys Wed Oct 08 04:06:48 2003 (3F837138)

f7225000 f7247680 ks ks.sys Wed Aug 04 08:15:20 2004 (41107EF8)

f7248000 f726b980 portcls portcls.sys Wed Aug 04 08:15:47 2004 (41107F13)

f726c000 f72c5540 ctaud2k ctaud2k.sys Wed Oct 08 04:06:01 2003 (3F837109)

f72c6000 f72e8e80 USBPORT USBPORT.SYS Wed Aug 04 08:08:34 2004 (41107D62)

f72e9000 f72fc780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 08:07:04 2004 (41107D08)

f72fd000 f73db000 ati2mtag ati2mtag.sys Wed Sep 29 14:22:20 2004 (415AA8FC)

f73e8000 f73e87a0 symlcbrd symlcbrd.sys Wed Oct 16 08:50:27 2002 (3DAD0C33)

f7407000 f7407b80 Null Null.SYS Fri Aug 17 22:47:39 2001 (3B7D82EB)

f7432000 f7432c00 audstub audstub.sys Fri Aug 17 22:59:40 2001 (3B7D85BC)

f746f000 f7471280 rasacd rasacd.sys Fri Aug 17 22:55:39 2001 (3B7D84CB)

f749b000 f74b5580 Mup Mup.sys Wed Aug 04 08:15:20 2004 (41107EF8)

f74b6000 f74e2a80 NDIS NDIS.sys Wed Aug 04 08:14:27 2004 (41107EC3)

f74e3000 f74f9780 KSecDD KSecDD.sys Wed Aug 04 07:59:45 2004 (41107B51)

f74fa000 f751d000 Fastfat Fastfat.sys Wed Aug 04 08:14:15 2004 (41107EB7)

f751d000 f752ef00 sr sr.sys Wed Aug 04 08:06:22 2004 (41107CDE)

f752f000 f754d780 fltmgr fltmgr.sys Wed Aug 04 08:01:17 2004 (41107BAD)

f754e000 f7565800 SCSIPORT SCSIPORT.SYS Wed Aug 04 07:59:39 2004 (41107B4B)

f7566000 f757d480 atapi atapi.sys Wed Aug 04 07:59:41 2004 (41107B4D)

f757e000 f75a3700 dmio dmio.sys Wed Aug 04 08:07:13 2004 (41107D11)

f75a4000 f75c2880 ftdisk ftdisk.sys Fri Aug 17 22:52:41 2001 (3B7D8419)

f75c3000 f75d3a80 pci pci.sys Wed Aug 04 08:07:45 2004 (41107D31)

f75d4000 f7601d80 ACPI ACPI.sys Wed Aug 04 08:07:35 2004 (41107D27)

f7602000 f7624600 xmasbus xmasbus.sys Sun Dec 21 11:16:02 2003 (3FE564D2)

f7625000 f764cf80 vidstub vidstub.sys Mon Apr 26 19:47:41 2004 (408D4B3D)

f766e000 f7676c00 isapnp isapnp.sys Fri Aug 17 22:58:01 2001 (3B7D8559)

f767e000 f768ce80 ohci1394 ohci1394.sys Wed Aug 04 08:10:05 2004 (41107DBD)

f768e000 f769b000 1394BUS 1394BUS.SYS Wed Aug 04 08:10:03 2004 (41107DBB)

f769e000 f76a8500 MountMgr MountMgr.sys Wed Aug 04 07:58:29 2004 (41107B05)

f76ae000 f76bac80 VolSnap VolSnap.sys Wed Aug 04 08:00:14 2004 (41107B6E)

f76be000 f76c6e00 disk disk.sys Wed Aug 04 07:59:53 2004 (41107B59)

f76ce000 f76da200 CLASSPNP CLASSPNP.SYS Wed Aug 04 08:14:26 2004 (41107EC2)

f76de000 f76e8580 agp440 agp440.sys Wed Aug 04 08:07:40 2004 (41107D2C)

f770e000 f7716d00 intelppm intelppm.sys Wed Aug 04 07:59:19 2004 (41107B37)

f771e000 f772cb80 drmk drmk.sys Wed Aug 04 08:07:54 2004 (41107D3A)

f772e000 f773dd80 serial serial.sys Wed Aug 04 08:15:51 2004 (41107F17)

f773e000 f774ae00 i8042prt i8042prt.sys Wed Aug 04 08:14:36 2004 (41107ECC)

f774e000 f7758380 imapi imapi.sys Wed Aug 04 08:00:12 2004 (41107B6C)

f775e000 f776a180 cdrom cdrom.sys Wed Aug 04 07:59:52 2004 (41107B58)

f776e000 f777c080 redbook redbook.sys Wed Aug 04 07:59:34 2004 (41107B46)

f777e000 f778a880 rasl2tp rasl2tp.sys Wed Aug 04 08:14:21 2004 (41107EBD)

f778e000 f7798200 raspppoe raspppoe.sys Wed Aug 04 08:05:06 2004 (41107C92)

f779e000 f77a9d00 raspptp raspptp.sys Wed Aug 04 08:14:26 2004 (41107EC2)

f77ae000 f77b6900 msgpc msgpc.sys Wed Aug 04 08:04:11 2004 (41107C5B)

f77be000 f77c7f00 termdd termdd.sys Wed Aug 04 07:58:52 2004 (41107B1C)

f77ce000 f77d7480 NDProxy NDProxy.SYS Fri Aug 17 22:55:30 2001 (3B7D84C2)

f77fe000 f780c100 usbhub usbhub.sys Wed Aug 04 08:08:40 2004 (41107D68)

f781e000 f7827fa0 SYMNDIS SYMNDIS.SYS Sat Oct 16 01:18:14 2004 (41705AB6)

f782e000 f7836700 netbios netbios.sys Wed Aug 04 08:03:19 2004 (41107C27)

f784e000 f785e000 SAVRTPEL SAVRTPEL.SYS Sat Nov 01 13:26:40 2003 (3FA39870)

f785e000 f7866700 wanarp wanarp.sys Wed Aug 04 08:04:57 2004 (41107C89)

f786e000 f7876880 Fips Fips.SYS Sat Aug 18 03:31:49 2001 (3B7DC585)

f788e000 f789d900 Cdfs Cdfs.SYS Wed Aug 04 08:14:09 2004 (41107EB1)

f789e000 f78a6300 LHidUsb LHidUsb.Sys Fri Dec 12 02:25:39 2003 (3FD90B03)

f78ae000 f78b6d80 HIDCLASS HIDCLASS.SYS Wed Aug 04 08:08:18 2004 (41107D52)

f78be000 f78cd7c0 LMouFlt2 LMouFlt2.sys Fri Dec 12 02:25:14 2003 (3FD90AEA)

f78ee000 f78f4200 PCIIDEX PCIIDEX.SYS Wed Aug 04 07:59:40 2004 (41107B4C)

f78f6000 f78fa900 PartMgr PartMgr.sys Sat Aug 18 03:32:23 2001 (3B7DC5A7)

f792e000 f7933000 usbuhci usbuhci.sys Wed Aug 04 08:08:34 2004 (41107D62)

f7936000 f793c800 usbehci usbehci.sys Wed Aug 04 08:08:34 2004 (41107D62)

f793e000 f793f000 fdc fdc.sys unavailable (00000000)

f7946000 f794c000 kbdclass kbdclass.sys Wed Aug 04 07:58:32 2004 (41107B08)

f794e000 f7952880 TDI TDI.SYS Wed Aug 04 08:07:47 2004 (41107D33)

f7956000 f795a580 ptilink ptilink.sys Fri Aug 17 22:49:53 2001 (3B7D8371)

f795e000 f7962080 raspti raspti.sys Fri Aug 17 22:55:32 2001 (3B7D84C4)

f7966000 f796ba00 mouclass mouclass.sys Wed Aug 04 07:58:32 2004 (41107B08)

f796e000 f7973000 flpydisk flpydisk.sys Wed Aug 04 07:59:24 2004 (41107B3C)

f797e000 f7983200 vga vga.sys Wed Aug 04 08:07:06 2004 (41107D0A)

f7986000 f798aa80 Msfs Msfs.SYS Wed Aug 04 08:00:37 2004 (41107B85)

f798e000 f7995880 Npfs Npfs.SYS Wed Aug 04 08:00:38 2004 (41107B86)

f7996000 f799b000 SYMREDRV SYMREDRV.SYS Sat Oct 16 01:18:24 2004 (41705AC0)

f799e000 f79a51e0 SYMIDS SYMIDS.SYS Sat Oct 16 01:18:29 2004 (41705AC5)

f79a6000 f79ac180 HIDPARSE HIDPARSE.SYS Wed Aug 04 08:08:15 2004 (41107D4F)

f79ae000 f79b3f80 LHidFlt2 LHidFlt2.Sys Fri Dec 12 02:25:23 2003 (3FD90AF3)

f79b6000 f79ba500 watchdog watchdog.sys Wed Aug 04 08:07:32 2004 (41107D24)

f7a7e000 f7a81000 BOOTVID BOOTVID.dll Fri Aug 17 22:49:09 2001 (3B7D8345)

f7b12000 f7b14980 gameenum gameenum.sys Wed Aug 04 08:08:20 2004 (41107D54)

f7b16000 f7b19c80 serenum serenum.sys Wed Aug 04 07:59:06 2004 (41107B2A)

f7b22000 f7b24580 ndistapi ndistapi.sys Fri Aug 17 22:55:29 2001 (3B7D84C1)

f7b3e000 f7b41c80 mssmbios mssmbios.sys Wed Aug 04 08:07:47 2004 (41107D33)

f7b6e000 f7b6fb80 kdcom kdcom.dll Fri Aug 17 22:49:10 2001 (3B7D8346)

f7b70000 f7b71100 WMILIB WMILIB.SYS Fri Aug 17 23:07:23 2001 (3B7D878B)

f7b72000 f7b73700 dmload dmload.sys Fri Aug 17 22:58:15 2001 (3B7D8567)

f7b74000 f7b75580 xmasscsi xmasscsi.sys Sat Dec 20 20:03:41 2003 (3FE48EFD)

f7b78000 f7b796c0 ctprxy2k ctprxy2k.sys Wed Oct 08 04:08:11 2003 (3F83718B)

f7b7a000 f7b7b100 swenum swenum.sys Wed Aug 04 07:58:41 2004 (41107B11)

f7b7c000 f7b7d280 USBD USBD.SYS Fri Aug 17 23:02:58 2001 (3B7D8682)

f7b7e000 f7b7ff00 Fs_Rec Fs_Rec.SYS Fri Aug 17 22:49:37 2001 (3B7D8361)

f7b80000 f7b81080 Beep Beep.SYS Fri Aug 17 22:47:33 2001 (3B7D82E5)

f7b82000 f7b83080 mnmdd mnmdd.SYS Fri Aug 17 22:57:28 2001 (3B7D8538)

f7b84000 f7b85080 RDPCDD RDPCDD.sys Fri Aug 17 22:46:56 2001 (3B7D82C0)

f7b86000 f7b87640 SYMDNS SYMDNS.SYS Sat Oct 16 01:18:07 2004 (41705AAF)

f7b88000 f7b89100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 23:07:23 2001 (3B7D878B)

f7b94000 f7b95a80 ParVdm ParVdm.SYS Fri Aug 17 22:49:49 2001 (3B7D836D)

f7b96000 f7b971e0 WBHWDOCT WBHWDOCT.SYS Thu Jun 14 04:54:07 2001 (3B28274F)

f7c36000 f7c36d00 pciide pciide.sys Fri Aug 17 22:51:49 2001 (3B7D83E5)

f7d34000 f7d34d00 dxgthk dxgthk.sys Fri Aug 17 22:53:12 2001 (3B7D8438)

Unloaded modules:

b6de9000 b6e13000 kmixer.sys