Newsgroup: it.comp.os.win.win2000
Titolo: WinDbg: analisi .dump

Ho analizzato il file di dump con WinDbg e mi chiedevo se qualcuno riusciva
a capire la causa che ha generato il crash, visto che proprio non riesco a
ricavarne nulla, se non che chi ha generato l'eccezione č il kernel, cioč
ntoskrnl.exe, ma da questo non riesco poi a ricavare il driver che ha
generato il crash.
Sotto riporto l'anali di WinDbg... grazi a chiunque abbia voglia di perderci
tempo! :)
---
Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is:
SRV*c:\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT\system32\drivers
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: WinNt
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e8f0
Debug session time: Thu Aug 05 00:19:18 2004
System Uptime: 0 days 1:15:17.097
Loading Kernel Symbols
............................................................................
...............................
Loading unloaded module list
........
Loading User Symbols
........
****************************************************************************
***
* *
* Bugcheck Analysis *
* *
****************************************************************************
***
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {c000001d, cf84000c, 1, ed4bbdcc}
Probably caused by : ntoskrnl.exe ( nt!ExFreeToPPNPagedLookasideList+41 )
Followup: MachineOwner
---------
kd> !analyze -v
****************************************************************************
***
* *
* Bugcheck Analysis *
* *
****************************************************************************
***
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: cf84000c, The address that the exception occurred at
Arg3: 00000001, Parameter 0 of the exception
Arg4: ed4bbdcc, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {ERRORE DI EXCEPTION} Istruzione non
valida Si tentato di eseguire un'istruzione non valida.
FAULTING_IP:
+ffffffffcf84000c
cf84000c ffff ???
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: ed4bbdcc
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x1E
EXCEPTION_RECORD: ed4bba9c -- (.exr ffffffffed4bba9c)
ExceptionAddress: cf84000c
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0
CONTEXT: ed4bb6f4 -- (.cxr ffffffffed4bb6f4)
eax=00000002 ebx=00000000 ecx=00000000 edx=00000000 esi=00000001
edi=80400bbe
eip=cf84000c esp=ed4bbb64 ebp=ed4bbda8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
cf84000c ffff ???
Resetting default scope
LAST_CONTROL_TRANSFER: from 80455e49 to cf84000c
SYMBOL_ON_RAW_STACK: 1
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ed4bbda8 80455e49 00000001 00000000 00000000 0xcf84000c
ed4bbddc 8046a152 a00a9b59 ed1af7d0 00000000 nt!PspSystemThreadStartup+0x69
00000000 f000e7d2 f000e2c3 f000e7d0 f000e7d0 nt!KiThreadStartup+0x16
f07ce7d2 00000000 00000000 00000000 00000000 0xf000e7d2
STACK_COMMAND: .cxr ffffffffed4bb6f4; dds @$csp ; kb
FAILED_INSTRUCTION_ADDRESS:
+ffffffffcf84000c
cf84000c ffff ???
FOLLOWUP_IP:
nt!ExFreeToPPNPagedLookasideList+41
80415381 ebeb jmp nt!ExFreeToPPNPagedLookasideList+0x41 (8041536e)
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!ExFreeToPPNPagedLookasideList+41
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4047db83
BUCKET_ID: 0x1E_BAD_IP_nt!ExFreeToPPNPagedLookasideList+41
Followup: MachineOwner
---------
kd> lm t n
start end module name
5ff80000 5ff8c000 CSRSRV CSRSRV.dll Fri Jun 20 21:51:44 2003 (3EF365D0)
5ff90000 5ff9d000 basesrv basesrv.dll Wed Mar 24 03:19:04 2004 (4060F018)
5ffa0000 5ffe0000 winsrv winsrv.dll Wed Mar 24 03:19:06 2004 (4060F01A)
5fff0000 5fff4000 csrss csrss.exe Fri Jun 20 21:53:04 2003 (3EF36620)
77e10000 77e75000 USER32 USER32.dll Wed Mar 24 03:19:01 2004 (4060F015)
77f40000 77f7e000 GDI32 GDI32.DLL Wed Mar 24 03:19:00 2004 (4060F014)
78460000 784e2000 ntdll ntdll.dll Wed Mar 24 03:19:00 2004 (4060F014)
796b0000 7976f000 KERNEL32 KERNEL32.DLL Wed Mar 24 03:19:01 2004 (4060F015)
80062000 800794e0 hal hal.dll Wed Jan 15 20:41:57 2003 (3E25B985)
80400000 805cacc0 nt ntoskrnl.exe Fri Mar 05 02:44:35 2004 (4047DB83)
a0000000 a01a3f80 win32k win32k.sys Fri Mar 05 02:50:14 2004 (4047DCD6)
bcc30000 bcc54240 kmixer kmixer.sys Wed Apr 16 06:02:03 2003 (3E9CD5BB)
bd153000 bd166ac0 ipsec ipsec.sys Mon Apr 21 20:19:40 2003 (3EA4363C)
bd31c000 bd357bc0 srv srv.sys Wed Apr 30 01:05:07 2003 (3EAF0523)
bd420000 bd4239a0 ADBLOCK ADBLOCK.DLL Fri Jun 14 14:20:04 2002 (3D09DF74)
bd428000 bd42a120 HTTPFILT HTTPFILT.DLL Fri Jun 14 14:20:00 2002 (3D09DF70)
bd4b0000 bd4befe0 Cdfs Cdfs.SYS Wed Apr 16 05:58:53 2003 (3E9CD4FD)
bd520000 bd5239c0 PROTECT PROTECT.DLL Fri Jun 14 14:20:19 2002 (3D09DF83)
bd528000 bd52a460 MAILFILT MAILFILT.DLL Fri Jun 14 14:20:10 2002 (3D09DF7A)
bd538000 bd549f80 wdmaud wdmaud.sys Wed Apr 16 06:23:02 2003 (3E9CDAA6)
bd5ea000 bd5f58c0 sysaudio sysaudio.sys Wed Apr 16 06:21:44 2003 (3E9CDA58)
bd63a000 bd6574a0 afd afd.sys Wed Apr 30 10:45:29 2003 (3EAF8D29)
bd6f8000 bd77ae40 3dfxvs 3dfxvs.dll Thu Nov 02 13:49:50 2000 (3A0162EE)
bd77b000 bd790180 dump_atapi dump_atapi.sys Tue Apr 01 20:08:25 2003
(3E89D599)
bd791000 bd7b33c0 Fastfat Fastfat.SYS Wed Jan 15 20:48:39 2003 (3E25BB17)
bd7dc000 bd842240 mrxsmb mrxsmb.sys Fri May 23 00:46:57 2003 (3ECD5361)
bd855000 bd87f9c0 rdbss rdbss.sys Fri May 23 00:47:05 2003 (3ECD5369)
bd8b0000 bd8bbee0 aswMon aswMon.SYS Sun Jun 13 12:40:26 2004 (40CC2F1A)
bd920000 bd947e00 netbt netbt.sys Wed Jul 16 21:44:26 2003 (3F15AB1A)
bd948000 bd95cf20 FILTNT FILTNT.SYS Fri Jun 14 14:19:55 2002 (3D09DF6B)
bd95d000 bd9ae060 tcpip tcpip.sys Wed Apr 30 01:05:31 2003 (3EAF053B)
bda4f000 bda731e0 portcls portcls.sys Wed Apr 16 06:11:22 2003 (3E9CD7EA)
bda74000 bdb2f4e0 adm8830 adm8830.sys Mon Nov 01 17:27:51 1999 (381DBF87)
bfe18000 bfe423a0 update update.sys Wed Apr 16 06:22:01 2003 (3E9CDA69)
bfe43000 bfe62d00 ks ks.sys Wed Dec 04 18:09:38 2002 (3DEE36D2)
bfe63000 bfe76000 el90xnd5 el90xnd5.sys Fri Oct 29 23:54:34 1999 (381A179A)
bfe76000 bfea4000 3dfxvsm 3dfxvsm.sys Tue Feb 11 20:56:37 2003 (3E495575)
bfea4000 bfebaba0 ndiswan ndiswan.sys Wed Apr 30 01:05:01 2003 (3EAF051D)
bfedb000 bfef0640 Mup Mup.sys Wed Jan 15 20:54:01 2003 (3E25BC59)
bfef1000 bff1aaa0 NDIS NDIS.sys Wed Apr 30 01:05:01 2003 (3EAF051D)
bff1b000 bff98800 Ntfs Ntfs.sys Thu Jun 05 00:11:33 2003 (3EDE6E95)
bff99000 bffaa7c0 KSecDD KSecDD.sys Sun Sep 21 02:32:19 2003 (3F6CF193)
bffab000 bffc0180 atapi atapi.sys Tue Apr 01 20:08:25 2003 (3E89D599)
bffc1000 bffe29c0 dmio dmio.sys Wed Jan 15 20:47:04 2003 (3E25BAB8)
bffe3000 bffff4e0 ftdisk ftdisk.sys Tue Apr 01 00:21:58 2003 (3E88BF86)
ed000000 ed00e800 pci pci.sys Wed Jan 15 20:44:07 2003 (3E25BA07)
ed010000 ed01b780 isapnp isapnp.sys Wed Jan 15 20:43:47 2003 (3E25B9F3)
ed020000 ed028700 CLASSPNP CLASSPNP.SYS Wed Jan 15 20:42:51 2003 (3E25B9BB)
ed050000 ed05ca80 rasl2tp rasl2tp.sys Wed Apr 30 01:05:06 2003 (3EAF0522)
ed060000 ed06bc40 raspptp raspptp.sys Thu May 15 01:47:00 2003 (3EC2D574)
ed070000 ed07ea80 parallel parallel.sys Wed Jan 15 20:47:14 2003 (3E25BAC2)
ed080000 ed08c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 20:47:20 2003 (3E25BAC8)
ed090000 ed09e180 Cdr4_2K Cdr4_2K.SYS Tue Sep 24 23:21:41 2002 (3D90D765)
ed0a0000 ed0adea0 mf mf.sys Mon Feb 24 20:41:46 2003 (3E5A757A)
ed0b0000 ed0bba80 i8042prt i8042prt.sys Wed Apr 16 06:00:59 2003 (3E9CD57B)
ed0c0000 ed0cf8e0 serial serial.sys Wed Apr 16 06:19:39 2003 (3E9CD9DB)
ed0d0000 ed0db3c0 L8042pr2 L8042pr2.sys Wed Aug 07 02:42:25 2002 (3D506CF1)
ed0e0000 ed0ef580 lmouflt2 lmouflt2.sys Wed Aug 07 02:42:46 2002 (3D506D06)
ed0f0000 ed0f9ce0 NDProxy NDProxy.SYS Fri Oct 01 01:25:35 1999 (37F3F16F)
ed110000 ed119be0 usbhub usbhub.sys Wed Mar 19 00:30:41 2003 (3E77AC21)
ed140000 ed148fa0 Npfs Npfs.SYS Sun Oct 10 01:58:07 1999 (37FFD68F)
ed150000 ed158680 msgpc msgpc.sys Wed Jan 15 20:54:25 2003 (3E25BC71)
ed160000 ed1681a0 netbios netbios.sys Tue Oct 12 21:34:19 1999 (38038D3B)
ed1d0000 ed1d8240 Fips Fips.SYS Tue May 09 17:28:29 2000 (39182E9D)
ed280000 ed285520 PCIIDEX PCIIDEX.SYS Tue Feb 25 19:31:08 2003 (3E5BB66C)
ed288000 ed28f4c0 MountMgr MountMgr.sys Tue Feb 10 20:47:53 2004 (40293569)
ed290000 ed297720 disk disk.sys Wed Jan 15 20:43:05 2003 (3E25B9C9)
ed298000 ed29d680 viaagp viaagp.sys Wed Jan 15 20:47:10 2003 (3E25BABE)
ed2a0000 ed2a6900 viaagp1 viaagp1.sys Fri Dec 27 05:13:04 2002 (3E0BD350)
ed2c8000 ed2cc400 ptilink ptilink.sys Wed Jan 15 20:47:15 2003 (3E25BAC3)
ed2d8000 ed2dc0e0 raspti raspti.sys Fri Oct 08 22:45:10 1999 (37FE57D6)
ed300000 ed306c40 cdrom cdrom.sys Wed Jan 15 20:43:04 2003 (3E25B9C8)
ed310000 ed315560 Cdralw2k Cdralw2k.SYS Tue Sep 24 23:20:49 2002 (3D90D731)
ed318000 ed31ff40 uhcd uhcd.sys Wed Jan 15 20:45:50 2003 (3E25BA6E)
ed330000 ed334fc0 USBD USBD.SYS Wed Jan 22 18:05:33 2003 (3E2ECF5D)
ed348000 ed34fac0 RMSPPPOE RMSPPPOE.SYS Fri Oct 04 04:22:01 2002 (3D9CFB49)
ed360000 ed366080 kbdclass kbdclass.sys Thu Feb 20 17:37:30 2003 (3E55044A)
ed370000 ed376160 parport parport.sys Wed Jan 15 20:47:13 2003 (3E25BAC1)
ed388000 ed38f000 fdc fdc.sys unavailable (FFFFFFFE)
ed3a8000 ed3ad5c0 mouclass mouclass.sys Thu Feb 20 17:37:45 2003 (3E550459)
ed3b8000 ed3bea20 EFS EFS.SYS Wed Jan 15 20:46:55 2003 (3E25BAAF)
ed3d0000 ed3d4a60 flpydisk flpydisk.sys Wed Jan 15 20:42:52 2003 (3E25B9BC)
ed3f0000 ed3f5240 Msfs Msfs.SYS Wed Oct 27 01:21:32 1999 (3816377C)
ed408000 ed40fd00 wanarp wanarp.sys Fri Aug 16 14:25:01 2002 (3D5CEF1D)
ed410000 ed412a20 BOOTVID BOOTVID.DLL Thu Nov 04 02:24:33 1999 (3820E051)
ed414000 ed416d00 PartMgr PartMgr.sys Wed Jan 15 20:43:07 2003 (3E25B9CB)
ed470000 ed4722e0 ndistapi ndistapi.sys Wed Jan 15 20:54:15 2003 (3E25BC67)
ed480000 ed483e60 TDI TDI.SYS Wed Jan 15 20:56:26 2003 (3E25BCEA)
ed4a0000 ed4a3640 serenum serenum.sys Wed Jan 15 20:47:01 2003 (3E25BAB5)
ed4bc000 ed4be120 viausb viausb.sys Tue Aug 21 00:11:51 2001 (3B818B27)
ed4cc000 ed4ce5c0 admjoy admjoy.sys Mon Oct 18 23:05:08 1999 (380B8B84)
ed4dc000 ed4df580 vga vga.sys Sat Sep 25 20:37:40 1999 (37ED1674)
ed4fc000 ed4ff040 Aavmker4 Aavmker4.SYS Sun Jun 13 12:38:38 2004 (40CC2EAE)
ed500000 ed501d20 Diskperf Diskperf.sys Wed Feb 12 22:34:38 2003 (3E4ABDEE)
ed502000 ed503b80 dmload dmload.sys Wed Jan 15 20:47:06 2003 (3E25BABA)
ed504000 ed5056a0 viaide viaide.sys Thu Oct 18 08:11:14 2001 (3BCE7282)
ed506000 ed507240 admfilter8830 admfilter8830.sys Tue Mar 14 01:25:51 2000
(38CD870F)
ed50a000 ed50b540 lkbdflt2 lkbdflt2.sys Wed Aug 07 02:42:27 2002 (3D506CF3)
ed514000 ed515ca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 20:53:30 2003 (3E25BC3A)
ed51c000 ed51de40 rasacd rasacd.sys Sat Sep 25 20:41:23 1999 (37ED1753)
ed572000 ed5738a0 ParVdm ParVdm.SYS Tue Sep 28 05:28:16 1999 (37F035D0)
ed5a4000 ed5a5c20 HTMLFILT HTMLFILT.DLL Fri Jun 14 14:20:02 2002 (3D09DF72)
ed5a6000 ed5a75e0 DNSCACHE DNSCACHE.DLL Fri Jun 14 14:19:57 2002 (3D09DF6D)
ed5aa000 ed5ab9e0 POP3FILT POP3FILT.DLL Fri Jun 14 14:20:08 2002 (3D09DF78)
ed5ae000 ed5af6a0 FTPFILT FTPFILT.DLL Fri Jun 14 14:20:17 2002 (3D09DF81)
ed5b2000 ed5b39e0 IMAPFILT IMAPFILT.DLL Fri Jun 14 14:20:15 2002 (3D09DF7F)
ed5b4000 ed5b5820 NNTPFILT NNTPFILT.DLL Fri Jun 14 14:20:13 2002 (3D09DF7D)
ed5c8000 ed5c8b00 pciide pciide.sys Wed Jan 15 20:43:03 2003 (3E25B9C7)
ed5c9000 ed5c9f80 WMILIB WMILIB.SYS Sat Sep 25 20:36:47 1999 (37ED163F)
ed67d000 ed67dda0 CONTENT CONTENT.DLL Fri Jun 14 14:20:11 2002 (3D09DF7B)
ed689000 ed689a40 audstub audstub.sys Sat Sep 25 20:35:33 1999 (37ED15F5)
ed6a1000 ed6a1f80 dump_WMILIB dump_WMILIB.SYS Sat Sep 25 20:36:47 1999
(37ED163F)
ed6b6000 ed6b7000 swenum swenum.sys Wed Dec 04 18:10:07 2002 (3DEE36EF)
ed707000 ed7079e0 Null Null.SYS Sat Sep 25 20:34:58 1999 (37ED15D2)
ed70c000 ed70cee0 Beep Beep.SYS Thu Oct 21 00:18:59 1999 (380E3FD3)
ed711000 ed711f80 mnmdd mnmdd.SYS Sat Sep 25 20:37:40 1999 (37ED1674)
Unloaded modules:
bd2f7000 bd31c000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bd59a000 bd5a7000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bd5aa000 bd5b8000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bd766000 bd77b000 VGA.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
bd6f8000 bd77b000 3dfxvs.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
ed170000 ed179000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed3e0000 ed3e5000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ed4d4000 ed4d7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

 tempo! :)
Premettendo che non ho mai analizzato un dump, da ignorante totale io darei
la colpa al driver della scheda di rete o alla scheda di rete proprio o
ancora, se la sostituzione di questi non risolvesse ugualmente il problema,
dal protocollo TCP/IP, e proverei a disinstallarlo e reinstallarlo ex novo.
Max

 dal protocollo TCP/IP, e proverei a disinstallarlo e reinstallarlo ex
novo.
Mille grazie, č pur sempre una strada da tentare... ci provo subito!
Ciao

 perderci tempo! :)
Ciao,
Hai per caso una schede di rete "inglobata" (non mi viene il termine :( )
sulla scheda madre?
Usa lo slot 1 (se PCI) per la schede di rete, controlla i driver e
reinstalla il TCP/IP.
Prova: ping -t localhost, controlla se dopo un paio di minuti perdi
pacchetti.